Data Classification Guide to IT Services
Use this guide to make informed decisions about where to safely store and share university data. Protecting sensitive data is a shared responsibility. You are responsible for ensuring that your use of permitted services complies with laws, regulations, and policies where applicable. Please visit the Core Security Standards webpage for more information about how to safely secure workstations and servers. Contact IT-Security@uiowa.edu or Research-Computing@uiowa.edu with any questions.
Data Types
Public: data that is public, or published with no restrictions. Examples include published "white pages" directory information, maps, academic course descriptions, news releases.
University/Internal: data that is non-public or internal data. Examples of institutional data include official university records, financial reports, unofficial student records, de-identified research data.
Restricted: data that is confidential or restricted due to personal privacy considerations or compliance regulations and laws. Examples include student transcripts, identifiable human subjects research data, full-face photogenic images or videos, financial aid data.
Critical: data that has the most stringent legal or regulatory requirements and requires special security controls. Examples include data governed by HIPAA (personal health information), SSNs, credit card information (PCI), personal identifiers (passport/driver's license numbers), data governed by ITAR (export-controlled). PLEASE NOTE - PCI data should not be stored on any of the services listed below. If you are working with PCI data, please contact the IT Security Office.
Subsets of Critical Category
For the purposes of this article, the following subsets of Critical data are included to define more clearly which campus services allow this type of information. The Critical category is very much dependent on what the specific regulation states. If you have questions about what data in the Critical category can be stored/used on any of the below services, please contact Research-Computing@uiowa.edu.
Critical - Export-Controlled: U.S. defense-related data where disclosure to a foreign national must be prevented. Examples include military items, space-related technology, technical defense data (e.g. ITAR, EAR)
Critical - HIPAA: protected health information (PHI) from the University of Iowa Hospitals and Clinics. Examples of restricted data combined with any health information.
IT Tools & Services
|
Service |
Public |
University/Internal |
Restricted/Critical (personal identifiers & SSNs only) |
Export-Controlled |
HIPAA |
 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Personal Devices (e.g. laptops, USBs, personal cloud services, etc.) |
|
 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Legend:
|
Permitted |
|
Permitted with IT Security Consultation |
|
Not Permitted |
| *** | HIPAA data should only be stored on a CIFS share |