Skip to main content
JAMIA Open logoLink to JAMIA Open
. 2024 Aug 28;7(3):ooae083. doi: 10.1093/jamiaopen/ooae083

Implementing virtual desktops for clinical research at an academic health center: a case report

Adrian H Zai 1,, Steven Wong 2, Yurima Guilarte-Walker 3, Paul Langlois 4, Brian Coleman 5, Apurv Soni 6, David D McManus 7, Katherine Luzuriaga 8
PMCID: PMC11357573  PMID: 39206281

Abstract

Objectives

To address the challenges of sharing clinical research data through the implementation of cloud-based virtual desktops, enhancing collaboration among researchers while maintaining data security.

Materials and Methods

This case study details the deployment of virtual desktops at UMass Chan Medical School (UMass Chan). The process involved forming a Research Informatics Steering Executive workgroup, identifying key requirements, implementing Amazon WorkSpaces, and establishing configurable data management for research support.

Results

Key lessons include the significance of collaboration, balancing user-friendliness and functionality, flexibility in data management, maximizing virtual desktop efficiency within budget constraints, and continuous user feedback. The implementation of virtual desktops supports secure collaborative research, advancing medical knowledge and improving healthcare outcomes.

Discussion

The structured approach to implementing virtual desktops addresses data security, regulatory compliance, and real-time collaboration challenges. Continuous feedback and iterative improvements have enhanced the system’s effectiveness.

Conclusion

The successful implementation of virtual desktops at UMass Chan demonstrates the potential for such systems to support secure, collaborative research, offering insights for similar initiatives in other academic health centers.

Keywords: virtual systems, medical research, informatics, information technology, data security

Background

Sharing clinical research data allows investigation at scale yet can be hampered by several factors, including data security, overcoming limited computing power, and addressing data duplication. To tackle these hurdles, numerous research teams, including those at academic health centers such as Johns Hopkins1 and Duke Health,2 have turned to cloud-based virtual desktops, which provide secure, controlled access to research analytics and foster collaboration3,4 along researchers.5–7 This approach is akin to that in clinical settings, where similar technologies are extensively used for both local and remote access to electronic health records (EHRs), protecting patient data.8 However, differences exist, notably in application types, user workloads, and data-sharing methods. Research commonly uses shared drives for data collaboration, in contrast to the EHR-centric model in clinical environments.

Virtual desktops offer several distinct advantages specific to their environment.9 Firstly, they provide a secure, centralized platform where data can be accessed and analyzed without the need for local storage, reducing the risk of data breaches associated with physical devices. Secondly, virtual desktops support real-time collaboration with built-in tools for communication and data sharing, enabling multiple researchers to work on the same data set simultaneously while maintaining strict version control. Thirdly, these platforms facilitate compliance with regulatory requirements by ensuring that data access and usage are logged and monitored, which is more challenging with distributed data solutions. Lastly, virtual desktops can easily scale computational resources like CPU and GPU based on the needs of the research, offering flexibility and cost-efficiency that are not typically available with traditional secure endpoints.

Additionally, virtual desktops are both scalable and flexible, permitting research teams to adjust the system according to their needs and resources.10 This adaptability is particularly valuable when handling large datasets or accommodating new research collaborators. Lastly, virtual desktops play a significant role in enhancing research reproducibility and transparency by providing a centralized, standardized platform for data storage, analysis, and collaboration. Virtual desktops also play a significant role in enhancing research reproducibility and transparency by providing a centralized, standardized platform for data storage, analysis, and collaboration, aligning with FAIR (Findable, Accessible, Interoperable, and Reusable) principles11 and recent NIH Data Sharing requirements.12 This, in turn, helps build trust in research findings and promotes the advancement of clinical research.

While cloud-based virtual desktops, such as those at Duke and Johns Hopkins, offer significant advantages in scalability, accessibility, and resource availability, they also come with higher costs and dependency on reliable internet connectivity. Conversely, on-premises solutions, such as those at Utah,13 Cornell,14 and British Columbia,15 provide greater control over data and compliance with specific regulatory requirements but require substantial initial investment and ongoing maintenance.

The current case report adds to the existing peer-reviewed and gray literature on secure desktops by detailing the implementation process, challenges, and solutions for deploying virtual desktops at UMass Chan Medical School (UMass Chan). This deployment aims to enhance secure data sharing, collaboration, and computational capabilities while addressing the specific needs of an academic health center.

