You are here

Security and privacy requirements for a multi-institutional cancer research data grid: an interview-based study.

TitleSecurity and privacy requirements for a multi-institutional cancer research data grid: an interview-based study.
Publication TypeJournal Article
Year of Publication2009
AuthorsManion, FJ, Robbins, RJ, Weems, WA, Crowley, RS
JournalBMC Med Inform Decis Mak
Volume9
Pagination31
Date Published2009
ISSN1472-6947
KeywordsBiomedical Research, Computer Communication Networks, Computer Security, Confidentiality, Databases, Factual, Decision Making, Organizational, Governing Board, Government Regulation, Health Insurance Portability and Accountability Act, Humans, Intellectual Property, Interviews as Topic, Medical Oncology, Organizational Policy, United States
Abstract

BACKGROUND: Data protection is important for all information systems that deal with human-subjects data. Grid-based systems--such as the cancer Biomedical Informatics Grid (caBIG)--seek to develop new mechanisms to facilitate real-time federation of cancer-relevant data sources, including sources protected under a variety of regulatory laws, such as HIPAA and 21CFR11. These systems embody new models for data sharing, and hence pose new challenges to the regulatory community, and to those who would develop or adopt them. These challenges must be understood by both systems developers and system adopters. In this paper, we describe our work collecting policy statements, expectations, and requirements from regulatory decision makers at academic cancer centers in the United States. We use these statements to examine fundamental assumptions regarding data sharing using data federations and grid computing.METHODS: An interview-based study of key stakeholders from a sample of US cancer centers. Interviews were structured, and used an instrument that was developed for the purpose of this study. The instrument included a set of problem scenarios--difficult policy situations that were derived during a full-day discussion of potentially problematic issues by a set of project participants with diverse expertise. Each problem scenario included a set of open-ended questions that were designed to elucidate stakeholder opinions and concerns. Interviews were transcribed verbatim and used for both qualitative and quantitative analysis. For quantitative analysis, data was aggregated at the individual or institutional unit of analysis, depending on the specific interview question.RESULTS: Thirty-one (31) individuals at six cancer centers were contacted to participate. Twenty-four out of thirty-one (24/31) individuals responded to our request- yielding a total response rate of 77%. Respondents included IRB directors and policy-makers, privacy and security officers, directors of offices of research, information security officers and university legal counsel. Nineteen total interviews were conducted over a period of 16 weeks. Respondents provided answers for all four scenarios (a total of 87 questions). Results were grouped by broad themes, including among others: governance, legal and financial issues, partnership agreements, de-identification, institutional technical infrastructure for security and privacy protection, training, risk management, auditing, IRB issues, and patient/subject consent.CONCLUSION: The findings suggest that with additional work, large scale federated sharing of data within a regulated environment is possible. A key challenge is developing suitable models for authentication and authorization practices within a federated environment. Authentication--the recognition and validation of a person's identity--is in fact a global property of such systems, while authorization - the permission to access data or resources--mimics data sharing agreements in being best served at a local level. Nine specific recommendations result from the work and are discussed in detail. These include: (1) the necessity to construct separate legal or corporate entities for governance of federated sharing initiatives on this scale; (2) consensus on the treatment of foreign and commercial partnerships; (3) the development of risk models and risk management processes; (4) development of technical infrastructure to support the credentialing process associated with research including human subjects; (5) exploring the feasibility of developing large-scale, federated honest broker approaches; (6) the development of suitable, federated identity provisioning processes to support federated authentication and authorization; (7) community development of requisite HIPAA and research ethics training modules by federation members; (8) the recognition of the need for central auditing requirements and authority, and; (9) use of two-protocol data exchange models where possible in the federation.

DOI10.1186/1472-6947-9-31
Alternate JournalBMC Med Inform Decis Mak
PubMed ID19527521
PubMed Central IDPMC2709611
People: 
Frank Manion
University of Michigan Comprehensive Cancer Center at North Campus Reserach Complex
1600 Huron Parkway, Bldg 100, Rm 100 
Mailing Address: 2800 Plymouth Rd, NCRC 100-1004
Ann Arbor, MI 48109-2800 
Ph. (734) 764-8848 Fax. (734) 615-0517
Please acknowledge the Cancer Center Support Grant (P30 CA046592) when publishing manuscripts or abstracts that utilized the services of the University of Michigan's Comprehensive Cancer Center's Shared Resource: Cancer Informatics.
Suggested language: "Research reported in this [publication/press release] was supported by the National Cancer Institute of the National Institutes of Health under award number P30CA046592."

Copyright © Cancer Center Informatics-2011 Regents of the University of Michigan