The EPIC-Norfolk StudyData is accessed through a trusted research environment (TRE) known as SRCP where you access the data and run your analysis within the EPIC-Norfolk systems.
Secure Research Computing Platform (SRCP)
What is SRCP?
SRCP is a secure and controlled analysis environment provided by the University of Cambridge Research Computing Service. It allows researchers to access and analyse EPIC-Norfolk datasets for research, similar to a secure reference library. Rather than extracts of individual level data being ‘released’ to users, SRCP provides access to a secure analytics environment so researchers bring the analysis to the data. Results are checked to make sure they align with the research objectives and sensitive data is not being taken out before being removed from the platform.
Why do we use SRCP?
Previously, to access personal/sensitive data we would be required to complete a Data Transfer Agreement for us to be able to give you a copy of the data to process on your own systems. This is in order to comply with Data Protection laws as well as to comply with the funder conditions under which the data was acquired, which we are obliged to pass on to onward users of the data. Getting this agreement in place takes some time (several months), and an alternate method of getting you access quicker is to use SRCP, which effectively treats you as if you were a member of our department.
What can be done with SRCP?
SRCP is Linux-based and has standard analysis software such as R and Python available, along with tools for more specialist ’omics analyses. There is scope to add new software that is not currently is assessed on a case by case basis. Containers can be run via Singularity. Computational resources can be provided to meet your analysis needs on a cost recovery basis.
How do you access SRCP?
We would first need you to complete some training and sign a visiting worker agreement, which effectively treats you as if you are a member of our department. Once the visitor’s agreement has been set up, an IT account will be created which in turn allows your SRCP account to be activated. Accounts are specific to individuals and must not be shared. A project will be set up on SRCP and your data will be saved into a secure folder that you are able to access. Multiple users are able to access the same project.
How are results that are to be taken out from the SRCP checked?
Results that are to be taken out of the SRCP are checked to minimise the risk of confidential information about an individual being revealed – this is called statistical disclosure control (SDC). Even when direct identifiers are removed, results such as tables, charts, or summary statistics can sometimes allow people to be identified indirectly, particularly where small numbers or unusual values are involved. Researchers are expected to understand the principles of SDC and to design their analyses so that they manage risk appropriately. Making it easy for an output checker to do their job by providing good descriptions of the results and how SDC has been applied will mean it is more likely that outputs will be approved quickly. More information can be found here: https://srcp-docs.readthedocs.io/en/latest/03-Taking-files-on-and-off-SRCP.html#explanation-of-file-transfers-on-the-srcp
Can machine learning models be removed from the SRCP?
We recognise the significant opportunities offered by developing machine learning (ML) models using EPIC-Norfolk study data. However, the removal of trained ML models from the SRCP presents disclosure risks that are not yet fully addressed by existing practical guidance. In particular, ML models represent a new class of research output, for which the potential to disclose individual-level information is less well understood than for standard statistical analyses.
While robust policies and procedures exist for disclosure checking of conventional analytical outputs, there is currently limited consensus on how to assess and mitigate the risk that trained ML models may leak individual-level data once released from a trusted research environment. This challenge is not unique to the SRCP, and we are actively engaging with external experts to align our approach with emerging best practice as it develops.
In the interim, our policy is to generally prohibit the removal of ML models trained on EPIC-Norfolk study data from the SRCP unless there is compelling evidence that they do not pose a risk of individual-level data disclosure. Subject to standard output checking, ML model performance metrics and hyperparameters may be released.
SRCP service and infrastructure charges
While we do not charge for the data itself, we apply a service and infrastructure fee for accessing data via the SRCP. This contributes to the costs of establishing, maintaining and supporting the platform.
For a standard academic-group setup, indicative charges are:
- Project fee: £1,000 per year
- User fee: £500 per user per year
These fees cover a standard allocation of processing power, memory and storage, together with a standard level of environment preparation, data preparation, onboarding and user support. Where a project requires additional technical resources, data preparation, analysis support or other non-standard work, we will agree any additional charges during the application process.
Fees are:
- Calculated for the total agreed project period, subject to a minimum period of one year.
- Charged in full-year increments; any part of an additional year is charged as a full year.
- Subject to VAT where applicable.
- Payable (in advance) for the full agreed project period.
Start of the chargeable period
The agreed project period, and the associated charges, begin on the start date set out in the Visiting Worker Agreement. This date will normally be the day on which the agreement is confirmed and work to prepare the project starts, including setting up the SRCP, preparing data, and completing onboarding arrangements.
Researchers must complete all required access and onboarding procedures before they can use the SRCP. We will work to help users complete the required onboarding steps as promptly as possible, but the project period begins on the project start date and does not wait until user access is activated, as SRCP resources and staff support are committed from that date.
Project duration and extensions
Researchers should ensure that the requested project period includes sufficient time to complete their planned analysis, prepare and submit outputs for publication, and address any comments arising from peer review or other approval processes.
It is not possible to suspend or “freeze” a project at no cost during periods when work is temporarily paused. SRCP resources, project configuration and support arrangements remain in place throughout the agreed project period.
If access is required beyond the agreed project end date, an extension must be requested and approved before the end of the existing project period. Extensions will incur further charges and will require a new invoice.
SRCP availability
The SRCP is delivered and supported by a central University of Cambridge team on a best endeavours basis. We will use reasonable efforts to provide and maintain the service, but no guarantee is made regarding service levels, uptime or uninterrupted availability.
Summary
· SRCP is the standard way to access EPIC-Norfolk data for analysis.
· You are limited to using the software available on SRCP system.
· You are not able to remove the data from SRCP, only the summary results that are relevant to the research (once approval is given).
More information can be found in the SRCP documentation.