Although virtual desktops offer numerous advantages, there is a growing body of literature on their implementation within academic health centers for research purposes. Distinct challenges involve determining the optimal virtual desktop arrangement, safeguarding data security and privacy, balancing computing power against cost, and promoting flexible data sharing among researchers. To tackle these issues, the authors established a steering committee to oversee the implementation of virtual desktops. This strategy facilitated responsible and ethical clinical data sharing while advancing medical research and healthcare results. We provide a case report on the deployment of virtual desktops at UMass Chan, along with the insights gained from this experience.

Case description

Setting

UMass Chan is a medical school and a hub for the Clinical and Translational Science Awards (CTSA) program. With over 3600 faculty members and a large patient population through its clinical partners, it supports extensive clinical and translational research. The Research Informatics Core (RIC), integral to the CTSA initiative and part of the UMass Chan’s Center for Clinical and Translational Science, combines resources from the non-academic IT department, which provides essential infrastructure like network services, data storage, and security, and the Division of Health Informatics and Implementation Science, which offers specialized informatics expertise. This integration ensures efficient and secure data management for research. The institution’s close collaboration with its affiliated clinical partners facilitates translation of research findings into clinical practice.

The research community at UMass Chan encompasses a wide range of expertise, fostering a collaborative and innovative environment. Investigators typically request clinical data from the RIC, which provides the information through encrypted email after obtaining Institutional Review Board (IRB) approval and finalizing a data use agreement. This process, however, presents security concerns as data can become vulnerable once transferred outside the firewall and saved on researchers’ personal devices. The implementation of virtual desktops is designed to address this challenge, among others, and to bolster data security.

IT/informatics infrastructure

Before implementing virtual desktops, the IT department did not manage or encrypt endpoint devices like laptops and desktops comprehensively. This lack of centralized management made downloading clinical data files, such as Excel files, a significant privacy risk. The decision to transition from traditional endpoints to cloud-based virtual desktops was driven by the need to enhance data security, comply with institutional mandates, and improve research efficiency. The move to virtual desktops was motivated by the need to mitigate security risks associated with data transfer and storage on personal devices, as well as to facilitate real-time collaboration among researchers. The implementation of virtual desktops is designed to address these challenges and bolster data security by ensuring that data remains within a controlled environment, accessible only through secure virtual desktops.

PLUM platform

PLUM (Platform for Learning Health System at UMass) is a comprehensive cloud-based platform that centralizes research data, enabling advanced analytics and linking research to clinical practice. PLUM contains a research data warehouse, which we named the Patient Research Record, that aggregates and stores large volumes of clinical and research data from various sources within the institution in an Observational Medical Outcomes Partnership (OMOP) Common Data Model. This centralized repository supports data standardization, secure sharing, and efficient management. PLUM provides a suite of tools for data analysis, natural language processing, and AI model creation, facilitating collaborative research. By offering scalable computing resources, PLUM enables researchers to handle large datasets and perform complex analyses. The platform’s secure environment ensures compliance with data privacy regulations and supports collaboration among researchers by providing controlled access to data. Virtual desktops serve as the entryway to PLUM, ensuring that data remains within a controlled environment.

Methods

Identifying key requirements

To implement virtual desktops, we formed a Research Informatics Steering Executive (RISE) workgroup to identify key requirements. The workgroup, consisting of senior leadership in research informatics, research IT, patient privacy, and information security, met weekly to discuss research infrastructure and to determine essential features for the virtual desktop. The RISE workgroup engaged in a thorough requirements-gathering process, involving feedback from investigators to understand their specific needs and workloads. This collaborative approach ensured that the virtual desktop environment would meet the diverse needs of the research community at UMass Chan.

The key requirements identified included the need for a secure, centralized platform for data access and analysis, the ability to support real-time collaboration, scalability to accommodate varying computational needs, and compliance with data privacy regulations. These requirements guided the design and implementation of the virtual desktop environment.

The virtual desktop must offer anywhere accessibility, allowing users to access a virtualized environment from any location using only a web browser. The user interface should be user-friendly, featuring Microsoft Windows 1016 as the operating system to minimize the learning curve. Standardized applications must come pre-configured and be designed to work seamlessly with the school’s infrastructure security, ensuring users have the necessary tools for their research activities.

Furthermore, the virtual desktop must be designed to provide a secure environment. By bringing the tools to the data, the virtual desktop should create a secure yet feature-rich environment where data remains within our firewall while researchers can work with their data remotely. Consequently, the virtual desktop must offer secure access to data while safeguarding patient privacy.

Implementing virtual desktops and configurable data management for research support

We followed a structured process to establish virtual desktops based on AWS (Amazon Web Services) Workspace technology.17 AWS is a comprehensive and widely adopted cloud platform that offers a range of services, including computing power, storage, and databases, delivered on demand. Our choice of AWS was driven by its robust security features, scalability, and flexibility.

