1. Tryggve project developing services for sensitive biomedical data: Call for Nordic use cases NeiC 2015 Conference Workshop on sensitive data Antti Pursula 5.5.2015 Espoo, Finland

2. Use of sensitive data in research Data collected by hospitals, public health authorities, researchers, biobanks, etc. has tremendous potential for improving human health if made available for biomedical research. However, the data is usually identifiable to individuals Utilizing sensitive data in research is allowed but specific ethical, legal and technical measures need to be taken to protect privacy of data subjects 2

3. 3

4. 4

5. Use of sensitive data in research Utilizing sensitive data in research is allowed but specific ethical, legal and technical measures need to be taken to protect privacy of data subjects Nordic Tryggve project aims to enable the use of sensitive data in biomedical research by addressing – data processing, storing and transfer – best practices and processes (e.g. in AAI) – requirements of legislation in Nordics 5

6. Tryggve project – platform for sensitive biomedical data 6 Nordic 3-year collaboration on sensitive biomedical data funded by NeIC and the ELIXIR nodes in Denmark, Finland, Norway & Sweden Main goals – Facilitate sharing and combining sensitive data between countries – Enable projects to store and process sensitive data securely Tryggve is user-driven: Use cases submitted by the research community are implemented.

7. Themes in the Tryggve project Technology development Interoperability of systems Process development Legal environment Use cases 7

8. Themes – Technology development Purpose: Provide secure computing environment for analysis of sensitive data. “Building blocks” – TSD 2.0 service at USIT, Norway – Mosler service at BILS, Sweden – ePouta IaaS at CSC, Finland – Tools registry at DTU, Denmark Variety in the systems involved offers flexibility to handle different user demands 8

9. Themes – Interoperability of systems Purpose: Enable data transfer between systems and improve their joint use. Tasks include – data transfer service – portable software installations using Docker containers – shared computing resources – study requirements for common authentication and authorization mechanisms 9

10. Example of interoperability: Shared computational resources across Nordics Aim: Enable use of resources across Nordic ELIXIR nodes. Mosler service in Sweden offers PaaS environment for processing of sensitive data, and ePouta in Finland offers IaaS resources Offering compute and storage resources from ePouta for Mosler will bring benefits: – When Mosler hardware resources are full or not available – When data resides at ePouta and users wish to use Mosler frontend – When legislation or practices require dataset not to be moved outside Finland Requires connecting two infrastructures and a dedicated network connection between systems 10

11. Themes – Process development Purpose: Share best-practices in service operations and improve usability and accessibility of services. Tasks include – optimizing account delivery process (2-factor authentication) – sharing experiences in IT security and security reviews – improving (or harmonizing) customer contract processes – possibilities for resource sharing across countries One important aspect of Tryggve is to share knowledge in the field of the project in Nordic countries. 11

12. Themes – Legal environment Purpose: Review legal framework relevant to using sensitive data in research in Nordic countries and provide guidelines for legal requirements for trans-Nordic studies. Tasks include – assessing relevant legislation in Nordic and EU level – analyse legal requirements and conditions in some of the use cases Work can be shared, e.g. NordForsk NORIA-Net report on Joint Nordic Registers and Biobanks includes overview of legal framework – http://www.nordforsk.org/en/publications/publications_container/joi nt-nordic-registers-and-biobanks-a-goldmine-for-health-and-welfare- research/view 12

13. Themes – Use cases Purpose: Implement and support concrete use cases to facilitate great research and to attach project in real user demands. Use case presents an actual and specific need at a research group Cases can be submitted continuously during the project. – Prioritization of use cases decided by Tryggve Steering group Work within a use case is collaboration between Tryggve project (implementation, technical support, etc.) and researchers (requirements, testing, pilot use, …) Instructions to submit use cases on the project web site wiki.neic.no/wiki/Tryggve 13

14. Use case example: Trans-Nordic Gene-Environment Analyses in Schizophrenia Aim: Systematic evaluation of the interaction of genetic risk with environmental risk factors for schizophrenia All genetic and environmental data now exist and could be analysed, however the data are siloed within individual research groups and unavailable for combined analysis. “To accomplish the scientific aims, we require a secure place to conduct harmonized analyses of gene-environment interactions and risk of schizophrenia. “ Use case by: Prof. P. Sullivan (KI, Sweden), and collaborators in Finland, Denmark and Norway. Tryggve project to provide secure processing environment and to perform legal assessment of trans-Nordic use of the data 14

15. Proposing a Use Case for Tryggve is easy 15 More information at https://wiki.neic.no/wiki/Tryggve#Use_cases

16. Tryggve end products - Added value for the users Trusted platform for services on sensitive data in Nordics – Store, share and process sensitive data for research – Simple way to apply for permission and get access to services – Facilitate powerful projects on the Nordic level Platform shown to comply with legal framework 16

17. Thank you For updates check project web page wiki.neic.no/wiki/Tryggve Contact Project Manager Antti Pursula antti.pursula@csc.fi 17