Regulated Data Chart

Owned by Micah Schaafsma
Last updated: Oct 21, 2024 by Josh Kanehen

Regulated Data is any data that is controlled by regulations that the University must comply with in storing, transmitting, or using that data.  Before using any service to send, store, or share Institutional Data, review which systems are approved for regulatory compliance.  The Regulated Data Chart helps you understand which software and systems are safe to store different types of Regulated Data in.  These restrictions are often dictated by the security of the system as well as contractual agreements between the university and the service provider.

How to interpret the Regulated Data Chart

Hover over or click on chart icons for more details about restrictions.

(tick) Use Permitted  - No technical, policy, or contractual issues exist that prohibit use of this data type with this service. You may send, store or share the regulated data type with this service if your data steward and your department/unit policies permit you to do so.

  Use Restricted  -  Use of this service with the regulated data type is restricted and approval is required. To use this service or to learn more about the restrictions in place, contact the CIS Business Systems Team .

(error) Use Prohibited  - Use of this service with the regulated data type is prohibited. Do not use this service to send, store or share the regulated data type.



FERPA

Education Records

PII / Internal Data

Personal Data

Confidential Data


HIPAA

Health Records

GLBA

Bursar Records

Common Rule

Human Subjects Research

Paper





Paper files

(tick) 

Health records are highly regulated and should not be stored outside of the SPU health center. Paper storage of HIPPA regulated data is permitted but highly restricted.

Computing





CIS Managed Computers

(tick) 

(tick) 

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

GLBA data can be stored on CIS Managed computers. No other computers are compliant with regulatory restrictions.

Human Subjects data can be stored on CIS Managed computers. No other computers are compliant with regulatory restrictions.

Personal / Non-Managed Computers

FERPA data may be stored on a personal computer if it is password protected, encrypted and follows the DOE guidelines on the secure storage and transmission of FERPA protected data .

Some types of PII may be stored on a personal computer if it is password protected and encrypted. Ensure you understand the regulatory controls governing the data.

Data classified as confidential cannot be stored personal devices

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Mobile Devices

FERPA data may be stored on a mobile device if it is password protected, encrypted and follows the DOE guidelines on the secure storage and transmission of FERPA protected data .

PII data classified as Internal or Confidential can be stored with permissions restricting access to appropriate employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

Data classified as confidential cannot be stored personal devices

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

USB Drives (unencrypted)

FERPA data may only be stored on a external storage or USB drives if it is password protected, encrypted, and follows the DOE guidelines on the secure storage and transmission of FERPA protected data .

PII data classified as Internal or Confidential cannot be stored on external drives per SPU's Identity Theft Prevention Program implemented in accorance with the FTC Red Flags Rule.See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

Data classified as Internal or Confidential cannot be stored on external drives per SPU's Identity Theft Prevention Program implemented in accorance with the FTC Red Flags Rule.See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

Unencrypted and unauthenticated storage does not meet the minimum regulatory compliance requirements for HIPAA protected data

Unencrypted and unauthenticated storage does not meet the minimum regulatory compliance requirements for GLBA protected data

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

USB Drives (encrypted)

FERPA data may be stored on a external storage or USB drives if it is password protected, encrypted, and follows the DOE guidelines on the secure storage and transmission of FERPA protected data .

PII data classified as Internal or Confidential can legally be stored on encrypted external storage, however it is inadvisable.

PII data classified as Internal or Confidential can legally be stored on encrypted external storage, however it is inadvisable.

Unencrypted and unauthenticated storage does not meet the minimum regulatory compliance requirements for HIPAA protected data

Unencrypted and unauthenticated storage does not meet the minimum regulatory compliance requirements for GLBA protected data

FERPA data may be stored on a external storage or USB drives if it is password protected, encrypted, and follows the DOE guidelines on the secure storage and transmission of FERPA protected data .

Files Shares / Collaboration Services
JIRA
FERPA data can be stored in JIRA as long as the permissions limit access to appropriate staff. See the DOE guidelines on the secure storage and transmission of FERPA protected data that you must follow.

PII data classified as Internal or Confidential can be stored with permissions restricting access to appropriate employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

Data classified as Confidential cannot be stored in this system.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

SPU Wiki

(tick)


PII data classified as Internal or Confidential can be stored with permissions restricting access to appropriate employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

Data classified as Confidential cannot be stored in this system.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

SharePoint

(tick) 

(tick) 

PII data classified as Internal or Confidential can be stored with permissions restricting access to appropriate employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

GLBA data can be stored with permissions restricting access to appropriate employees.