We created an AWS account and set up a new virtual private cloud (VPC) with at least 2 subnets in separate availability zones. The use of 2 subnets in different availability zones ensures high availability and fault tolerance, minimizing the risk of service disruption due to hardware failures or other issues in a single availability zone. This setup enhances the reliability and resilience of our virtual desktop infrastructure.

We then established a virtual desktop directory connected to the VPC.18 We then added users and assigned them to a virtual desktop bundle that outlined hardware and software specifications before deploying them to individual users, granting them access to their virtual desktops from any location with internet connectivity.

To accommodate a diverse range of research needs, we assembled a team of 40 researchers and incorporated a variety of software applications that support an extensive array of research tasks, including natural language processing, data analytics, and AI model creation. The informatics and IT teams defined 4 tiers of configurations, each offering distinct CPU, GPU, and RAM options, through a top-down approach, relying on expert consensus to determine the optimal setups for varying research needs. This process involved senior leadership and domain experts who assessed the technical requirements and anticipated workloads of different research projects. This structure enabled users to flexibly scale computing power and storage resources according to their requirements, rendering the system highly adaptable and suitable for most needs.

The researchers access these resources through their virtual desktops, which serve as a gateway to the Patient Research Record where research data sets are stored. IT-established security groups govern access to the data, ensuring adherence to IRB approvals and maintaining compliance.

Budget constraints

The implementation of the virtual desktop environment was conducted within specific budget constraints. We secured funding for the initial setup from a carryover grant provided by the CTSA. This funding covered the design, configuration, and initial deployment costs. For the ongoing operational costs, including maintenance, support, and cloud service fees, we planned to integrate these expenses into the pricing model employed by the RIC. This model involves billing researchers for data requests or charging departmental funds with their consent. The budget constraints required careful planning and cost management to ensure that the virtual desktop environment remained sustainable and cost-effective.

Virtual desktop setup effort

A senior cloud engineer led the development of our virtual workspaces. Initially, 10 hours were dedicated to designing the workspace template. Ongoing maintenance tasks, including image and license updates, require 4 hours monthly. Additionally, setting up a new user workspace from the template takes about 1 hour per request, and monthly updates to workspace reports necessitate a further half hour.

Pricing model

Our pricing model consists of a base rate plus an hourly charge. This model allows for flexibility in usage and cost management. Users are billed based on their actual usage of the virtual desktop environment. This variable cost structure ensures that users only pay for the resources they consume, promoting cost efficiency.

Software applications

The software applications installed in our virtual desktop default installations include widely-used programs such as SPSS,19 SAS,20 JMP,21 R,22 Tableau Server,23 Chrome,2 RStudio, Matlab,24 Jupyter Notebook,25 PuTTY,26 Git/Github,27 Elixir,28 SQL Server Management Studio,29 Erlang OTP,30 MS Office,31 and Stata.32

Secure folder management and data sharing

We used Amazon FSx for Windows Server as a secure folder management system to enable data sharing among authorized users.33 This system provides a fully managed, scalable, and secure file system, making it ideal for sharing sensitive information. Once the system was configured, we defined roles and access levels and only granted access to shared folders to authorized individuals. This ensured that only those who were permitted could access the data.

To facilitate collaboration and simplify research processes, we established 3 folders (see Figure 1). The first folder is dedicated to team collaboration and allows research team members to share files with one another. The second folder is a personal folder where researchers can store their data on their respective virtual desktops’ local drives, offering them flexibility and the ability to choose the most appropriate method for their needs and preferences. The third folder is read-only and is utilized by the RIC to extract clinical research data from PLUM. When the RIC shares data with the research team, they must obtain IRB approval, including the start and end dates of the proposed research project. Once the study is completed, access to the data is removed. This honest brokering process ensures that data is only accessible for the duration of the approved study, enhancing data security and compliance.

Figure 1.

The figure illustrates a folder management system for virtual workspaces, consisting of three key components: a team collaboration folder, a local storage folder for each user, and a read-only data folder managed by the Research Informatics Core. These folders are integrated into a central workspace system that connects to the PLUM architecture, facilitating the sharing and management of data from the research data repository.

The folder management system for virtual workspaces consists of 3 folders: (1) A folder for team collaboration, (2) A local storage folder for each user, and (3) a folder for the RIC to share data from our research data repository in PLUM.

Please note that data resources and virtual desktops operate independently on public clouds and are subject to strict security and compliance measures. Separate authorization and approved virtual desktops for each resource are required to maintain the security of the data when accessing data from multiple resources.

