Wynton PHI environment, which is subset of the Wynton HPC environment, is approved for storing and working with Protected Health Information (PHI) data as long as the specific PHI-data usage is covered by the institutional review board (IRB) approval for the principal investigator (PI). This way, PIs can be confident that they are conducting their research computing with PHI in a compliant environment.
Wynton team has worked closely with UCSF IT Security and the UCSF Privacy, Legal, and Risk (PLR) group to follow the best practices in addressing security and privacy related risks. We obtained the services of an outside security consulting firm to put together a System Security Plan (SSP) based on the NIST 800-53 revision 4 framework from the US federal government. The SSP lists twelve security domains with a total of 156 risk control categories. The SSP then describes how Wynton PHI addresses each risk control, and clearly identifies the owner of each risk control. The Wynton team reviewed this SSP with IT Security and PLR for their support of the plan and also went through a security risk assessment with IT Security which assigned an overall risk level of “Low”.
Please note that Wynton PHI employs a shared risk model that relies on individual PIs and their research team members to own certain risks and follow the guidelines set in Wynton User Agreement as well as UCSF Minimum Security Standards for Electronic Information Resources.
2021-12-17: Contrary to Wynton HPC, we can currently onboard only UCSF staff and UCSF affiliates who have a UCSF ID on Wynton PHI. We are working on allowing also non-UCSF research collaborators to get a Wynton PHI account with approval from the PHI project’s PI.
To apply for a new Wynton HPC account with PHI access, or to update an existing account for PHI access, please follow the instructions for requesting or updating an account. This will initiate an automated onboarding process to check that you meet the following prerequisites:
Valid email address
PI approval to work on Wynton PHI
Attested to UCSF Statement of Responsibility
Once these are completed, you will be notified of your account credentials to access Wynton PHI. If you already have a regular Wynton HPC account, your account will be reconfigured to access Wynton PHI.
Depending on your project, Wynton PHI may or may not be the best fit for your project. We encourage you to also evaluate the following alternatives at UCSF that are approved for PHI data: