As an employee of Indiana University (IU), it is your responsibility to protect the data that you encounter every day. This guide is intended to provide you with an understanding of:
Critical data and critical information both refer to the most sensitive type of data that demands special care and handling to prevent serious consequences. Mishandling critical data could lead to criminal or civil penalties, identity theft, personal financial loss, invasion of privacy, and/or unauthorized access to this type of information by an individual or many individuals.
Personally identifiable information (PII) is any information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information. Some PII is not sensitive, such as full name and email. Other elements can be considered more sensitive, which could result in substantial harm to an individual, including:
Given the potential for misuse and harm to the individual in the event of unauthorized access, it is important to store PII in approved locations and limit the collection to what is required.
The Family Educational Rights and Privacy Act (FERPA) generally prohibits the disclosure of student education records once a student starts attending a university. Student data protected by FERPA already requires extra precautions, however the most sensitive types of data are classified as critical:
For more information, visit the FERPA website or contact the student data steward at datastu@iu.edu.
Like students, it is crucial to protect the information that belongs to the staff, faculty, and all employees at IU. Data collected as part of the employment process can be highly sensitive and may be protected by Indiana State data protection laws:
For more information about staff data, contact the staff data steward at lkress@iu.edu.
For more information about faculty data, contact the faculty data steward at aknshah@iu.edu.
The Health Insurance Portability and Accountability Act (HIPAA) imposes numerous, strict privacy and security requirements on individually identifiable health information. Health records and payment details related to healthcare services that are managed by a covered entity fall under Protected Health Information:
The vast majority of IU units should maintain no PHI whatsoever. For more HIPAA information, visit the HIPAA Privacy & Security website or contact the health data steward at hipaa@iu.edu.
Examples of services or activities that IU may offer which result in the creation of customer information covered under GLBA could include but are not limited to:
In addition to data regulated by FERPA and HIPAA, other common examples of protected research data include participant PII or PHI. There are special considerations to consider in addition to personal or health data. SecureMyResearch provides self-service resources and one-on-one consulting to help IU researchers, faculty, and staff meet cybersecurity and compliance requirements for processing, storing, and sharing regulated and unregulated research data.
For more information, visit the Research Data Commons or email the research data steward at hcoates@iu.edu.
There are several ways that you can take personal responsibility for protecting data at IU. Even if you think you do not have any critical information under your control, there are tools to help make sure.
You may also check with the IU Data Management team at iudata@iu.edu if you are unsure whether you need to apply special care and handling to the information elements and assets you use.
The Data Sharing and Handling Tool provides guidance on how to properly classify, store, and share the data you manage.
You may also check with the University Information Policy Office (UIPO) at uipo@iu.edu or 812-855-UIPO if you are unsure whether you need to apply special care and handling to the information elements and assets you use.
