Principal Investigators/Research Assistants

Data Access Request and Use Certification

for the

NIH Pediatric MRI Data Repository

I request access to the NIH Pediatric MRI Data Repository, which consists of data collected by the Brain Cooperative Group as part of the NIH MRI Study of Normal Brain Development, for the purpose of scientific investigation or the planning of clinical research studies as described in the Data Access Request and Use Certification (DUC). I agree to the following terms:

1. Research Use

I, my research staff and institutional organization, and my prime contractor and/or subcontractors (listed on the DUC, if any), will use the NIH Pediatric MRI Data Repository Dataset(s) only for the research purposes described on the DUC and in accordance with federal, state, and local laws, and any relevant institutional policies. This applies to all versions of the NIH Pediatric MRI Dataset(s).

New uses of the data outside of those described in the data access request or substantive modifications to the research project will require submission of a new application by completion of a new DUC, even if a new copy of the NIH Pediatric MRI Data Repository dataset is not required.

2. Public Posting of Approved Users Information (name, affiliation) and Research Use

In accordance with provisions for "Availability of Information" in the NIH Grants Policy Statement, I agree that, if I become an approved user, information about my proposed research use may be posted on a public website that describes the projects of approved users of the Pediatric MRI Data Repository. The information may include my name, my institution or organization, project name, a description of my research objectives, design and analysis plan, and a non-technical summary of the planned research.

3. FederalWide Assurance (FWA) and Human Subjects Review

My institution or organization is covered by a FederalWide Assurance (FWA) issued by the United States Department of Health and Human Services (HHS) Office of Human Research Protections, and I will comply with all applicable federal and state laws for the use of this data, which may include 45 C.F.R. Part 46. I understand that my institution may view this research activity as human subjects research requiring certain review or approval.  This review and approval may include Institutional Review Board (IRB) approval, exemption from IRB review, and/or a determination regarding whether or not human subjects are involved.  I will review this issue with appropriate institutional officials and follow all applicable human subject protections, if any.

4. National Institutes of Health (NIH) Commons Account

My institution is registered in the NIH electronic Research Administration (eRA) Commons and has provided me with a Commons user account.

5. Non-transferability

I will retain control over the data and, subject to applicable law, agree not to distribute the raw data in any form to any entity or individual other than my research staff who also agree to the terms within this DUC. I and my institution acknowledge responsibility for ensuring appropriate use of these data by research staff.

Any investigator from another institution with whom I may collaborate and who requires access to the data must complete an independent DUC before he/she may gain access to the data.

6. Change of Institution

If I change institutions and wish to take the data obtained from the NIH Pediatric MRI Data Repository with me, I will submit a new DUC in which the new institution acknowledges and agrees to the provisions of the DUC. If I change institutions and do not take the data with me, I will securely destroy all copies of the NIH Pediatric MRI dataset obtained under this DUC, including backup or working copies at the original site. Thus, I will not transfer the authorization to use the data to anyone else without obtaining permission from NIH.

7. Non-identification

I will not use the NIH Pediatric MRI Data Repository Dataset(s), or any other information, to identify or contact any individual Study participant, except as permitted by law (e.g., in connection with a separately negotiated collaboration with the original research team).

8. Non-Governmental Endorsement

I will not claim, infer, or imply U. S. Governmental endorsement of any research project, the entity or personnel conducting the research project, or any resulting commercial product(s).

9. Indemnification

I understand that although reasonable efforts have been taken to ensure the accuracy and reliability of the data in the NIH Pediatric MRI Data Repository, NIH does not and cannot warrant the results that may be obtained by using any data included therein. NIH disclaims all warranties as to the accuracy of the data in the NIH Pediatric MRI Data Repository dataset or the performance or fitness of the data for any particular purpose.

10. Possible Duplication of Research

I understand that other researchers have access to the NIH Pediatric MRI Data Repository and that duplication of research is a distinct possibility. I also understand that it is possible that the participants whose data are in the NIH Pediatric MRI Data Repository may also be participants in other studies so that there is no guarantee that all NIH Study Datasets that may be distributed are or will be mutually exclusive in terms of participants.

11. Research Use Reporting

If approved, I agree to provide a brief Progress Report summarizing the progress of the research specified in my data access request after one year, at which time a new DUC will be required for continued use of the Data Repository. The progress report is submitted in accordance with OMB#0925-0001 (Research and Research Training Grant Applications and Related Forms) and will include a brief update on the research, including the potential significance of any findings and plans for future research; any resulting scientific presentations with the name, bibliographic citation (if any) and submission date; any publications resulting from the use of data from the NIH Pediatric MRI Data Repository with the title, authors, bibliographic citation, and submission date of the publication; any breaches in data security (for example, accidental data distribution beyond approved users); and a brief description of any non-proprietary downstream intellectual property generated or intended to be generated as a result of using this data.

I am also invited to provide any general comments regarding the effectiveness of the NIH Pediatric MRI Data Repository, such as ease of access and use, appropriateness of data formats, challenges in complying with the NIH Pediatric MRI project policies, and suggestions for improving data access or use.

I will submit a progress report at the end of the approved one-year access period through a link on the website for submitting such reports or via an email to [email protected].

12. Publication of Abstracts and Acknowledgment of the NIH Pediatric MRI Project

If I publish abstracts using data from the NIH Pediatric MRI Data Repository, I agree to the following:

a. I will cite the NIH Pediatric MRI Data Repository and the NIH funding sources in the abstract as space allows.

b. I will include a reference to the specific version of the NIH Pediatric MRI Data Repository dataset analyzed.

