Division of Research
Data Use Agreements (DUAs)
What’s in a Data Use Agreement?
Sometimes referred to as a data transfer agreement or data sharing agreement, or other variations on these terms, a DUA is a contract between two or more parties regarding the use and protection of data. Often data subject to an agreement are a necessary component of a research project. Having an executed agreement in place may be a required precondition to transfer certain data, including human subject research data, protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA), or other data deemed to be sensitive or confidential by the data provider. A DUA may also be required when a researcher intends to access protected data in an externally hosted data repository.
DUAs address important issues such as:
- Limitations on use of the data
- Obligations to safeguard the data
- Liability for harm arising from the use of the data
- Intellectual property and publication expectations
- Privacy rights associated with transfers of confidential or protected data
DUAs legally bind the institution and the individual researcher(s) to appropriate protection and use of the data. The mutual understanding established by an agreement can help prevent future issues by clearly setting forth the expectations of both the data provider and data recipient. Importantly, researchers may not sign agreements on behalf of Brown University; review and signature are required by a responsible party authorized to act on behalf of the University.
Brown has classified its information assets into one of four risk-based categories (None, Level 1, Level 2, or Level 3) for the purpose of determining who is allowed to access the information and what security precautions must be taken to protect it against unauthorized access. It is the data and service owner’s responsibility to ensure appropriate security measures are taken depending on the risk classification.
Brown provides guidance to assist the research community with understanding the relationship between research and protected health information (PHI) that is covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
The Information Security Group is available for consulting on all topics related to information security, privacy, P2P, compliance, social networks, wireless, laptop safety, and online protection. The group also consults on new and on-going security projects, and is also available for speaking at department and organizational meetings.
Stronghold is a secure computing and storage environment that enables Brown researchers to analyze sensitive data while complying with regulatory or contractual requirements. It has been established by Brown University to be compatible with Federal and Rhode Island Law standards for data privacy and protection.
Roles and Responsibilities
Several groups and individuals have specific responsibilities regarding the execution of DUAs.
How to Initiate and Manage Agreements
When Brown Is the Data Provider
When Brown is the data provider, an outgoing DUA is required to transfer the following types of data to a recipient data requester:
- individually identifiable health information or protected health information;
- personally identifiable information being shared beyond the parties named in the formal agreement or contract that governs the transfer of the data, or in the Brown IRB-approved informed consent;
- student information derived from education records that are subject to the Family Educational Rights and Privacy Act;
- data that are controlled by laws or regulations other than or in addition to those listed above;
- data obtained from an individual or organization under obligations of confidentiality;
- data whose storage, use and transfer must be controlled for other reasons (e.g., risk Level 3 data that will be shared with anyone outside of Brown, or proprietary concerns.
If Brown data being shared externally has been de-identified, Brown does not require a DUA or RAC review.
Review Process for Outgoing DUAs
- The recipient data requester (outside party) requests data from the Brown PI.
- The Brown PI or a designee from the Brown research team submits a DUA request in Huron.
- Upon electronic receipt of a new request, RAC begins its initial submission review and contacts the administrative contact listed in the submission if any of the required documentation is missing or incomplete.
- RAC prepares a draft of the outgoing agreement to send to the PI and the administrative contact listed.
Approval Process for Outgoing DUAs
If the data are being shared under the auspices of a Brown IRB-approved protocol in which the recipient party or parties receiving identifiable data from Brown are named in the informed consent, then an outgoing DUA is not required by Brown. However, if Brown is sharing identifiable data with a party not named in the informed consent or the data being shared are subject to special restrictions regarding their protection or use, then an outgoing DUA must be executed.
Once the terms have been finalized to the satisfaction of Brown, the agreement will be circulated for signature. After the agreement has been fully executed (signed by all parties), a PDF copy will be provided to the PI and to the administrative contact listed in the submission.
Data is then transmitted to the recipient data requester in accordance with the terms and conditions outlined in the DUA. When the agreement has expired or is terminated, the recipient data requester must destroy or return the data in accordance with the terms and conditions.
When Brown Is the Data Recipient
When Brown is the data recipient, an incoming DUA may be required for any of the reasons listed for when Brown is the provider, or as otherwise required by the data provider.
If a Brown PI requests to receive data from an outside institution or organization, it is the responsibility of the data provider to determine whether a DUA must be executed prior to sharing the data with Brown.
