caBIG™ Data Sharing Information

The caBIG™ Data Sharing and Security Framework:

The basic tool for caBIG™ Data Sharing is the Data Sharing and Security Framework, which is designed to facilitate appropriate data sharing between and among organizations by addressing legal, regulatory, policy, ethical, proprietary, contractual, and socio-cultural barriers.

This framework was established and is being further developed by the caBIG™ Data Sharing and Intellectual Capital (DSIC) Workspace.

When fully developed, the Data Sharing and Security Framework will consist of:

• caBIG™ Policies
• Processes and Best Practices
• Model Documents
• Trust Fabric

End User Benefits of Data Sharing

WHY SHARE DATA?

• The large volumes of research data created by the high throughput genomics and proteomics technologies can best be harvested by teams of individuals - rather than by single PI's.
• To realize the scientific and public health benefits of translational and personalized medicine, collaboration across and within disciplines is required to leverage broad knowledge and skill bases.
• Data sharing raises the visibility of individual studies and data collections; it opens avenues of data dissemination and validation – leading to more citations in publications and increased prominence.
• Grants from NIH exceeding $500,000 require a plan for data sharing.

Participating in the DSIC Workspace

• If you are in a Cancer Center participating in the “Getting Connected with caBIG™” deployment effort, you will need to participate in the activities of the DSIC Workspace in order to facilitate data sharing.
• Your participation will involve assisting with the review and refinement of the tools the Workspace is developing to assist researchers and institutions in their data sharing initiatives. You will be asked to evaluate using these products in your own institution.
• These DSIC tools include such documents and processes as:
  
  • Using the caBIG™ Data Sharing and Security Framework as a decision support tool
  • Model documents such as guidelines for preparing data sharing plans for use with IRBs and other officials at the institution, standardized click-through data use agreements between providers and users of data, model informed consent provisions for sharing data via caBIG™
  • Policy papers on topics such as data de-identification, incentives to share data, and timeframes for sharing unpublished data

Understanding the Framework

• You can use the caBIG™ Data Sharing and Security Framework as a decision support tool to facilitate data sharing at your Center by determining which data can be shared and under which type of access and data security controls. To do so, you will need to assess the sensitivity of the data by using the Framework's four elements:
  
  • Economic/Proprietary/IP Value
  • Privacy/Confidentiality/Security Considerations
  • IRB or Institutional Restrictions
  • Sponsor Restrictions
• The organization assesses the data to be shared along the four elements and assigns a low, medium or high sensitivity rating to the data, which drives the selection of the sharing mechanism.
• The organization arrives at an overall level of sensitivity for the data by weighting the outcomes of the four elements according to its own judgment.
• The outcome, that is, a low, medium or high sensitivity rating, determines how the organization wants to control access to that data.
• The organization offering to share data determines the controls on access to that data by determining
  • The level of certainty needed regarding the authentication of the identity of data users, and
  • Whether particular authenticated groups or individuals are authorized to access the particular data.
  • The levels of security attached to data sensitivities of various levels are informed by guidance from the National Institute of Standards and Technology (NIST). Note: The assessment is discussed in more detail below.

Organizational Assessment Elements

Economic/Proprietary/IP Value

• Relates to the Need for Protection. Sample Questions: Are the data subject to a restrictive license? Do the data relate to an invention report you have, or intend to file, with your institution? Is the study closed? Are the data or study findings awaiting publication?
• The Framework asks you to select the category of proprietary value that best describes your data:
  
  • None/Low – Not subject to restrictive license or invention report
  • Medium – Data not yet submitted for publication
  • High – PHI, nonpublic intellectual property or other significant restriction

Privacy/Confidentiality/Security Considerations

• Relates to Privacy and Security. Sample Question: Do federal or state laws or your institution's policies prohibit or restrict disclosure?
• The Framework asks you to select the category of sensitivity that best describes your data:
  
  • Low Sensitivity - De-Identified/Anonymized Data Set
  • Medium - Coded/Limited Data Set
  • High Sensitivity - Identifiable Data

IRB or Institutional Restrictions

• Relates to Human Subjects Research Considerations.Sample Question: Do your institution's or IRB's policies or the applicable informed consent documents explicitly or implicitly restrict or permit disclosure (e.g., “no commercial use”)?
• The Framework asks you to select the level of restriction that best describes your data:
  
  • Low - Explicit Permission for Registry Participation
  • Medium - Policy or Consent Limitations
  • High - Explicit Consent Limitations/Restrictions

Sponsor Restrictions

• Relates to Restrictions from Sponsors in Grants and Contracts. Sample Question: Do the terms and conditions in any sponsored agreements prohibit or restrict disclosure outside the institution or to the Grid?
• The Framework asks you to select the level of sponsor restriction that best describes your data:
  
  • Low - No Restrictions
  • Medium - Delays or Other Moderate Restrictions
  • High - Classified Research/Major Restrictions

Using the Framework as a Decision Support Tool

• Using the Framework as a decision support tool can help you determine the structures and mechanisms needed to share the data under consideration:
  
  • General Website Terms of Use - No Restrictions on Access
  • Standardized Click-Through Terms and Conditions - Some Limitations on Access to the Data
  • Individually Negotiated Bi-Lateral or Multi-Lateral Agreement - More Restricted Access Conditions

Note: Each organization must select the type of agreement that best fits the needs. The Data Sharing and Security Framework is not a strict policy or guideline.

Next Steps

• If you are in a Cancer Center participating in the “Getting Connected with caBIG™™” deployment effort, complete the following steps to begin implementing the caBIG™ Data Sharing and Security Framework:
  
  1. Visit the DSIC Workspace to review workspace activities and identify a qualified Cancer Center representative that can best contribute to the review of future workspace products, such as model documents, policies and best practices. Much of DSIC's work occurs in two special interest groups (SIG): the Regulatory SIG and the Proprietary SIG.
  2. Contact the DSIC WS Lead, Marsha Young ( young_marsha@bah.com ) with your representative's name, contact information, and area of interest/expertise.
  3. Join the DSIC listservs to receive announcements.
  CABIG_DSIC-L - Data Sharing and Intellectual Capital Workspace
  CABIG_DSIC_PRO_SIG-L - Working Group - Proprietary SIG
  CABIG_DSIC_REG_SIG-L - Working Group - Regulatory SIG

See Also:
Getting Connected with caBIG™ Data Sharing and Security Framework (PDF)