Open Menu Close Menu Open Search Close Search

A data/specimen transfer agreement allows a researcher to share data and/or specimens with a collaborator (a person or entity not associated with the study or the researcher’s institution).

The Tufts Health Sciences IRB must be notified if a researcher or institution plans to share data and/or specimens with a recipient (person or entity). An agreement is required between the institution providing the data and/or specimens and the entity receiving them such as a Material Transfer Agreement (MTA), Data Use Agreement (DUA), Collaboration Agreement, etc.  An agreement is not required if the recipient is part of a clinical trial that has an existing contract and the use is included in the IRB authorization (or waiver of authorization) approval for the clinical trial.

An agreement is established between a provider institution and recipient institution. This is to document the data and/or specimens being transferred and terms and conditions with respect to ownership, permitted uses of the data and/or specimens, publication of results, development of inventions, disposal of the data and/or specimens, and liability.

The following elements should be included in the agreement:

  1. Permitted uses and disclosures of the data and/or specimens by the recipient, consistent with the purposes of the research
  2. Limits on who can use or receive the data and/or specimens
  3. Appropriate safeguards to prevent the use or disclosure of the data and/or specimens other than as provided for in the agreement
  4. Requirements for reporting unauthorized uses or disclosures of protected health information to the HIPAA Privacy Officer and to the IRB
  5. A statement prohibiting identifying or contacting subjects

Limited Data Set and Data Use Agreement

HIPAA defines a Limited Data Set as protected health information that excludes 16 categories of direct identifiers which may be used or disclosed for research, public health or health care operations purposes without authorization, with a Data Use Agreement (DUA).

The following identifiers must be removed from health Information if the data are to qualify as a limited data set: 

  1. Names
  2. Postal address information, other than town or city, state, and ZIP Code
  3. Telephone numbers
  4. Fax numbers
  5. Electronic mail addresses
  6. Social security numbers
  7. Medical record numbers
  8. Health plan beneficiary numbers
  9. Account numbers
  1. Certificate/license numbers
  2. Vehicle identifiers and serial numbers, including license plate numbers
  3. Device identifiers and serial numbers
  4. Web universal resource locators (URLs)
  5. Internet protocol (IP) address numbers
  6. Biometric identifiers, including fingerprints and voiceprints
  7. Full-face photographic images and any comparable images

The health information that may remain in the information disclosed includes:

  • Dates and ages greater than 89
  • Some geographic information (City, county, state and more than 3-digit ZIP codes, including ZIP+4,  are allowed in a Limited Data Set, but street address is not)
  • Any other unique identifying number, characteristic, or code not listed as direct identifiers, provided that the code or identifier does not replicate part of a listed direct identifier
  • A Limited Data Set may include a link field to allow the provider to re-identify the individual

Please note that Tufts researchers are not authorized to sign Agreements on behalf of Tufts – the agreement must be submitted to Tufts Medical Center Research Administration or Tufts University OVPR to obtain the proper review and signature.

For questions or to establish an agreement, please contact:

Tufts Medical Center

Research Administration

Grants and Contracts

tuftsmcgrants&contra@tuftsmedicalcenter.org

Tufts University

Tufts Tech Transfer

Office for Technology Transfer and Industry Collaboration (TTIC)
MTA@tufts.edu