Data Use and Governance Toolkit" width="80px" height="100px" />NCBI Bookshelf. A service of the National Library of Medicine, National Institutes of Health.
Friedler HS, Leavy MB, Bickelman E, et al. Outcome Measure Harmonization and Data Infrastructure for Patient-Centered Outcomes Research in Depression: Data Use and Governance Toolkit [Internet]. Rockville (MD): Agency for Healthcare Research and Quality (US); 2021 Oct.
Data Use and Governance Toolkit" width="80px" height="100px" />
NOTE: This example contract does not substitute for appropriate legal involvement and/or review during the development or carrying out of the contracting process. Registries should consult with their own legal advisors prior to developing, formalizing, and/or implementing contract language.
[This is a sample framework only. There are a number of areas for registries to consider. In the event the researcher is an individual (and not an entity), then this Sample Agreement may be modified accordingly. A Registry’s actual Data Use Agreement should be reviewed and finalized with the input and approval of legal counsel.]
[Name of Registry], located at [Registry Address] (“Registry”) and [Name of Research Entity], located at [Researcher Address] (“Researcher”), enter into this Data Use Agreement (“Agreement”) as of [Effective Date] (the “Effective Date”).
[May consider inserting a background of the Registry, e.g., its mission, purpose, how the Registry came to possess the Data, general overview of underlying Data contributors, reason(s) for sharing the Data]
A description of the data to be shared hereunder (the “Data”) is set forth on Exhibit A attached to this Agreement.
Registry hereby grants to Researcher the right to access and use the Data for the purpose expressly set forth in this Agreement.
Researcher shall use the Data solely to perform the Research (and related activities) described in Exhibit B attached to this Agreement (the “Research”). Any other uses are strictly prohibited without the express prior written permission of Registry. To conduct additional or different research, Researcher must submit a separate proposal to Registry. Any such additional/different research must be approved by Registry and set forth in either an amendment to this Agreement or a subsequent data use agreement with Registry.
Researcher shall perform the Research and use the Data in strict compliance with: (i) this Agreement; (ii) all applicable laws, rules and regulations (including but not limited to the Health Insurance Portability and Accountability Act of 1996 and all regulations implements thereunder, (“HIPAA”); (iii) all Registry policies, procedures, and governance documents made available to Researcher; (iv) all regulatory approval documents (including but not limited to approvals of Institutional Review Boards (“IRBs”), patient informed consent forms, and patient HIPAA authorization forms; and (v) any documentation submitted by Researcher to Registry in order to gain access to the Data (e.g., Data access request forms, Research proposals).
Researcher shall be responsible for performing the Research, overseeing Research personnel and for overall compliance with this Agreement. Registry shall have no obligations with respect to any aspects of the Research.
Researcher shall use appropriate safeguards to prevent use or disclosure of the Data other than as provided by this Agreement. Researcher shall notify Registry within [may consider inserting a specific timeframe, e.g., two (2) business days, or a more general requirement, e.g., immediately/promptly upon discovery] of any uses or disclosures of Data not permitted by this Agreement.
To the extent applicable, Researcher shall obtain and maintain throughout the Research the relevant IRB’s permission to use the Data for purposes of the Research. Researcher shall provide Registry with all written evidence of such IRB approvals upon request.
Researcher may make available the Data only to those persons expressly identified as Research personnel in Exhibit B. Any other personnel may require an amendment to this Agreement or a separate data use agreement with Registry.
Registry (or its agents) may audit Researcher’s use of the Data to ensure compliance with this Agreement. Any such audits will be conducted during Researcher’s regular business hours with reasonable advanced notice and consideration for Researcher’s business operations. Researcher will cooperate, and will ensure that all Researcher personnel will cooperate, with the auditors and will make all records and materials available to them.
[May consider inserting other restrictions that may be desirable, e.g., prohibitions on using the Data for specific purposes, use of Data within specific geographic locations only]
Registry is making the Data available to Researcher at no cost to Researcher. [If payment is desired, it may be beneficial to add payment terms, e.g., invoicing procedure, payment due dates].
Researcher bears all costs and expenses incurred by Researcher to access and use the Data, and conduct the Research.
