Data Privacy, De-identification & Sharing Agreements
Not all research data can or should be shared openly, and this sub-cluster covers the legal, ethical, and technical mechanisms that govern access to data containing personal, sensitive, or culturally significant information. De-identification standards, most notably the HIPAA Safe Harbor method, specify which identifiers must be removed or altered from health data before it can be treated as no longer individually identifiable, and are a starting point (though not the only method) for handling human-subjects data in the United States. Governance of data about or from Indigenous peoples follows a separate and complementary framework: the CARE Principles for Indigenous Data Governance, developed by the Global Indigenous Data Alliance, assert that Indigenous data governance must account for Collective Benefit, Authority to Control, Responsibility, and Ethics, principles that sit alongside, rather than replace, the FAIR principles for data more broadly. Where data cannot be fully de-identified or openly shared, controlled access is typically governed by data sharing agreements or data use agreements, which specify permitted uses, security requirements, and downstream restrictions on data recipients; NIH guidance on data sharing agreements is a frequently cited reference point for structuring these. For a research administrator, this is one of the highest-stakes areas of data management, since errors here carry legal and reputational risk beyond the individual study. Pages in this sub-cluster cover de-identification methods and their limits, how to structure and negotiate a data sharing agreement, and how Indigenous data governance frameworks interact with institutional and funder policy.
Guides
Opt-Out Health Information Exchange (HIE): Consent Models, Record Locator Service (RLS), and 42 CFR Part 2 Segmentation
Technical guide to Opt-Out vs. Opt-In Health Information Exchange (HIE) consent, Record Locator Service (RLS) filtering, 42 CFR Part 2, and FHIR Consent.
HL7 FHIR Consent Resource: Privacy Directives, Research eConsent, and 42 CFR Part 2 Segmentation
Technical guide to the HL7 FHIR Consent resource: status, scope, policyRule, recursive provision blocks, clinical trial eConsent, and 42 CFR Part 2 rules.
Smart Contracts in Healthcare: Dynamic Patient Consent, Prior Authorization Automation, DSCSA Track-and-Trace, and HL7 FHIR
Technical guide to smart contracts in healthcare: permissioned DLT dynamic patient consent, prior authorization automation, DSCSA track-and-trace, and FHIR.
Indiana Health Information Exchange (IHIE) & State HIE Networks: INPC, CRISP, SHIN-NY & TEFCA
Technical guide to the Indiana Health Information Exchange (IHIE), INPC CareWeb, state HIE participation mandates (NC, CA, NY, MD), and TEFCA connectivity.
HIPAA Preparatory to Research (45 CFR § 164.512(i)(1)(ii)): The 3 Representations, PHI Removal Rules, and Recruitment Boundaries
Technical guide to the HIPAA Preparatory to Research provision (45 CFR 164.512(i)(1)(ii)): 3 representations, PHI removal rules, and recruitment limits.
Information Blocking Rule (45 CFR Part 171): Cures Act Actors, EHI Scope, OIG Penalties, and CMS Disincentives
An authoritative regulatory guide to the 21st Century Cures Act Information Blocking Rule (45 CFR Part 171), detailing the three regulated Actor categories, statutory knowledge standards, Electronic Health Information (EHI) Designated Record Set alignment, HHS OIG civil monetary penalties up to $1 million, and CMS provider disincentives.
ℓ-Diversity (l-Diversity) in Clinical Research: Distinct, Entropy & Recursive Formulas, Worked Example, and Python/R Code
Technical guide to l-diversity (Machanavajjhala et al., 2007), covering distinct, entropy, and recursive (c, l)-diversity formulas, EHR worked examples, and Python/R code.
HIPAA Data Use Agreement (DUA): 45 CFR § 164.514(e) Checklist, Limited Data Set Rules, and DUA vs. BAA
A regulatory compliance checklist and guide for HIPAA Data Use Agreements (DUAs) under 45 CFR § 164.514(e), detailing Limited Data Set (LDS) identifier rules, the mandatory statutory provisions, prohibitions on re-identification or subject contact, DUA vs. Business Associate Agreement (BAA) comparisons, and Federal Demonstration Partnership (FDP) templates.
