SURE provides a uniquely simple and secure solution
SURE provides a uniquely simple and secure solution to the problem of transferring and storing sensitive data contained in clinical registries, routinely collected datasets and cohorts for the purposes of research and analysis.
The data cannot be copied, downloaded or transmitted by email or other means. Researchers can take their analyses from SURE but not the original data. All inputs and outputs are vetted through a unique “curated gateway” for compliance and the SURE system records and archives all transactions for future reference.
SURE security features
Purpose-built privacy protection
- SURE operates as a central, secure, online destination for analysing sensitive human research data, and allows data custodians tight control over what they make available and to whom.
- Purpose-built technology, which is internationally unique, automates and manages the information flow in and out of SURE
- SURE overcomes the major privacy challenges, reputational and legal liability risks associated with releasing data to external parties.
Access control
- SURE access is strongly authenticated requiring three different factors of authentication
- SURE is hosted in a tier-3+ (i.e. best available) data centre in Sydney that is also used by some of Australia’s leading telecommunications, government and financial institutions.
- Regular on-site and off-site backups of data are made. All off-site backups and archival data are encrypted prior to being transferred to secure off-site storage
- All users are required to undertake training on issues of privacy, ethics, information security and statistical disclosure control prior to gaining access to SURE and sign a deed outlining the terms and conditions of using SURE
SURE data and workspace validation procedures
Data Validation Procedures
Inbound
- Files being moved into a SURE workspace are uploaded to the External Curated Gateway
- During upload all files are verified for size before being made available for review
- The next step in the review process is for all files to be scanned for viruses and transferred from the external curated gateway to the internal curated gateway
- Uploaded files are reviewed by the Workspace Curator in the Internal Curated Gateway
- If the Curator approves the files for use in SURE, the Internal Curated Gateway will allow project team members to download into the SURE workspace.
Outbound
- Files to be downloaded from a SURE workspace to a local drive for publication or reporting are uploaded to the Internal Curated Gateway
- Uploaded files are reviewed by the Workspace Curator in the Internal Curated Gateway (unit record level data is not allowed to be removed from SURE workspaces)
- If the Curator approves the files for use outside of SURE, the External Curated Gateway will allow download (for a period of two weeks) to the users local drives.
Data Use Controls
- Access to SURE by individual users is logged and additional levels of user logging are available on-request including file access and keystroke logging
- All activity in the Curated Gateway is logged and can be made available to data custodians on-request.
Workspace Validation Procedures
- HREC approvals, and data custodian approvals, for the research being undertaken, must be provided to the Sax Institute prior to setting up the workspace
- An Agreement governing the use and provision of the workspace must be established between the research organisation and the Sax Institute
- Researcher Deeds governing the activities of researchers must be established for each researcher accessing the workspace
- Changes to personnel accessing the workspace must be accompanied by evidence of revised HREC approvals
- Each SURE User is required to successfully complete a SURE training course before access to SURE is provided.
SURE is operated by the Sax Institute and is supported by the Population Health Research Network which is an initiative of the Australian Government National Collaborative Research Infrastructure Strategy (NCRIS) and the NSW Government.