in this digital age , large amounts of valuable data are being generated by a wide range of health care applications across diverse systems . these data have the potential to offer tremendous insight into populations and health care systems . these diverse users often have specific preferences for analytic tools that create endless permutations of potential system configurations . this framework outlines our experience in deploying a secure data analysis platform ( sedap ) , and the process of planning and designing a secure environment enabling access to the data from anywhere at any time . the framework addresses the challenges of complying with security requirements in a rapidly changing landscape of data privacy and regulations surrounding patient data.1,2,3 while third - party cloud computing services offer great scalability and cost flexibility , building and operating a dedicated environment leverages existing organizational resources and provides complete control over requirements . traditional environments such as data warehouses , computing clusters , or other appliances are made available through the virtual desktop infrastructure ( vdi ) . the secure data analysis platform ( sedap ) is the result of a bottom - up , user - centric development , deployment , and maintenance approach taken by the integrated cancer information and surveillance system ( iciss ) at the lineberger comprehensive cancer center for the university of north carolina at chapel hill ( unc - ch ) in conjunction with the unc - ch information technology services research consulting ( its - rc ) group . the sedap was built as a replacement for a dedicated linux based server system and was designed with the following main objectives and user requirements : 
 increased usability : a modern graphic user interface ( gui)-based environment to get users up and running quicker;increased accessibility : secure and flexible remote access while supporting bring your own device ( byod ) where applicable ; andincreased security : closed and controlled environment with single common security management plan . increased usability : a modern graphic user interface ( gui)-based environment to get users up and running quicker ; increased accessibility : secure and flexible remote access while supporting bring your own device ( byod ) where applicable ; and increased security : closed and controlled environment with single common security management plan . a solid framework for deploying such an environment guides and accelerates the planning , design , and implementation stages while addressing six core components : ( 1 ) security , ( 2 ) ease of access , ( 3 ) performance , ( 4 ) cost , ( 5 ) tools , and ( 6 ) training . iciss currently provides big data resources for clinical and population health research including comparative effectiveness research ( cer ) and outcomes research . the iciss core data repository is composed of north carolina central cancer registry tumor data linked to public and private insurance claims data . additional linkages to other patient registries , cohort studies , genomic , and clinical data provide additional layers of patient data.4 the iciss team includes clinicians , biostatisticians , epidemiologists , health services researchers , demographers , geographers , and computer scientists , trained at the phd and master s degree levels . approach needed to optimally leverage secondary data , as well as a large diversity in informatics technology expertise and user requirements.5 when a legacy system expired , this multidisciplinary team environment combined with large data sets encompassing clinical phi offered a unique opportunity to gather specific user requirements and test system optimization in order to develop the proposed framework . security requirements for any system are directly connected to the data requirements and the data source . most state and federal governments have enacted specific privacy protection laws to address personal and business information other common sources of research data such as health care organizations , government entities , or academic institutions that require implementation of specific security requirements . in the united states , these requirements might include , but are not limited to , the federal information security management act ( fisma ) , health insurance portability and accountability act ( hipaa ) , and family educational rights and privacy act ( ferpa ) . implemented security controls will directly affect operational procedures.6 therefore , careful planning is required to enumerate the types of data that will be analyzed over the lifetime of the system and to identify the most stringent data security requirements . in sedap , data access is managed through authorization to folders by assigning one of four different access rules : 
 role - based access , such as system administration or data management , is assigned to users based on task - specific responsibilities irrespective of project or data.institutional review board ( irb ) and study - specific access is assigned to all staff specifically assigned to an active study and leverages the existing academic institutional irb approval systems.data use agreement ( dua ) access is assigned to the few individuals who require access to an entire  raw  data set , or who subset data for others and are involved in merging and linking data.team level access is used for exploratory work and collaboration within multidisciplinary settings . role - based access , such as system administration or data management , is assigned to users based on task - specific responsibilities irrespective of project or data . institutional review board ( irb ) and study - specific access is assigned to all staff specifically assigned to an active study and leverages the existing academic institutional irb approval systems . data use agreement ( dua ) access is assigned to the few individuals who require access to an entire  raw  data set , or who subset data for others and are involved in merging and linking data . team level access is used for exploratory work and collaboration within multidisciplinary settings . a global security management plan outlining these access rules was developed and is compliant with all regulatory requirements associated with executed duas as well as institutional , state , and federal rules . this written plan helped to build trust with the data suppliers and provides the baseline for contractual agreements . within our institution we were able to leverage global security controls such as common user ids and network security , while others controls had to be developed from the ground up . the infrastructure allows users to connect through dedicated remote software to virtual desktops such as microsoft windows or linux . this approach allows a bring your own device ( byod ) model and accessibility from the wide variety of devices within the academic workplace . the environment allows users to disconnect from a virtual desktop from device a and reconnect from device b without disrupting jobs and analyses . this model provides flexibility for users and projects while the configuration of sedap facilitates standardization of key scientific process such as project tracking , data structures , access controls , and documentation . sedap configuration has helped build a culture of transparency for an academic environment that requires replication of tasks and analyses across data samples . for research on large , disparate health care data sets , it has reduced duplication of effort and has increased efficiency as users are trained in the same way and have access to the same sets of tools and to a systematic platform for sharing programming code and other information . a specific benefit of a vdi is that a computing job requiring extensive time will not be interrupted when the user disconnects . this is particularly important for complex queries or simulations using large data sets that may take days to run . the virtual machine inside the vdi continues to run and process any or parallel jobs that have been started . we further implemented a messaging system that can transmit messages from within the secure environment to a web portal and that notifies users via email of changes in job status . this allows them to know when jobs have completed or been interrupted without having to log into the computing environment . this messaging system has significantly helped with efficiency regarding large jobs that take days to run but may unexpectedly be stopped due to software failure , allotted disk space , or even model parameterization failure . before implementing the system , the performance requirements were assessed with a set of benchmarks that measured the existing computing resources available to the users . the disk i / o performance was measured at the end user level , meaning an average of the performance on top of the operating system . since our data size requirements exceed 10 terabytes , a solid state disk ( ssd ) setup for laptops or desktops was not measured . the outcomes of the data conversion benchmark ( figure 3 ) show that increasing i / o performance significantly affects the data processing performance . the iciss daily workflow often requires scanning and creating more than 100 gb in a single analytical step . to reach high performance read and write rates of over 300 megabytes per second additionally , advanced data caching and buffering is implemented to absorb the high demand of data . the resulting vdi environment performs on data operations at a level of a high performance desktop environment with ssd . during the first two years of operation , we experienced a shift in the performance bottleneck . with users no longer having to waiting for larger jobs to finish , the threshold of the data size per job increased . we were able to address some of these with training and implementing best practices at the level of individual users . finding the right balance between performance and cost is primarily defined by processing power requirements . costs add up quickly , and making a business case to replace a running legacy system with a newer and more expensive system can be hard to sell to stakeholders who may not understand the technical details or requirements of the team . we adopted a bottom - up approach to cost estimation and system budgeting by first calculating the costs of a traditional analytic workstation . basing our estimate on the price of a high performance workstation with a cost of $ 4,500 and a three year warranty , we elected to use a yearly $ 1,500 per user as a rough baseline for hardware . the resulting aggregate of 50 users for four years resulted in $ 300,000 for infrastructure . by working closely with unc its - rc , we were able to identify opportunities for the sedap to leverage existing campus infrastructure such as server room space , networks , power supply and backup , technicians , and operational staff . slower disks based on serial at attachment ( sata ) technology are considerably cheaper than high performing solid state drives ( ssd ) . using cloud storage solutions might also be an option as long as all the security considerations are met . we elected to operationalize both cheaper  slow  and a more expensive  fast  storage . data that is in active analysis and temporary caching will use the  fast  environment while less performance - dependent information uses the costs associated with operationalizing the platform for users are another factor that is less easily estimated but can not be overlooked . account creating , access provisioning , troubleshooting , interfacing with representatives from its , and user training are critical activities that cost staff valuable time . this staff support time is also not easily recuperated or justified with extramural funding in an academic environment . yet these activities and staff support are essential to transform the environment into a true solution for users , and the costs associated with delivery of these services must be incorporated . we learned that key aspects of personnel and staff cost were the identifying of and teaming up with existing organizational resources . in our case , we closely tracked hours spent by our service provider in these activities for each  seat  created in the first four months of system deployment ( to account for the learning curve associated with new processes ) , and calculated the proportion of the employee s fully burdened salary that this time represented . each research study utilizing the platform was then assessed a fee equivalent with these costs . the nature of this fee is dependent on funding type : for those