HIPAA Expert Determination (45 CFR § 164.514(b)(1)): Statistical Principles, Risk Thresholds, and Safe Harbor Comparison
Technical guide to the HIPAA Expert Determination de-identification method (45 CFR § 164.514(b)(1)), covering HHS OCR statistical principles, k-anonymity, and Safe Harbor differences.
eHealth Exchange: DURSA Governance, Federal VHIE Integration, IHE XCA/FHIR Architecture, and TEFCA QHIN Status
A technical and legal guide to the eHealth Exchange nationwide health information network, examining its origins in the federal NwHIN, the Data Use and Reciprocal Support Agreement (DURSA), Department of Veterans Affairs (VHIE) and federal agency connectivity, IHE XCA/XCPD and HL7 FHIR specifications, and TEFCA QHIN operations.
CommonWell Health Alliance: Record Locator Service (RLS), TEFCA QHIN Architecture, Carequality Bridge, and IHE XCA / HL7 FHIR R4 Exchange
Technical guide to CommonWell Health Alliance: Record Locator Service (RLS), TEFCA QHIN exchange, Carequality bridge, IHE XCA, and HL7 FHIR R4 workflows.
HIPAA Limited Data Set (45 CFR § 164.514(e)): The 16 Excluded Identifiers, Retained Research Elements, and DUA Checklist
HIPAA Limited Data Set (45 CFR § 164.514(e)) checklist: the 16 excluded direct identifiers, retained dates and ZIP codes, and mandatory DUA provisions.
What Is a Health Information Exchange (HIE)? Architecture, Exchange Forms, RHIOs, and TEFCA
Health Information Exchange (HIE) refers both to the standards-based electronic mobilization of clinical data across healthcare organizations and to the regional or state networks (RHIOs) that govern directed, query-based, and consumer-mediated exchange alongside national frameworks like TEFCA.
UK Biobank Data Access: Tiers, Cost, and How to Apply
UK Biobank’s 500,000-participant cohort is one of the most heavily used population-health resources in research — but access requires a scoped application through its Access Management System, a fee, and a binding use agreement. This guide covers the mechanics.
Information Governance in UK Health Research: The HRA Framework
How the Health Research Authority frames Information Governance for UK health research: UK GDPR, the Data Protection Act 2018, common law confidentiality, and Section 251/CAG support.
Genomics England’s National Genomic Research Library: How Researchers Get Access
How researchers apply to access Genomics England’s National Genomic Research Library through the governed Research Environment, and what’s actually in it.
Subpoena for Medical Records: The Federal Decision Tree for HIM and Privacy Officers
A subpoena is not an instruction to release records. The federal analysis – court order vs subpoena vs authorization, what 45 CFR 164.512(e) satisfactory assurances actually require, why law enforcement and 42 CFR part 2 records take different paths, and where minimum necessary applies.
TEFCA and QHIN Participation: Designation, Exchange Purposes, and How to Join
TEFCA participation is a procedure with defined steps, deadlines and grounds for denial, codified at 45 CFR Part 172. This guide leads with that procedure — the QHIN qualification requirements, the application and Onboarding timeframes, the 30-day production transaction rule that can rescind a Designation, suspension, termination and appeal — plus the six Exchange Purposes and the choice between QHIN, Participant and Subparticipant.
Information Blocking Exceptions: All Ten, and How to Decide Which Applies
The information blocking exceptions are part of the definition of information blocking, not a set of defences bolted on afterwards — a practice covered by one is not information blocking at all. There are now ten, not the eight most guidance still cites. This guide walks each exception in 45 CFR Part 171 with the conditions that actually have to be met, the procedural deadlines that most often forfeit them, and a working decision sequence.
Differential Privacy for Research Data Release
What differential privacy means, a worked numeric example, how to choose an epsilon privacy budget, and when it should replace suppression for releasing research data.
Trusted Research Environments and the Five Safes Framework
A practical guide to trusted research environments (TREs): what the Five Safes framework assesses, how the researcher accreditation and project-approval procedure works, and how TREs relate to data safe havens and secure data environments.
k-Anonymity and Disclosure Risk in Shared Datasets
How k-anonymity, l-diversity and t-closeness quantify re-identification risk in a dataset before it is shared, with a worked example and how they relate to HIPAA Expert Determination.
All of Us Researcher Workbench: How Tiered Access Works
How NIH’s All of Us Research Program governs researcher access to its precision-medicine dataset through the Registered and Controlled Tiers, the institutional Data Use and Registration Agreement (DURA), and individual researcher requirements — plus the 2026 migration to Researcher Workbench 2.0.
EGA (European Genome-Phenome Archive): The EU’s Controlled-Access Counterpart to dbGaP
The European Genome-phenome Archive (EGA) is the EU’s controlled-access repository for human genomic, phenotypic, and clinical research data, jointly run by EMBL-EBI and CRG. Here is how its Data Access Committee model, GDPR compliance, and Federated EGA architecture work, and how it compares to dbGaP.