Researcher represents and warrants that (i) it is duly incorporated or organized, validly existing and in good standing under the laws of the jurisdiction of its incorporation or organization; (ii) it has the power, authority and legal right to enter into this Agreement and to perform the activities contemplated hereunder, and that it has taken all necessary corporate action to authorize execution of this Agreement to the extent required; (iii) it has obtained or will obtain, to the extent required, all necessary consents, approvals and authorizations of governmental or regulatory authorities required to be obtained related to the performance of this Agreement and the Research; and (iv) the execution and delivery of this Agreement will not conflict with or violate any requirement of any applicable law or regulation and does not conflict with or constitute a default under any contractual obligation enforceable against it.
[Depending on the nature of the Data, it may be advisable to add detailed security requirements for Researcher to follow, e.g., use of encryption, password security requirements, separation of Data from other datasets, linking Data with other datasets. Security requirements also may be set forth in a Registry policy cross-referenced here].
[May consider including a cap on liability/damages].
[May consider including indemnification language (e.g., “Researcher shall indemnify, defend, and hold harmless Registry and its officers, employees, agents, and representatives from and against any and all claims, damages, losses, fees, expenses, and liability arising from use of the Data.”];
[May consider including a disclaimer of warranties related to the accuracy, integrity, reliability, or completeness of data, as well as a disclaimer of standard warranties of title, non-infringement, merchantability, fitness for a particular purpose. May also consider adding language so it is clear that underlying registry data contributors have no responsibilities regarding the Data.]
All Data is and shall remain the sole and exclusive property of Registry. No ownership rights in or to the Data are transferred to Researcher hereunder.
Researcher agrees that it will not disclose to others or use for its own benefit or the benefit of others, any Data or other Confidential Information disclosed by Registry in the course of this Agreement. For purposes of this Agreement, “Confidential Information” shall mean methods, processes, know-how, policies, procedures, templates, and other non-public confidential information of Registry. All Confidential Information is and shall remain the confidential property of Registry. Researcher shall keep the Confidential Information in strict confidence and may not use or otherwise disclose the Confidential Information to any third party without the prior written consent of Registry. Researcher shall notify Registry within [insert timeframe, e.g., two (2) business days] of any uses or disclosures of Confidential Information not permitted by this Agreement.
[May consider adding language about publicity/use of each party’s names, e.g., if Registry wants to publicize the fact that Researcher is accessing/using the Data].
[If inventions are contemplated, may consider adding applicable invention ownership/rights language.]
Term: The term of this Agreement shall commence on the Effective Date and, unless earlier terminated as set forth in this Section 8, shall remain in effect [may consider a specified term; e.g., set number of years, or a broader end date, e.g., until completion of the Research].
Termination: Either party may terminate this Agreement upon [insert number] days prior written notice to the other party for any reason or no reason. Registry may terminate this Agreement immediately upon written notice to Researcher if Registry is no longer permitted to share the Data with Researcher. In addition, either party may terminate this Agreement upon written notice to the other party in the event of a material breach of this Agreement by the other party, which material breach is not cured within [insert number] days after receipt of written notice thereof.
Effect of Termination: [Insert the Registry’s requirement for post-termination activities, e.g., will Data need to be returned or destroyed, can Researcher continue using the Data for a limited period].
[Registry may insert its desired publication requirements or otherwise attach or cross-reference its policy governing publications].
[Registry may consider adding specific attribution requirements, to ensure that all references of Registry as the source of Data are accurate and consistent in any publications].
[Registry may consider adding customary contract boilerplate, such as clauses related to assignment, notices, survival, counterparts, force majeure.]
IN WITNESS WHEREOF, the duly authorized representatives of the parties hereto have executed this Agreement as of the Effective Date.
| REGISTRY | RESEARCHER |
|---|---|
| By:_______________________________ | By: |
| Print Name:________________________ | Print Name: |
| Title:_____________________________ | Title: |
| Date:_____________________________ | Date: |
[May consider adding: (i) description of the Data being shared; (ii) format of the Data; (iii) method of Data delivery; (iv) classification of the Data (e.g., de-identified data)]; (v) any specific restrictions on Data usage depending on the nature of the Data (e.g., can Data be used for commercial purposes, is use of the Data limited to academic endeavors, can Researcher benchmark/compare the Data with its own data).
[May consider adding: (i) name of study (including name and ID number of protocol); (ii) detailed description of the Research being conducted and how Data will be used; (iii) whether/which IRB approvals are required; (iv) names/titles/locations of Researcher personnel accessing/using the Data; (v) where the data will be accessed/hosted; (vi) Research timelines; (vii) Research publications anticipated
