Guidance on access and use of dbGaP data

The National Center for Biotechnology Information (NCBI) manages a data repository known as the “database of Genotypes and Phenotypes” or “dbGaP.” The function of this data repository is to archive and distribute data developed from studies that investigate relationships between genotypic and phenotypic information in humans.

Process for requesting access to dbGaP datasets

Investigators who are permanent employees of Duke and eligible to serve as a Principal Investigator (PI) at Duke, may request access to dbGaP datasets for research purposes. The following process is in place for Duke investigators interested in requesting access to use dbGap data:

1. The investigator creates a project and follows the steps to complete and submit the online application through the dbGaP Authorized Access System as a “Principal Investigator” using their eRA Commons account.
   • Investigators who do not already have an eRA Commons account should work with the grant managers to initiate account set up.
2. The application routes to a Duke Institutional Signing Official (Office of Research Support for Campus/Provost Area investigators; Duke Office of Scientific Integrity for School of Medicine and Nursing investigators) to approve the proposal submission once steps 4 and 5 are complete.
   • If the appropriate Signing Official is not listed, then they won't be able to view the Data Access Request.
   • The information for the appropriate Signing Official is provided in the REDCap intake form (linked in step 3 below) after you select your entity.
3. To initiate Duke's review of the application, the investigator (or their representative) submits a request via this REDCap form. To complete the form, the following information is needed:
   • NetID and email address of all internal collaborators who will have access to the downloaded data
   • Datasets being requested, including version numbers for datasets
   • The dbGaP project number
4. The Duke Institutional Signing Official will coordinate with the investigator on requirements, which include:
   • The PI and all internal collaborators completing or refreshing the completion of the "dbGaP Data Use Compliance Training (00196907)" in the Learning Management System:
     • https://duke.sabacloud.com/Saba/Web_spf/NA7P2PRD024/app/me/learningeventdetail;spf-url=common%2Fledetail%2Fcours000000000019354%3Freturnurl%3Dcatalog%252Fsearch%253FsearchText%253Ddbgap%2526selectedTab%253DLEARNINGEVENT%2526filter%253D%25257B%25257D&context%3Duser&learnerId%3Demplo000000000335539
   • Attestation of compliance with all data terms and conditions
     • This Compliance Certification Form is sent out to all Internal Collaborators automatically upon completion of the REDCap form based on email addresses entered in intake. They have subject lines that begin "SIGNATURE REQUIRED".
   • Confirmation from IRB that dbGaP is listed as a source in the iRIS record.  
5. Once approved by the Duke Institutional Signing Official, the NIH reviews and authorizes approval to access the date. The investigator may then access the dataset through the dbGaP Authorized Access System.
   • The request may still be denied by dbGaP for a number of reasons. In most cases the above steps do not need to be repeated.

Storage of dbGaP Data

Please note that as of January 25, 2025, the National Institutes of Health (NIH) requires that all approved users of NIH controlled-access genomic data repositories, like dbGaP, secure their data in systems that comply with NIST SP 800-171. This requirement applies to all new or renewed Data Use Certifications. Please use this link for more information about the policy change. The NIH has drafted NIH Security Best Practices for Controlled-Access Data Subject to the NIH Genomic Data Sharing (GDS) Policy here. Data needing these controls must be stored in PACE (SOM) or the PNR (campus). Please email researchdatasupport@duke.edu for more information.

Need help?

• Contact researchdatasupport@duke.edu