1. DSSF Decision Support Tools – Contractual

2. Usual Disclaimers The analyses represented in the following slides reflect current understanding of applicable federal laws and regulations, but do not reflect more restrictive state laws or institutional policies and are no substitute for legal advice from your own institutional attorneys.

3. caBIG™ Data Sharing and Security Framework (DSSF) Image: DSSF in the form of a flowchart. At the top would be the Data/Images/Specimens. This is followed by four vertical strands representing the four areas of sensitivity in four domains (Human Research, Privacy, Contractual, and Proprietary). Following each domain there is an example of the types of questions/issues that would pertain to that particular domain. Within each domain area, the Framework then identifies one of three levels of sensitivity which are color-coded: low (green), moderate (yellow) and high (orange). That being stated, each domain is as follows: 1.Domain: Economic/Proprietary/IP Value (Need for Protection from Institution or PI Perspective. Examples: Is the data subject to a restrictive license? Is it related to an invention report you have or intend to file with your institution? Results: None/Low (Green), Medium (Yellow) High (Orange) 2.Domain: Privacy/Confidentiality/Security Considerations (Legal/Regulatory). Examples: Do federal or state law or your institution’s policies prohibit or restrict disclosure? Results: Low (Green)-De-Identified/Anonymized Data Set, Medium (Yellow)- Coded/Limited Data Set, High (Orange)-Identifiable Data 3.Domain: IRB/Institutional Restrictions (Human Subjects Considerations-Ethical). Examples: Do your institutions or IRB’s policies or the applicable informed consent documents explicitly or implicitly restrict or permit disclosure (e.g. “no commercial use”)? Results: Low (Green)- Explicit Permission for Registry Participation, Medium (Yellow)-policy limitations, High (Orange)- explicit consent limitations/restrictions 4.Domain: Sponsor Restrictions (Grant or Contract Terms and Conditions). Examples: Do terms and conditions in any sponsored agreements prohibit or restrict disclosure outside institution or the caGRID? Results: Low (Green): No restrictions, Medium (Yellow)- Delays or Other Moderate Restrictions, High (Orange)-Classified Research/Major Restrictions. The next section of the image shows the three possible sensitivity outcomes (Low/ Green, Medium/Yellow, High/Orange) and the corresponding data sharing mechanism to employ. 1.Assessment: Low (green). Criteria: if all of the following are present; no IP value, low sensitivity data, no IRB restrictions, no sponsor restrictions. Data Sharing Mechanism: general website terms of use 2.Assessment: Medium (yellow) Criteria: if any of the following is present; moderate IP value, moderate sensitivity data (e.g. LDS), limited institutional or IRB policy restrictions, moderate sponsor restrictions. Data sharing mechanism: standardized click- through terms and conditions. 3.Assessment: High (orange). Criteria: if any of the following are present; high IP value, high sensitivity data (e.g. PHI), significant IRB/consent restrictions, major sponsor restrictions. Data sharing mechanism: standardized click-though terms and conditions or individually negotiated bi-lateral or multi-lateral agreement

4. Target Audience Study Investigators and Research Teams Sponsored Programs Offices Institutional Legal Counsel

5. Sponsor Requirements Do the terms and conditions in any funding grants or contracts (from the government or private sources), or other agreements, prohibit or restrict disclosure? Questions/Issues: Do the terms of any agreements with sponsors governing the original data collection or creation delay or otherwise limit, restrict, or prohibit disclosure? Do the terms of any agreements with original data sources delay or otherwise limit, restrict, or prohibit disclosure?

6. “Low Sensitivity Data” Funding or other related agreements contain no restrictions or require only attribution The institution and investigator are not bound by any agreements that restrict the right to share data with others including those outside the institution The institution or investigator is bound by an agreement requiring only attribution of the source of the data to be disseminated

7. “Moderate Sensitivity Data” Funding or other agreement includes any of the following types of provisions: Imposes restrictions on data sharing for a limited period of time (e.g., sharing only after publication by sponsor, or only after project participants have an exclusive time period to review the data or only after a related patient application has been filed) Allows data sharing only with non-profit entities or other defined groups Allows data sharing only for non-commercial or other restricted purposes Allows use but not dissemination of data derived from data provided by the disclosing institution or investigator, or funded by the applicable sponsor

8. “High Sensitivity Data” Funding or other agreement: Allows transfer only with consent of sponsor or other specified party Allows transfer only under defined security conditions Requires the receiving or funded entity to disclose, license, or assign results derived from the data to the sponsor or another specified party Otherwise restricts receiving institutions’ ability to retransfer data

9. Pulling it all Together … Image: IP Restrictions, Privacy/Confidentiality Restrictions, IRB/Ethical Restrictions and Sponsor Restrictions are represented as separate but connectable puzzle pieces that make up a whole.

10. Other DSIC Tools Data Sharing and Security Framework (DSSF) Decision Support Tools Human Research Considerations Privacy Considerations Proprietary Considerations Model Informed Consent, Consent and Authorization Elements Decision Support Tool & Associated Materials

11. Contacting the Knowledge Center Contact us via our Forums https://cabig-kc.nci.nih.gov/DSIC/forums/ General forums DSIC Tools-specific forums