Safeguarded file transfer is an important element of efficient data exchange. It is also an essential component of contemporary data linkage and integration processes involving the transfer of personally identifiable data about individuals and individual organisations. Secure file transfer provides a transparent audit trail for source agencies, requesting agencies and administrators.

The national Population Health Research Network (PHRN) provides a secure file transfer service, offered free of charge to all PHRN partners (including Tasmania) and their stakeholders. The PHRN’s Secure Unified File Exchange (SUFEX) is hosted by the national node of the network within Curtin University in Western Australia. The only software required to access SUFEX is a standard web browser. Use of the service requires little, if any, local IT support. Features include automatic file encryption and decryption.

Agencies participating in the exchange of data must carefully consider and select file transfer mechanisms appropriate to the level of risk and security demanded by the type and format of data to be exchanged.

All high-risk data matching, linkage and integration projects must be managed by an individual or individuals with ultimate accountability for the sound conduct of the relevant project. All projects that involve personally identifying or sensitive information about individuals are classified as high-risk.

At a national level, there are three Accredited Integrating Authorities for the management of data integration projects involving Commonwealth data: the Australian Bureau of Statistics (ABS), the Australian Institute of Health and Welfare (AIHW) and the Australian Institute of Family Studies (AIFS). These organisations oversee high-risk data integration projects from start to finish, potentially working with a network of agencies throughout the process. This may include engaging another agency to undertake the actual data linkage or support the dissemination of data.

Agencies must ensure appropriate levels of governance are in place for all Tasmanian Government data exchange projects, including the appointment of an individual or individuals with skills and knowledge proportionate to the assessed level of project risk. More detail is provided in ADEPT Tools.

The use of privacy-protecting data linkage processes allows information about individuals to be de-identified, integrated and used to inform improved policies and strategic decisions necessary to deliver better, more targeted services to the community. By replacing personally identifying information with reference codes, data can be brought together for the analysis of complex relationships between causative factors and real or potential effects.

The Tasmanian Data Linkage Unit (TDLU) uses secure, privacy-preserving methodologies to link health and other related data at an individual level. Part of the national PHRN, TDLU is a collaborative venture between the Department of Health and Human Services (DHHS) as the lead agency, with operation of the unit outsourced and housed at the Menzies Institute  for Medical Research.

Agencies planning to initiate policy and service delivery research projects involving personally identifying data must be rigorous in identifying and evaluating risks, securing facilities and safeguarding processes in accordance with ADEPT Procedures before embarking on a process of data linkage and integration, especially if the project is to be undertaken in-house.

Agencies should be aware that projects may also need to be reviewed and approved by relevant Ethics Committees. For example, the Tasmanian Health and Medical Human Research Ethics Committee (HREC) is responsible for reviewing all research projects that involve:

• invasive physiological, clinical and/or medical interventions;
• research involving the use of human tissue, human genetic research and staff, patients or resources of any hospital in Tasmania.