VPR: Facilitating Primary and Secondary Sharing of Cancer Registry Data

Cancer registries participating in the Virtual Pooled Registry Cancer Linkage System (VPR) routinely release cancer information for inclusion in and analysis by approved minimal-risk linkage studies. Per the 2023 NIH Data Management and Sharing Policy, these studies may be required to make their scientific data available for use by others (a.k.a. secondary data sharing) in a manner that promotes the following:

“Sharing scientific data helps validate research results, enables researchers to combine data types to strengthen analyses, facilitates reuse of hard-to-generate data or data from limited sources, and accelerates ideas for future research inquiries. Central to sharing scientific data is the recognized need to make data as available as possible while ensuring that the privacy and autonomy of research participants are respected and that confidential/proprietary data are appropriately protected.”¹

To facilitate secondary data sharing and ensure the protection of registry-acquired data, the NAACCR DUA Task Force developed the VPR Templated DUA (VPR DUA) that is signed between the registry and the primary researcher. The VPR DUA is a standard agreement and has been adopted by 26 of the 45 VPR registries in lieu of their registry-specific agreement. The VPR DUA includes a term that allows secondary sharing if the following requirements are met:

1. The shared dataset has been properly de-identified pursuant to 45 CFR 164.514(b)(2)(i).
2. The identity of the study participants cannot be readily ascertained, and the secondary recipient will not attempt to learn the identity using the data or by linking with other data sets.
3. The secondary recipient is either:
   • A controlled access repository that meets specific criteria and requires a DUA that prohibits users from further sharing the data.
   • An organization that has executed a DUA with the primary researcher that is at least as restrictive as the VPR DUA or has signed a Flow-Through
   • Agreement that prohibits further sharing the data other than with a controlled access repository.
4. The primary recipient provides the registries with an annual report of new or updated data sharing activities.

The NAACCR DUA Task Force recently finalized the VPR Flow-Through Agreement that flows the terms and conditions of the VPR DUA on to the secondary recipient. The VPR Flow-Through Agreement prohibits the secondary recipient from further sharing the data other than with a controlled-access repository that meets specific criteria, and requires a DUA that prohibits users from further sharing the data.

^{1 https://osp.od.nih.gov/policies/scientific-data-management-policy/}