Data Use Policy

Introduction

The National Institutes of Health (NIH) has supported data collection from participants in numerous clinical trials and epidemiologic studies as part of approved protocols under the Rare Diseases Clinical Research Network (RDCRN). These data from well- characterized population samples constitute an important scientific resource. It is the view of the NIH that their full value can only be realized if they are made available, under appropriate terms and conditions consistent with the informed consent provided by individual participants, in a timely manner to the Rare Diseases Community and the largest possible number of qualified investigators. Accordingly, the Rare Diseases Clinical Research Network (RDCRN) has adopted a Data Sharing Policy (Appendix A) establishing the criteria and mechanisms for data sharing among investigators within the Rare Diseases Network (RDN) and with the general scientific community.

This Data Use Policy is informed by and intended to be fully consistent with guidance issued by the Rare Diseases Clinical Research Network (RDCRN), the National Center for Advancing Translational Sciences (NCATS), and the National Institutes of Health (NIH). In the event of any conflict between this policy and RDCRN, NCATS, or NIH data use or data transfer agreements, the terms of the applicable RDCRN, NCATS, or NIH agreement shall prevail.

I. Scope:

This policy addresses how data generated by the BBDC are to be used.

II. Definitions:

Commercial Purpose–Data will be considered as being for a commercial purpose if they are to be used by an individual or investigator who is an employee of a for-profit organization, if they are to be used by an individual or investigator as the basis for a consulting relationship with a for- profit organization. Data will also be considered as being for a commercial purpose if the investigator(s) take any affirmative steps to facilitate commercial use of results derived from data.

Data–In this policy, the term data refers to data generated by the BBDC and maintained by the RDCRN’s Data Management and Coordinator Center (DMCC). All data sharing activities must comply with applicable U.S. federal regulations governing the transfer of sensitive data, including restrictions on bulk data transfer and access by foreign entities, where applicable.

• Aggregate Data Set: Any summary of individual-level data, including regression output(s), simple univariate frequencies and cross-tabulations, and means or other summary statistics presented on grouped data.
• Coded Data Set: Identifying information (such as name or social security number) that would enable an investigator to readily ascertain the identity of the individual to whom the private information pertain has been replaced with a number, letter, symbol, or combination thereof (i.e., the code); and a key to decipher the code exists, enabling linkage of the identifying information to the private information or specimens.
• Anonymized Data Set: Data recorded in such a way that subjects cannot be identified or re-identified.
• De-identified Data Set: According to HIPAA, a data set can be designated as de-identified based on one of two methods: First, an expert may determine that the dataset has a very small probability of leading to identifying an individual (“expert determination method”). Alternatively (“safe harbor method”) the data set must be stripped of 18 direct identifiers (name, social security number, etc.), and contain no elements of a date except for the year, and no territorial aggregation below the state, except for the first three digits of a ZIP code identifying an area with 20,000 or more inhabitants.
• Limited Data Set: As specified in the HIPAA Privacy Rule, limited data sets differ from de-identified data sets as they may contain dates and city/state/zip code location information, but sharing of the information must be governed by a data use agreement

Data User Categories 

• External Users: Investigators or entities not affiliated with the BBDC who request access to BBDC data for secondary research, regulatory, or commercial purposes.
• Internal Users: Investigators and staff who are members of the BBDC and are conducting research under an approved BBDC protocol.
• “Other Use” – Use of data other than for publication purposes, such as for a grant application, presentation, to determine the feasibility of a data mining project or study, or to support an IND or NDA application.
• BBDC Member/Members – Includes all members of the Brittle Bone Disorders Consortium, such as principal investigators, co-investigators, study coordinators, study neuropsychologists, biostatisticians, and program administration.
• BBDC Leadership – Consortium principal investigator, Executive committee members

NIH Data Management and Sharing Plan (DMSP)– A formal plan required by the National Institutes of Health that describes how scientific data will be managed, preserved, and shared during and after completion of a research project, consistent with applicable laws, regulations, consent limitations, and institutional policies.

