Data User Code of Conduct

Please click here for a downloadable .pdf version.

Terms of Use

As an Authorized Data User of the All of Us Research Program data, I will:

• Read and adhere to the All of Us Research Program Core Values.
• Follow all laws and regulations regarding research involving human data and data privacy that are applicable in the area where I am conducting research.
  • In the United States, this includes all applicable federal, state, and local laws.
  • Outside of the United States, other laws will apply.
• Conduct research that follows all policy requirements, including those not expressly mentioned in this document, and conforms to the ethical principles upheld by the All of Us Research Program.
• Respect the privacy of research participants at all times.
  • I will NOT use or disclose any information that directly identifies one or more
    participants.
    • If I become aware of any information that directly identifies one or more
      participants, I will notify the All of Us Research Program immediately by
      emailing support@ResearchAllofUs.org.
  • I will NOT attempt to re-identify research participants or their relatives.
    • If I unintentionally re-identify participants through the process of my work,
      I will contact the All of Us Research Program immediately by emailing
      support@ResearchAllofUs.org.
    • If I become aware of any uses or disclosures of All of Us Research
      Program data that could endanger the security or privacy of research
      participants, I will contact the All of Us Research Program immediately by
      emailing support@ResearchAllofUs.org.
  • I will NOT disclose identifiable, sensitive information about any participant to any individual who is not an Authorized Data User.
    • This includes in response to a request from law enforcement or during
      any legal, administrative, legislative, or other proceeding.
• Read and comply with All of Us Research Program policies pertaining to the respectful use of data from individuals or groups who self-identify or are otherwise identified as American Indian and/or Alaska Native.
• Use the All of Us Research Program data ONLY for the purpose of biomedical or health research.
• Provide a meaningful and accurate description of my research purpose every time I create a Workspace.
  • Within each Workspace, I will use the All of Us Research Program data only for the research purpose I have provided.
  • If my research purpose changes, I will make appropriate amendments to my Workspace description in a timely fashion.
  • If I have a new research purpose, I will create a new Workspace and provide a new description.
• Take full responsibility for any external data, files, or software that I import into the All of Us Researcher Workbench and the consequences thereof.
  • I will follow all applicable laws, regulations, and policies regarding access and use of any external data, files, or software that I upload into my Workspace.
  • I will NOT upload data or files containing personally identifiable information (PII), protected health information (PHI), or identifiable private information (IPI) into my Workspace.
  • I will NOT use external data, files, or software that I upload into my Workspace for any malicious purposes.
  • If any import of data, files, or software into my Workspace results in unforeseen consequences and/or unintentional violation of these terms, I will notify the All of Us Research Program by emailing support@researchallofus.org as soon as I become aware.
    
• Use a version of the All of Us Research Program database that is current at or after the time I establish my Workspace.
• Inform the All of Us Research Program using the Misconduct Reporting Form if:
  • I have been penalized in the past for one or more instances of research and/or
    professional misconduct; or
  • Subsequent to becoming an All of Us Authorized Data User, I am penalized by
    another entity for research and/or professional misconduct.

As an Authorized Data User of the All of Us Research Program data, I will:

• NOT share my login information with anyone, including another Authorized Data User.
  • I will NOT create any group or shared accounts.
• NOT use All of Us Research Program data or any external data, files, or software that I upload into the Researcher Workbench for research that is discriminatory or stigmatizing of individuals, groups, families, or communities, in accordance with the All of Us Policy on Stigmatizing Research.
  • I will contact the All of Us Resource Access Board (RAB) by emailing
     aouresourceaccess@od.nih.gov for further guidance on this point as needed.
• NOT attempt to contact All of Us Research Program participants.
• NOT take screenshots of or attempt in any way to copy, download, or otherwise remove any participant-level data from the All of Us Researcher Workbench.
  • I will NOT publish or otherwise distribute any participant-level data from the All of Us Research Program database.
  • I will NOT publish or otherwise distribute any data or aggregate statistics corresponding to fewer than 20 participants unless expressly permitted under the terms of the All of Us Data and Statistics Dissemination Policy.
    
• NOT redistribute or publish any data or statistics with the intent of reproducing the All of Us Research Program database or part of the database outside of the All of Us Researcher Workbench.
• NOT attempt to link Registered or Controlled Tier All of Us Research Program data at the participant level with participant-level data from other sources without the explicit, documented permission of the All of Us Research Program.
  • I will apply for such permission from the RAB by emailing aouresourceaccess@od.nih.gov.
    
• NOT use All of Us Research Program data or any part of the Research Hub for marketing purposes.
• NOT represent that the All of Us Research Program endorses or approves of my research unless the All of Us Research Program expressly provides such endorsement in writing.
• NOT use the ALL OF US wordmark or stylized mark in connection with my or any other person’s or entity’s product(s) or service(s).
• NOT adopt, incorporate, use, or seek to register any mark or trade name confusingly similar to or suggestive of the ALL OF US wordmark or stylized mark.

Data Disclaimer

The All of Us Research Program does not guarantee the accuracy or availability of the data in the All of Us Research Program database; guarantee the performance of the software in the All of Us Research Program database; or warrant or endorse the research results obtained by using the All of Us Research Program database.

Signature Section

I (Authorized Data User) have personally reviewed this Data User Code of Conduct. I agree to follow all terms of use described therein.

