Duke Services and Data Classification

Applicable To: 

Duke Health

Duke University

Version 1.3

Authority

Duke University Chief Information Security Officer

Duke Health Chief Information Security Officer

Determining the Nature of the Data

Questions to Consider

Are you storing Sensitive data elements (for example, ePHI, Social Security Numbers, DMCA, PCI DSS or FERPA data)? See the Duke Data Classification Standard for the definitions of Sensitive, Restricted, and Public data.

Use of Duke Services

Selecting a Duke Service Depending on Data Classification

The following chart outlines which Duke services meet the minimum security requirements for use with Sensitive, Restricted and Public data. (Staff can also use the SecureIt decision tree tool.) Duke faculty, students and staff should be aware that there may be institutional, legal, regulatory and contractual obligations that require the use of specific storage options. For example:

• ITAR and PCI-related data always require Security Office consultation before use.
• FERPA: Consult with the Registrar’s Office.
• FISMA: SOM GovCloud is required.
• Veterans Administration: PACE is required storage. REDCap is not allowed.
• Social Security Numbers: Collection requires an institutional exception.
• GDPR: Consult with the Privacy Office for allowable options.
• Duke Health non-consented identifiable clinical research data: Per DOCR Policy, PACE is required storage.

All users of the solutions and services that store Duke data must adhere to the following:

• Use only for the approved intended use.
• Store only the information you need or plan to use.
• Provide access only to authorized or approved individuals; remove access immediately when no longer need.
• Do not provide public or broad access to data without institutional approval.
• Retain data only as long as it is needed, or in accordance with Duke retention requirements.

Legend: ✓ = yes; – = no

Use of Cloud Services

Selecting a Cloud Service Depending on Data Classification

The following chart outlines which Duke services are appropriate for use with Sensitive, Restricted and Public data.

¹ No ITAR or PCI related data may be stored on Box or Microsoft Office 365.  For additional details see: https://box.duke.edu/security-and-usage/

² If the Team will be used to share Sensitive Data, the Team must be set to Private not Public.

³ For Duke Health, only Duke Zoom Telehealth may be used for clinical purposes to see patients or exchange Protected Health Information (PHI). Duke Zoom (non-Telehealth) and Duke's WebEx may be used for classes and meetings. Any meeting with the possibility of PHI may not be recorded. Sensitive information may be discussed during a live Zoom meeting when recording is not in use but should not be recorded, typed into a chat session or otherwise stored within Zoom. 

⁴ Specific guidelines exist for the use of Adobe Sign. For more see General Information and License Restrictions. Note: All Health side access for Adobe Sign must be approved and provisioned by DHTS Web Services.
 

Use of Other Cloud Services (Personal Use)

Selecting a Cloud Service Depending on Data Classification

The following chart outlines outside cloud services appropriate for personal use. In general, these services are not approved for official Duke use without consultation with the Duke security offices and/or privacy offices.

Document Type: Policy

Last Reviewed: 11/2023