Data Use Agreement (DUA)-Researcher(s) who wish to use BBDC data need to have a an appropriate "data use agreement" with a the BBDC to provide anonymized, coded, aggregate, or limited data set without an authorization or a waiver of authorization from an IRB or Privacy Board. The agreement must list the permitted use and disclosures of the PHI being used and require that the researcher will:

• Use appropriate safeguards for the information,
• Not use or further disclose the information other than as agreed or as required by law,
• Report any uses/disclosures that were not permitted
• Ensure that anyone who has access to the data also agrees to these restrictions to not identify the information of individuals on whom data were collected or make any attempt to contact individuals on whom data were collected

The DUA may be part of a Services Agreement (see section D) or a stand-alone agreement.

III. Policies

A. NIH Data Management and Sharing (DMS) Policy
In accordance with the National Institutes of Health (NIH) Data Management and Sharing (DMS) Policy, the Brittle Bone Disorders Consortium (BBDC) is committed to the responsible management and timely sharing of scientific data generated from NIH-funded research. All BBDC studies supported in whole or in part by NIH funding will comply with the applicable NIH-approved Data Management and Sharing Plan (DMSP).

Data sharing under this policy will:

• Be consistent with applicable informed consent documents, Institutional Review Board (IRB) approvals, and participant privacy protections.
• Protect participant confidentiality in accordance with HIPAA, applicable federal and state laws, and institutional policies.
• Specify the type of data to be shared (e.g., de-identified individual-level data, limited data sets, associated metadata, and documentation).
• Identify the repository(ies) through which data will be shared (e.g., NIH-designated or NIH-supported repositories such as dbGaP or other controlled-access repositories, as appropriate).
• Define the anticipated timeline for data sharing and any justified limitations or delays (e.g., publication embargoes, consent restrictions).

The BBDC, in coordination with the RDCRN Data Management and Coordinating Center (DMCC), will oversee compliance with the NIH DMS Policy and ensure that data sharing obligations are met throughout the study lifecycle.

B. Data Stewardship and Governance
The Brittle Bone Disorders Consortium (BBDC), through its Administrative Core and Consortium Leadership, serves as the data steward on behalf of participating sites. The BBDC has the authority to:

• Collect, aggregate, and manage consortium data in collaboration with the RDCRN Data Management and Coordinating Center (DMCC);
• Determine the conditions under which data are shared within the consortium and with external users;
• Execute Data Use Agreements (DUAs), Services Agreements, or other data transfer mechanisms consistent with RDCRN and NIH policies;
• Authorize the transfer of consortium data, without direct identifiers, to NIH designated federal data repositories.

These authorities are exercised in accordance with participating site agreements, informed consent limitations, IRB approvals, and applicable laws.

C. Data Use 
All data generated by the BBDC is available to all BBDC members for analysis.

The only Protected Health Information (PHI) available to all internal investigators are dates of birth, study visit dates, dates of occurrence of clinical events, dates of admission, discharge, and death. All other identifying information such as name, address, phone number, fax number, email address, social security number, medical record number, health plan beneficiary number, and account numbers are only available to investigators at the enrolling site. Certificate/license numbers, vehicle identifiers, device identifiers, web URLs, IP address numbers, biometric identifiers, full face photographic images, and other unique identifying numbers or codes are not collected as part of BBDC research.

External investigators will specify whether de-identified data or limited data set(s) are requested. If a limited data set is requested, only data from subjects that have consented to share a limited data set will be shared. To ensure that the confidentiality and privacy of study participants are protected, all external investigators seeking access to data from BBDC studies must execute and submit an appropriate standard data use agreement form and other required documentation prior to obtaining BBDC data.

D. General Data Released to the Scientific Community
The BBDC Administrative Core is authorized to transfer consortium data, without direct identifiers, to the RDCRN Data Repository and other NIH designated federal data repositories, with operational support from the RDCRN DMCC, in order to fulfill NIH and RDCRN data sharing obligations.

Data generated by BBDC studies will be shared with the scientific community as required for NIH-funded research and in compliance with the NIH Data Management and Sharing (DMS) Policy, its associated Implementation Guidance, and the RDCRN Data Sharing Policy (Appendix A). Data sharing will be conducted in accordance with the NIH-approved Data Management and Sharing Plan for each study.

Shared data will include, as appropriate:

• De-identified or limited data sets;
• Relevant metadata, data dictionaries, and documentation sufficient to enable reuse;
• Information on data provenance and quality.

General data release will not include customized analyses but will include sufficient documentation to support secondary research use. Access controls (e.g., controlled-access repositories) will be applied when required to protect participant privacy or honor consent limitations.

