Medical Research Data Transfer: Secure Collaboration

Medical research data transfer means moving de-identified or limited datasets between academic medical centers, coordinating centers, core labs, and public repositories while honoring the Common Rule (45 CFR 46), HIPAA's research exceptions, GDPR Article 89 safeguards for scientific research, and the specific Data Use Agreement governing the study. The files range from a 5 MB REDCap export to a 2 TB genomics BAM archive, and the transfer method changes accordingly — Globus for the genomics, an IRB-approved secure portal for the limited dataset, an encrypted web transfer for the ad-hoc chart reviews that fall between those categories.

The Data Use Agreement Sets the Rules

Before a byte moves, the DUA between institutions dictates what's allowed. A typical multi-site study DUA specifies:

• Data elements included (date shift rules, zip code truncation to 3 digits, age capping at 89)
• Storage requirements at the receiving site (encrypted at rest, access-controlled)
• Transfer method (SFTP over VPN, SCP with public-key auth, approved web portal)
• Re-identification prohibition and small-cell suppression rules
• Publication review period before release
• Destruction date and method

When the DUA says "transfer via the sponsor's designated secure portal," you use that portal even if it's slower than your institution's Globus endpoint. When the DUA is silent on method, you fall back to your institution's IRB-approved mechanisms. Don't invent a workflow between institutions.

De-Identification Tiers in Research

HIPAA recognizes three categories:

1. Fully de-identified data (45 CFR 164.514(b)) — either Safe Harbor (remove 18 identifiers) or Expert Determination (statistical opinion of very small re-identification risk). Outside HIPAA once de-identified.
2. Limited Data Set (45 CFR 164.514(e)) — removes most identifiers but keeps dates and geographic detail smaller than state. Requires a Data Use Agreement. Still PHI.
3. Coded data with linkage key held at originating site — technically still PHI at the originating site, but the coded dataset at the receiving site may qualify as de-identified under specific circumstances.

Most multi-site research runs on Limited Data Sets. Date of admission matters. Geographic region matters. Age in years matters. Transfer workflows have to treat these as regulated data — not as open-science datasets ready for GitHub.

NIH Data Management and Sharing Policy

Since January 2023, the NIH Data Management and Sharing Policy (NOT-OD-21-013) requires a DMS plan for every funded study. Plans specify how data will be shared, where (dbGaP, NIMH Data Archive, the National Sleep Research Resource, etc.), and when.

For genomics data, dbGaP's controlled-access tier has specific transfer requirements: Aspera for high-speed upload, pre-approved institutional signing authority, two-factor authentication. For clinical trial data, ClinicalStudyDataRequest.com and Vivli require structured metadata and specific file formats.

If your DMS plan says "data will be shared via Vivli within 12 months of study completion," your transfer workflow has to produce Vivli-ready packages on schedule. Plan the pipeline, don't scramble at submission.

Genomics Scale: Terabytes in Motion

A whole-genome sequencing BAM file runs 50-200 GB. A single subject's short-read FASTQs compress to 80 GB. Multiply by cohort size and you're moving 10-100 TB per analysis batch. Web-based transfer tools can't do this. Options:

• Globus Connect — high-performance data transfer over GridFTP, used by virtually every NIH-funded research computing center. Endpoints at UChicago, Stanford, Broad, NIH Biowulf, NCI, and most CTSA sites.
• Aspera (IBM) — UDP-based transfer with congestion control, used by dbGaP, SRA, and commercial sequencing providers.
• AWS Snowball Edge — 80 TB physical devices shipped via FedEx when network transfer would take weeks.
• Cloud-to-cloud transfer — if source and destination both sit on AWS S3 or GCP Cloud Storage, S3 Batch Replication or Storage Transfer Service moves petabytes in hours.

For the smaller files that surround the big ones — phenotype spreadsheets, QC reports, study protocols — an encrypted web transfer keeps the metadata pipeline moving without waiting for the BAM upload to finish.

