Add information on security exceptions for accessing data of former personnel who have left UAB

uabrc / uabrc.github.io

UAB Research Computing Documentation

https://docs.rc.uab.edu

21 stars 12 forks source link

Add information on security exceptions for accessing data of former personnel who have left UAB #635

Open wwarriner opened 1 year ago

wwarriner commented 1 year ago

What would you like to see added?

Service request form available here: https://uabprod.service-now.com/service_portal?id=sc_cat_item&sys_id=bd3721e2374c27c0daa253b543990e5d

Note that this is not a Research Computing function.
As part of the response to the "justification/description" box, please make note that the request is for data held on RC systems.
This form can be avoided if written approval can be provided directly from the person in question.
[Optional, use only if relevant!] To avoid needing this form in the future, we highly recommend setting up a data management plan. Part of this plan would be
- Storing important and critical research data only in shared storage areas accessible to or owned by the PI responsible
- Integration of research data held in personal storage as part of personnel "off-boarding"

wwarriner commented 6 months ago

From a recent email I sent related to this. This needs refinement before putting in an article.

UAB IT has a process in place for granting access to data of researchers/collaborators who are no longer with the institution, and I can help you get started with that. The process exists to ensure appropriate regulatory protocols are adhered to.

The first step is to go to the following link and fill in the form. Be sure to mention as part of the “justification/description” that you want to access data for $blazerid on GPFS at Research Computing. After the form is submitted a ticket is created and routed to the people who can grant authorization for access, for review.

wwarriner commented 6 months ago

Another email, asking about "Approval Type" box. This definitely needs refinement before putting in an article.

So, thinking about this like a business office person, I’m thinking if $person was your student or staff in your lab, then the first choice is probably best (two-levels up supervisor). If it was someone in a completely different department (like a professor in the dept of medicine wanting access to data from a student in the school of engineering), or if there are special instructions from a high-level administrator, that might be when you’d choose the second option.

While the request being made is uncommon, it is still a “day-to-day operations” sort of request. So, from a slightly different perspective, a two-level-up supervisor is probably someone closer to the day-to-day than someone on this list: https://www.uab.edu/president/leadership/senior-leadership.