E. Types of Data Shared
In accordance with RDCRN guidance, BBDC data may be shared in one or more of the following forms:

• Aggregate Data Sets: Summary level data including descriptive statistics and analyses.
• De identified Data Sets: Data stripped of direct identifiers in accordance with HIPAA safe harbor or expert determination.
• Limited Data Sets: Coded data sets that may include dates and limited geographic information, shared only under an executed Data Use Agreement.

The level of data shared will be determined based on informed consent permissions, IRB approvals, risk of re identification, and the intended use of the data.

F. Data Repositories and Access Controls
BBDC data subject to NIH data sharing requirements will be deposited in appropriate NIH-designated or NIH-supported repositories, such as dbGaP or other controlled-access repositories, consistent with the study’s Data Management and Sharing Plan.

Access to shared data may be subject to:

• BBDC Executive Committee review;
• Execution of a Data Use Agreement (DUA);
• Verification of investigator qualifications and institutional assurances.

All secondary users of BBDC data must comply with repository-specific terms of use, applicable DUAs, and all requirements outlined in this policy.

G. Documentation of Data Sharing 
The BBDC will maintain records of:

• Data releases and recipients;
• Approved data use purposes;
• Executed Data Use Agreements and Services Agreements;
• Applicable IRB approvals and consent limitations.

This documentation will be retained to support NIH reporting, audit readiness, and compliance with RDCRN governance requirements.

H. Data Sharing Continuity
In alignment with RDCRN guidance, the BBDC will maintain a strategy for continued data sharing beyond the end of the cooperative agreement period, including coordination with NIH managed repositories to ensure long term availability of consortium data to qualified researchers.

I. Specific Data Requests
External commercial and non-commercial investigators interested in using data generated by the BBDC prior to its general release to the scientific community or who would like customized data reports and/or analysis have several options as described below.

• Collaboration with a BBDC member on analysis and publication (or other use) –
• External investigators (commercial or non-commercial/academic) Independent analysis
• Services Agreement

J. Data Request Process
Individuals and institutions participating in the BBDC as well as, non-participating persons should submit a concept sheet for executive committee review. This concept sheet should be submitted to the BBDC project manager as outlined in Appendix B.

This concept sheet will be reviewed by the BBDC executive committee for feasibility and scientific merit within 1 month of submission of all materials. The executive committee is comprised of all BBDC PIs. If the concept sheet is submitted by a member or the executive committee, then they must recuse themselves from the evaluation.

Approval will be determined by taking a majority vote. If a proposal is rejected, then written documentation must be issued within 4 weeks of the decision. Rationale must be provided along with the determination. An appeal can be made, and the concept sheet can be resubmitted to the executive committee. This resubmission must occur within 2 months of the rejection documentation being received.

Once a concept has been approved, the BBDC project manager will forward this request to the Data Management and Coordinating Center (DMCC) or the BBDC Statistical team. The DMCC or the BBDC statistical team will then ensure that this request is processed in a timely manner.

Once data requests have been completed, the DMCC or the BBDC statistical team will send the data reports to the executive committee for review. This information will be transmitted via email unless requested otherwise. It is the executive committee’s responsibility to approve this information before it is sent out to the requestor(s) listed on the approved concept sheet.

K. Services Agreements, Contracts, and Responsibilities of external investigators 
A service agreement needs to be executed for any data mining project involving external investigators. This template incorporates the following elements: statement of work, fee schedule, invoicing instructions, nondisclosure and trade secrets terms, ownership and use of work product arrangements, publication and presentation rights and other standard legal terms. Services Agreements will also set forth a project cost and budget and will contain a data use agreement. If it is anticipated that data will be requested more than once or will require complex analyses, a BBDC infrastructure fee will be assessed for support provided. Service agreements will be executed by a designated representative of the executive committee or by the consortium PI.

For external investigator(s), the scope of the research to be performed with the BBDC data will be clearly outlined in Appendix B or any revisions of Appendix B mutually agreed upon in writing by a duly authorized representative of external investigator and the BBDC. External investigator(s) will certify that all its employees and other persons involved in the Research will be made aware of and comply with the obligations under which the BBDC data are shared. No part of the BBDC data shall be transferred to any third party or to any other person not specifically engaged in the conduct of the Research. External investigator(s) have to agree to establish appropriate administrative, technical, and physical safeguards to prevent unauthorized use of or access to the De-Identified BBDC Data.