funding vehicles permitting computing costs , a flat fee was assessed . for funding mechanisms that only fund personnel , a fraction of the service provider s salary was included in the budget of each proposal . licenses for a virtual platform and end user software can also be very expensive and contribute to overall and maintenance costs . we were able to leverage  educational institution  licenses , but to avoid overspending on these licenses user input was directly sought to limit the selection of tools within the sedap . a list of tools currently used in the legacy computing solution was expanded to include tools requested by users based on their existing skill set and planned professional development . once the initial list was finalized , we were able to take advantage of institutional discounts and bundling of licenses to provide a wide variety of tools at reduced cost . some of these tools include sas , stata , r , arcgis , qgis , mathematica , pearl , php , sqlite , latex , and oracle sql developer . the tools are preinstalled in two different microsoft windows base images supported by the vdi . one image is intended for use of data containing identifiers and is focused on data management . tools installed in this image are intended to support tasks including file decrypting and encrypting , packing and unpacking of archives , export - transform - load ( etl ) , database loading , and file conversion . these tools support statistical analysis ( including simulation ) , geospatial analysis , network analysis , and documentation tools . to guarantee rapid deployment an image is assigned to the new user . at the point of authentication , a copy of the image is prepared unless the user had an active image from a previous connection . this configuration works well if physical separation of space is required , but it exponentially increases the administrative work to maintain updates . traditional computing cluster , data warehouses , or modern appliances can also easily be integrated into a vdi . tools training : the configuration of commonly used tools such as sas , stata and r likely differs from the  out of the box  setup . the adjustments within the vdi can be specified to optimize performance based on user requirements . having users continuously involved with defining best practices of specific features of these tools creates a valuable knowledge library . to this end , we actively solicit feedback from user groups and facilitate communication in order to share their experiences and improve performance . this group is the primary source of new requirements to alter configurations or add new tools . the user community also maintains a web - based faq repository to retain and share knowledge . security training : as part of the global security management plan , our administrative team provides security training for all users before they are granted access . a signed workforce authorization serves as an internal contract and clearly defines the understanding of rules and sanctions . we also leverage and track required training imposed by the academic institution and the health care system . research personnel at the university are required to complete an ethics training in order to participate in research requiring irb review . despite these institutional requirements , best practices or curriculum regarding data security have not been integrated into departmental curriculums . in an era of increasing data security concerns , requiring in - person training provides a critical teaching opportunity . security requirements for any system are directly connected to the data requirements and the data source . most state and federal governments have enacted specific privacy protection laws to address personal and business information other common sources of research data such as health care organizations , government entities , or academic institutions that require implementation of specific security requirements . in the united states , these requirements might include , but are not limited to , the federal information security management act ( fisma ) , health insurance portability and accountability act ( hipaa ) , and family educational rights and privacy act ( ferpa ) . implemented security controls will directly affect operational procedures.6 therefore , careful planning is required to enumerate the types of data that will be analyzed over the lifetime of the system and to identify the most stringent data security requirements . in sedap , data access is managed through authorization to folders by assigning one of four different access rules : 
 role - based access , such as system administration or data management , is assigned to users based on task - specific responsibilities irrespective of project or data.institutional review board ( irb ) and study - specific access is assigned to all staff specifically assigned to an active study and leverages the existing academic institutional irb approval systems.data use agreement ( dua ) access is assigned to the few individuals who require access to an entire  raw  data set , or who subset data for others and are involved in merging and linking data.team level access is used for exploratory work and collaboration within multidisciplinary settings . role - based access , such as system administration or data management , is assigned to users based on task - specific responsibilities irrespective of project or data . institutional review board ( irb ) and study - specific access is assigned to all staff specifically assigned to an active study and leverages the existing academic institutional irb approval systems . data use agreement ( dua ) access is assigned to the few individuals who require access to an entire  raw  data set , or who subset data for others and are involved in merging and linking data . team level access is used for exploratory work and collaboration within multidisciplinary settings . a global security management plan outlining these access rules was developed and is compliant with all regulatory requirements associated with executed duas as well as institutional , state , and federal rules . this written plan helped to build trust with the data suppliers and provides the baseline for contractual agreements . within our institution we were able to leverage global security controls such as common user