QResearch

QResearch is a large, anonymised database of GP records from over 35 million patients with longitudinal data tracking back over 30 years & is linked to mortality, cancer registration & hospital data.

Learn more about QResearch including contact information on the website.

Active Users: 45 | Active Projects: 35

SAFE People - Login & Access

✓ Currently only academic researchers from UK universities are eligible to use the TRE where there is a contract of employment, honorary contract or data sharing agreement in place. Researchers sign a set of t&c’s, then complete information governance training. Researchers submit their CV for assessment by the Scientific Committee to ensure that the team have the necessary skills to undertake the research proposed. One of the applicants must be medically qualified.

✓ Login: Remote Desktop over VPN with 2FA. Access via QResearch VPNs. VPN is locked to the user’s device, ensuring that access is only granted to machines that meet the QResearch Workstation Setup Requirements

✓ Min. Requirement: Accessing systems must run a currently supported OS with latest patches set to auto-install. System is audited before access is granted. No min. hardware requirements. Additional security requirements are defined in the latest version of the QResearch Workstation Setup Requirements Document.

✓ International Access: No data leaves the Oxford servers in any situation. Applications to access the TRE internationally are handled on a case-by-case basis in line with the data controller agreements & ethics.

SAFE Settings - Compute & Services

✓ On Premise hosted at an Oxford Data Centre.

✓ Windows Server DataCentre Edition.

✓ Compute hardware configuration: Standard: Dedicated 16GB RAM, 4 Logical Xeon Gold Processors, 200 GB HDD Max: Dedicated 512GB RAM, 72 Logical Xeon Gold Processors, 2TB HDD + Tesla V100 GPU

✓ Ability to modify VMs on request depending on review by QResearch.

✗ No Managed Data analytics capabilities – in development

✗ No federated queries - in development

✗ No federated analytics - in development

SAFE Settings - Security Certifications & Measures

✓ Security Certifications: NHS Data Security Protection Toolkit

✓ Security Measures: Everything needed to gain DSPT certification

✓ Each project team has its own VM. These “Project Level” VMs are isolated from each other. Project-specific datasets are put on the VMs by QResearch admins. The project team can share the data inside the project VM only. VMs cannot see or access other project VMs. Some VMs have access to Core data sets via Fileshares, access to these fileshares is via project groups & VMs to prevent a project VM unauthorised access to Core data

✓ Unauthorised access: 2FA ensures user identity, VPN with MAC locks to device ensures workstation identity (& compliance). Data Loss: Data resides on redundant, fault tolerant storage. All hardware has next day warranty to replace failed parts. Monthly hardware checks are performed to detect degradation. Automatic checks are setup with Dell to report predicted drive failures. User code is backed up each week, Data is not. (Data can be re-created from source in case of disaster) Misuse by user: Users have minimal privileges, internet access is disabled

SAFE Settings - Software access

✓ Default software: MS office, STATA, R, Python. STATA requires individual or site license. Sophos Endpoint Agent runs on all VMs to detect & prevent malicious code execution.

✓ Code/library import: Users cannot import their own code/ software. Users can request changes to their environment, including addition of libraries. Each change is reviewed by QResearch, & if approved, actioned by a QResearch administrator

✓ Collaboration Software: Git

SAFE Data - Data Access Mechanisms

✓ Data Provisioning: Researchers are provided with the dataset necessary to answer their question both in terms of the variables/data items received & sample size (as specified in their application form). Datasets are provided on servers held in the secure data centre.

✓ Receive Data: Researchers are only able to receive datasets agreed in their application & data sharing agreement. Data suppliers such as NHS Digital provide data that is pseudonymised at source with openpseudonymiser software. This uses a salted, encrypted hash. Datasets are transferred to the core administration team by SFTP

SAFE Outputs - Data Output/export

✓ Aggregate level graphs & tables, Weights & code for trained AI algorithms, Source code & binaries developed within the environment

✗ No export plans (other data types)

✗ Data transmit to other SAFE Settings: Data sharing agreements do not allow this

✓ Statistical disclosure control process in place