Security and privacy requirements for a multi-institutional cancer research data grid: an interview-based study

Area of Science:

• Bioinformatics
• Health Informatics
• Cancer Research Informatics

Background:

• Data protection is critical for human-subjects data in information systems.
• Grid-based systems like caBIG facilitate real-time data federation, posing regulatory challenges.
• Understanding these challenges is crucial for developers and adopters of such systems.

Purpose of the Study:

• To collect policy statements, expectations, and requirements from US cancer center regulatory decision-makers.
• To examine fundamental assumptions regarding data sharing in federated and grid computing environments.
• To identify challenges and inform best practices for regulated data sharing.

Main Methods:

• An interview-based study with key stakeholders from US cancer centers.
• Utilized a structured instrument with problem scenarios and open-ended questions.
• Employed qualitative and quantitative analysis of transcribed interviews.

Main Results:

• Achieved a 77% response rate from 24 participants across six cancer centers, including IRB directors and privacy officers.
• Conducted 19 interviews, gathering responses on governance, legal issues, de-identification, security, and consent.
• Identified themes including governance, legal/financial issues, partnerships, de-identification, technical infrastructure, training, risk management, auditing, and IRB/consent.

Conclusions:

• Large-scale federated data sharing in regulated environments is achievable with further development.
• Key challenges involve creating effective authentication and authorization models for federated systems.
• Nine specific recommendations address governance, partnerships, risk management, technical infrastructure, identity provisioning, training, auditing, and data exchange.