External investigators receiving BBDC data derived from NIH-funded research must agree to comply with all applicable NIH Data Management and Sharing Policy requirements, including repository-specific terms, approved data use limitations, and reporting obligations related to data reuse.

External investigators should agree not to use the de-Identified BBDC Data, either alone or in concert with any other information, to make any effort to identify or contact individuals who are or may be the sources of the de-Identified BBDC Data without specific written approval from the BBDC and appropriate Institutional Review Board (“IRB”) approval, if required. Should an external investigator inadvertently receive identifiable information or otherwise identify a subject, they shall promptly notify BBDC and follow reasonable instructions, which may include return of or destruction of the identifiable information.

BBDC administrative core, through its prime Institution, Baylor College of Medicine, shall provide collaborators, de-Identified BBDC data, in available formats, contingent upon approval of the BBDC. Collaborator warrants it shall use the de-identified data provided to it pursuant to this Agreement solely for the Research Project detailed in this Agreement. Collaborators agree to conduct the Research Project and use of de-identified data ethically and in compliance with all applicable laws concerning the privacy and confidentiality of individually identifiable patient information, including, without limitation, HIPAA. The collaborator should fully comply with the Data Use Agreement of the BBDC.

Collaborator agrees not to use or further disclose the de-identified data in a manner that would violate HIPAA if done by Baylor College of Medicine. Collaborators further agree to use the de-Identified BBDC data in compliance with all applicable laws, rules, and regulations, as well as all professional standards applicable to research.

Except as authorized under this Agreement or otherwise required by law, collaborators agree to retain control over the de-identified BBDC Data and shall not disclose, release, sell, rent, lease, loan, or otherwise grant access to the de-identified BBDC data to any third party, except collaborator affiliates, and research partners specifically listed in the executed an agreement. Any such sharing shall be no less restrictive than the restrictions and conditions set forth in this Agreement, without the prior written consent of Baylor College of Medicine. Collaborators agree to establish appropriate administrative, technical, and physical safeguards to prevent unauthorized use of or access to the de-identified BBDC Data.

L. BBDC Site Responsibilities
BBDC sites agree to submit data in a timely manner so that it is available for analysis. The BBDC collects numerous data points from a large number of participants. It is to be noted that the BBDC will not have all data points on all participants. The BBDC cannot assure completeness of any dataset that is being provided. If an external investigator uses the BBDC data for regulatory filings with the FDA, whereas the BBDC will make every effort to provide reliable data, the BBDC sites will NOT be able to provide access to source files, patient records, or other research-related data files for the purposes of monitoring or audit (e.g., FDA audits). The BBDC data have been collected from the standpoint of a NIH-funded natural history study and thus these data do not have the monitoring or auditory oversight that are typically required of interventional studies being conducted under an FDA-IND.

M. Intellectual property
Each BBDC site owns the data collected at their own site. The BBDC owns the complete set of data collected at all sites (collective ownership). Data will be entered into dBGap; therefore, the NIH will also own the data set. At the completion of the study, the Osteogenesis Imperfecta Foundation will have ownership of the data set. Upon completion of study and NIH funding, the anonymized data will be deposited into a NIH-approved public database and thus, the NIH will have ownership of this anonymized dataset. Upon completion of study and NIH funding, the Osteogenesis Imperfecta Foundation will have ownership of the de-identified and coded datasets.

External investigators can only keep the de-identified BBDC data for a period of 2 years after expiration or early termination of any agreement with the BBDC or the end of the BBDC, whichever is earlier. After this term, external investigators shall follow the disposition instructions provided by the BBDC. However, external investigators may retain one (1) copy of the data to the extent necessary to comply with the records retention requirements under any law, and for the purposes of research integrity and verification.

N. Publications
All data requests are executed in the spirit that the data are being used for scholarly activities. It is an expectation of the BBDC that all data analyses conducted under the data use policy outlined here will lead to publications. Authorship for publication purposes shall be consistent with the standards of authorship being defined by the Uniform Requirements for Manuscripts Submitted to Biomedical Journals established by the International Committee of Medical Journal Editors (see www.icmje.org). All publications coming from the BBDC data are subject to the BBDC publication policy.

O. Conflict of Interest, Data Release & Publication Agreement
Please see appendix C.