New NIH security rules for genomic data sets are slowing research, prompting workarounds

In the spring of 2025, Andrew Lynn, a developmental cognitive neuroscientist at the University of Louisville (UofL), was starting a research project that would rely on data from the Adolescent Brain Cognitive Development (ABCD) Study, a U.S. effort to explore what affects children’s health and brain growth. But when he navigated to its website to download the data, he came across a worrisome announcement invoking an unfamiliar acronym: NIST SP 800-171.

He learned the acronym referred to a National Institute of Standards and Technology (NIST) protocol for handling highly sensitive data, which now covered genomic information from ABCD’s participants. Lynn actually planned to analyze only nongenomic data, such as MRI scans and questionnaires. But the ABCD site said scientists wanting access to any of its data would soon need compliant computer servers, which he and his UofL colleagues did not have.

Unable to meet the deadline, his group lost access to ABCD’s data for 2 months before finding a limited and temporary workaround. His research output has slowed—concerning for a junior faculty member working toward tenure. “I take data...