ids and network security , while others controls had to be developed from the ground up . the infrastructure allows users to connect through dedicated remote software to virtual desktops such as microsoft windows or linux . this approach allows a bring your own device ( byod ) model and accessibility from the wide variety of devices within the academic workplace . the environment allows users to disconnect from a virtual desktop from device a and reconnect from device b without disrupting jobs and analyses . this model provides flexibility for users and projects while the configuration of sedap facilitates standardization of key scientific process such as project tracking , data structures , access controls , and documentation . sedap configuration has helped build a culture of transparency for an academic environment that requires replication of tasks and analyses across data samples . for research on large , disparate health care data sets , it has reduced duplication of effort and has increased efficiency as users are trained in the same way and have access to the same sets of tools and to a systematic platform for sharing programming code and other information . a specific benefit of a vdi is that a computing job requiring extensive time will not be interrupted when the user disconnects . this is particularly important for complex queries or simulations using large data sets that may take days to run . the virtual machine inside the vdi continues to run and process any or parallel jobs that have been started . we further implemented a messaging system that can transmit messages from within the secure environment to a web portal and that notifies users via email of changes in job status . this allows them to know when jobs have completed or been interrupted without having to log into the computing environment . this messaging system has significantly helped with efficiency regarding large jobs that take days to run but may unexpectedly be stopped due to software failure , allotted disk space , or even model parameterization failure . before implementing the system , the performance requirements were assessed with a set of benchmarks that measured the existing computing resources available to the users . the disk i / o performance was measured at the end user level , meaning an average of the performance on top of the operating system . since our data size requirements exceed 10 terabytes , a solid state disk ( ssd ) setup for laptops or desktops was not measured . the outcomes of the data conversion benchmark ( figure 3 ) show that increasing i / o performance significantly affects the data processing performance . the iciss daily workflow often requires scanning and creating more than 100 gb in a single analytical step . to reach high performance read and write rates of over 300 megabytes per second additionally , advanced data caching and buffering is implemented to absorb the high demand of data . the resulting vdi environment performs on data operations at a level of a high performance desktop environment with ssd . during the first two years of operation , we experienced a shift in the performance bottleneck . with users no longer having to waiting for larger jobs to finish , the threshold of the data size per job increased . we were able to address some of these with training and implementing best practices at the level of individual users . entertaining the concept of building a large platform can be daunting . finding the right balance between performance and cost costs add up quickly , and making a business case to replace a running legacy system with a newer and more expensive system can be hard to sell to stakeholders who may not understand the technical details or requirements of the team . we adopted a bottom - up approach to cost estimation and system budgeting by first calculating the costs of a traditional analytic workstation . basing our estimate on the price of a high performance workstation with a cost of $ 4,500 and a three year warranty , we elected to use a yearly $ 1,500 per user as a rough baseline for hardware . the resulting aggregate of 50 users for four years resulted in $ 300,000 for infrastructure . by working closely with unc its - rc , we were able to identify opportunities for the sedap to leverage existing campus infrastructure such as server room space , networks , power supply and backup , technicians , and operational staff . slower disks based on serial at attachment ( sata ) technology are considerably cheaper than high performing solid state drives ( ssd ) . using cloud storage solutions might also be an option as long as all the security considerations are met . we elected to operationalize both cheaper  slow  and a more expensive  fast  storage . data that is in active analysis and temporary caching will use the  fast  environment while less performance - dependent information uses the  slow  space . costs associated with operationalizing the platform for users are another factor that is less easily estimated but can not be overlooked . account creating , access provisioning , troubleshooting , interfacing with representatives from its , and user training are critical activities that cost staff valuable time . this staff support time is also not easily recuperated or justified with extramural funding in an academic environment . yet these activities and staff support are essential to transform the environment into a true solution for users , and the costs associated with delivery of these services must be incorporated . we learned that key aspects of personnel and staff cost were the identifying of and teaming up with existing organizational resources . in our case , we closely tracked hours spent by our service provider in these activities for each  seat  created in the first four months of system deployment ( to account for the learning curve associated with new processes ) , and calculated the proportion of the employee s fully burdened salary that this time represented . each research study utilizing the platform was then assessed a fee equivalent with these costs . the nature of this fee is dependent on funding type : for those funding vehicles permitting computing costs , a flat fee was assessed . for funding mechanisms that only fund personnel , a fraction of the service provider s salary was included in the budget of