BioMedIT: Swiss National TRE Network for Health Data - Requirements and Comparison to other European Frameworks

Research using sensitive personal data offers major benefits to science and society. Trusted Research Environments (TREs) have become the accepted means of enabling it safely, and a growing set of national and European initiatives are now converging on what such environments should provide. This raises a practical question for anyone planning, building or assessing one: what must a compute platform actually deliver, in technical and organisational terms, to qualify as a TRE? This whitepaper addresses that question, based on the model developed and operated for several years by BioMedIT, the Swiss national TRE network for health-related sensitive personal data[1]. BioMedIT was established in the context of the Swiss Personalized Health Network (SPHN) and financed by the Swiss Confederation and hosting institutions ETH Zurich, University of Basel, and University of Lausanne. It complements our earlier contribution, Versatile Trusted Research Environments: An approach for Switzerland[2], which made the case for versatile TREs: where the first paper addressed the why, this one addresses the what. A TRE is a service that combines technology, processes, data, and people — coordinated and managed to provide a secure, compliant research environment for handling sensitive data. In this paper we identify the key requirements for setting up and operating TREs and we classify them in six areas, spanning both technical and organisational controls: core infrastructure, security, a harmonised service offering, service management and operations, support and awareness, and ethical and legal support. For each area, we describe the measures expected of a TRE provider alongside how they are implemented in BioMedIT. They apply to both standalone and federated TREs, and indicate which measures apply only to federations. They do not prescribe specific technologies or products: they are deliberately formulated at a level of abstraction that allows different platforms to meet them in different ways. The Appendix to this white paper provides the explicit list of requirements defined and implemented in BioMedIT, as the Swiss national TRE network, along the categories: Secure Infrastructure, Security Management, Harmonized Service Offering, Service Management, Support Awareness, and Ethical and Legal Compliance Support. We then map these requirements to four frameworks: SATRE, the UK community specification for TREs; the DARE UK Federated Architecture Blueprint; the EOSC-ENTRUST Blueprint for a European network of TREs; and the specifications for Secure Processing Environments prepared under the European Health Data Space (EHDS). From this work we draw the following conclusions: ‒ A TRE is defined by technical and organisational controls together: Secure infrastructure is only the foundation and one of the requirement areas; a platform which addresses only a subset of the six areas leaves gaps between the layers which can be exploited. ‒ The BioMedIT approach is aligned with international practice: The mapping shows strong alignment with all four frameworks, which were developed independently of BioMedIT, by different communities in different legal contexts across Europe. This indicates that the requirements are a necessary basis for working with sensitive personal data, enabling Swiss researchers to leverage processing of sensitive data from international sources with confidence. [1] In production since 2018, BioMedIT federates three TRE providers: Leonhard Med at ETH Zurich, sciCORE+ at the University of Basel, and SENSA, operated by the University of Lausanne in collaboration with the Swiss Institute of Bioinformatics, with central coordination from the SPHN Data Coordination Centre [2] Appleton, O. et al. (2024) Versatile Trusted Research Environments: An approach for Switzerland. Zenodo. Available at: https://doi.org/10.5281/zenodo.14012894