IPD Sharing and Clinical Reports: Plan Separate Disclosure Releases

TL;DR

Sharing participant-level data with approved researchers and publishing anonymized clinical reports are different releases. They involve different materials, audiences, access conditions and privacy assessments. A registry statement about a future sharing plan describes another layer: declared intent. Treating these three layers as interchangeable can create an unusable data package or a misleading disclosure claim. [1] [2] [3]

In our August 1, 2026 AACT snapshot, 53,631 of 596,685 study records declare an affirmative IPD-sharing plan. The count measures the registry field at that snapshot. It provides no verification that data were delivered, that a request was approved or that a legal obligation was met. ClinicalTrials.gov’s data-element definitions identify the field as optional, so a missing entry alone supplies no compliance finding. [1] [4]

The useful planning unit is a release-specific package: defined purpose and recipient, authoritative data and document versions, justified privacy transformations, supporting documentation and an accountable approval. This article proposes a way to organize that package while keeping each disclosure regime’s actual scope intact.

Read the sharing statement as a plan

ClinicalTrials.gov’s IPD Sharing Statement module captures whether there is a plan to share, together with descriptions such as the data to be shared, timing and access criteria where supplied. It is distinct from results tables and uploaded documents. A public protocol PDF can be available while participant data remain subject to controlled access; an affirmative plan can exist before a data package is ready. [1]

The retained snapshot partitions all 596,685 records into 53,631 Yes, 206,669 No, 53,464 Undecided and 282,921 unspecified/blank entries. The categories sum to the total. The chart describes declarations across a heterogeneous historical registry, with no eligibility restriction or adjustment for field introduction, study age or external sharing policies. [4]

For an individual trial, compare the statement with its approved sharing arrangements and update process. Ask what data and supporting materials the plan covers, when they become available, who may apply and how a decision will be made. Record a change in the plan with its reason and approval. These are proposed governance questions, rather than additional mandatory registry fields.

Our ClinicalTrials.gov outcome-reconciliation report addresses the separate task of preparing aggregate results. It should be read alongside the data-sharing plan, while preserving the distinction between the deliverables.

Identify which publication or access route applies

EMA Policy 0070 clinical-data publication concerns clinical documents submitted in specified marketing-authorization procedures for human medicines. The published material includes clinical overviews, summaries, study reports and specified appendices. EMA’s resumption covered medicines with new active substances receiving a CHMP opinion from September 2023 onwards, with the first resumed non-COVID packages available in January 2024. Its Step 2 expansion from April 2025 concerns the publication program’s scope; it should not be described as activating a general participant-level-data release requirement. [2]

Health Canada’s Public Release of Clinical Information initiative concerns clinical information in drug submissions and medical-device applications following regulatory review, with defined procedures and exceptions. Its guidance addresses preparing the clinical information for public release and documenting anonymization. It does not turn every sponsor-held analysis dataset into an unrestricted public download. [3]

ICMJE’s policy concerns data-sharing statements for clinical-trial reports and registration of sharing plans for trials beginning enrollment on or after January 1, 2019. It distinguishes a required statement from a requirement to share data. NIH’s Data Management and Sharing policy has a separate funding-policy scope and expects an approved plan and compliance with it. Neither policy should be represented as a universal ClinicalTrials.gov field mandate. [5] [6]

The controlled-access row is an editorial planning category, not a claim that one common access protocol governs all repositories. Verify the requirements of the selected repository, contract, funder and jurisdiction.

Design privacy review for the actual release environment

Public release and access by a limited group of approved researchers create different exposure contexts. Health Canada’s guidance explicitly considers the release environment when assessing re-identification risk. It calls for an objective, systematic and documented process, including identification of variables, risk assessment and justified anonymization. EMA also requires anonymization of clinical reports and publishes the applicant’s anonymization report. [2] [3]

Removing names alone leaves indirect identifiers, combinations of dates, rare events and narrative details to assess. Recoding a participant identifier can preserve linkage across files, while the existence of a separate key and other linkable information remains relevant to the privacy assessment. Choose transformations in relation to the data, available external information and intended audience. A defensible anonymity assessment requires the actual release context and data, beyond a cell-size rule or generic threshold.

Privacy review should preserve the package’s scientific meaning as far as the applicable privacy requirements allow. Document how transformations affect time relationships, grouping, outliers and the analyses the recipient may conduct. A dataset that appears internally consistent can still lose utility when a transformation breaks a relationship between datasets or removes the context of a clinical narrative. These are review considerations, rather than instructions for a particular anonymization algorithm.

For public documents, inspect the actual final file: visible redactions, searchable text, attachments and metadata can represent different surfaces. For structured data, review the exported files together with their code lists and documentation. Keep the unmodified authoritative sources under their applicable retention and access controls, and distinguish them clearly from the released copy. The proposed checks support an actual privacy review; they do not replace it.

Build one package for one defined release

Start with a manifest of the intended files and their versions. Resolve which protocol, analysis plan, data cut and derivations govern the package. Supporting documents should allow the recipient to interpret the data without implying that an outdated protocol or earlier analysis plan was the governing version.

This is an editorial package proposal. An authority or repository may prescribe different files, formats or approval steps. In a public-report workflow, use its publication instructions. In a controlled-access workflow, align the package with the approved request and permitted uses.

Consider a request for a secondary analysis that needs event timing and treatment exposure. A public report package may contain redacted narratives and aggregate tables, while the approved research package may require structured variables and documentation. Copying one package into the other route can fail both the scientific purpose and the privacy review. The decision is to define the intended release first, then assess whether the available materials and approvals support it. This is a hypothetical example, rather than an observed repository case.

Connect collection systems to the release record

Source-to-release traceability begins with data collection and continues through analysis, export and disclosure. Give each handoff an identified owner and record the versions exchanged. Preserve enough documentation to explain a correction or transformation later. Our GCP inspection-evidence report discusses that reconstruction task across clinical systems.

EClinCloud’s EDC solution is relevant to upstream clinical data management. Assess the actual export, documentation and service scope with the study team. This article makes no claim that the product supplies an anonymization engine or that an export is automatically suitable for public release. The release owner must assess the resulting package against its purpose and applicable requirements. [7]

Methods and limits

The chart uses the inherited AACT August 1, 2026 aggregate of the IPD-plan field, with each study counted once. Blank and unspecified values remain a descriptive category. No sharing-execution rate, policy-compliance rate or causal trend is inferred. CTIS document-type codes, repository-volume claims and universal anonymization thresholds are outside this analysis. Regulatory and policy scope was checked against the primary sources below; the release-package tables are editorial synthesis.

Sources

1. National Library of Medicine. ClinicalTrials.gov protocol registration data element definitions, IPD Sharing Statement module.

2. EMA. Clinical data publication, including resumption, program scope and preparation for publication.

3. Health Canada. Public Release of Clinical Information: guidance document, particularly scope and §6 anonymization.

4. Clinical Trials Transformation Initiative. AACT database. Author analysis of the August 1, 2026 snapshot, retained IPD-plan declaration aggregate.

5. ICMJE. Clinical trials: data sharing, Recommendations for the Conduct, Reporting, Editing, and Publication of Scholarly Work in Medical Journals.

6. NIH. Data Management and Sharing Policy overview.

7. EClinCloud. EDC solution. Used only for the stated product scope.