Protect human genomic data by matching access to the consent and permitted uses, then applying the repository’s and agreement’s safeguards throughout the data’s lifecycle. Removing names is not, by itself, a reason to make a dataset public: for NIH Genomic Data Sharing (GDS), the submitting institution uses the consent and its certification to determine whether unrestricted or controlled access is appropriate.
Start by identifying the rules for this dataset
Before preparing files for sharing, establish which requirements govern them. NIH distinguishes between obligations for people using genomic data and requirements for NIH-supported repositories and access systems, so a rule for one repository or agreement should not be assumed to apply to another.
- Funder and repository: Identify the applicable policy and the repository’s requirements. NIH’s GDS overview and repository and user requirements describe separate parts of that framework.
- Consent and use limits: Check what participants consented to and any limitations on future use or sharing. For NIH GDS submissions, consent informs both whether data are appropriate for submission and which access tier fits.
- Agreement and institutional certification: Locate the Data Use Certification or comparable agreement, the institution’s certification, and any project-specific conditions. These define what approved users and their institutions have agreed to do.
The NIH GDS policy notice states that consent is the basis for the submitting institution’s decision about whether data should be available through unrestricted or controlled access. That makes access selection a governance decision tied to the data’s collection and permitted uses, not simply a technical setting.
Should human genomic data be open access or controlled access?
Neither tier is universally correct. Choose the one that fits the consent and use limits, while considering who may access the data and what oversight is required. The comparison below describes the NIH access approaches; other repositories may have different terms.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
| Decision point | Unrestricted/open access | Controlled access |
|---|---|---|
| Consent compatibility | Appropriate only when the consent and institutional determination support unrestricted release. | Used when the data’s consent and use limitations call for access to be governed. |
| Permitted secondary use | Users may access the data without individual approval, but must respect applicable privacy expectations and use limits. | Requests are reviewed for consistency with established data-use limitations; approval applies to a proposed research use. |
| Who may access | Available without individual access approval. | Researchers whose request is approved and who meet the applicable conditions. |
| Approval and agreement | No individual controlled-access approval is required; NIH still expects responsible use. | Requires approval and agreement to the applicable conditions, such as a Data Use Certification. |
| Safeguards and oversight | Users must not attempt to identify participants and should acknowledge the dataset and repository in presentations and publications. | Approved users and their institutions have continuing confidentiality, integrity, and security responsibilities under the applicable terms and NIH best practices. |
Controlled access is a way to govern secondary use; it is not a guarantee that data cannot be re-identified. Likewise, the open tier does not erase privacy responsibilities. NIH says users of both controlled-access and unrestricted/open-access human genomic data should manage and secure the data in a way that protects participants’ privacy.
How to protect genomic data when sharing research
Use a documented process that connects the access decision to the controls and oversight required by the applicable terms.
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
- Record the access rationale. Document how the consent, institutional certification, and established data-use limitations support the selected tier. If the permitted use is uncertain, resolve it with the responsible institutional office and repository before release.
- Confirm recipient conditions for controlled data. Check that access approval covers the proposed research use and that users have accepted the governing agreement. Make the conditions available to the project team so access and use decisions can be checked against them.
- Assign institutional oversight. Establish who is responsible for ensuring the project follows the certification and agreement. NIH treats violations of access terms or the user code as data management incidents, so teams should know their institution’s process for handling a suspected incident.
- Assess the storage and analysis environment. If controlled-access files will be held or analyzed by a cloud provider or other third-party IT system, assess whether it meets the same applicable standards as the project. NIH holds the institution responsible for oversight; selecting a cloud service alone does not establish compliance.
- Check the governing dates and terms. NIH’s user guidance says its updated security best practices apply to new or renewed user agreements from January 25, 2025. Agreements approved earlier follow their stated standards until project close-out or renewal. The NIH repository requirements page has its own effective dates, so verify the terms for the particular dataset, repository, and system.
- Keep permitted use visible after access is granted. Ensure users understand the approved research purpose and the applicable data-use limits. For open-access human genomic data, NIH specifically says not to try to identify participants and asks users to acknowledge the dataset and repository in resulting presentations and publications.
Does de-identifying genetic data make it safe to share publicly?
Do not treat de-identification as a substitute for checking consent, use limits, and repository policy. NIH’s GDS framework bases the access decision on the consent under which data or samples were collected, and NIH’s user guidance continues to emphasize protecting participant privacy even for unrestricted/open-access human genomic data. The reviewed NIH guidance does not establish that removing identifiers makes a genomic dataset impossible to re-identify.
For a dataset being considered for public release, the submitting institution should make and document the access determination under the applicable consent and certification rather than relying on a label such as “de-identified.”
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Who is responsible if genomic data are stored in the cloud?
The institution remains responsible for oversight when a cloud provider or another third-party IT system stores or analyzes NIH controlled-access genomic data. NIH expects such systems to meet the same applicable standards as the institution’s other arrangements for controlled-access data. Responsibility does not transfer simply because a service provider hosts the files.
Assess the actual system and its use against the agreement, NIH best practices, and the repository’s requirements. The NIH guidance does not endorse a specific cloud vendor, plan, or configuration as automatically compliant.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What security rules apply to NIH controlled-access genomic data?
For approved users, the precise duties come from the applicable Data Use Certification or similar agreement, together with NIH security best practices and the requirements governing the repository or access system. NIH identifies confidentiality, integrity, and security as responsibilities of approved users and their institutions. Do not assume one universal checklist applies to every project: confirm which agreement governs and whether its terms are new, renewed, or still in force under an earlier approval.
For agreements approved before January 25, 2025, NIH user guidance says the previously stated standards remain applicable until close-out or renewal. For new or renewed agreements from that date, the updated best practices apply. Repository requirements have separate effective dates, so check the relevant repository page as well as the user agreement.
Responsible sharing includes fairness and participant rights
Security and access control are not the whole of responsible data sharing. The Global Alliance for Genomics and Health (GA4GH) frames responsible genomic and health-data sharing around human rights, privacy, non-discrimination, and procedural fairness. Those principles are useful when considering whether a proposed use respects participants and how access decisions are made, alongside the binding consent, policy, and agreement terms for a particular dataset.
For NIH GDS specifically, use the NIH GDS policy notice for the consent-based submission framework, the NIH guidance on using genomic data responsibly for user obligations, and the repository’s current requirements for system-specific terms.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