each proposal . licenses for a virtual platform and end user software can also be very expensive and contribute to overall and maintenance costs . we were able to leverage  educational institution  licenses , but to avoid overspending on these licenses user input was directly sought to limit the selection of tools within the sedap . a list of tools currently used in the legacy computing solution was expanded to include tools requested by users based on their existing skill set and planned professional development . once the initial list was finalized , we were able to take advantage of institutional discounts and bundling of licenses to provide a wide variety of tools at reduced cost . some of these tools include sas , stata , r , arcgis , qgis , mathematica , pearl , php , sqlite , latex , and oracle sql developer . the tools are preinstalled in two different microsoft windows base images supported by the vdi . one image is intended for use of data containing identifiers and is focused on data management . tools installed in this image are intended to support tasks including file decrypting and encrypting , packing and unpacking of archives , export - transform - load ( etl ) , database loading , and file conversion . these tools support statistical analysis ( including simulation ) , geospatial analysis , network analysis , and documentation tools . to guarantee rapid deployment an image is assigned to the new user . at the point of authentication , a copy of the image is prepared unless the user had an active image from a previous connection . this configuration works well if physical separation of space is required , but it exponentially increases the administrative work to maintain updates . traditional computing cluster , data warehouses , or modern appliances can also easily be integrated into a vdi . tools training : the configuration of commonly used tools such as sas , stata and r likely differs from the  out of the box  setup . the adjustments within the vdi can be specified to optimize performance based on user requirements . having users continuously involved with defining best practices of specific features of these tools creates a valuable knowledge library . to this end , we actively solicit feedback from user groups and facilitate communication in order to share their experiences and improve performance . this group is the primary source of new requirements to alter configurations or add new tools . the user community also maintains a web - based faq repository to retain and share knowledge . security training : as part of the global security management plan , our administrative team provides security training for all users before they are granted access . a signed workforce authorization serves as an internal contract and clearly defines the understanding of rules and sanctions . we also leverage and track required training imposed by the academic institution and the health care system . research personnel at the university are required to complete an ethics training in order to participate in research requiring irb review . despite these institutional requirements , best practices or curriculum regarding data security have not been integrated into departmental curriculums . in an era of increasing data security concerns , requiring in - person training planning , financing , building , and operating a secure computing and analytic system can be a long process . in an academic environment , this also requires collaboration between diverse multidisciplinary stakeholders who may not usually interface or have the same priorities . it is always challenging for stakeholders and customers to remain objective and evaluate whether a technical platform will meet the requirements , especially while commercial vendors are promoting products as being optimal and complete solutions . it is important not to fall into a  if we build it , they will come  fallacy , and instead to build with careful collaboration and extensive discussions with users . this way , investments can be maximized and expectations are clearly communicated . an important aspect of understanding our user expectations was the implementing of the data management benchmarks . during this process we were able to test our performance expectations , and to clearly and objectively set expectations for end users . implied in the building on existing infrastructures versus building an enclosed and dedicated system are that the availability and stability are dependent on the leveraged infrastructures . a system architecture enabling scalability supports unexpected growth and staging of cost throughout the life cycle of the environment . this framework was developed for a large data analytics program and was key to the development of the sedap computing environment . sedap adoption by a user group representing multiple health care data researchers and data managers from multiple schools across unc has been rapid . next steps for this system include standardization of information and data structure normalization to improve access to the data . we hope to accelerate cohort discovery and to shorten the life cycle of grant development and research projects by deploying a consolidated observational medical outcomes partnership ( omop ) model within a relational database system . the framework and processes of benchmarking and soliciting user inputs will continue to help with implementation and evaluation .
introduction : large amounts of health data generated by a wide range of health care applications across a variety of systems have the potential to offer valuable insight into populations and health care systems , but robust and secure computing and analytic systems are required to leverage this information.framework:we discuss our experiences deploying a secure data analysis platform ( sedap ) , and provide a framework to plan , build and deploy a virtual desktop infrastructure ( vdi ) to enable innovation , collaboration and operate within academic funding structures . 
 it outlines 6 core components : security , ease of access , performance , cost , tools , and training.conclusion:a platform like sedap is not simply successful through technical excellence and performance . 
 it s adoption is dependent on a collaborative environment where researchers and users plan and evaluate the requirements of all aspects .