The Data Classification Policy specifies that all university data must be assigned one of three levels based upon confidentiality requirements: Open, Sensitive or Restricted. Data owners are given the responsibility of appropriately classifying data.
The classification should be a list of specific data types used within a unit, corresponding classifications, and any special handling specifications. The task of preparing the classification may be delegated, but the data owner must explicitly approve the final document. This classification must be documented and communicated with data users and custodians. Data custodians then apply appropriate controls based on these classifications, and data users comply with the use requirements.
Controls appropriate to the different data classifications are specified in information security policies and standards. Data classifications, including ‘Open’, are not related to the applicability of public records laws to specific data. All requests for public records are to be forwarded to the University General Council, regardless of the classification of requested data.
Initial Classification
Data owners can use the table below as an initial classification of data within their unit. Data types that have classifications mandated (due to applicable laws, regulations or contracts) and those that are in common use throughout the university are included. Data owners must add any other data types used in the unit.
| Data Type | Classification | Justification |
|---|---|---|
| Student records (non-directory) | Restricted | FERPA |
| Credit card cardholder data | Restricted | PCI, FISA (F.S. 501.171) |
| Patient medical records (identifiable) | Restricted | HIPAA |
| Patient billing records | Restricted | HIPAA |
| Human subject research data (if includes PII or PHI identifiers) | Restricted | HIPAA |
| Social Security Numbers | Restricted | FISA (F.S. 501.171) |
| Export Controlled data | Restricted | ITAR |
| Animal research protocols | Sensitive | Competitive and commercial potential, security concerns |
| System security plans | Sensitive | Protective information |
| Unpublished research results | Sensitive | Competitive and commercial potential |
| Exams (questions and answers) | Sensitive | Exam integrity |
| Employee data (not including SSN) | Sensitive | Employee privacy |
| UF Directory (students & staff) | Open | FERPA |
| University regulations | Open | Intended for public use |
| Course catalog | Open | Intended for public use |
| Public web sites | Open | Intended for public use |
| De-identified patient information | Open | HIPAA |
Definitions
Data owner: Senior leadership, typically at the dean, director or department chair level, with the ultimate responsibility for the use and protection of university data.
Data custodian: The staff member, typically one primarily responsible for IT, that is responsible for implementation of security controls for university data.
Data user: Any member of the university community that has access to university data, and thus is entrusted with the protection of that data.
References
- UF Data Classification Policy
- HIPAA
- FERPA
- PCI
- Florida Statute 817.5681 Breach of security concerning confidential personal information in third-party possession
- ITAR