Data Sharing Certifications (NIH)

• OSP should sign all forms - NIH requires that they be signed by an "institutional signatory." IRB does not have that authorization.
• OSP will want confirmation of compliance from Emory IRB, however, before signing.
• Thus, information must be provided to the IRB for us to review.

• Provisional Certification is an option when the information below is not yet available (e.g. at grant submission stage). This is a form stating that not enough information is available, but that the ultimate consent form and protocol will comply with the NIH policy.

Note: Genomic Data Sharing is a subset of data sharing that falls under a special NIH policy (the "Genomic Data Sharing" policy). A specific Institutional Certification is required for these plans. Only large-scale genomic analyses falls under the policy - as defined by the NIH. NCI has an excellent web site explaining the policy.

The IRB weighs in on whether the data sharing plan is ethical, and if it complies with any applicable policies and regulations.

• Ethical: whether subjects would reasonably understand that their data might be shared in this manner, based on the informed consent form/discussion, and whether it is appropriate given the study population's beliefs, attitudes, and laws.
• Compliant:
  • If consent is waived, does the sharing align with the Belmont Principles and human subjects regulations? This may depend on what identifiers are involved.
  • If the study was NIH funded, did the informed consent align with the NIH policy in place at the time the data or samples were collected?

1. Copies of all consent form versions used to collect the samples/data to be shared (or the draft consent form, for a new study)

2. A pre-filled copy of the institutional certification (or two certifications, if samples were collected both prior to and after the NIH genomic data sharing policy update), with the investigator's draft answers to the questions about how data use should be limited (if at all). Answers should be based on the consent form(s) the subjects signed.

   • Note: for the benefit of science and per NIH guidance, limitations should only be those required by the informed consent, not investigator or IRB preference

   • Obtain the relevant document here: Key Documents for Genomic Data Sharing (go to "Institutional Certifications" section)

3. This worksheet: Institutional Certification Request form for Emory submitting data. The form asks for, among other things:

   • All applicable IRB numbers for studies that collected (or will collect) the data to be shared, and the samples that generated the data, if applicable
   • If large-scale genomic data is involved (see website above), and the data to be shared was or will be generated under an NIH-funded grant, include the date range during which the samples were collected (or state that all samples will be collected prospectively)
   • Note: The NIH policy was updated on January 15, 2015, to require explicit informed consent for sharing genomic data broadly in repositories

Sometimes a different institution will be submitting data to a repository, where some/all data involved specimens collected at Emory. If this is your case, please explain the situation in your email request, including the study titles/PI's involved, and submit Institutional Certification Request form for Emory not submitting data (DOCX) instead. The site submitting the data to the repository should be the one completing and signing the final Institutional Certification.

Please send requests to irb@emory.edu. They will most likely be directed to the IRB Director or a Team Lead for handling.

In rare cases, the IRB may need to request an amendment to an existing study to revise the scope of HIPAA/consent waivers. Or, the IRB may determine that data sharing is not consistent with the consent forms the subjects signed. If this occurs for a study that already took place, you will need to discuss next steps with your NIH representative.