A conversation with eDRIS: Part 2

In Part 1 of our conversation with the Electronic Data Research and Innovation Service (eDRIS), we heard from Research Coordinator (RC) Jules. In the post, Jules described what a typical day might look like for an RC. The idea of the post was to provide researchers with an insight into what the job of an RC involves. Overall, my hope was that having this insight might help to better align researchers and RC’s understanding of what one another are doing on a daily basis. In this post, I reflect on the goings on of Jules’s day and ask Jules some follow up questions.

If you want to skip through to any specific questions – for example skip right to the end for some Top-tips!!!- then click on the question headings below:

1: How many projects does an RC normally have on the go at once? 

Twenty-five is actually at the lower end of the scale for us. When demand is really high, it’s not unusual for RCs to carry up to 40 live projects and also deal with up to 20 enquiries on potential projects!

Back to contents.

2: Are there instances where you would arrange meetings with researchers to have discussions about their projects?

Yes we frequently arrange phone calls to discuss issues. Like a lot of people, many of us are working from home and this has sped up the adoption of remote working tools. For Public Health Scotland, we have access to MS Teams and we are using this more and more for meetings with researchers. As a former researcher, I am aware of the need to plan research carefully. Now with my role in eDRIS, I am aware of potential issues that researchers may not think of early on. We do try to have meetings with researchers early on, even before permissions applications start, mainly to ascertain if the data requests are feasible. It may seem like we don’t respond quickly, and, though this can be true, I hope part 1 of this blog has given a little bit of insight into some of the reasons for this!

Back to contents.

3: What are the most common issues you see with requests from researchers? Equally, what does the perfect SDC request look like?

It doesn’t need to be perfect. We get that researchers are busy juggling competing demands so the request just needs to be good enough so that the reader can understand the context enough to assess easily. The framework eDRIS operates under is what is called the ‘Five Safes’. This is a way to model the whole process, from permissions through to outputs. The basic principle is to break projects into five themes: Safe People, Safe Projects, Safe Setting, Safe Data and Safe Outputs. SDC requests fall into this last theme. When we look at outputs we are asking ourselves if there is any risk of disclosing confidential information from this output. We have to judge several things: Does this output disclose anything on its own, does this output in conjunction with other data that may be available increase the risk of disclosure and lastly, what is the damage that would be done if something were disclosed.

Output checking requires us to have a good working relationship with our researchers, as we may ask them to do something that they don’t agree with. With all that in mind, a good enough output would be one where we, as output checkers, can look at it and say “Ah, there’s a title, clearly labelled, acronyms expanded, this researcher has explained all of the outputs clearly to a non-specialist, there’s enough information in this file for me to understand what I’m looking at and make an informed assessment, and where there are disclosure risks, they have mitigated against them and provided an explanation of what has been done, and they have asked us only for the most important outputs for their research” If we can see all of these, then output checking becomes a routine check for us and outputs, I can’t emphasise this enough, are released much quicker. We know that us asking researchers to look at outputs again is frustrating, as it’s also frustrating and time-consuming for us (we don’t like going back to researchers either…).

Over time, if the outputs from researchers are easy for us to check, we trust that researcher more, and it will be easier and quicker for their outputs to be released.

Back to contents.

4: Can you quickly explain the difference between HSCPBPP and SPBPP?

The Health and Social Care Public Benefit and Privacy Panel (HSC PBPP) and the Statistics Public Benefit and Privacy Panel (SPBPP) are the main bodies, we interact with, that assess project applications and decide whether permissions are given to access confidential data. The difference is HSC PBPP represent NHS Scotland so decide on applications to access NHS Scotland datasets, and SPBPP represent the Scottish Government (SG), and decide on applications where the researchers want to access e.g. Census data or Education data. Where the project intends to link NHS Scotland and SG data, applications to both panels are required.

Back to contents.

5: How often is it that you, as an RC, would flag up to researchers that their training is about to expire? Is this something you routinely check for?

As you say, this is the responsibility of the researchers. However, as we are also responsible for ensuring researchers meet the conditions of their permissions, we do make sure that IG training is still valid. For projects using the safe haven, we set accounts to be disabled on the IG training expiry date. In tandem with this measure RCs also periodically remind researchers that their training is due to lapse to avoid the situation where the researcher contacts us to let us know they can’t access the safe haven! Obviously this is not ideal, as it adds delays while training is renewed, so it’s far better that researchers take responsibility for being aware that their training is up to date Again I don’t have any wonderful solution that comes to mind at the moment but there must be some simple steps researchers can take to make sure we don’t end up in the position where our IG training is about to expire and we haven’t planned to get updates (i.e. by booking onto a Safe Researcher Training course). Something as simple as setting a calendar reminder when we first do and pass our training?! Or maybe a month in the year where we encourage researchers to check- Information Governance Ganuary?! This has actually prompted me to check mine…

Back to contents.

6: Is there any kind of trouble shooting list that researchers can refer to before they contact their RC in panic? I suppose this might minimise the frequency of the scenarios like the one you mention arising.

