Secure Data Facility

CPC's Secure Data Facility (SDF) has two distinguishing features: (1) controlled entry and (2) computing equipment configured to accommodate only authorized users and appropriate use. SDF has one entry which is always locked with a combination pushbutton lock. The combination to the door is locked in a safe which is stored off-site and is used exclusively for the SDF. Only SDF Team members have access to the combination for this safe. The combination to the door is changed whenever anyone loses authorization to use the SDF. Inside the SDF are two protected computers, networked to each other and a secured printer only, with software needed by the researcher. The computers are locked inside a cabinet and the keys to this cabinet are stored in the SDF safe.

CPC SDF Team

· Tim Van Acker, Head of Systems & User Service
· Tim Rath, Systems staff
· Allan Christman, Systems staff
· Phil Bardsley, Application Programming/Statistical User Service

Gaining Authorization to Use the SDF

All CPC affiliates are eligible to use the SDF. A CPC Affiliate is either a Fellow, Trainee or a UNC faculty or student sponsored by a CPC Fellow or the Director. Researchers from outside UNC are eligible to access the SDF as CPC visiting scholars. The following steps are required to gain permission to use the SDF.

Submit a data protection plan to the sensitive data provider. CPC strongly recommends that your plan include members of CPC's SDF Team as signatories to any data protection and usage agreements you establish with the data vendor. You should also have the plan reviewed by Tim Van Acker, Head of Systems & User Service, before submitting it to the data vendor.
Provide CPC with:
a) A copy of the plan approved by the data vendor and the data vendor's authorization to use the data. The authorization should identify the research data content, list all authorized researchers, and the length of time for which access is granted.
b) A copy of the principal investigator's letter of authorization from your institution's IRB.
Sign the CPC SDF Access Agreement (Add Health researchers will use the Add Health Data Access Agreement). Only researchers and staff who sign these documents are allowed in the SDF, whether they are using the equipment or not.
Fill out the form Request for Access to Space, Equipment, or Services (see CPC's personnel manager, Joyce Vines, in room 208).
Provide the data to a member of the SDF Team for transfer to online storage. Removable media containing sensitive data will be kept in the SDF safe.

Using the SDF

Authorized users may use the SDF at any time, but to avoid overbooking the room please use the online calendar to reserve your seat. Use of the computer equipment will be automatically logged. Each authorized user of the SDF will be provided with:

the combination to the SDF entrance
a suitably restricted computer account
a training session for using the computer equipment

Users who need to print results will print to the secured printer in the CPC network room and will not be able to get the printout until it is reviewed for confidentiality risks by an authorized member of the SDF Team. If the printout is thought to have no risk, then it will be given to the researcher. Otherwise it will be shredded.

SAS for Windows, the Microsoft Office Suite (including Word, Excel, Access, and Powerpoint), Norton Antivirus, and Winzip will be available on the SDF computers. If you require other software, please bring a licensed copy to be installed for your use.

Terminating Use of the SDF

When the user either has no further need of the data, or the period of authorized access has expired, the following steps will be taken:

The sensitive data will be released from online storage with a secure erasure procedure.
The user's account will be removed.
The combination to the SDF entrance will be changed, and all other authorized users will be notified of the change.
The offline copies of the data will either be returned to the data vendor or destroyed.