Some governmental organizations have an application process that must be completed prior to the start of negotiations. Please contact RAC when starting this type of application process to assist you with identifying and managing data use/compliance issues.
The data provider will share a template with the data sharing terms. Please submit a DUA request in Huron and upload the template for RAC's review.
RAC does not, as a matter of routine practice, create DUAs on behalf of the data provider. If a data provider is requesting that Brown create a DUA on its behalf, please contact the office to discuss.
Review Process for Incoming DUAs
- The Brown data requester submits a data request directly to the data provider. The data provider will typically either send the Brown data requester a draft DUA for review and signature by Brown or directly engage in conversation with RAC to determine whether an agreement is needed.
- Once the data provider and RAC confirm that a DUA is needed, the Brown data requester submits a DUA request in Huron. RAC will review the agreement to ensure the appropriate terms and conditions are negotiated.
- Upon electronic receipt of a new request, RAC will begin initial submission review and will contact the PI and the administrative contact listed in the submission if any of the required documentation is missing or incomplete.
- The DUA is negotiated in compliance with all applicable Brown policies and in consultation with other offices and individuals as needed.
Approval Process for Incoming DUAs
Once all terms have been finalized to the satisfaction of Brown and the data provider, the DUA will be circulated for signature. RAC notifies the Brown data requester that the agreement is executed and provides a copy.
It is the Brown data requester’s responsibility to understand and comply with the terms of the DUA and to ensure data are only used and/or shared as specified in the agreement. Prior to receiving data from the data provider, the Brown data requester should seek clarification from RAC if any requirements remain unclear.
Sharing Data and Updating an Incoming DUA
The data provider shares data with the Brown data requester in accordance with the DUA terms and conditions. Agreements will typically contain specific conditions on publication and disposition of the data. The Brown data requester is responsible for following such requirements.
Any requested updates to the agreement must be submitted to RAC by the Brown data requester. When the expiration date of the agreement is approaching, RAC will alert the Brown data requester of the impending expiration date. The Brown data requester is then responsible for requesting an extension of the term if additional time is needed to complete the research.
Amendments to Existing DUAs
Amendments to existing DUAs may be necessary for a variety of reasons, including changes in custodian/contact information, adding data files, requesting an extension or adding a collaborator.
For both incoming and outgoing data, the submitting individual (provider or requester) must submit the original agreement and proposed amendment to RAC for review. RAC will sign off on the amended DUA once the terms have been finalized.
Special Categories of Data
Centers for Medicare and Medicaid Services
SPH leadership has authorization to review its own DUAs for Centers for Medicare and Medicaid Services data when such data are being used for an SPH research project. SPH then submits the agreement to RAC for approval and signature.
Typically, researchers requesting Health and Retirement Study/Medicare and National Health and Aging Trends Study/Medicare datasets will be asked to complete two separate DUAs; however, since the Centers for Medicare and Medicaid Services considers the submission a single request, all agreements will be reviewed and processed through SPH to ensure consistency and to streamline processes.
National Institutes of Health
The National Institutes of Health (NIH) has established designated data repositories, including the database of Genotypes and Phenotypes (dbGaP), Sequence Read Archive and NIH Established Trusted 6 Partnerships, for securely storing and sharing controlled-access human research data submitted to NIH under the NIH Genomic Data Sharing Policy.
RAC is the signatory official for NIH data, and the appropriate staff member should be listed as signatory on all dbGaP requests.
If other data or materials repositories (e.g., the European Genome-phenome Archive) require an institutional official to sign at the time of deposit, RAC will be the signatory official.
Externally Hosted Data Accessed Electronically
In some instances, data may be accessed through acceptance of an electronic DUA frequently appearing as terms and conditions displayed on the researcher's computer screen for the researcher to click the "I accept" (or the equivalent) button.
A Brown PI, or a designee of the Brown PI, may electronically accept terms and conditions associated with access to externally hosted data. Research Integrity will not need to review the terms and conditions associated with electronic access to the data. However, if there is a separate, standalone data use agreement requiring authorized institutional signature associated with access to the data, the standalone agreement must be sent to RAC for review.
Any individual who electronically accepts terms and conditions is responsible for reading the terms and conditions, saving them electronically and distributing them to every individual who will have access to the data. Any individual who has access to the externally hosted data is bound by the accepted terms and conditions.