H3Africa’s Data and Biospecimen Access Committee (DBAC): A Governance Model for African Genomic Research
How H3Africa’s Data and Biospecimen Access Committee (DBAC) governs access to African genomic data and biospecimens collected under broad consent, including eligibility, the request process, and access conditions.
PhysioNet Credentialed Access: How to Get MIMIC and Other Restricted Data
How PhysioNet’s open, restricted, and credentialed access tiers work, and what the credentialing process (CITI training, identity review, and a per-dataset Data Use Agreement) requires before a researcher can access MIMIC and other physiological or clinical signal datasets.
Vivli: How the Data Request and Access-Review Process Works
Vivli is a non-profit platform for requesting individual participant clinical trial data. Here is how its request form, administrative check, data-contributor feasibility review, Independent Review Panel, data use agreement, and secure research environment actually work, step by step.
Data Trusts: A Community-Governed Model for Sharing Sensitive Research Data
What a data trust is, how it differs from a data sharing agreement, data governance policy, or data commons, and how research administrators can evaluate the fiduciary trustee model for sharing sensitive data.
Data Anonymisation in Research: Techniques, Standards, and When It’s Required
How researchers anonymise data: core techniques, the GDPR/HIPAA/NIST standards that define the term, and when anonymisation is actually required versus pseudonymisation or controlled access.
Data Security Incident Notification Requirements: GDPR, HIPAA, and State Law
A practical breakdown of when a data security incident involving research data triggers legal notification duties — GDPR Articles 33 and 34, the HIPAA Breach Notification Rule, and US state breach-notification laws — and how these differ from institutional IRB and sponsor notification obligations.
Data Breach Response Plan Template: A Worked Outline for Research Data
A section-by-section worked template for a research-data breach response plan, covering detection and reporting, triage and classification, containment, regulatory/contractual notification obligations (HIPAA, dbGaP, DUA, IRB, export control, 2 CFR 200.113), remediation, and a sample incident-log format.
Data Protection Act 2018 in Health and Social Care Research
How the UK Data Protection Act 2018 works alongside UK GDPR to govern health and social care research: special category conditions under Schedule 1, the Schedule 2 research exemption, and the 2026 move of safeguards from section 19 to UK GDPR Articles 84B/84C.
Data Use Agreement Template: A Worked Example, Clause by Clause
Two illustrative, clause-annotated Data Use Agreement examples — a bilateral HIPAA limited-dataset DUA and a dbGaP-style controlled-access certification — plus the checklist any defensible DUA needs to answer.
Data Availability Statement Sample: Worked Examples
Four fully worked data availability statement samples — open repository, restricted/controlled access, no new data, and third-party data — as ready-to-adapt illustrative composites, not real study records.
Data Sharing Agreement: A Worked Example, Clause by Clause
A complete, fictional composite data sharing agreement walked through clause by clause — parties, permitted use, security, publication rights, retention, and liability — showing what filled-in language actually looks like.
Indigenous Health Equity Fund: What It Funds and What It Means for Data Governance
A guide to the Indigenous Health Equity Fund (ISC-administered, $2B/10yr): funding streams, eligibility, and the OCAP/CARE data governance obligations that attach to funded projects generating Indigenous health data.
Managing Participant-Level Research Data
How to de-identify, tier access to, and govern sharing of participant-level (human-subjects) research data under HIPAA and GDPR, distinct from informed consent and IRB review.
AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research
What the AIATSIS Code of Ethics for Aboriginal and Torres Strait Islander Research requires: its four core principles, how it replaced GERAIS in 2020, and what it means for data governance and ethics review.
Health Data Research Service (HDRS): What It Is
What the UK Health Data Research Service (HDRS) is, where it came from, what it will provide, how it is funded and governed, and how it differs from HDR UK.
Data Sharing Agreements Between Collaborators and Institutions
What a data sharing agreement covers between collaborating institutions — ownership, permitted use, security/privacy obligations, publication rights, and retention/destruction terms — and how it differs from a Data Management Plan, a Data Use Agreement, and a Material Transfer Agreement.
How to Write a Data Availability Statement for Reproducibility
A practical, standards-based guide to writing a data availability statement that genuinely supports reproducibility: required elements, real ICMJE/PLOS/Springer Nature/NIH requirements, example wording for common data-sharing situations (including third-party data), and common mistakes to avoid.