By entering my initials next to each statement below, I acknowledge that:

• My work, including any external data, files, or software I upload into the Researcher Workbench, will be logged and monitored by the All of Us Research Program to ensure compliance.
• My name, affiliation, profile information, and research description will be made public. My research description will be used by the All of Us Research Program to provide participants with meaningful information about the research I conduct with the All of Us research resources.
• The All of Us Research Program retains the discretion to make decisions at any time about my access, including the provision or revocation thereof, that take into account any research and/or professional misconduct for which I’ve been penalized in the past or that I may commit or am found to have committed subsequent to becoming an All of Us Authorized Data User.

I acknowledge that failure to comply with the requirements outlined in this Data User Code of Conduct may result in termination of my All of Us Research Program account and/or other sanctions, including, but not limited to:

• The posting of my name and affiliation on a publicly accessible list of violators, and
• Notification of the National Institutes of Health or other appropriate entities about my actions.

I understand that failure to comply with these requirements may also carry financial or legal repercussions. Any misuse of the All of Us Research Hub, Researcher Workbench, or data resources is taken very seriously, and other sanctions may be sought.

Authorized Data User Name

UserID

Date

Definitions

All of Us Research Program:

A national longitudinal research initiative that aims to engage at least one million participants living in the United States. Participants contribute health data and specimens (blood, urine, saliva) to a repository that includes health, behavioral, genomic, and other data. The All of Us Research Program is a key component of the Precision Medicine Initiative, which aspires to leverage advances in genomics and health information technology to accelerate biomedical discoveries.

All of Us Researcher Workbench:

The cloud-based research platform that the All of Us Research Program has created, where individuals can register to become Authorized Data Users and create project specific Workspaces through which they may access and analyze the data.

All of Us Research Hub:

The collection of All of Us Research Program resources made available on researchallofus.org.

All of Us Resource Access Board (RAB):

The board that operationalizes decisions regarding resource access, including data access. Its responsibilities include overseeing registration procedures for new Authorized Data Users, conducting Workspace audits, responding to Authorized Data User inquiries around compliance with the All of Us research resources terms of use, and reviewing potential violations of said terms.

Authorized Data User:

A person who is authorized to access and/or work with Registered or Controlled Tier data from the All of Us Research Program.

To become an Authorized Data User, individuals must:

• Ensure they are covered by an institutional Data Use and Registration
  Agreement (DURA), as applicable;
• Verify their identities;
• Complete the All of Us Responsible Conduct of Research Training;
• Read and acknowledge this Data User Code of Conduct; and
• Complete all other required steps in the Authorized Data User onboarding
  process.

Data Access Tiers:

Curated iterations of the All of Us Research Program participant data made accessible for biomedical and health research through the All of Us Researcher Workbench. Data access tiers are distinguished from one another predominantly by access requirements and the type and level of obfuscation of the included data.

• Public Tier: A data tier containing only summary statistics and aggregate information about the All of Us participant cohort. The Public Tier can be accessed by anyone; it does not require Authorized Data User credentials or logging into the All of Us Researcher Workbench.
• Registered Tier: A data tier containing a limited set of individual-level participant data–including data from electronic health records, wearables, and surveys, as well as physical measurements taken at the time of participant enrollment–that are subjected to a greater level of privacy-preserving generalization and obfuscation than data in the Controlled Tier. The Registered Tier can only be accessed by Authorized Data Users who log in to the All of Us Researcher Workbench.
• Controlled Tier: A data tier containing more granular, minimally obfuscated individual-level participant data. The Controlled Tier includes additional, more sensitive data elements, such as genomic data, that build upon those available in the Registered Tier. Like the Registered Tier, Controlled Tier access requires Authorized Data Users to log in to and interact with the data through the All of Us Researcher Workbench.
  

Identifiable Private Information (IPI):

Private information for which the identity of the subject is or may readily be ascertained by the investigator or associated with the information (45 CFR § 46.102).

Identifiable, Sensitive Information:

Information that is about an individual and that is gathered or used during the course of research, and A) through which an individual is identified; or B) for which there is at least a very small risk, as determined by current scientific practices or statistical methods, that some combination of the information, a request for the information, and other available data sources could be used to deduce the identity of an individual (adapted from 42 U.S.C. § 241(d)(4)).

Marketing:

To make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service (45 CFR §164.501).

Personal Identifying Information (PII):

Information that can be used to distinguish or trace the identity of an individual (e.g., name, Social Security number, biometric records, etc.), either alone, or when combined with other personal or identifying information that is linked or linkable to a specific individual (2 CFR § 200.1).

Professional Misconduct:

Harassment, discrimination, or other inappropriate conduct– including but not limited to sexual harassment, racial discrimination, intimidation, bullying, and other unproductive, disruptive, and/or violent behaviors–committed within or in a manner that directly impinges upon the work environment. For more information on supporting a safe and respectful workplace, please find additional resources here.

Protected Health Information (PHI):

Individually identifiable health information that is transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium (45 CFR § 160.103).

Research Misconduct:

Fabrication, falsification, or plagiarism in proposing, performing, or reviewing research, or in reporting research results (42 CFR § 93.103), or other instances of academic or scientific misconduct including but not limited to data use violations, data management incidents, institutional policy violations, or legal or regulatory violations pertaining to the conduct of research.

Workspace:

A user-created analytical sandbox within the All of Us Researcher Workbench where users can virtually pull in subsets of data from the All of Us Research Program database and perform analyses; Authorized Data Users must create a new Workspace for each research project using All of Us data and provide a plain language description of the research project, as well as other project information, that will be published publicly in the All of Us Research Projects Directory.