Implications of Notice of Proposed Rule Making, Office of Management and Budget Circular A-110, "Uniform Administrative Requirements for Grants and Agreements With Institutions of Higher Education, Hospitals, and Other Non-Profit Organizations."

We are now in the public comment period on a Notice of Proposed Rule Making (NPRM) which has significant implications for the scientific research community. The Omnibus 1999 Appropriations bill directed the Office of Management and Budget (OMB) to amend Circular A-110 to extend the Freedom of Information Act (FOIA) to "require Federal awarding agencies to ensure that all data produced under an award will be made available to the public under the [FOIA]. …If the agency obtaining the data does so solely at the request of a private party, the agency may authorize a reasonable user fee equaling the incremental cost of obtaining the data."

The NIH is developing a response to the NPRM issued by the OMB regarding the release of grantee data under FOIA. In order to seek clarification from the OMB during the comment period, the NIH is working with the scientific community to address some areas of concern. This document lays out some areas of concern and, in some cases, addresses the implications of the use of FOIA for data release, and will form the basis of the NIH response.

In the NPRM, the OMB proposes that Federal agencies make available research data produced under Federal awards in response to FOIA requests. Following legislative intent, the OMB has confined such data release to published data used by the Federal Government in developing policy or rules. These limitations are consistent with the language that preceded the law, but are much more narrow than the law itself and might be subject to challenge. The NPRM indicates that the awarding agency should make the data available through the procedures established under the FOIA, including the statutory concept of what constitutes a record and the statutory exemptions. However, several important issues remain to be clarified.

During this public comment period, individual researchers, research institutions and Federal agencies have an opportunity to seek clarification of different aspects of this proposed rule. This document seeks to present some of the issues that need to be clarified. For example, how broad is the definition of data? How would costs of compliance be recouped? Are protections for privacy under FOIA sufficient?

What are data? Biomedical and behavioral research encompasses a wide range of types of data which might be produced under awards. The current Grants Policy Statement defines data as recorded information, regardless of the form or media on which it may be recorded, and includes writings, films, sound recordings, pictorial reproductions, drawings, designs, or other graphic representations, procedural manuals, forms, diagrams, work flow charts, equipment descriptions, data files, data processing or computer programs (software), statistical records, and other research data. Does this definition of data present any problems relative to data release?

In most cases the release of data requires substantial other information to make the data usable. Does the current legislation envision requiring such documentation for data that are released? Who makes the decision about adequacy of documentation?

When do data have to be released? A stated point of release is following publication. However, many studies result in a series of publications, each of which involves subsets of the data. Would the publication of any data require the release of all data? If not, would grantees be asked to make new releases with each publication? Is publication restricted to formal, peer reviewed publications or does it include any public sharing of data, such as verbal presentations or press releases?

Public presentation may be seen as having occurred whenever analytic results based on data appear in printed (paper or electronic) or oral form outside the of the grantee institution. That is, when a public speech is made, a working paper is circulated to other scientists outside one’s own institution, a report is provided to a government agency, or testimony is given to a government or judicial entity or publication. Public descriptions of study design, methodological issues, or sample characteristics should not be considered to be analyses and the basis for releasing data. A complexity is that public presentations often occur before all of the data are completely collected and analyzed. Some subsets of data (e.g., particular variables, samples, or experiments) may be made public before others. This is particularly the case in longitudinal studies, in which data are gathered in successive waves and may be analyzed in segments. Even in such instances of partial analysis, the guideline for release of data could still rest on the public presentation of results from the data. Whenever a component of the data (e.g. a wave of a longitudinal study, or a subset of variables) is presented in a public forum, then those data could be viewed as suitable for access under FOIA. Restriction to publication in peer reviewed journals would address some of these concerns.

Is privacy of individual subjects protected? FOIA exemptions protect data that could reasonably be used to identify individuals and would thus constitute a violation of privacy; but such protection of privacy is not extended to institutions, such as clinics or hospitals, which may have legitimate reasons to protect their anonymity. If individuals participating in the trials were to obtain access to data prior to the completion of all data collection, it could disrupt their participation in the study.

Will current practices to ensure confidentiality and appropriate use of data be affected? Data for which some level of risk of confidentiality exists are protected under various forms of data release agreements that require that the researcher adhere to certain guidelines, such as not attempting to re-identify the individuals, not linking the data to other existing files such as credit records, driver licenses, voter files, etc. How can such guidelines be enforced under the proposed new regulations?

Informed consent documents frequently tell the potential subjects that their data will be used only for research purposes. These documents would have to be modified since the FOIA places no restrictions on the use of data.

How far-reaching is this legislation? The present language applies to data regardless of the level of funding by the Federal government. This raises concerns for researchers with some Federal support who have collaborative studies supported by private funds and/or funds from other countries; the logic of requiring full access to these data, for which Federal government collaboration could lead to complete access to one’s data, could be a serious disincentive to collaborative research.

