How to Evaluate Human Genomic Data Before Research Reuse

Before reusing human genomic data, our recommendation is to evaluate the proposed research alongside the permissions and responsibilities attached to the dataset. A technically suitable file is only one part of that decision. The workflow below draws on public guidance from NHGRI and NIH, with a program example from All of Us; it is an editorial synthesis, not legal advice or a new research study.

Start with the question and the dataset

Write down what the project will investigate, which data it needs and who will perform the analysis. Our recommendation is to use that description as the reference point for every subsequent permission check, rather than beginning with the widest available dataset and narrowing the research later.

NHGRI describes privacy and identity responsibilities as part of genomic data science. In our assessment, that makes the proposed handling of participant information a central design question. Ask the research team to explain the intended use in ordinary language before assessing its technical pipeline.

Read consent alongside sharing conditions

NHGRI informed-consent guidance addresses consent considerations in genomic research, including circumstances in which seeking consent may be appropriate beyond the requirements of human-subjects regulations. The NIH policy overview connects future research purposes and broad data sharing with consent expectations for relevant samples or cell lines.

Our recommendation is to record the applicable consent terms and sharing conditions separately. Ask the responsible institution to resolve uncertainties about the planned project before treating broad sharing language as permission for every possible use. These NIH expectations should not be presented as a universal rule for every dataset worldwide.

Treat privacy as an ongoing responsibility

NHGRI privacy guidance explains why the uniqueness of genomic information complicates anonymization. For a practical program example, All of Us describes removing identifying personal details, requiring researcher training and obtaining agreement to data-use rules before making data available.

Our recommendation is to evaluate these safeguards as a set, not use the removal of identifiers as the sole approval criterion. Document who may access files, where analysis will occur and how the team will respond to a proposed change in use. Do not describe the existence of safeguards as proof that privacy risk has disappeared.

Keep institutional accountability visible

NIH controlled-access data guidance states that the institution remains responsible for oversight failures involving cloud providers or third-party systems. Its data-user code restricts attempts to identify or contact participants without appropriate approvals.

Our recommendation is to name an accountable institutional owner before choosing a computing environment. Ask that owner to confirm the applicable access agreement, approved users and oversight arrangements. An outsourcing decision should therefore prompt a review of responsibilities, rather than an assumption that purchasing a service transfers them.

Finish with a documented go or no-go decision

Budget assumptions deserve their own check. NHGRI sequencing-cost guidance cautions that organizations account for sequencing costs differently. Our recommendation is to distinguish the purchase or production of sequence data from the resources the proposed reuse project will require.

Bring the research purpose, permission review, access arrangements and resource assumptions into one decision record. Approve the project only after the responsible team has resolved its open questions; otherwise document what must change. This is our proposed evaluation workflow, not a certification that a particular dataset or project satisfies every applicable obligation.

Related Business 2.0 reading: related sector analysis; further business coverage; additional technology analysis; more industry context; related reference coverage.