Quest Data Security Guidance
Quest users must ensure that Quest adheres to any security or contractual requirements regarding their data and that their management of research data complies with all Northwestern policies, including the Research Data Policy and the Data Classification Policy.
The Data classification policy categorizes all University data into four categories (Levels 1-4). Based on the levels defined in the Data Classification Policy, Quest is appropriate for storing and analyzing publicly available data, i.e. Level 1. Under certain circumstances and with prior approval, Level 2 and/or Level 3 data may be allowed on Quest.
Quest is not appropriate for the following data types:
- Sensitive data: Data that contains personally identifiable information about identifiable human subjects (PII), health information, or identifiable genetic information.
- Restricted data: Data subject to specific legal, regulatory, or contractual requirements, including data use agreements (DUAs) and state or federal regulations like HIPAA or NIST 800-171.
While reasonable efforts are made to secure the data on Quest, Northwestern’s focus is to provide an open, collaborative research environment. Thus, Quest is not designed to meet any particular compliance framework, such as NIST 800-66 (for health information) or NIST 800-171 (for controlled unclassified information).
See the examples below for more specific information on the types of data appropriate to use on Quest. If you have questions about the security measures of the Quest system or whether your data is appropriate for Quest, please reach out to the Research Computing Support team by filling out the Quest User Support form or emailing quest-help@northwestern.edu.
Data Examples
The following examples are provided to help researchers make informed decisions about storing and processing data on Quest. These examples do not replace principal investigators’ responsibility for ensuring their research data is properly stored and secured.
Examples of data APPROPRIATE for Quest
- Publicly available data
- Data that is intended for public release but needs to be kept private until publication
- Data that will be shared as part of a publication
Examples of data that are NOT APPROPRIATE for Quest:
- Data subject to compliance frameworks such as HIPAA, FERPA, NIST 800-171, NIST 800-53, FISMA, or FedRAMP
- Controlled Unclassified Information (CUI) from government grants or contracts
- Data subject to export control restrictions
- Financial account numbers such as credit cards or bank account numbers
- Government identification numbers, such as social security numbers, driver’s license numbers, or state identification card numbers
- Passwords or other information that allows access to secured online accounts
- Biometric data, such as fingerprints, retina or iris scans, or facial geometry
- Health insurance or medical record account numbers, policy numbers, or other identifiers
- Identifiable protected health information, including medical records, that are not de-identified to the standard defined by the Health and Human Services de-identification standards; potential identifying fields include email addresses, residential addresses, birthdates, license plate numbers, photographs or images, phone numbers, and combinations of information such as age and zip code.
- Private, personally identifiable information that could harm individuals if it were public. This includes information that could cause reputational harm. For example, survey data that includes the respondent’s IP address (which can be identifying) and their private opinions on a sensitive topic.
- Unstructured text data that may contain any of the above restricted types of information directly or through combinations of information in the text. This includes, for example, unstructured text fields in medical records that do not contain explicit data fields with personal information but may contain names, dates, or other identifying information in the unstructured text.
- Data collected or scraped from restricted or non-public websites, such as social media posts that are only shared with contacts
- Data being used for commercial or for-profit endeavors
- Data that is not associated with the research or business of Northwestern University
Examples of data that MAY BE APPROPRIATE for Quest
- Deidentified human-subject research data:
- If you are working with survey data, check that all identifiers have been removed, including IP addresses or email addresses that may have been collected automatically when using tools like Qualtrics or other online forms.
- If the data includes open-ended responses or other human-generated text fields, review those fields for potentially identifying information.
- For data not governed by specific requirements (such as non-health data), consider what would happen should your data become public: could it cause harm to the study participants? If so, Quest is not an appropriate place for your data.
- Human genetic data: Any genetic data on Quest must not include personal identifiers and must be deidentified according to HIPAA standards. Data cannot be subject to specific data security, privacy, or compliance requirements such as GDPR, NIST 800-66, NIST 800-171, NIST 800-53, FISMA, or FedRAMP. Note that some genetic data files released by NIH may carry security requirements that are not compatible with Quest such as those within NIH Controlled-Access Repositories.
- MRI and other medical images: Medical image files must be deidentified to remove any personal/facial features, metadata with patient information, and medical record numbers or other identifiers on the images before being stored on Quest. Note that Quest may not be used for deidentifying MRI images.
- Data governed by a Data Use Agreement (DUA): Please reach out to the Research Computing and Data Services team (quest-help@northwestern.edu) for more details on Quest security measures and compare them to the provisions of the DUA.
Frequently Asked Questions
Q: I have research data that is not appropriate for Quest. What other systems can I use to analyze this data?
A: The Research Data Storage Service (RDSS) and FSMResfiles provide appropriate options for the storage of some sensitive research data. These storage systems can be mounted on university-owned and managed computers to provide secure access to your data. If you need to meet specific compliance or data use agreement requirements, or you need computational resources beyond what your laptop or personal computer can accommodate, Northwestern IT and Feinberg School of Medicine IT can work with you to set up secure cloud computing environments or other available resources. Contact researchdata@northwestern.edu to start that conversation.
Q: Can I use Quest to deidentify my data?
A: No. Data needs to be deidentified before it is transferred to Quest. If you need computational resources beyond your laptop or personal computer to perform the deidentification, contact researchdata@northwestern.edu to discuss options.
Quest System Security Measures
Information regarding the security measures of the Quest system is available upon request. Please contact the Research Computing and Data Services team by submitting a Quest User Support form or by emailing quest-help@northwestern.edu for further information.
Data Access and Sharing on Quest
- Data read and/or write permissions on user data storage spaces can be granularly set by the data owners to limit access to files and directories. Data stored in a user’s home directory can only be accessed by that user by default. Data stored in an allocation’s project directory is only shared with other users of that allocation by default.
- Northwestern IT system administrators have administrative access to the entire Quest storage system. Northwestern IT staff access user storage spaces only in support of system’s operational security and stability or to fulfill user support requests.
- Quest users can choose to extend access to their data to others through Globus. Data shared through Globus may offer users broader access permissions than those available on Quest. If Globus is utilized, it is the data owner’s responsibility not to share data with unauthorized individuals and to monitor access permissions on data shared with others.