Duke Services and Data Classification

Duke University IT Security Office (ITSO)

Duke Health Information Security Office (ISO)

 

Duke University Chief Information Security Officer

Duke Health Chief Information Security Officer

 

• Are you storing Sensitive data elements (for example, ePHI, Social Security Numbers, DMCA, PCI DSS or FERPA data)? See the Duke Data Classification Standard for the definitions of Sensitive, Restricted, and Public data.

 

The following chart outlines which Duke services meet the minimum security requirements for use with Sensitive, Restricted and Public data. (Staff can also use the SecureIT decision tree tool.) Duke faculty, students and staff should be aware that there may be institutional, legal, regulatory and contractual obligations that require the use of specific storage options. For example:

• ITAR and PCI-related data always require Security Office consultation before use.
• FERPA: Consult with the Registrar’s Office.
• FISMA and Veterans Administration: PACE is required storage. REDCap is not allowed.
• Social Security Numbers: Collection requires an institutional exception.
• GDPR: Consult with the Privacy Office for allowable options.
• Duke Health non-consented clinical research data: PACE is required storage.

All users of the solutions and services that store Duke data must adhere to the following:

• Use only for the approved intended use.
• Store only the information you need or plan to use.
• Provide access only to authorized or approved individuals; remove access immediately when no longer need.
• Do not provide public or broad access to data without institutional approval
• Retain data only as long as it is needed, or in accordance with Duke retention requirements.

 

The following chart outlines which Duke services are appropriate for use with Sensitive, Restricted and Public data.

**If the Team will be used to share Sensitive Data, the Team must be set to Private not Public.

**** Specific guidelines exist for the use of Adobe Sign. For more see General Information and License Restrictions. Note: All Health side access for Adobe Sign must be approved and provisioned by DHTS Web Services.
 

The following chart outlines outside cloud services appropriate for personal use. in general, these services are not approved for official Duke use without consultation with the Duke security offices and/or privacy offices.