The CCR security measures are designed to give users access to the specific information that they need and have been granted access to for the purpose they are accessing the database, while protecting that information that they should not have access to or should not need access to for their indicated session purpose.

Users are granted security roles on three levels: on an application-wide level, relative to each cancer group to which they are assigned — see Administering Cancer Group Users and Cancer Group-Related Security Roles — and relative to each study to which they are assigned within that cancer group — see Administering Users — Study-based Roles and Study-Related Security Roles. When working in CCR, the user may only ever access information that their defined roles at these three levels allow, and then only when they have indicated that their work is related to that cancer group and (if applicable) study that has granted them that security role.

On top of this, the user's indicated session purpose can also have an important effect on what information is available to them — see Defining the Session Purpose and Changing the Session Purpose. For example, if the user indicates that their session purpose is Research/General, the information displayed will all be de-identified (identifying information such as the patients' name or MRN will not be displayed), regardless of whether the user has permission within the cancer group to view identifying information or not. Likewise, in order for a user to access study-specific information, the user must have indicated that their session purpose is Research/Study for that particular study. If the indicated session purpose is something else, even Research/Study for a different study, they will not be able to access the study-specific data for the first study, regardless of what security permissions have been granted to them relative to that study.

A fourth level of security was added to CCR as organizations outside of HCI began using CCR — site-level security. Each user is assigned a site based on the organization through which they are accessing CCR. Users may typically only access information specific to their assigned site. The user's site is identified at the time the user specifies their session purpose.