Skip to main content

Licensing Principles for Data from Human Sources

The purposes of Duke may be furthered by licensing certain data to third parties for use or study. Through such licensing arrangements, Duke believes data can be used to benefit society at large. This dissemination of data will be consistent with Duke’s efforts to promote open science.

Learn More about Policy

Frequently Asked Questions about Data Licensing

 This policy applies solely to data from human sources and biospecimens to the extent they retain associated phenotypic data. This includes, but is not limited to, DUHS patient records/clinical information and data whose creation and use fall under the jurisdiction of research ethics committees (for example, the DUHS IRB and campus IRB).  This policy does not apply to data that is not derived from human sources.

Yes, the Policy includes Duke University, its Schools of Medicine and Nursing, and DUHS, which includes DUHS’ affiliates such as the Duke PRMO, LLC, the Duke Integrated Network, Inc., and the Duke University Affiliated Physicians (Duke Primary Care).

All faculty, staff, and other persons receiving compensation from the University or DUHS for services rendered, as well as all research personnel, students and graduate assistants, whether compensated or not, who work on any research project under Duke control, and medical staff, whether compensated or not, who deliver clinical care in the context of DUHS are covered by this Policy and are, therefore “Covered Persons.”

This policy does not alter or amend the ownership interests that Duke or other persons have in data under other applicable policies, including the Duke University Policy on Intellectual Property Rights and the Policy on Research Records: Sharing, Retention, and Ownership. Nor does this policy alter or amend Duke’s policy for income sharing for inventions covered under the Policy on Inventions, Patents, and Technology Transfer.

Identifiable human source data should not be shared or licensed outside of Duke without first reviewing the request with ORC. All licensed human source data must be de-identified, specifically, removal of the 18 identifiers, in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Safe Harbor (DUHS De-Identified Protected Health Information Policy) or configured as a limited data set in accordance with HIPAA (DUHS Uses and Disclosures Involving Limited Data Sets Policy).

Pursuant to Duke’s Policy on Research Records: Sharing, Retention, and Ownership, the primary owner of all research records is the University. Research records include, by way of example but not limitation, material contained in research notes, laboratory notebooks, and in other media such as computer disks and instrument printouts.

Significant research materials or products generated by any research are also part of the research record.


A Duke employee who contributes individually identifiable creativity, ingenuity, and intellectual effort to the data collection or curation that gives the data its licensable value. However, if your daily job requires the application of these qualities you may not be a Data Enhancer.

Generally, clinicians or faculty members who collect clinical trial data in the routine delivery of clinical care or as part of their daily job responsibilities will not be considered a Data Enhancer, unless the individual makes a significant creative and intellectual contribution to the data that gives it its licensable value.

For example, if the clinical trial is Investigator-initiated and is determined to include individually identifiable creativity, ingenuity and intellectual effort to the data collection or curation (beyond the protocol) that gives the data its licensable value; a Covered Person who meets this standard would be considered a Data Enhancer.

The Data Licensing Committee will conduct its own diligence as to whether an individual will be considered a Data Enhancer and, if so, whether other Duke community members also meet the standard. This diligence may include interviewing individuals involved in the collection and compilation of the data.

Data created, collected and/or stored in the standard operations of Duke, including, for example, the routine delivery of clinical care; or, Data to which ingenuity and creativity have been applied, but the Duke role or job position specifically requires the application of such qualities to the daily work of the Duke faculty and staff member.

For Example, Regulatory Data From An IND, Data In Support Of The Patent Application, Etc.

Income resulting from licenses where data are included or contemplated as part of an intellectual property license will be shared according to the Policy on Inventions, Patents, and Technology Transfer and no additional income share will be given under this policy.

No, Duke does not sell human source data. In certain circumstances, Duke may license human data to third parties. Human source data licensed in this matter must either be de-identified or configured as a limited data set and may be licensed pursuant to a HIPAA permitted purpose.


Generally, faculty contact the Office of Translation & Commercialization directly to begin the process of licensing human data. If you have human source data that has licensable value, however, the University may decide to license that human data without your approval, after review of your concerns with the Data Licensing Committee.


Generally, the Office of Translation & Commercialization, in consultation with the Data Licensing Committee, will determine the financial terms of the data licensing agreement. These may be determined using benchmarks from prior agreements, determination of the costs for reproducing such data, and other inputs.

Sharing of human source data among colleagues at Duke in accordance with Duke policies is permitted and encouraged. Clinical data, including EHR data, must be maintained within approved Duke Health computing environment. Please contact Duke Health ACE with any questions or requests for access to clinical data.

Sharing of human source data outside of Duke with academic colleagues for research purposes is also encouraged, but should be managed under Duke Health and HIPAA compliance procedures. Generally, an appropriate agreement will be negotiated by the Office of Research Contracts.

Typically, these agreements are managed by DU procurement. If you have questions, please contact Dean Freck in the University Procurement Office.

For release  of Human Source Data To A Public Database For Future Non-Duke And Duke Research Purposes (Research) Or Clinical Purposes Including, But Not Limited To, Establishing Quality Metrics And/Or Benchmarking Patient Outcomes And Clinical Effectiveness (i.e., Quality Improvement)(Clinical Registries)?

Please contact  Susan Hayden, J.D from the Office of Research Contracts

Potentially yes, but the license would need to be reviewed by the Data Licensing Committee. Duke’s Office of Scientific Integrity (DOSI) is represented on the Data Licensing Committee. DOSI would address potential conflict of interest concerns, including creation of any applicable conflict of interest management plan.


Yes, either under the terms of your sponsored research agreement negotiated by a SOM central administration office (most likely Office of Research Contracts) or under a license negotiated by the Office of Translation & Commercialization. However, it is unlikely you would be considered a Data Enhancer in this situation.

Duke’s strong preference is that human source data is de-identified or configured as limited data set, as such terms are defined by HIPAA, and licensed non-exclusively and without the right to sublicense or to provide the data to another third party. The Data Licensing Committee will review special circumstances and determine exemption.

If a Data Enhancer is identified, Net Revenue shall be shared as follows: 30% to the Data Enhancer; and remaining apportioned among Duke entities.

If there is no Data Enhancer, Net Revenue is apportioned among Duke entities.

If an individual does not agree with a decision pursuant to this Data Licensing policy, the individual may request to attend the Data Licensing Committee to discuss the decision. The individual may subsequently review the decision with the Chancellor for Health Affairs and/or University Vice President of Research.  If the individual does not agree with the reviews, such individual may appeal a decision to the President of the University or the President’s designee(s). Within ten business days after the President’s decision, any person aggrieved by the application of this policy may proceed as of right to binding arbitration before a single arbitrator pursuant to the commercial arbitration rules of the American Arbitration Association. Each party shall bear its own costs in connection with the proceedings; but in the event, an Arbitrator finds that a party has proceeded in bad faith, the Arbitrator may award costs and expenses (including attorneys’ fees) to the other party.

In cases where a sponsor is paying for the collection of human data, it is unlikely you would be considered a Data Enhancer. Those agreements would be handled by the Office of Research Contracts. Contact: Susan Hayden, J.D., Office of Research Contracts

View More Resources

Visit our Resource Page