Ensuring patient data privacy and security

To safeguard patient data within the virtual desktop, we followed several measures. Firstly, we conducted a risk assessment to identify potential vulnerabilities and threats. Secondly, we implemented access control policies to ensure authorized users accessed patient data based on defined roles and access levels. Thirdly, we established robust security protocols, including firewalls and encryption, to secure patient data. Finally, we continuously monitored the virtual desktop for security breaches, reviewing user activity logs and setting up automated alerts for suspicious activities.

Continuous feedback collection

To ensure continuous improvement and user satisfaction, we collect regular feedback on our virtual desktops. New users complete a survey after their first 2 weeks, and all users are surveyed quarterly to identify areas for enhancement. This open feedback loop helps us refine our virtual desktop offerings to meet the evolving needs of our diverse user base.

Results

Engineer hours and costs

The development and maintenance of the virtual desktop environment required a significant investment of time and resources. Initially, 10 hours were dedicated to designing the workspace template, led by a senior cloud engineer. Ongoing maintenance tasks, including image and license updates, require 4 hours monthly. Setting up a new user workspace from the template takes about 1 hour per request, and monthly updates to workspace reports necessitate a further half-hour.

The cost per user decreased over time due to economies of scale and Amazon’s pricing structure. As more users joined the platform, the overall cost of maintaining the infrastructure was distributed among a larger number of users, reducing the per-user cost. UMass Chan utilizes an elastic pricing model with AWS, purchasing resources as needed. This approach allows for flexibility and cost efficiency, ensuring that resources are available on demand without overcommitting to a fixed amount.

The total cost of implementing the virtual desktop environment included both the initial setup costs and the ongoing operational costs. The initial setup costs covered the design and configuration of the virtual desktop infrastructure, while the operational costs covered the ongoing maintenance, support, and cloud service fees. Users were charged a variable cost to use the virtual desktop, based on their usage. As the number of users increased, the cost per user decreased, allowing for more efficient resource allocation and cost savings.

Usage and cost structure

Users were billed based on their actual usage of the virtual desktop environment. This variable cost structure ensured that users only paid for the resources they consumed, promoting cost efficiency. Over time, as the platform scaled and more users joined, the price per user decreased due to the economies of scale achieved through bulk purchasing and resource sharing.

We offer 3 power configuration options, developed in consultation with our current users, to accommodate the diverse use case categories we’ve identified. These configurations cater to: (1) users who only require access to clinical research data, (2) users who conduct analytics using traditional statistical methods with average to large data sets, and (3) power users who employ machine learning or other artificial intelligence techniques to develop algorithms. In all cases, researchers wanted to have working folders to optimize data sharing and management.

Cost of virtual desktops

We observed that the cost per hour per user decreased from July 2022 to February 2023 (see Figure 2 and the online Supplementary File for the raw data). This was due to the increase in the total number of users from 4 to 46 during this period. As the total number of users increased, the fixed cost of providing the service was spread across a larger user base, resulting in a lower cost being attributed to each user.

Figure 2.

The figure is a line graph showing that as the number of virtual desktop users increases from 5 to over 45 over eight months, the cost per hour per user decreases from 14 cents to about 2-4 cents, indicating economies of scale.

Cost associated with using virtual desktops decreases per user as total number of users increase.

User feedback on virtual desktops

Users identified several challenges through continuous feedback on virtual desktops, including complex security implementations, insufficient access to AWS tools, lack of approved data/file-sharing methods, and inadequate support for version control methods and team folder administration. Additionally, concerns were raised about virtual desktop operation reports and incorporating licensed applications. Meetings between IT, RIC, clinical departments, and power users were held to address and improve these issues.

Discussion

Within the PLUM architecture, virtual desktops are the primary interface for researchers to access, analyze, and collaborate on data from the Patient Research Record. This seamless integration enables secure and efficient research while minimizing data duplication and transfer risks. Lessons learned from the implementation of virtual desktops at UMass Chan are the following:

Collaborative development process: The success of the virtual desktop implementation was largely due to the collaborative efforts of the leadership team, IT professionals, security experts, clinical researchers, and patient privacy experts. This multidisciplinary approach ensured that the system was developed with input from all stakeholders, resulting in a solution that met the needs of researchers while addressing data security and privacy concerns.

Balancing user-friendliness and functionality: We aimed to strike a balance between providing extensive functionalities and maintaining user-friendliness. Our virtual desktops offer a user-friendly experience without sacrificing critical functionalities. By offering standardized applications, a familiar operating system (Windows 10), and preset configurations, we provided researchers with the computing power they needed while keeping the system intuitive and easy to use. This balance ensured that researchers could efficiently perform their tasks without being overwhelmed by complexity or unnecessary features.