13. Publication of Manuscripts and Acknowledgment of the NIH Pediatric MRI Project

If I publish manuscripts using data from the NIH MRI Pediatric MRI Data Repository, I agree to the following:

a. I will include the specific version number of the dataset used.

b. I will acknowledge the source of the data and the funding agencies by including a statement, such as the following:

“Data used in the preparation of this article were obtained from the NIH Pediatric MRI Data Repository created by the NIH MRI Study of Normal Brain Development. This is a multisite, longitudinal study of typically developing children from ages newborn through young adulthood conducted by the Brain Development Cooperative Group and supported by the National Institute of Child Health and Human Development, the National Institute on Drug Abuse, the National Institute of Mental Health, and the National Institute of Neurological Disorders and Stroke (Contract #s N01-HD02-3343, N01-MH9-0002, and N01-NS-9-2314, -2315, -2316, -2317, -2319 and -2320). A listing of the participating sites and a complete listing of the study investigators can be found at

http://www.bic.mni.mcgill.ca/nihpd/info/participating_centers.html

c. I will also include the following statement: “This manuscript reflects the views of the authors and may not reflect the opinions or views of the NIH.”

14. Notifying NIH of Publications

Upon acceptance for publication, I will notify the NIH as to when and where a publication of a report from any research using the Study Dataset(s) will appear. I will make this notification through a link on the website or via an email to [email protected].

15. Terms of Use and Termination

I understand that my approved use will remain effect for a one year period, after which I must reapply for continued access and use of the data. At the end of the period, if I have completed my active use of the data, e.g., publications have been submitted and accepted and there are no plans for continued analysis, I will securely archive the data in keeping with applicable law and institutional policies. However, if I wish to continue to analyze data and/or submit publications, I will reapply to maintain an active status for data access purposes.

16. Privacy Act Notification

I agree to provide the information requested below. I agree that information collected from me as part of this DUC may be made public in part or in whole for tracking and reporting purposes. This Privacy Act Notification is provided pursuant to Public Law 93-579, Privacy Act of 1974, 5 U.S.C. Section 552a. Authority for the collection of the information requested below from the recipient comes from the authorities regarding the establishment of the National Institutes of Health, its general authority to conduct and fund research and to provide training assistance, and its general authority to maintain records in connection with these and its other functions (42 U.S.C. 203, 241, 289l-1 and 44 U.S.C. 3101), and Section 301 and 493 of the Public Health Service Act. These records will be maintained in accordance with the Privacy Act System of Record Notice 09-25-0156 (http://oma.od.nih.gov/ms/privacy/pa-files/0156.htm) covering "Records of Participants in Programs and Respondents in Surveys Used to Evaluate Programs of the Public Health Service, HHS/PHS/NIH/OD." The primary uses of this information are to document, track, and monitor and evaluate use of the NIH Pediatric MRI Data Repository, as well as to notify recipients of updates, corrections or other changes to the database. I understand that I may have my contact information updated or removed from the system by making this request through the website.

I understand that the Federal Privacy Act protects the confidentiality of my NIH records. The NIH and any sites they designate to distribute the Pediatric MRI data will use the data collected from recipients for the purposes described above. In addition, the Act allows the release of some information in my records without my permission; for example, if it is required by members of Congress or other authorized individuals. I understand the information requested is voluntary, but necessary for me to obtain access to data.

By signing and dating the DUC, my Institutional Official and I certify our agreement to the NIH principles, policies and procedures for the use of NIH MRI Pediatric Data Repository dataset(s) as described in this document. We further acknowledge that we have shared this document and the NIH policies and procedures with any research staff who will use the NIH Pediatric MRI Data Repository dataset(s) and other appropriate institutional staff and officials.

17. Information Technology (IT) Security

I acknowledge the expectation that I will follow information security practices designed to keep the data that I receive from the NIH Pediatric Data Repository secure. Suggested “best practices” include the following:

a. Not attempting to override technical or management controls to access data for which I have not been expressly authorized.

b. Not using my trusted position and access rights to exploit system controls or access data for any reason others than in the performance of the proposed research.

c. Ensuring that anyone directed to use the system has access to, and is aware of, these information security best practices and all existing policies and procedures relevant to the use of the NIH Pediatric MRI Data Repository, including but not limited to, the policies at http://www.NIH-PediatricMRI.org and 45 CFR Part 46.

d. Maintaining a secure password policy which includes:

1) Choosing passwords of at least seven characters including at least three of the following types of characters: capital letters, lower case letters, numeric characters and other special characters.

2) Changing my password every six months.

3) Protecting my password from access by other individuals—for example, storing it electronically in a secure location.

e. Notifying NIH Pediatric MRI Data Repository staff, as permitted by law, at [email protected], of security incidents and incidents of suspected fraud, waste or misuse of NIH Pediatric MRI data and when access to the NIH Pediatric MRI Data Repository is no longer required.

f. Protecting the data, providing access solely to authorized researchers with permitted access to such data at my institution or to others as required by law.

g. Making sure the data are not exposed to the Internet or posted to a website that may be discovered by Internet search engines such as Google or MSN.

h. When downloading NIH Pediatric MRI data, downloading the data to a secured computer or server with strong password protection and avoiding or limiting the storage of data on a laptop or other portable medium.

i. If and when storing data on a portable device, encrypting the data. Most operating systems have the ability to natively run an encrypted file system or encrypt portions of the file system. (Windows = EFS or Pointsec and Mac OSX = File Vault)

j. For the computers hosting NIH Pediatric MRI data, ensuring that they have the latest security patches and are running virus protection software.

k. When leaving my office, closing out of data files or locking my computer.

l. Using a timed screen saver with password protection.

m. When finished using the data, destroying the data or archiving it securely for a required period of time and arranging for its destruction at a defined date, as permitted by law and institutional policies.

Form dated April 5, 2013

6