The Middle Tier: REDCap, Spreadsheets, and Chart Reviews

The majority of research data transfers aren't genomics. They're a 40 MB REDCap export, a 15 MB de-identified chart abstraction spreadsheet, a 200 MB folder of de-identified CT thumbnails for an AI validation study. Secure web transfer fits this range cleanly.

Requirements:

• AES-256-GCM encryption, ideally client-side
• TLS 1.3 transport
• Link expiration (7-30 days per the DUA)
• Audit log with file hash and recipient IP
• Passphrase channel separate from link channel

HexaTransfer hits this spec with zero-knowledge client-side encryption. Try it at hexatransfer.com — free, no account, 10 GB max. Log the transfer in your research study binder with date, recipient, file description, and hash.

GDPR Article 89 and International Research

EU research data has specific safeguards under GDPR Article 89: pseudonymization, data minimization, and purpose limitation aligned with the research purpose. For transfers from EU institutions to US collaborators after Schrems II, the EDPB's Guidelines 03/2020 on processing data for scientific research apply.

Supplementary measures for non-EEA transfers:

• Pseudonymization with the key held at the EU site
• Client-side encryption so the transfer provider has no plaintext access
• Contractual prohibition on government-mandated disclosure challenges
• Documented Transfer Impact Assessment

The UK Data Protection Act 2018 adds specific research provisions; the MHRA and HRA oversee UK research data use. The Swiss FADP approximates GDPR but has different transfer rules. Don't assume one workflow covers all European partners.

Reproducibility Packages and Open Science

Journals like Nature, Science, and The Lancet increasingly require reproducibility packages at submission: code, de-identified data sufficient to reproduce the analysis, and environment specs (Docker containers, Singularity images, renv/conda lockfiles). These packages run 100 MB to 10 GB typically.

Transfer to the journal's submission system or to a Zenodo/Figshare/Dryad repository needs:

• DOI assignment for citation
• ORCID authentication for the depositor
• Licensing metadata (CC0, CC-BY, custom DUA reference)
• Persistent archival format (.tar.gz of source trees, .csv.gz rather than .xlsx)

Open science doesn't mean unencrypted transit. It means open access after deposition. The transfer to the repository still needs TLS 1.3 and integrity checks.

Audit Trails for Research Integrity

Beyond IRB requirements, research integrity investigations happen. The HHS Office of Research Integrity handled 40+ inquiries in a typical recent year. If allegations arise, investigators reconstruct who had access to what data at which timepoint. Your transfer audit log supports that reconstruction.

Retention: NIH requires retention of research data for at least 3 years after the final project report, longer for specific programs. Many institutions require 7 years. For clinical trial data supporting an NDA, that extends to 25+ years.

Log fields:

1. Timestamp UTC
2. Sender identity (authenticated institutional account)
3. Recipient identity (authenticated, not a generic mailbox)
4. File SHA-256
5. IRB protocol reference
6. DUA reference

Coordinating Centers and Data Flow Mapping

Multi-site studies route data through a Data Coordinating Center. The DCC maintains the master dataset, handles quality control, and distributes derived datasets to analytic cores and individual sites. Transfer flows look like:

• Site → DCC: encrypted upload of CRF data and source document PDFs
• DCC → Core Lab: derived dataset for specific analytic aim
• DCC → Sites: periodic progress reports with site-level benchmarks
• DCC → Repository: final study dataset at publication or per DMS plan

Each edge has its own transfer method, DUA, and audit requirement. Map the flows in a diagram before the study opens. Update the diagram when a new core joins.

When Research Data Becomes Clinical Data

A clinical trial readout triggering a protocol amendment or SUSAR reporting moves research data into regulatory territory. At that moment, the transfer has to meet 21 CFR Part 11 in addition to research protections. Your pipeline has to switch modes — or, better, already meets Part 11 for all transfers so the switch is unnecessary.

Medical research data transfer lives at the intersection of open science, regulatory compliance, and practical network engineering. The right tool for a 10 MB phenotype file is the wrong tool for a 2 TB BAM. Build a layered workflow that matches each transfer to its appropriate rail, document it in the DMS plan, and the rest is careful execution.