Human Subjects data can be stored with permissions restricting access to appropriate employees.

Department File Share

(tick) 

(tick) 

PII data classified as Internal or Confidential can be stored with permissions restricting access to appropriate employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

GLBA data can be stored with permissions restricting access to appropriate employees.

Human Subjects data can be stored with permissions restricting access to appropriate employees.

SPU OneDrive for Business

(tick) 

(tick) 

PII data classified as Internal or Confidential can be stored with permissions restricting access to appropriate employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

GLBA data can be stored with permissions restricting access to appropriate employees.

Human Subjects data can be stored with permissions restricting access to appropriate employees.

OneDrive / Dropbox / Google Docs

This platform does not meet regulatory compliance standards for PII

This platform does not meet regulatory compliance standards for confidential data.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Communications
MS Teams

(tick) 

(tick) 

PII data classified as Internal or Confidential can be stored with permissions restricting access to appropriate employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to store.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

GLBA data can be stored with permissions restricting access to appropriate employees.

Human Subjects data can be stored with permissions restricting access to appropriate employees.

Slack / Google Hangouts

Data classified as Internal cannot be transmitted by SPU employees using personal email. Students may upse personal email to transmit this information to an SPU employee.

Data classified as confidential cannot be stored in this system.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data. Notably, if the Team is being used as a SharePoint site, see the usage under SharePoint.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Office 365 SPU Email

(tick) 

PII data classified as Internal or Confidential can be sent only to recipients with SPU email addresses, NOT external email addresses.

Data classified as confidential cannot be stored in this system.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data. Notably, if the Team is being used as a SharePoint site, see the usage under SharePoint.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Personal or non-SPU Email

Data classified as Internal cannot be transmitted by SPU employees using personal email. Students may upse personal email to transmit this information to an SPU employee.

Data classified as confidential cannot be stored in this system.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data. Notably, if the Team is being used as a SharePoint site, see the usage under SharePoint.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data


FERPA

Education Records

PII / Internal Data

Personal Data

Confidential Data


HIPAA

Health Records

GLBA

Bursar Records

Common Rule

Human Subjects Research

Academic Systems
Canvas

(tick) 

(tick) 

PII data classified as Internal can be transmitted via SPU email between employees. See Data Laws and Regulations for regulatory compliance info specific to the data you want to transmit.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data. Notably, if the Team is being used as a SharePoint site, see the usage under SharePoint.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

TK20 

(tick) 

(tick) 

Data classified as confidential cannot be stored in this system.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data. Notably, if the Team is being used as a SharePoint site, see the usage under SharePoint.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Zoom PRO / Panopto

(tick) 

(tick) 

Data classified as confidential cannot be stored in this system.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data

This system does not meet the minimum regulatory compliance requirements for GLBA protected data. Notably, if the Team is being used as a SharePoint site, see the usage under SharePoint.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Administrative Systems
Adobe Sign

(tick) (tick) 

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data, though we are currently working on securing a Business Associate Agreement between SPU and Adobe that would allow this.

This system does not meet the minimum regulatory compliance requirements for GLBA protected data, though we are currently working on securing a Business Associate Agreement between SPU and Adobe that would allow this.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Banner

(tick) 

(tick) 

(tick) 

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data, though we are currently working on securing a Business Associate Agreement between SPU and Adobe that would allow this.

(tick) 

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

CBord Odyssey

(tick) 

Some specific types of Confidential data can be stored in for identity verification and generating ID card.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data, though we are currently working on securing a Business Associate Agreement between SPU and Adobe that would allow this.

(tick) 

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Destiny One

(tick) 

(tick) 

Some specific types of Confidential data can be stored in for online student registration and identity verification purposes.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data, though we are currently working on securing a Business Associate Agreement between SPU and Adobe that would allow this.

(tick) 

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

JumpForward

(tick) 

(tick) 

Some specific types of Confidential data can be stored in JumpForward for the purposes of managing student athletes. Check with Athletics for regulatory requirements and NCAA compliance.

This system does not meet the minimum regulatory compliance requirements for HIPAA protected data, though we are currently working on securing a Business Associate Agreement between SPU and Adobe that would allow this.

This system does not meet the minimum regulatory compliance requirements for GLBA protected data, though we are currently working on securing a Business Associate Agreement between SPU and Adobe that would allow this.

This system does not meet the minimum regulatory compliance requirements for Human Subject protected data

Medicat