Not every dataset exported from a biorepository is a research-grade dataset. The distinction matters more than it might appear, and it comes down to five criteria that determine whether a dataset can actually support the downstream analyses a research program needs — or whether it will require months of remediation before any scientific work begins.
The term "research-grade" is used loosely in the biomedical data space, sometimes as a marketing label and sometimes as a substantive quality claim. Our view is that it should mean something specific and verifiable. A dataset that meets all five criteria below can be treated as a starting point for analysis. One that fails on even two of them typically introduces uncertainty that compounds through the research program in ways that become expensive to address later.
Criterion 1: Documented De-identification
De-identification is necessary but not sufficient for research-grade status. The more important question is whether the de-identification is documented in a way that can withstand downstream scrutiny.
The two recognized frameworks under HIPAA — Safe Harbor and Expert Determination — have different documentation requirements and different implications for downstream use. Safe Harbor requires the removal of 18 specified identifier types and certification that the covered entity has no actual knowledge that the remaining data could identify an individual. Expert Determination requires a qualified statistician to attest that the risk of re-identification is "very small." Both produce de-identified data in the regulatory sense, but Expert Determination produces a richer audit trail: a signed attestation, a methodology description, and a statistical analysis that can be presented as part of a data licensing package.
A dataset is research-grade with respect to de-identification only if the method is documented, the documentation is tied to the version of the dataset being licensed, and the documentation is available to the data buyer as part of the delivery package. "We de-identified it using Safe Harbor" is not documentation — it is an assertion. The documentation is the procedure, the log of removed fields, and the attestation.
Criterion 2: A Traceable Consent Chain
The consent chain is the sequence of documented authorizations that runs from the original participant consent through any subsequent re-consent, study amendments, or secondary use authorizations, to the specific use being contemplated by the data buyer. For a dataset to be research-grade, this chain must be traceable — meaning each link can be documented and verified.
In practice, many biobank collections have consent chains that are partially complete. The original consent form exists. An IRB approval for the original study exists. But an explicit authorization for commercial secondary use, or a determination that the broad consent language covers the intended use, may never have been formalized. This gap forces the data buyer to make their own legal interpretation of the consent scope, which is slow, expensive, and inconsistent across buying organizations.
A research-grade dataset includes a consent scope summary that characterizes what uses are authorized, prepared by or reviewed by legal counsel, and cross-referenced to the consent documents it summarizes. This doesn't eliminate the buyer's legal review — it makes that review a verification exercise rather than a from-scratch interpretation.
Criterion 3: Phenotypic Completeness at the Relevant Variable Level
Phenotypic completeness is not an absolute measure — it's specific to the research question. A dataset can be complete with respect to the variables a cardiovascular outcomes program needs and simultaneously incomplete with respect to the variables a neurodegenerative disease program requires. This makes phenotypic completeness a criterion that must be evaluated at the level of the specific research application, not as a global property of the dataset.
What matters for a research-grade determination is that completeness is documented at a granular variable level, not just declared at the dataset level. A data package that includes a completeness matrix — showing, for each variable or variable group, the percentage of records with non-missing values, the distribution of missing data across demographic subgroups, and notes on why certain data is systematically absent — gives a research team the information they need to assess fitness for purpose before committing to a data access request.
A scenario that illustrates this: consider a metabolomics program evaluating a cardiometabolic cohort for biomarker discovery. The fasting status documentation in the dataset, a critical confounding variable for many metabolomics measurements, turns out to be present for only about 60% of records — and the missingness is concentrated in a particular enrollment site that used a different clinical workflow. A completeness matrix would have surfaced this before the research team's analysis plan was built around the assumption of complete fasting documentation. Without it, the gap surfaces three weeks into analysis.
Criterion 4: Format Standardization and Schema Documentation
Biobank data arrives in formats that reflect the systems used to collect it over the years of the collection's active enrollment. ICD-9 procedure codes from the early enrollment period, ICD-10 codes from the later period, and no crosswalk documentation. HL7 v2 lab data from one institution and FHIR R4 observations from another, with different field semantics that are not obvious from the field names. Genomic variant calls produced with pipeline versions that are no longer reproducible and not documented in the dataset metadata.
Format standardization means the dataset has been transformed into a consistent, documented schema with a data dictionary that a research team's bioinformatician can use without requiring extended consultation with the data provider. For genomic data, this typically means VCF files with documented reference genome, pipeline version, and variant filtering criteria. For clinical phenotype data, it means harmonized coding systems with provenance fields indicating whether a code was originally ICD-9 and mapped, or was native ICD-10. For longitudinal records, it means visit sequence documentation that makes the temporal structure of the data explicit.
We're not claiming that format standardization is easy — it isn't. It requires substantial curation work and domain expertise. The claim is that this work belongs in the data preparation phase, not in the research team's onboarding phase.
Criterion 5: Longitudinal Follow-up Documentation
Longitudinal data is the feature that makes biobank collections uniquely valuable for certain research questions — and the feature that is most difficult to verify without adequate documentation. A collection that enrolled 5,000 participants over a decade and tracked clinical outcomes through medical records linkage has very different research utility depending on the follow-up completion rate, the ascertainment method, and the duration of active follow-up.
Research-grade status on this criterion requires that the follow-up structure be documented explicitly: enrollment period, active follow-up period, outcome ascertainment method (self-report, medical records linkage, death registry, claims data), follow-up completion rate by cohort subcategory, and any periods of incomplete follow-up due to institutional or operational gaps. This information determines whether a program requiring a specific minimum follow-up duration can actually use the dataset, and it should be available as part of the dataset record rather than requiring a direct conversation with the biobank's data team.
Applying the Framework in Practice
The five criteria — documented de-identification, traceable consent chain, phenotypic completeness at the variable level, format standardization, and longitudinal follow-up documentation — are not a checklist that a dataset either passes or fails globally. In practice, a dataset may be fully research-grade on three criteria and require remediation work on two others. The value of the framework is in making that profile explicit early, so a research team can decide whether the remediation is tractable within their timeline and budget, or whether a different collection is a better starting point.
What the framework also makes clear is that the difference between a biorepository export and a research-grade dataset is not primarily a technology problem — it's a curation and documentation problem. The data exists. The scientific value is already there. The gap is in the work required to verify, document, and package that data in a way that makes it transactable for a research buyer without requiring them to recreate the curation layer from scratch.
