Table 5 Potential functions of the governing body suggested by participants.

Data Use

Establish principles of operation of the community

Make project-wide decisions regarding appropriate use of data and tissue (rules of engagement)

Establish uniform position on data ownership and intellectual property

Set standards for assuring data integrity

Establish common guidelines on professional credentials needed to access specific types of data

Oversee the "joining" of organizations

Review privacy laws and research ethics guidelines for potential foreign partners before entry

Community-Wide IRB Functions

Provide community-wide assurance that all repositories have appropriate IRB review

Establish common Data Safety Monitoring Plans agreeable to constituent IRBs

Act as a community-wide Data Safety Monitoring Board

Establish standards for Human Subjects Research (HSR) and HIPAA training; require institutions to assess own training modules; publish results to community

Provide guidance on common consent form language across caBIG

Random checks of user publications to determine whether data use appropriate to protocol

Risk Assessment

Establish common levels of data risk and identify security mechanisms appropriate for risk level

Provide centralized statistical assurance of minimal risk of re-identification for systems

Establish Security Policies and Processes

Prevent and police abuse

Establish common guidelines for provisioning and de-provisioning users

Establish requirements for monitoring credentialing process and assess incoming progress reports

Establish standards for authorization

Set minimum standards for physical security

Set standards for what users will have to agree to do and not do

Audit and Oversight

Aggregate audit information and provide reports back to member institutions

Monitor compliance with established and agreed upon processes

Periodic checks of whether the data which is supposed to be de-identified is REALLY de-identified

Investigation of security incidents

Reporting and Enforcement

Establish enforcement policy for sanctioning of organizations or individuals who misuse resource

Report misuse to OHRP, ORI and funding agency when necessary

Issue federation-wide reports of security incidents

Maintain federation "No Fly" list of researchers not permitted access anymore from any institution

Mediation

Mediate disputes between organizations

Accept requests to appeal decisions at local institutions (for example termination of access)

Build Trust within the Community

Build trust among institutions that data will be used appropriately

Build trust in veracity of user identities

External Standards and Best Practices

Set external standards participating institutions must meet (e.g. CLIA approval of tissue-banks)

Seek out and publicize community-wide best practices

Strategic Role

Establish goals for the entire project and ensure that operation is in keeping with those goals

Monitor new regulations coming from the federal government and address relevance to sites

Assess and address weaknesses of the collaborative research environment

Address novel problems