Resources for evaluating requests to share data and specimens include the following: 

•     Investigator Manual: Sharing Data, Specimens, or Images  
•     HRP 503 Biomedical Protocol Template, Data Management and Confidentiality and Data and Specimen Banking 
•     HRP-503a Registries and Repositories, several sections, but primarily Data/Specimen Access and Release 
•     Checklists / Worksheets  related to consent and authorization 
•     Office of Research Compliance Guidance on External Sharing of Human Subjects Research Data  

Study teams should include the following information in the protocol and/or application:  

•     Purpose of the sharing/receiving 
•     Who is doing the sharing 
•     Who will receive the data/samples/images 
•     How data/samples/images will be transmitted 
•     If data/samples will be directly identifiable/coded/de-identified/anonymized 
•     What data will be shared with samples/images 

IRB Analysts should review the consent and/or authorization forms to ensure they describe sharing in a manner consistent with the proposed sharing.  If the sharing is proposed as part of a change of protocol and was not previously described, evaluate whether a waiver of consent and authorization could be justified.  

If the data is either anonymous/de-identified or is coded (and not associated with any other identifiers), and the recipient will never have access to the code, then the data set is considered de-identified to the recipient and no longer subject to HIPAA.   

If the data will be coded with limited identifiers (e.g., dates), the data represents a limited data set (LDS), and a data use agreement (DUA) will be required.  

Depending on identifiability to the UW-Madison study team, a waiver of authorization may be needed. For example, if UW study team is not only maintaining an LDS (identifiable data) but will use the data, a waiver of authorization may be needed, unless authorization has already been obtained at UW. 

If the data contains direct identifiers or free text fields containing identifiable information, a waiver of HIPAA authorization would be required. Under a waiver of HIPAA authorization, study teams are expected to account for all disclosures of research subjects’ protected health information (for details, please see the HIPAA-Researchers webpage). If there are questions about whether the content of the free text fields contains identifiable information, study teams should contact their HIPAA Privacy Officer.

IRB Analysts should review the consent and/or authorization forms under which data/samples were collected to ensure they describe sharing in a manner consistent with the proposed sharing.  If sharing was not described in the original documents, a waiver of informed consent will be needed to share the samples. Also consider whether the data/samples being received by UW include HIPAA identifiers.  If limited identifiers will be included, a DUA will likely be needed.  If direct identifiers are included, a waiver of authorization may be necessary. 

If the data/sample receipt is part of change of protocol, ensure the ‘Study Procedures’ page in the nPBA indicates secondary use, and collection and/or use of biological specimens if specimens will be obtained. 

Sending or receiving identifiable samples or data to or from an external entity may raise engagement issues particularly for federally funded studies. Reliant should be consulted in these cases.