Data Sharing Certifications (NIH)

The NIH requested an "Institutional certification" to share my study data in a repository, and/or to approve my grant proposal's data sharing plan. What now?


Who can sign?

  • OSP should sign all forms - NIH requires that they be signed by an "institutional signatory." IRB does not have that authorization. 
  • OSP will want confirmation of compliance from Emory IRB, however, before signing. 
  • Thus, information must be provided to the IRB for us to review.

What's Provisional Certification?

  • Provisional Certification is an option when the information below is not yet available (e.g. at grant submission stage). This is a form stating that not enough information is available, but that the ultimate consent form and protocol will comply with the NIH policy.

Note: Genomic Data Sharing is a subset of data sharing that falls under a special NIH policy (the "Genomic Data Sharing" policy). A specific Institutional Certification is required for these plans. Only large-scale genomic analyses falls under the policy - as defined by the NIH. The NCI has an excellent web site explaning the policy: Click Here

What and how does the Emory IRB review for my request?

The IRB weighs in on whether the data sharing plan is ethical, and if it complies with any applicable policies and regualtions.

  • Ethical: whether subjects would reasonably understand that their data might be shared in this manner, based on the informed consent form/discussion, and whether it is appropriate given the study population's beliefs, attitudes, and laws.
  • Compliant:
    • If consent is waived, does the sharing align with the Belmont Principles and human subjects regulations? This may depend on what identifiers are involved.
    • If the study was NIH funded, did the informed consent align with the NIH policy in place at the time the data or samples were collected?

 The IRB needs five things as part of a request for Institutional Certification:

  1. Copies of all consent form versions used to collect the samples/data to be shared (or the draft consent form, for a new study)
  2. A pre-filled copy of the institutional certification (or two certifications, if samples were collected both prior to and after the NIH genomic data sharing policy update), with the investigator's draft answers to the questions about how data use should be limited (if at all). Answers should be based on the consent form(s) the subjects signed.
    • Note: for the benefit of science and per NIH guidance, limitations should only be those required by the informed consent, not investigator or IRB preference
    • Obtain the relevant document here: Key Documents for Genomic Data Sharing (go to "Institutional Certifications" section)
  3. This worksheet: Institutional Certification Request form for Emory submitting data. The form asks for, among other things:
    • All applicable IRB numbers for studies that collected (or will collect) the data to be shared, and the samples that generated the data, if applicable
    • If large-scale genomic data is involved (see website above), and the data to be shared was or will be generated under an NIH-funded grant, include the date range during which the samples were collected (or state that all samples will be collected propspectively)
    • Note: The NIH policy was updated on January 15, 2015, to require explicit informed consent for sharing genomic data broadly in repositories

What if the certification is for a multi-site study under a different PI?

Sometimes a differnet institution will be submitting data to a repository, where some/all data involved specimens collected at Emory. If this is your case, please explain the situtation in your email request, including the study titles/PI's involved, and submit Institutional Certification Request form for Emory not submitting data instead. The site submitting the data to the respository should be the one completing and signing the final Institutional Certification. 

To whom should I send the information?

Please send requests to They will most likely be directed to the IRB Director or a Team Lead for handling. 

What if my study does not comply with the NIH Policy?

In rare cases, the IRB may need to request an amendment to an existing study to revise the scope of HIPAA/consent waivers. Or, the IRB may may determine that data sharing is not consistent with the consent forms the subjects signed. If this occurs for a study that already took place, you will will need to discuss next steps with your NIH representative.