Projects in the Protected Environment
To access the Protected Environment (PE), you must either request that a new project be hosted in the PE or be added to an existing project. Before beginning this process, ensure you have an active University of Utah account (uNID), which is required to access CHPC-managed environments.
Setting up a New Project in the Protected Environment
The Protected Environment (PE) is suitable for projects involving Protected Health Information (PHI) along with other data types with additional security requirements not met by the General Environment. However, not all projects are suitable for the PE.
Projects that do not Require Protected Environment Resources
Not all projects require resources in the PE. Additionally, you may be able to use services such as REDCap or Box to collect, collaborate on, and store data.
If your data are deidentified and not subject to regulation or contract, there is no requirement to use the PE, or other secure computing environments, unless specified in a data use agreement or similar document. For more information on what information is protected, please see a summary of the HIPAA Security Rule.
It may be that your project needs can be served by using the REDCap (Research Electronic Data Capture) tool. REDCap can be used to create web-accessible forms, a secure database with continuous auditing, and a flexible reporting system. More information can be found on the REDCap training page. To determine whether the REDCap tool fits with your project, please contact REDCap Support or see ServiceNow - Survey Tools for more information.
The University of Utah instance of Box, https://box.utah.edu, can be used to store PHI (according to the Acceptable Use Policy). To use the Box instance for PHI, users need to create a specific University of Utah Box account - personal Box accounts cannot be used. If your project only requires a storage space for a volume of data below the limit on Box, you likely do not need PE resources. If you need to store and process data (HTC, HPC, SQL, etc.) or use SAS/STATA and/or other applications, your project's needs are likely better served via the CHPC's PE.
Projects for which the Protected Environment is not Appropriate
The PE is not suitable for projects with stringent security requirements, such as compliance with FISMA standards or NIST SP 800-171 or NIST SP 800-53. This includes projects involving Controlled Unclassified Information (CUI). Increasingly, such security requirements also apply to genomic data. If you have questions or concerns about the nature of your data, please contact us.
The CHPC operates a small environment that is compliant with NIST SP 800-171. Additionally, we are working on a larger environment for regulated research computing projects. If you have a project for which compliance with NIST SP 800-171 or other security controls is necessary, please contact us.
New Project Request
For new projects, please submit the Needs Assessment form on the CHPC Portal with all required information. We will respond to your request as soon as possible. In the meantime, please feel free to contact us with any questions. If you already submitted the Needs Assessment form, you may view its status on the CHPC Portal.
| The CHPC reviews submitted Needs Assessments weekly. |
Requirements for New Projects
Some projects may require review by other entities at the university.
Depending upon the scope of the project, an Inherent Risk Survey may need to be done by the Information Security Office (ISO) Governance, Risk & Compliance (GRC) group. For more information, please see Policy 4-004. If necessary, a risk assessment and mitigation plan must be approved by the Information Security Office. In addition, a satisfactory scan report must be completed. For more information about the process, contact this group via iso-grc@utah.edu.
If there is any information sharing with third parties, an Information Sharing Assessment Form (ISAF) needs to be initiated with the Privacy Office to determine if a Business Associate Agreement (BAA) is required. The ISAF must be completely filled out by the requesting department and returned for evaluation by the Privacy Office. The Privacy Office will determine the need for a BAA or other agreement to protect the information being shared. The ISAF form can be found on the Business Associates page. Please refer to the university's Privacy Office for details and help. Please be sure to send the CHPC any existing contracts or BAAs you may have with third parties.
If there are or will be any accounts provided for people outside the University of Utah (e.g., researchers from another institution), a University of Utah Non-Employee Confidentiality and Security Agreement must be signed and sent to the CHPC for our records. Please contact us if you have any questions about this form and when it is needed.
Additional Project Resources
Groups may purchase additional resources for their project(s) in the PE. Available resources include storage, virtual machines, a compute allocation, and dedicated compute nodes.
If the new project needs additional storage beyond the free 250Gb tier, you may purchase additional project space. See the PE storage page for details about storage options and prices. Backups can also be purchased upon request.
Virtual machines provide specialized environments and hosting services when the HPC cluster and Windows server do not address your project's needs.
If you have an active project on CHPC systems that requires a new VM to be provisioned, please request one by contacting the CHPC. If your project is not yet active on CHPC systems, you will need to submit a Needs Assessment detailing both your project and your VM needs. Any PE virtual machine requests must come from the PI or their deligate; see 1.4.2 Virtual Machine Allocation Policy. For VM block sizes and costs, please refer to the VM documentation page.
For information about allocations on the Redwood cluster, please see the allocation documentation. Allocations are requested through a separate form and are not a part of the Needs Assessment process. Requests can be made by the PI of the project or their delegate, provided the delegate also has a PE account.
| Allocations in the Protected Environment are currently reviewed and awarded by CHPC staff. |
As in our General Environment, users in groups without allocation can run in the freecycle mode on general nodes or as guest on the owner nodes, subject to preemption by jobs with allocation or owner jobs, respectively.
Research groups can purchase compute nodes that are added to a CHPC-operated cluster. Researchers from the group that own a node have priority access to the node. If you are interested, please contact us; we can provide quotes for nodes. Nodes may be purchased by contacting the CHPC directly; this is not a part of the Needs Assessment.
Gaining Access to a Protected Environment Project
The PI of the project can invite project members to the project by going to https://portal.chpc.utah.edu/invite, selecting the project, and inviting the project member. The new project member will receive an invitation via email. When accepted, their access will be granted immediately, given that the new project member has completed their HIPAA training and is listed as Study Personnel on the IRB (if applicable) of the project.
|
If you are requesting access to a project with an IRB or RGE record, you will need to be listed as personnel associated with the project in ERICA, the University of Utah Compliance System. To ensure compliance with regulations, the CHPC is only able to provide access to projects for individuals listed on relevant IRB or RGE records. If you are not listed as study personnel, or if you are unsure whether you are listed as study personnel, please consult the Principal Investigator of the project. |
If you do not have a PE account, one will be created for you when you accept the PI invitation. If you already have a PE account, your account will be updated to provide access to the new project.
Connecting to the Protected Environment
Once you are part of an active project withint the PE, you can now connect to resources within the PE.