A field guide for core-facility IT
A practical checklist for keeping sequencing data, analysis history and client access accountable across projects. Start with your institution's rules, then evaluate the tools that need to support them.
Start with the obligation
A core may handle research data with different consent terms, data-use limitations and client agreements in the same week. Decide what applies to each project before selecting storage or sharing defaults. NIH's Genomic Data Sharing Policy applies to certain NIH-funded large-scale genomic studies; its expectations include a sharing plan, appropriate repositories and responsible handling of controlled-access data. NIH policy overview
If protected health information is involved, have your privacy team determine whether HIPAA applies and what research use or disclosure is permitted. Research data are not automatically outside HIPAA, and removing names alone is not a complete de-identification assessment. HHS research guidance
The decision trail
Intake
Consent and use
Analysis
Inputs and versions
Delivery
Named access
Every transfer of responsibility should have an owner and a record.
Five review points
Record the project owner, assay, human or non-human origin, consent and permitted uses. Keep the approval or restriction with the project record, not just in an email thread. A sample ID alone does not establish that data are safe to share publicly.
Ask: Who approved this use, and where is that decision recorded?
List the core staff, investigators and external collaborators who need each dataset or report. Decide separately who can view, download or manage it. Review access when people change roles or a project ends.
Ask: Can an investigator see another group's files through a shared folder?
For each handoff, preserve the input identifiers, pipeline version, parameters, reference and resulting files. This makes it easier to investigate a surprising result and explain which analysis produced a deliverable.
Ask: Could someone reproduce the report without reconstructing the workflow from memory?
Confirm recipient identity, the exact files and folders, download rights and whether a time limit is required. Do not mistake a link for authorization, or assume that a link expires by default.
Ask: Who can open the link after it has been forwarded?
Agree on retention periods, archival location, deletion responsibilities and incident escalation with your institution and client. Those terms depend on the data and agreement; a product setting is not a substitute for policy.
Ask: What happens to raw reads and reports when the engagement closes?
Putting the checklist to work
Bridge Horizon can help keep analyses and handoffs together. Your team still owns its consent review, policy decisions and assessment of whether a particular deployment meets contractual or regulatory requirements.
Show a named recipient only the relevant project, dataset, report, folder or files. The person granting access may choose an expiry; links do not expire by default.
Review input files, pipeline runs and their resulting reports in the same workspace, rather than handing over an unexplained folder of outputs.
Ask us to walk through access boundaries, audit evidence, retention and deployment options against your institution's requirements. Do not assume a compliance certification from these features alone.
These primary sources explain the policy context. Your institution's privacy, security and research offices should determine what applies to a specific project.
Review your own workflow
We can walk through a core-facility handoff, from analysis history to named client access, and discuss what your IT team needs to validate.