Security and privacy requirements for a multi-institutional cancer research data grid: an interview-based study

Abstract

BackgroundData protection is important for all information systems that deal with human-subjects data. Grid-based systems – such as the cancer Biomedical Informatics Grid (caBIG) – seek to develop new mechanisms to facilitate real-time federation of cancer-relevant data sources, including sources protected under a variety of regulatory laws, such as HIPAA and 21CFR11. These systems embody new models for data sharing, and hence pose new challenges to the regulatory community, and to those who would develop or adopt them. These challenges must be understood by both systems developers and system adopters. In this paper, we describe our work collecting policy statements, expectations, and requirements from regulatory decision makers at academic cancer centers in the United States. We use these statements to examine fundamental assumptions regarding data sharing using data federations and grid computing.MethodsAn interview-based study of key stakeholders from a sample of US cancer centers. Interviews were structured, and used an instrument that was developed for the purpose of this study. The instrument included a set of problem scenarios – difficult policy situations that were derived during a full-day discussion of potentially problematic issues by a set of project participants with diverse expertise. Each problem scenario included a set of open-ended questions that were designed to elucidate stakeholder opinions and concerns. Interviews were transcribed verbatim and used for both qualitative and quantitative analysis. For quantitative analysis, data was aggregated at the individual or institutional unit of analysis, depending on the specific interview question.ResultsThirty-one (31) individuals at six cancer centers were contacted to participate. Twenty-four out of thirty-one (24/31) individuals responded to our request- yielding a total response rate of 77%. Respondents included IRB directors and policy-makers, privacy and security officers, directors of offices of research, information security officers and university legal counsel. Nineteen total interviews were conducted over a period of 16 weeks. Respondents provided answers for all four scenarios (a total of 87 questions). Results were grouped by broad themes, including among others: governance, legal and financial issues, partnership agreements, de-identification, institutional technical infrastructure for security and privacy protection, training, risk management, auditing, IRB issues, and patient/subject consent.ConclusionThe findings suggest that with additional work, large scale federated sharing of data within a regulated environment is possible. A key challenge is developing suitable models for authentication and authorization practices within a federated environment. Authentication – the recognition and validation of a person's identity – is in fact a global property of such systems, while authorization – the permission to access data or resources – mimics data sharing agreements in being best served at a local level. Nine specific recommendations res...

A Focus Area Maturity Model for a Statewide Master Person Index

“…Policy issues involved with real-time information exchange in support of biomedical research were studied by researchers associated with the cancer Biomedical Informatics Grid (caBIG). In an effort to understand the regulatory challenges posed by the real-time federation of clinical data for caBIG, researchers interviewed decision-makers from participating research centers and identified several policy concerns grouped around a number of broad themes, including governance, legal and financial, technical infrastructure, trust, auditing, risk management, and patient consent [15]. We have chosen these themes as initial focus areas for our model.…”

Federated Authentication

“…A further, more detailed treatment of the topic of governance in federations involving academic medical centers can be found in Manion et al (2009) and Weems et al (2007).…”

A Federated Network for Translational Cancer Research Using Clinical Data and Biospecimens

“…Our approach is based on earlier qualitative research on the complex regulatory requirements of biomedical data grids (19). Each institution obtains an exempt approval from each institution’s IRB to create and maintain its TIES node.…”