How will the new regulations affect the increasing linkages to administrative records? Usually, the dissemination of these valuable administrative data occurs under tightly regulated conditions, often controlled by memoranda of understanding. If some part of a database can be obtained under the new agreements, then agencies or organizations may decline to participate in these agreements to release data since release of certain types of seemingly non-sensitive data could compromise confidentiality in other areas.

If researchers need to build into their consent forms reference to the potential access of others to the data it will be important that the new language apply to data collected after the law, regulation and implementation are in effect.

How long does such access remain in force? Circular A-110 essentially requires that grantees retain data for three years following the completion of a grant, although researchers may work on data far longer than that. If researchers still have data, are they required to provide it? Is there any point in time at which grantees do not have to provide data? If a project continues for many years -- perhaps with evolving data sets -- does the access continue as long as there is any funding for the research?

How is compliance assured? While compliance could be built into ongoing grants, it is not clear how compliance would be assured for those grantees who no longer have research support. This is a complex situation for NIH awards, as the research grantee is the institution rather than the individual. For example, an investigator may have left the institution under which data were collected. Is the original institution obligated to retain and make available such data even if the investigator moved and completed the study elsewhere?

Who bears the cost of compliance? While the legislation indicates that reasonable charges could be levied, it does not offer a strategy to ensure that the costs that are recovered are actually made available to those who bear the burden of preparing and providing the data. By requiring access to data that the government does not have, there is a need for an administrative process to obtain the data and ensure that exemptions have been properly applied. At present, while the agency can charge for FOIA requests, the funds that are recovered go to the Treasury Department, not the agency. There is no compensation for the Federal staff or agency involved. Reimbursement for expenses is of greater concern than under the present FOIA because the administrative burden of obtaining data is much more complex and time consuming. Currently, there is no mechanism to provide a financial compensation to either present or past grantees. Since the authors of the law and those of the NPRM recognize the potential for financial burden, it is important to work out a process whereby funds can go to the appropriate entities.

How might data archives be affected?

Could these regulations perversely affect data archives designed to disseminate data? Several data archives whose major purpose is the dissemination of data are supported by Federal grants. If these archives "improve" data in some manner (documentation, cleaning, combining with other data, etc.) that have been donated to the archive, are these datasets then subject to FOIA access if used in policy or regulations? If certain conditions were attached to the donation, such as requiring that the data be used only for research and not redistributed, will the conditions remain in effect? If not, will this reduce the willingness of researchers and others to donate data to these archives? If data are already archived, does that fulfill the request for release of data, and can the researchers simply direct the requester to the archive? Clarification that the requester would use research data only for research purposes might bring data sharing under this law into closer alignment with other accepted strategies for data sharing.

Are proprietary data and data collected under CRADAs protected? As noted in the FOIA exemptions, federal statute prohibits the release of certain information related to technology transfer such as pending patent applications and certain information in a CRADA. Are there areas where potential release of early data would hinder collaborations?

How are "regulations" and "policy" defined? The NIH is not a regulatory agency. However, a regulatory agency might make use of data collected under NIH awards, thus enabling a request for data release. It would be helpful to clarify what comprises policy. For example, if a Data and Safety Monitoring Board stops a clinical trial and a clinical alert is issued, would that trigger a release of data even though the investigator had not had the opportunity to analyze and publish the data? If we assume that a clinical alert is not a policy but a means of announcing clinical research findings, then we still must define what constitutes "publication." There is considerable difference between data that are used directly to develop a policy or regulation and data that provide a broad background for such activities. The more direct the link between data and the resulting policy or regulation the less ambiguity. It would be important to clarify how directly linked the data must be to invoke release under FOIA.

Are there ways to assure appropriate release of data? Given the wide variety of types of data that might be involved, agencies might elect to develop their own data-sharing policies that would encompass the specific circumstances that they face. This would provide appropriate access to data for both researchers and the public, avoid disincentives to research collaboration and involvement for both investigators and those who would participate in clinical studies, and ensure that appropriate protections were in place for personal and institutional privacy.

In conclusion, this legislation has significant implications for the conduct of research and the protection of research data as well as for the sharing of research data. While the NIH supports the sharing of research data, it is important that such sharing take place in the context of well-developed policies and procedures to address the many questions that may arise. The public comment period for this Notice of Proposed Rulemaking is an opportunity for the affected communities to raise their concerns and offer strategies for effective data sharing that could be endorsed by many different constituencies. This NPRM can be found in the February 4 issue of the Federal Register, available on the World Wide Web at the following address:
http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=1999_register&docid=99-2220-filed.

Comments on the NPRM should be addressed to: F. James Charney, Policy Analyst, Office of Management and Budget, Room 6025, New Executive Office Building, Washington, DC 20503. They request when possible that the comments be provided in a word processing file on a computer disk or e-mailed to fcharney@omb.eop.gov as full text within the message (not as an attachment). They also request that you include your name, title, organization, postal address, and e-mail address in the text of your message. Comments are due by April 5, 1999.