BLOG - Access to secure data during the Covid-19 pandemic - a model for the future?
Two researchers, Ben and David, discuss what challenges occurred when staff needed to work from home, due to the pandemic and whether remote access may become the norm?
Pre-Covid working environment
The Covid-19 pandemic has had far-reaching consequences for the way lots of people work. Administrative data research is no different. Prior to the national lockdown, researchers working on projects with the Scottish Centre for Administrative Data Research (SCADR) could sometimes only access data via monitored computers in secure locations. Other projects could be accessed remotely via secure internet connections, technically Virtual Private Networks (VPNs) using their university network. The national lockdown caused by the pandemic, resulted in changes being made to allow those with the correct approvals, access to appropriate data for projects remotely – this has successfully been done from researcher's homes.
In some ways, remote access has allowed projects to progress faster than they would have otherwise. Ben Matthew's work in the Safe Haven often required running statistical models which took four or more hours to complete. Ben mostly worked in a different part of the city to the Bioquarter campus where the Safe Settings was located, and so combining this time-intensive work in the BioQuarter with meetings several miles away was often not possible, delaying progress on analysis.
Fortunately for David Henderson, his projects prior to lockdown did not require access to a safe setting, although he needed to access the data from a university computer (Edinburgh Napier). In normal circumstances, David would make fortnightly visits to Edinburgh, from his home in the Highlands to allow him to do that. This was very difficult to juggle all work commitments around the short periods when he had access and analysis was possible. Sadly this sometimes resulted in delays, such as when David's outputs needed changing slightly but he didn't have time to fix them, prior to leaving Edinburgh - so it would have to wait another fortnight.
Getting remote access
Fortunately, one positive change as a result of the pandemic, is that by gaining remote access as approved researchers, both Ben and David could work more efficiently:
"Remote access means that I can fit analytical work in the safe settings seamlessly alongside other work commitments which previously would have slowed projects down." - Dr Ben Matthews, University of Edinburgh
"Remote access has allowed me to complete work safely and quickly, as I was no longer restricted to only gaining access every fortnight, when I visited Napier. This has also greatly reduced the frustration I would feel, when I didn't get my scheduled work done within the specific time." - Dr David Henderson, Edinburgh Napier University
Ironically, in some ways David felt working remotely from home was a safer way of accessing secure data. Using VPNs is a secure method of ensuring a direct link between a researcher’s computer and the data in the safe haven (essentially a tunnel between the two that no-one can break into). To access from home there are a minimum of five security steps to negotiate in order to get into the safe haven. These comprise a mix of home, university and safe haven security passwords or two-factor authentication steps. Whilst it won't be true for everyone, he feels fortunate that he could effectively set up a more secure setting at home than at a university location, as he can remove the risk of anyone else seeing his computer screens – something that is always minimized, but never completely eliminated, in a university setting.
Ben also felt that the IT infrastructure is highly secure and so any risks are at the user-end. However, he was confident that his training ensured that he could work safely with data, before getting access to secure data in any setting. He really enjoyed setting up a secure setting at home, and being recognised as a responsible and trustworthy user.
Making it possible
Ben and David wanted to remind SCADR researchers, that remote access would not be possible without the work of eDRIS research coordinators at Public Health Scotland (PHS) to amend data sharing agreements with data controllers. Access from home during the pandemic was granted via approvals from the information governance bodies that issued each project’s initial approval (one of the two Scottish Public Benefit and Privacy Panels). This meant requesting an amendment to the initial approval which would then be granted by the relevant panel. Some projects were granted this very quickly – others took a little longer to process presumably due to the large volume of requests.
Both Ben, David and the team here at the Scottish Centre for Administrative Data Research (SCADR) wish to thank the approvals bodies for reacting to the situation and working out solutions that kept the data safe but allowed the research to continue. We would also like to applaud PHS for their efforts in getting remote access up and running in very difficult circumstances.
The Future?
Overall, they both feel remote access has allowed them to conduct their work during the pandemic even more effectively than they were previously able to.
Importantly, the crucial ‘Five Safes’ approach (developed by the Office for National Statistics) to secure data access was maintained with more emphasis on the “safe people” pillar. We believe this is a model that could be used more generally and hope the experience during the pandemic can serve as an example of how this can be done safely, in the future.
This article was published on 03 Nov 2020
