Hi @bowatson! Welcome to OHDSI!
Some things that might be relevant to your questions:
As a general rule, data sites in OHDSI only share summary statistics (e.g. person counts and hazard ratios), not patient-level information. That already limits what the data can be used for.
OHDSI studies are required to have a full protocol before asking other sites to participate. An example study can be found here. In the past, those sites requiring per-study IRB approval have done so based on the protocol provided by the study leader.
So far we have not made use of DUAs (to my knowledge), but we have discussed them in the past.