Updates to NIH Genomic Data Sharing Policy Presentation

Overview and Potential Updates to NIHs Genomic Data Sharing Policy Presentation to the Secretary s Advisory Committee on Human Research Protections March 10, 2022 Taunton Paine, MA Director, Scientific Data Sharing Policy Division Office of Science Policy National Institutes of Health 1

NIH Genomic Data Sharing Policy Purpose Sets expectations and responsibilities to ensure broad, responsible, and timely sharing of genomic data Expects consent for research use Scope Applies to all NIH-funded research generating large- scale human or non-human genomic dataand secondary research using these data Became effective January 25, 2015 2

Fundamentals of the GDS Policy: Applicability Applies to primary involving generation of large-scale genomic data, e.g.: genome-wide association studies (GWAS); and single nucleotide polymorphisms (SNP) arrays; and genome sequence, transcriptomic, metagenomic, epigenomic, and gene expression data Examples include projects involving: Sequence data from more than one gene or region of comparable size in the genomes of more than 1,000 human research participants Sequence data from more than 100 genes or region of comparable size in the genomes of more than 100 human research participants Sequence data from more than 100 isolates from infectious organisms Whole genome or exome sequence data of more than one model organism species or strain Applies regardless of funding mechanism or level of funding 3

Fundamentals of the GDS Policy: Data Submission For studies using specimens/cell lines collected/created after January 25, 2015, expects consent for future research use and broad data sharing will have been obtained even if the cell lines or clinical specimens are de- identified Data should be submitted to an NIH-designated genomic data repository Establishes data sharing timelines for human and non-human genomic data Expects human data to be de-identified according to both the Common Rule and be stripped of identifiers per the HIPAA Privacy Rule at 45 CFR 164.514(b)(2) Data must be accompanied by an institutional certification assuring that, among other things: Limitations on secondary research use of the data, as expressed in the informed consent documents, are delineated; An IRB, privacy board, and/or equivalent body, has reviewed the proposal for data submission and assures that: The protocol for the collection of genomic and phenotypic data is consistent with 45 CFR Part 46; Submission and subsequent data sharing are consistent with the informed consent of study participants; Consideration was given to risks to individual participants and their families associated with data submission and future sharing; To the extent relevant and possible, consideration was given to risks to groups or populations associated with submitting data to NIH-designated data repositories and subsequent sharing 4

Fundamentals of the GDS Policy: Data Access Researchers requesting access to data in NIH-designated genomic data repositories must submit a Data Access Request (DAR) describing proposed research uses NIH Data Access Committees review requests for conformance with data use limitations provided by the institutional certification Approved users and their Institutional Signing Official co-sign a Data Use Certification, agreeing to abide by the data use limitations and a code of conduct, including: Not sharing any of the data obtained from controlled-access NIH-designated data repositories with individuals other than those listed in the data access request; Not attempting to identify individual participants from whom the data were obtained; Not selling any of the data obtained from NIH-designated data repositories; Agreeing to report any violation of the GDS Policy to the appropriate DAC(s) as soon as it is discovered; NIH provides information about the approved uses on the relevant study page in the database of Genotypes and Phenotypes (dbGaP), including a summary, the user, and their institution As of 2022, dbGaP contains data from over 1,200 studies and has approved over 64,000 secondary research uses 5

Major Updates to the GDS Framework since 2014 March 2015: NOT-OD-15-086, Notice for Use of Cloud Computing Services for Storage and Analysis of Controlled-Access Data Subject to the NIH Genomic Data Sharing (GDS) Policy February 2017: NOT-OD-17-044, Request for Information on Processes for dbGaP Data Submission, Access, and Management November 2018: NOT-OD-19-023, Update to NIH Management of Genomic Summary Results Access And many FAQs and resources 6

Changing Landscape of Genomic Data Sharing Continued evolution of data sharing expectations across NIH notably the 2020 NIH Data Management and Sharing Policy, effective January 2023 Increasing number of NIH-supported repositories and platforms storing, sharing, and analyzing human genomic data Interest in linking participants data from multiple sources, including from other research repositories and non-research sources Growing interest in using data elements that are considered potentially identifiable e.g., ZIP codes, dates < 1 year Continued development and expanded use of data types not covered under the GDS Policy but with similar attributes as genomic data 7

Requesting Input on Updating the GDS Policy Published RFI (NOT-OD-22-029) November 30, 2021 Comments accepted until February 28, 2022 Includes specific proposals or asks questions for: Harmonizing aspects of the GDS Policy with 2020 DMS Policy Standards for NIH-supported data repositories Whether to accept other standards for data de-identification, including expert determination, and under what conditions Refreshing NIH s Genomic Data Sharing Policy, December 1, 2021, blog by Dr. Lyric Jorgenson, NIH Whether to permit records linkage, and under what conditions Whether to expand the scope of the GDS Policy s sharing and/or protections to include other research scenarios (e.g., projects of smaller size) or data types (e.g., proteomics, metabolomics) 8

Next Steps Complete analysis of public comments Develop short-term and long-term plans for updating GDS Policy and framework Priority will be harmonizing GDS Policy implementation with DMS Policy, where appropriate, and changes may be phased 9

Additional questions: SciencePolicy@od.nih.gov Twitter: @NIH_OSP osp.od.nih.gov/blog/ 10