*********************************
There is now a CONTENT FREEZE for Mercury while we switch to a new platform. It began on Friday, March 10 at 6pm and will end on Wednesday, March 15 at noon. No new content can be created during this time, but all material in the system as of the beginning of the freeze will be migrated to the new platform, including users and groups. Functionally the new site is identical to the old one. webteam@gatech.edu
*********************************
Atlanta, GA | Posted: December 15, 2022
Summary Sentence:
Many years ago, Georgia Tech’s Office of the Executive Vice President (EVPR), the Institute for People and Technology (IPaT), and the Georgia Tech Research Institute (GTRI) made a significant investment of people and resources to create a HIPAA compliant,
Full Summary:
No summary paragraph submitted.
Matt Sanders and Richard Starr picturedMany years ago, Georgia Tech’s Office of the Executive Vice President (EVPR), the Institute for People and Technology (IPaT), and the Georgia Tech Research Institute (GTRI) made a significant investment of people and resources to create a HIPAA compliant, highly secure, data-rich resource named the Protected Health Data Infrastructure (PHDI) which is currently housed in the Coda data center at Tech Square and jointly operated by IPaT and GTRI.
PHDI’s location is apt since Coda serves as the pinnacle of innovation for Midtown Atlanta’s Tech Square and houses some of Georgia Tech’s most cutting-edge research labs, including PHDI’s tightly controlled, highly specialized environment devoted to storing sensitive, complex, healthcare-related data. For example, the PHDI environment is outfitted with secure review rooms and layers of data security coupled with tightly-controlled access restrictions.
One of the big benefits of Georgia Tech’s PHDI and team, among many other benefits, is that researchers have access to many types of detailed, sensitive healthcare data including the Center for Medicaid and Medicare Services (CMS) Medicaid dataset from 2005-2016 with more CMS data (2017-2019) scheduled to be added.
Other health data stored include electronic medical records (EMR) from physicians including lab results, vital signs, demographics, diagnoses, and medical notes. Data held in Georgia Tech’s PHDI is not restricted to text and includes x-ray, magnetic resonance imaging (MRI), and computed tomography (CAT) scan data. Future collaborations with AI Caring whose mission is to develop the next generation of personalized collaborative AI systems will require new data types to be stored in the PHDI environment to further science in artificial intelligence as it relates to healthcare and aging. The amount of data stored in Georgia Tech’s PHDI environment grows each year.
According to Matt Sanders, director of research operations for IPaT and a key faculty member of the PHDI team, “Georgia Tech’s PHDI environment and support team is special for three reasons. First, PHDI is a secure enclave with very specific physical, technical, and administrative safeguards in place. Second, our PHDI (IPaT and GTRI) team members have in-depth experience supporting numerous and varied research projects dealing with sensitive healthcare data, and thirdly, our team serves as consulting experts to help Georgia Tech and industry researchers properly approach working with complex healthcare data that may or may not require the use of the PHDI environment which can help researchers save time and expenses.”
One of the valuable resources on the PHDI team, among many, is Richard Starr. Starr, a research scientist with IPaT, has acquired deep academic and industry expertise associated with health data management and healthcare research during his many years working to advance Georgia Tech healthcare research projects. He noted, “the original use case for this [PHDI] environment was the CMS Medicaid data set that Tech purchased which was focused on southern states and some other large states from 2005-2009. Today, we’re gathering data from across the United States and will eventually have the CMS data updated to 2019. We know how to properly collect data from other healthcare sources like hospital systems, or state health departments, and store it to meet HIPAA requirements. Georgia Tech spends more than $100,000 on healthcare data each year to improve PHDI as a resource for researchers. The startup cost to build PHDI was high because of the complex data and supporting infrastructure, and now we’re well equipped to assist with even more complex healthcare data research.”
OneGT Operating Model
PHDI has a OneGT operating model with support from Georgia Tech’s EVPR, IPaT, Pediatric Technology Center (PTC), GTRI-ICL, GTRC, OIT cybersecurity and network services, GTRI information systems, GTRI research security, and other Georgia Tech unit and lab IT and research professionals. The PHDI team provides healthcare data management, compliance, and domain expertise including: operational relationship and process management with sponsors and data owners; streamlined research pipelines through standard data transfer and ETL processes, databases and tools, training, software development, cohort and project identification/development; and streamlined Institutional Review Board (IRB) applications, data usage agreement(s) and contracting processing with Georgia Tech’s legal, contracting and partnerships work with GTRC, as well as HIPAA security and compliance assistance for project development and implementation.
PHDI is a Secure Enclave
PHDI supports projects, datasets, and users from any Georgia Tech or GTRI unit where PHI/PII compliance needs are required including HIPAA, HITECH, CMS, and sponsor specific requirements for fully identifiable, limited data sets, and de-identified data. PHDI is a secure enclave with modest compute and storage resources which can be provisioned to host project specific storage, applications, and services for analytics, research data collection, and systems integrations.
Researcher access to the environment requires CITI HIPS and IRB training and approval. Projects and/or data as well as all administrative, network, security, and compliance resources are segmented from one another with rigid role-based access, network, storage, and system controls. PHDI follows the HITRUST Common Security Framework as well as United States National Security Agency best practices to achieve HIPAA compliance, and undergoes an annual risk assessment, third party certification, and security penetration testing.
Protected data does not enter or leave the environment without agreed upon procedures and approvals (based on contracts, data usage agreements (DUAs), IRB requirements, etc.). Policies are enforced through the separation of roles (researchers, data management, compliance, administration). Data access models include secure review rooms, remote access over 2FA VPN, as well as secure mobile and web services utilizing web application firewalls (WAF). Restrictions and auditing of activities including file upload/download and cut/copy/paste are also provided.
Technical safeguards include multiple layers of differing security protocols protecting data in transit and data at rest with multiple vendor products as well as routine auditing, alerting, and reporting. The PHDI environment also mandates administrative safeguards and undergoes periodic (annually, or when significant change or threat merits) risk assessment and management processes to gauge the security of the environment and develop plans for mitigations of any deficiencies. Contact the PHDI team for more details about physical, technical, and administrative safeguards.
PHDI Healthcare Projects - Past and Present
Healthcare Data Consulting Expertise
In addition to leading or supporting healthcare data projects, the PHDI team also provides cybersecurity consulting services related to healthcare data. The team is available to both Georgia Tech and health-related industry research projects to help them pursue data-driven solutions in addition to solving a variety of issues—many examples of the PHDI’s team capabilities are mentioned in the projects above.
According to Sanders, “before the formation of IPaT more than 10 years ago, Georgia Tech had the Health Systems Institute along with disparate teams spread across campus working on diverse and important healthcare data projects. Since IPaT was formed to better integrate Tech’s overall healthcare research community, Georgia Tech has landed large research awards and industry projects because we now have better resources [such as PHDI] and expertise to win and manage very large, very diverse multi-year healthcare projects.”
