poses significant challenges to the maintenance of confidentiality because of the risk posed by repeated queries to the database and the potential ability to infer individual attributes by comparing results for some table cells against others (see Duncan and Mukherjee, 2000). At this stage of software development for disclosure review, manual monitoring before output is sent back to a user may be more effective at protecting confidentiality. It may also, as in the NCHS system, allow users to request a broader array of outputs (e.g., regressions of various types in addition to tables). However, manual monitoring is more costly for the sponsor agency and precludes rapid response to user submissions.

Research that will permit expansion of this mode of access to confidential data is needed. The research should focus on efficient disclosure limitation methods for remote access that allow users to request a wide range of outputs and obtain output within reasonable time limits.

An alternative to research data centers, one that reduces burden to users because it does not require them to travel to a different location, is a licensing agreement. Licensing agreements, which are a valuable means of access to confidential data, have developed in different ways for different datasets. Although the Census Bureau does not currently have the authority to allow access to its confidential data under licensing agreements, the Bureau of Labor Statistics, the NCES, and NSF’s Division of Science Resources Statistics, among other agencies, license the use of confidential data to researchers who meet certain criteria. The HRS, which is carried out at the University of Michigan with funding from the National Institute on Aging, also licenses researchers to use its data. These licenses enable researchers to work at their home institution, without incurring the costs of relocating.

NCES—which currently uses licensing more than any other agency—requires potential users (such as state and local agencies, contractors, researchers) to complete an application designed for the specific type of user. The process involves preparing and submitting a formal letter of request, a license document, an affidavit of nondisclosure, and a security plan.⁴ Users of confidential HRS data must be affiliated with an institu-