If you collaborate with other individuals or organizations, a written agreement may be needed to protect the research and define each party’s responsibilities. FSU uses the Research Administration Management Portal (RAMP) to review and process research-related agreements.

RAMP includes standardized templates for Data Use Agreements and other research agreements. The Clinical Research Hub can help identify the likely agreement type and assist with submission. For system guidance, use the RAMP Help Center or review the RAMP Agreements FAQs.

Data Use Agreements: What Researchers Need to Know

A Data Use Agreement, or DUA, is a contract that sets the rules for receiving, sharing, using, protecting, and disposing of non-public data. Its purpose is to ensure FSU and the other organization understand their responsibilities before exchanging data.

You may need a DUA if:

• FSU will receive non-public or restricted data from another organization
• FSU will provide non-public or restricted data to an outside party
• The data provider places conditions on access, use, publication, sharing, retention, or destruction
• The data include confidential business information, student records, human-subject research data, restricted databases, or a HIPAA limited data set

If the data include health information

Protected health information, or PHI, is identifiable information about a person’s health, health care, or payment for care that is held or transmitted by an organization subject to HIPAA. A DUA may set safeguards and use restrictions, but it does not by itself authorize research use or disclosure of PHI. IRB, privacy, security, and other HIPAA requirements may also apply.

A HIPAA limited data set is still PHI even though specified direct identifiers have been removed, and a DUA is required before it is disclosed for research, public health, or health care operations. Data that meet HIPAA de-identification standards are not PHI, but other contractual, institutional, ethical, or security restrictions may still apply.

A DUA may not be the only agreement

Depending on the project, data-use terms may be included in another agreement, or more than one agreement may be needed. Examples include a clinical trial agreement, subaward, services agreement, Business Associate Agreement, confidentiality agreement, or material transfer agreement. IRB approval or a study protocol does not replace institutional review of the data transfer.

What researchers should do

1. Pause before exchanging data. Do not transfer, access, or share the data until the appropriate reviews and agreements are complete.
2. Gather the basics. Be ready to describe the data source, data elements, identifiers, purpose, users, storage system, and retention period.
3. Submit through RAMP Agreements. Start early so FSU can determine the appropriate agreement and any required IRB, privacy, information security, export-control, or other review.
4. Wait for institutional signature. Researchers should not sign agreements on behalf of FSU.

Not sure where to start?

Contact the Clinical Research Hub for help identifying the likely agreement type and preparing a RAMP submission, or email RAMP-Agreements@fsu.edu. You may also review the RAMP Agreements FAQs.