From Silos to Federation: Five Working Papers Challenging the Next Generation of NIH Data Sharing

The 2024 updates to NIH's genomic data-sharing requirements marked the most significant revision of the policy framework in nearly a decade, mandating earlier submission of genomic data plans and tightening expectations around informed consent for data deposited in NIH-designated repositories. But the policy conversation has not paused. A steady stream of working papers, preprints, and comment letters is now debating what the next revision cycle should contain.

The Institute has reviewed a cross-section of this emerging literature. What follows are five proposals worth tracking, the constituencies behind them, and their practical implications.

1. Codifying Tribal Sovereignty in Data Governance

The most persistent critique of federal data-sharing policy concerns Indigenous data. Working papers from Native bioethics scholars and organizations such as the Native BioData Consortium argue that NIH policy should recognize tribal nations as governing authorities over genomic data originating from their citizens—not merely as stakeholders to be consulted.

Proposals include requiring researchers to obtain tribal institutional review approval before depositing data from tribal members into NIH repositories, and creating a pathway for tribes to host data in tribally controlled repositories that NIH recognizes as functionally equivalent.

What it would mean in practice: Researchers recruiting in partnership with tribal nations would face an additional, meaningful approval layer. In exchange, tribes would gain enforceable control over a data class that has historically been extracted without benefit. Expect this issue to feature prominently in any future Request for Information.

2. Federated Queries as an Alternative to Centralized Deposit

A second cluster of papers challenges the repository model itself. Rather than moving genomic data to centralized databases, federated architectures would allow approved researchers to run queries against data held at its source—institution, hospital, or consortium—returning only aggregate results.

Proponents, including several large academic medical centers and informatics consortia, argue that federation reduces re-identification risk, eases consent management, and keeps data within local governance frameworks. Skeptics counter that federation can entrench well-resourced institutions, complicate reproducibility, and make auditing data quality harder.

What it would mean in practice: A hybrid model is the likeliest outcome: centralized repositories for smaller studies, federated access for large health systems. Policy language would need to clarify what constitutes compliance when data never changes hands.

3. Standardizing Consent Across Repositories

Consent is the quiet bottleneck of genomic data sharing. Working papers from genomics policy centers document wide variation in how consent language is interpreted when data moves between repositories, and propose a machine-readable consent standard—structured fields indicating, for example, whether data may be used in commercial research or recontacted participants.

Stakeholder support is broad but not universal. Patient advocacy organizations have largely welcomed the transparency; some commercial entities worry about the compliance burden.

What it would mean in practice: Investigators would tag datasets with standardized consent attributes at deposit, and repository access systems would enforce them automatically. The administrative lift is front-loaded; the downstream benefit is fewer consent violations.

4. Revisiting the De-identification Assumption

Several recent papers argue that NIH policy relies on an increasingly fragile premise: that de-identified genomic data is adequately protected. Genomic data is inherently identifying, and as reference panels grow, re-identification attacks become more feasible. Comment letters from security researchers propose mandatory access auditing, encryption-at-use for sensitive analyses, and periodic re-assessment of what counts as de-identified.

What it would mean in practice: Repositories would invest in tiered security and audit infrastructure; researchers would face stricter credentialing for controlled-access data. Costs would rise modestly; trust in the system would, ideally, rise more.

5. Benefit-Sharing and Participant Return of Results

Finally, a set of papers addresses a normative question: what do participants owe, and what are they owed? Proposals range from mandatory summary-results return to more ambitious frameworks for acknowledging data contribution in publications and, in some formulations, negotiating benefit-sharing with communities from which data derives.

What it would mean in practice: Principal investigators would budget for results-return infrastructure; repositories would track provenance and community agreements alongside consent status.

The Road Ahead

None of these proposals will be adopted wholesale, and several cut against one another—federated architectures and centralized consent enforcement, for instance, pull in different directions. But taken together, the working papers signal a field moving beyond the question of whether to share genomic data toward the harder question of how to share it justly, securely, and sustainably.

The Institute will continue tracking comment letters and policy dockets as NIH's implementation proceeds.