The main reasons we see for safe haven access are actually forgotten passwords, but this is usually obvious to the user!The first thing to be aware of is the safe haven web page is only accessible from recognised IP addresses, which are always associated with your host institution (e.g. the University). If you are not in the office (true for most people nowadays!), make sure you are on the university VPN. This will give an ‘Access Denied’ message if the IP address is not recognised.The least common issue is with the two-factor authentication PIN codes. The system used for the 2FA PINs very rarely fails (only once that I am aware of!), so if PINs are not being received, it’s usually something else. The most common reason is the user has entered the wrong username, these are different from the subsequent logins and researchers sometimes forget. The next most common reason is lack of mobile phone signal. If you have not received a PIN, check these first.
Finally, if you are not sure, just ask us!

Back to contents.

7: Is there somewhere that researchers can see what the rules are around proportionate governance issued by HSC-PBPP?

If we knew which of our requests would need to be sent for higher approval then we might reassess the situation and work out what is the best approach to take before coming to you with something that you then need to explain needs higher authorisation. This would be especially useful in cases where time constraints are tight for research projects. I suppose this comes back partly to understanding what is a ‘quick-question’ and what isn’t.

The governance around amendments is always evolving, so these rules are given to us as guidelines. RCs still frequently ask the panel mangers for advice! This is purely because of the diversity of projects, so I think it would be difficult to pin down every scenario and how each may be treated by the panel and eDRIS. The best way for researchers to figure out which amendments are the least controversial is to ask their RC! Another source of information is the amendment request form available from the HSC PBPP website, in conjunction with the guidance for applicants document, also available from the same website.

Back to contents.

8: What’s the most common email template you use?
The most common template, by far, is to ask researchers to complete a new enquiry form. Internally, the most common template is the safe haven password reset form… Since I wrote this article, eDRIS have developed, and continue to develop new tools, which has reduced the number of template emails we have had to use. It would be interesting to hear if researchers have noticed changes in the safe haven password reset processes, as this is now relatively painless for us!

Back to contents.

9: Would these things not have been flagged during RC and researcher discussions prior to submission? But in any case, would you say these are the most common queries that come back from the panel?

These issues will have been flagged by RCs before submission, but RCs can only offer advice, and it’s up to the researchers whether they choose to implement these! Most applications have at most, one or two of these items in feedback from the panels. It’s worth remembering that the majority of the applicants to eDRIS are first time applicants from a huge variety of backgrounds and will not have had to do anything like this before. As a researcher, a role I was in for many years myself, your focus is on the scientific or methodological merit of your research. Being asked to think of wider issues can be difficult to get right first time. I am guessing that this is a major factor in accounting for the frequency of these issues being highlighted. My advice would be to pay attention to the advice that your RC gives you (and read the guidance documents when you are completing the application form). I would say the data flow diagram is probably the most important piece of information to get right. This needs to show the source of the data (usually the individual records in a dataset), and each step in the journey from there to the place where researchers will access the final dataset. Once that is pinned down, it’s much easier for eDRIS to figure out what needs done, and for the panel to see where any risks are.

Back to contents.

10: Why are approved PBPP’s are not readily accessible to the public? I think this would improve transparency in the use of public/patient data, but also help avoid situations where researchers submit incomplete applications. Although all projects are different, it can often help to see what a successful application looks like, even if it is in an unrelated research project.

Do you have any view on this?

While a good idea in principle, the PBPPs contain confidential data! As an example, researchers’ emails, work addresses, professional registration numbers, signatures to name just a few. PHS have to process these under the same laws (GDPR, Data Protection Act) that we treat e.g. patient and employee records. I believe the eCRUSADers website has a link to the ‘Tooth Fairy’ application. I would recommend this as a resource for researchers to see what a complete application would look like. For transparency, PBPP publish abbreviated lists of approved projects and end of project summaries provided by applicants once projects are completed; these are available on the HSC PBPP website.

Back to contents.

11: What would be the top three bits of advice that you would give researchers whilst they make their way through the process of applying for and using administrative data in their research?

This is a tricky one, however, I will do my best!

1) Listen to your RC! We are well aware of the more problematic issues, but we usually have solutions to these. We can only offer advice, but we give this advice to help, not to make people’s lives difficult. We appreciate the governance arrangements are complex and can be confusing (see no 2 in this list), but we want to help.

2) Try to understand your project from the data controllers’ point of view. Data controllers want their data to be used for good, but they are also obliged by law to protect the privacy of the individuals whose data they hold. This applies from the moment you apply for access, right through to the point you request outputs for publication. RCs can help, but I would also recommend making use of the Information Commissioners website to understand data controllers’ obligations with regards to personal data.

3) Ask your peers and eDRIS. There are researchers and RCs that have many years of experience using administrative data in research. Your eCRUSADers website is a fantastic initiative.

If I could add a ‘bonus’ tip, please also let us know what causes you, as a researcher, the most pain. If it causes you pain, it causes us pain! We can’t promise to make swift changes, but we will do our best.

Back to contents.