Data Use Agreements

A Data Use Agreement (DUA) is a written agreement governing the terms and conditions upon which the Medical Center will permit transfer of institutional data to an external party. In any instance that Lurie Children’s patient or other data is shared with an external party, there must be authorization (whether from patient, statute, or legal) to share, or an agreement covering that transfer. Additionally, if you are using data that have been collected from another source, it’s important that you know from the beginning if there are any restrictions on how you can use and share the data.

Many researchers at the Medical Center receive data from outside agencies or institutions that are subject to DUAs. These are legal contracts that create parameters around the researchers’ use of the data and sometimes include detailed procedures for secure storage, restricted access, and analysis of the data. As part of the agreement, certain government agencies may also visit the researcher (or “licensee”) to conduct a compliance audit. In other cases, DUAs may simply prevent public release of the data or sale of the data to an external party. In cases where an agreement does not specify data security procedures, researchers must consider the need to keep their data secure so that the potential for harm to any individuals or organizations is minimized. When faced with two sets of data security requirements (e.g., one from the Medical Center’s IRB and one from a DUA), the researcher should always default to the requirements with higher standards for data protection. 

Datasets may include potentially identifying information because that data is integral to the value of the dataset. In such a case, the data may not be openly shared, but could be made available under specific DUAs. These datasets are likely to have restrictions on how results from the dataset are reported, and what happens to the data when the project is complete. In most cases, you will need to agree to abide by the terms of a DUA or contract before you are given access to this kind of data, and it is easy to tell if you are working with a dataset that has such restrictions. However, in some cases it may be easy to click through these terms and conditions without really reading them -- it is crucial to read the agreement in this case so to avoid legal rammifacations or restrictions on publication.

Conversely, if you plan to collect new data that contains sensitive, personally identifying information and would like to be able to share that data, including sensitive information, you will want to include that as part of your IRB protocol. Depending on your methodology, this could mean adding appropriate information as part of the participant consent process, creating a DUA, and developing specific plans about how you will make the data available.

Submit this form to initiate a Data Use Agreement.

If you have any questions about Data Use Agreements, please contact ospcontracts@luriechildrens.org.