The All of Us Research Program requires authorized users of the All of Us data to conduct research that follows and conforms to all data use policies. Data users should read, understand, and follow the full policies below. For your convenience, policies are available for download, with links provided below. Additionally, this 10-minute video from our policy team provides an overview of our data policies and how to conform to our data sharing policies when publishing.
Should you have questions regarding any policy in whole or part, please contact the Help Desk (email@example.com) for further assistance.
Data User Code of Conduct (DUCC)
The All of Us Data User Code of Conduct is read and signed by all researchers when registering for access to the Researcher Workbench and outline the responsibilities and ethical guidelines for researchers accessing program data. Users must adhere to core values, comply with laws and regulations, respect participant privacy, and use the data solely for biomedical or health research. The DUCC also emphasizes responsible handling of external data, prohibits discriminatory research, and sets restrictions on sharing, publishing, or redistributing participant-level data without explicit permission.
The following companion articles provide guidance on fulfilling the workspace description requirements and importing data into the Workbench so it conforms to the DUCC.
- Sample Workspace Description
- How to Comply with All of Us Policies when Importing Data into the Researcher Workbench
Data and Dissemination Policy
Per our Data and Dissemination Policy:
- No participant count of 1 to 20 can be published or distributed directly (a count of 0 is permitted); and
- No data or statistics can be reported that allow a participant count of 1 to 20 to be derived from other reported cells or information, including in text, tables, or figures. This includes the use of percentages or other mathematical formulas that in combination would allow an individual to deduce a participant count of less than 20.
This policy permits data users who wish to report data or aggregate statistics that correspond to fewer than 20 participants to obscure these values using scientifically accepted strategies, including collapsing data across cells, coarsening data, or cell suppression. More information about acceptable strategies and how to employ them can be found in this accompanying article.
If data users have a compelling reason to justify directly publishing or disseminating data or aggregate statistics that correspond to a participant count of less than 20, they may submit a request to the program for an exception. Please note that exceptions will be rare.
Publication and Presentation Policy
The All of Us Research Program emphasizes transparency and recognition of participant contributions in disseminating research results, which are outlined in the Publication and Presentation Policy. Researchers using All of Us data are required to submit final versions of peer-reviewed manuscripts to PubMed Central for immediate public access without an embargo and must inform the program of upcoming publications or presentations at least two weeks in advance. Presentations and publications must also adhere to our Data and Dissemination Policy with counts of 20 being censored according to suggested guidelines.
Stigmatizing Research Policy
The All of Us Research Program acknowledges the importance of preventing the misuse of collected resources for social detriment and aims to establish a working definition of stigma. Stigmatizing research, defined as any project with the potential to instigate marginalization, discrimination, or loss of status, can result from biased research design or the interpretation of findings that promote negative stereotypes. The program commits to taking steps to prevent such research and to address any intentional or unintentional instances that may arise from the use of its data resources. These are described further in our Stigmatizing Research Policy.
Ethical Conduct of Research Policy
The All of Us Research Program is dedicated to inclusivity and ethical research practices as described in our Ethical Conduct of Research Policy, acknowledging sensitivities in conducting research involving diverse participants. Adhering to the Federal Policy for the Protection of Human Subjects (The Common Rule), the program emphasizes three ethical principles: respect for persons, beneficence, and justice. Respect for persons entails treating participants as autonomous agents, particularly protecting vulnerable populations. Beneficence requires safeguarding participants' well-being, balancing potential benefits and risks ethically. Justice demands fair distribution of benefits and harms, emphasizing ethical inclusion and exclusion criteria and considering downstream effects. While All of Us scientific resources don't involve direct participant contact, researchers are expected to follow ethical principles to ensure fair treatment, minimize harms, and distribute benefits equitably, aligning with the core values of the program.
User Appeals Policy
The All of Us Research Program Data User Code of Conduct requires data users to establish a project workspace for each unique research project. Each project workspace, in turn, must bear a “meaningful and accurate description of [the] research purpose” and are subject to review upon public or user request or during periodic audits of the Research Hub. The All of Us Resource Access Board (RAB) will determine whether the workspace project is compliant with the DUCC and recommend corrective or enforcement action. In some instances, data users may disagree with RAB determinations. In these situations, data users may lodge an appeal as outlined in the User Appeals Policy.
Data Access Framework
The Data Access Framework describes the framework by which individuals will access All of Us data resources. Salient features include:
- The framework is inclusive; in particular, data will be accessible by citizen and community scientists and individuals conducting research outside of academic medical centers.
- There will be three tiers of data access: public data (no login required); registered data (login required); controlled data (additional approval required).
- Authorization for access to the registered and controlled data tiers will be user based, rather than project-based. Authorized users will receive a “data passport.” A data passport is required for access to the registered and controlled data tiers and to set up workspaces to carry out research projects .
- As one of the first steps in initiating an All of Us registered and controlled tier project and setting up a workspace, users will be required to submit a description of their project. These descriptions will be made public and searchable for auditing purposes to facilitate public engagement.
Egress Alert Policy
An egress alert will be issued when a registered researcher violates certain security policies put in place by the All of Us Research Program’s Data and Research Center (DRC), which is detailed in this policy. The most common reason an egress alert is triggered is through an attempt to download data from the Researcher Workbench (accidental or intentional); however, there are several other types of events that can cause an alert, such as: error messages, large queries, downloading summary data that is larger than the threshold (summary data is allowed to be downloaded, but row level data is not), or large notebooks (which are typically caused by large outputs). If you're using a large notebook that has triggered the alert, please use this article to clear outputs without opening them again.
- AoU_NAT_RW-Publications-Checklist.pdf100 KB
- Data User Code of Conduct V5 - 20231031.pdf300 KB
- AoU_Data_Access_Framework_508.pdf400 KB
- AoU_Policy_User_Appeals_508.pdf200 KB
- AoU_Policy_Stigmatizing_Research_508.pdf60 KB
- AoU_Policy_Publication_and_Presentation_508.pdf200 KB
- AoU_Policy_Ethical_Principles_508.pdf200 KB
- AoU_Policy_Data_and_Statistics_Dissemination_508.pdf200 KB