The problem evoked here is for your institution at which you work, to know that their researchers are not changing the data afterwards and following best practices. In this scheme, the user would submit the hashes to a central server controlled by the institution. Then, the user have no way of changing the content without them knowing.
And yes, you would need to add some authentication to know it's always the same user, but that's a different, orthogonal issue.
For actual proof e.g. in court, you'd need a third party with a private key used to sign the content. A little more involved... But the main point of that would be patent litigation, and with the new 'first to file' rule in the US, it is much less relevant.
