How SATRE evaluates secure research: A look inside the Health Informatics Centre (HIC) Trusted Research Environment (TRE)

In the first post of our SATRE blog series, we introduced the Standardised Architecture for Trusted Research Environments (SATRE), a best practice specification designed to support responsible, secure data research within the mixed economy of UK TREs. We explored the first pillar, Information Governance, and how the Health Informatics Centre (HIC) upholds high standards of transparency and compliance. 

In this second post, we will take a closer look at the Computing Technology and Information Security pillar. Drawing directly from the published SATRE evaluation of the HIC TRE, we explain how our infrastructure and practices operate day-to-day.

At HIC, we are committed to continuously improving our TRE services and national TRE research efforts. SATRE is central to this, and our involvement in the DARE UK-funded TREvolution programme of work reflects these priorities. 

SATRE Pillar 2: Computing Technology and Information Security

This pillar covers five core areas, each documented through our ISO 27001-accredited Information Security Management Systems and project management tools. Of the 24 mandatory specifications, 6 are covered by our accreditation; the remaining are enforced infrastructure controls and documented Standard Operating Procedures. 

 These controls help ensure our TRE is secure, sustainable and auditable.

1. End user computing: The HIC TRE is a secure-by-design computing environment for analysing sensitive data. Each user accesses a dedicated virtual desktop known as their TRE workspace, which is isolated, with no internet access or clipboard functionality. Access is role-based, and means that people only have access to what is strictly necessary, including HIC staff. Users on multiple projects have multiple isolated workspaces.
2. Infrastructure management: Designed around secure isolation, audit logging and centralised controls. Most services are hosted in-house, with external cloud resources for flexibility.
3. Capacity management: all processes, included those relating to TRE capacity and data controls, are documented in project management systems to ensure auditability, consistency, and accountability.
4. Configuration management: Software and system changes follow version-controlled processes, maintaining operational stability while allowing evolution.
5. Information security: as data curators, we apply proportional risk mitigation in all processes. For example, during our disclosure control process: before files are moved in or out of the TRE, they are reviewed by HIC to prevent re-identification, unintended data exposure and risk to the environment. These checks are built into our workflows, helping to maintain privacy and security.

A Culture of Security and Transparency

Technology is only part of what makes a TRE secure; implementation, oversight, and adaptability are equally as important. At HIC, we improve services through operational insights, innovative research, and alignment with national security standards. 

By aligning with SATRE and ongoing research efforts, HIC remains a leader in the UK TRE community, committed to responsible, transparent research infrastructure. Just as importantly, SATRE enables data custodians and the public to see how their data is being protected and used for research with public benefit. HIC promotes SATRE as a valuable tool for all safe setting providers. In Scotland, the Scottish Safe Haven Network has completed self- and peer-evaluations using the specification as a first step in federation. Institutions that have assessed their TREs have their evaluations on the SATRE website.

In our next blog post, we’ll explore the third SATRE pillar – Service Management, and how TREs can provide responsive services while supporting high-quality, secure research. As always, we welcome you to get in touch to discuss how HIC and our TRE can support your research.