Flexibility in data management and collaboration: The implementation of Amazon FSx as a secure folder management system allowed researchers to collaborate more effectively within the virtual desktop. By offering a Team Collaboration Folder and individual local storage, we provided researchers with the flexibility to choose the most appropriate method for their needs.

Maximizing virtual desktop efficiency within budget constraints: When it comes to virtual desktops, optimizing performance for the best value is key. Our pricing model consists of a base rate plus an hourly charge. Thus, it is important to closely monitor who uses the virtual desktops and how frequently they use them. Given the cost model, we have implemented a policy of removing access to virtual desktops if users haven’t accessed them within the past 2 months. However, it is important to note that we do not delete the data when access is removed; we only remove access to the virtual desktop itself. This approach ensures that data is preserved, and users can regain access to their data if needed. Additionally, we tend to favor configurations with higher CPU and GPU capacities because the incremental cost increase for higher performance is relatively small compared to the overall benefit. For example, the cost difference between a standard and a high-performance configuration might be a few cents per hour, which is minimal relative to the significant increase in computational power and efficiency it provides. This approach not only provides a better user experience but also helps to keep costs in check. We regularly review cost figures monthly to ensure that we stay within our budget constraints. By staying vigilant about virtual desktop configurations and access, we can optimize performance and value for our researchers.

Continuous user feedback: Through weekly meetings with IT, RIC, researchers and power users, open communication channels have been established to promptly identify and tackle user challenges. This process has led to significant improvements in various aspects of our virtual desktops, such as streamlined security, expanded access to AWS tools, and support for common version control methods. Introducing OneDrive for data import and export into AWS virtual desktop, using file gateways for AWS S3 access, and improving Team Folder administration have all contributed to a more efficient workflow. Monitoring virtual desktop operations using monthly utilization reports and assessing application integrations on a case-by-case basis allows for tailored solutions that meet user needs and optimize performance.

Conclusion

The implementation of virtual desktops at UMass Chan offers valuable insights for other academic health centers seeking to improve clinical data sharing, security, and collaboration. We hope this case study serves as a guide for institutions aiming to implement virtual desktops, fostering more effective research environments, and ultimately contributing to medical advancements and improved healthcare outcomes.

Supplementary Material

ooae083_Supplementary_Data

Acknowledgments

We extend our gratitude to George Matthews for his efforts in managing the virtual desktops. We would also like to acknowledge the support of the AWS team.

Contributor Information

Adrian H Zai, Division of Health Informatics and Implementation Sciences, Department of Population and Quantitative Health Sciences, UMass Chan Medical School, Worcester, MA 01655, United States.

Steven Wong, Division of Health Informatics and Implementation Sciences, Department of Population and Quantitative Health Sciences, UMass Chan Medical School, Worcester, MA 01655, United States.

Yurima Guilarte-Walker, Division of Health Informatics and Implementation Sciences, Department of Population and Quantitative Health Sciences, UMass Chan Medical School, Worcester, MA 01655, United States.

Paul Langlois, Information Technology, UMass Chan Medical School, Worcester, MA 01655, United States.

Brian Coleman, Information Technology, UMass Chan Medical School, Worcester, MA 01655, United States.

Apurv Soni, Department of Medicine, UMass Chan Medical School, Worcester, MA 01655, United States.

David D McManus, Department of Medicine, UMass Chan Medical School, Worcester, MA 01655, United States.

Katherine Luzuriaga, Molecular Medicine, UMass Chan Medical School and UMass Center for Clinical and Translational Science, Worcester, MA 01655, United States.

Author contributions

Adrian H. Zai conceptualized RISE and drafted the initial article. Steven Wong, Yurima Guilarte-Walker, Paul Langlois, and Brian Coleman participated in implementing Virtual Desktops. Katherine Luzuriaga championed the effort. Adrian H. Zai and Katherine Luzuriaga obtained funding. All authors helped edit the article.

Supplementary material

Supplementary material is available at JAMIA Open online.

Funding

National Institutes of Health’s National Center for Advancing Translational Sciences UL1TR001453.

Conflicts of interest

The authors have no competing interests to declare.

Data availability

The data underlying this article are available in the article and in its online supplementary material.

References

Associated Data

This section collects any data citations, data availability statements, or supplementary materials included in this article.

Supplementary Materials

ooae083_Supplementary_Data

Data Availability Statement

The data underlying this article are available in the article and in its online supplementary material.


Articles from JAMIA Open are provided here courtesy of Oxford University Press

RESOURCES