Sensitive Data

Sensitive data is defined as information that is protected against unwarranted disclosure. Not all of the information is sensitive, but data that is sensitive is protected by Indiana or federal law and by university policy. Protection of sensitive data may be required for legal or ethical reasons, for issues pertaining to personal privacy, or for proprietary considerations. 

The following list is protected by state and federal law and university policy, but because context does play a role in data sensitivity it is not exhaustive.

Sensitive information includes all data, in its original and duplicate form, which contains:

• Personal Identifiable Information (PII), as defined by Indiana state legislation laws
• Protected Health Information, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• Student education records, as defined by the Family Educational Rights and Privacy Act (FERPA)
• Customer record information, as defined by the Gramm Leach Bliley Act (GLBA)
• Communications being made, are in transit, and when they are stored on computers, as defined by the Electronic Communications Privacy Act of 1986 (ECPA)
• Card holder data, as defined by the Payment Card Industry (PCI) Data Security Standard
• Information that is deemed to be confidential in accordance with the Indiana Access to Public Records

Sensitive data also includes any information that is protected by university policy from unauthorized access. Examples of sensitive information may include, but are not limited to, some types of research data (such as research data that is personally identifiable or proprietary), public safety information, financial donor information, information concerning select agents, system access passwords, information security records, and information file encryption keys.