Institutional Cybersecurity in a Clinical Research Setting

Abstract

The principal challenge facing IT groups that support research on a daily basis lies in striking a fine balance: On one hand researchers must share data and use cutting edge analytic tools on a variety of computing platforms to enhance their creativity and productivity. On the other hand, much of the data that supports translational research contains personal health information derived from patients’ medical records. Hospitals are justifiably concerned about the highly sensitive nature of the data and the need to comply with a myriad of federal, state and local laws and contractual regulatory requirements that demand high levels of security and access control. In this chapter we discuss these challenges and the approaches taken at a research intensive children’s hospital to put a policy framework in place that enacts standards for security, monitoring, testing and design of the IT infrastructure. These protect the institution, while enabling collaboration and innovation among researchers. We stress the organizational need for a close and collaborative relationship between IT groups that support research and those charged with support of the medical center’s clinical and business operations. It is also important to recognize that technology alone cannot assure security. Institutional policies and user education also play key roles in assuring that confidential information is in fact protected.