Sensitive Data Protection Standard

Standard Number: IT.3.3.1S
Category: Information Privacy 
Owner: Information Technology Services
Effective: May 15, 2019
Revision History: None
Review Date: May 14, 2022

1. PURPOSE, SCOPE AND RESPONSIBILITIES

   1. The Sensitive Data Policy establishes the criteria for data that the University determines to be Sensitive Data. The purpose of this Standard is to identify the physical and environmental safeguards that must be implemented to protect Sensitive Data.
   2. This Standard applies to all University employees, students, and volunteers, as well as any third-party individuals and entities who are doing work on behalf of the University that generate, have access to, collect, or use Sensitive Data.
   3. This Standard is intended to ensure the Security of Sensitive Data at the University. It is not intended to supersede any regulatory or contractual requirements for handling such data. Some specific data sets, such as credit/debit card data, healthcare data, and financial account data, may have stricter requirements in addition to the minimum standard requirements identified in this document.
   4. The Chief Information Security Officer is responsible for implementing and enforcing this Standard. Health Sciences Center Information Technology Services (“HSCITS”) is responsible for the Security of Protected Health Information at the University. Information Technology Services (“ITS”) is responsible for ensuring the Security of all other Sensitive Data types.
   5. The Data Steward is responsible for ensuring the Sensitive Data for which they are responsible is classified and secured appropriately.
   6. It is the responsibility of Data Users authorized to generate, maintain, and/or access Sensitive Data to abide by this Standard. Data Users should avoid collecting, accessing, or sharing Sensitive Data whenever possible.

2. ACCESS AND SHARING

   1. Access to Sensitive Data requires approval of the Data Steward and must be restricted to only those who require accessing such data to perform job duties.
   2. Access to Sensitive Data must immediately be removed when an individual’s employment duties no longer require access.
   3. Printing, copying, and scanning of Sensitive Data is strictly prohibited unless the printer is securely configured in a restricted-access location, an authorized person is available to receive the printout immediately, or the printer is password-protected.
   4. Data Stewards must approve remote access to Sensitive Data to ensure it is accessed securely. Those individuals approved to remotely access Sensitive Data must take precautions to ensure the data is not viewed or accessed by unauthorized individuals (e.g., family members).
   5. Access to Sensitive Data must be limited to as few devices as possible, and all devices that do access Sensitive Data must meet the University-Owned Device Standard, including installation of Identity Finder and anti-virus software.
   6. The use of personal devices to access Sensitive Data is prohibited unless approved by either ITS or HSCITS.
   7. Mobile devices should not be used to access Sensitive Data. At minimum, mobile devices approved to access Sensitive Data must be password protected and encrypted.

3. INFORMATION SYSTEMS AND DEVICES

   1. All applications that host Sensitive Data must undergo a security assessment conducted by ITS prior to being purchased. All critical and high-severity vulnerabilities identified must be remediated prior to being connected to the University network.
   2. University Information Systems housing Sensitive Data must at minimum meet the following requirements unless an exception is approved by the appropriate dean/director:
      1. Run a Supported Operating System;
      2. Be patched to the most current security level provided by the vendor;
      3. Employ anti-virus software (e.g., Sophos), which is configured for automatic daily definition updating, automatic protection of all incoming files, and scheduled weekly drive scans;
      4. Isolate Sensitive Data from all Internet-facing programs and services;
      5. Disable remote desktop protocols;
      6. Be secured behind a hardware firewall;
      7. All system passwords must meet the Password Standard; and,
      8. Employ two-factor authentication.
   3. Pursuant to the Acceptable Use of Data and Technology Resources Policy, access to systems and devices storing Sensitive Data should be based on Least Privilege.
   4. Back up files of Sensitive Data must be kept in an ITS-managed or HSCITS-managed location, with an approved third-party vendor, or a room that is physically secured with card swipe/key and requires access logging.

4. STORING AND SCANNING

   1. Storage of Sensitive Data on an unsecure University electronic file or workspace (e.g., SharePoint, OneDrive) is not permitted. Exhibit A of the Sensitive Data Policy indicates approved storage locations for Sensitive Data types.
   2. ITS will scan networked devices monthly to identify any Sensitive Data stored in an unapproved location. Scan results must be remediated at least quarterly.
   3. Storage of Sensitive Data on sites external to the University (e.g., DropBox, Google Drive) is not permitted unless ITS/HSCITS has approved the vendor for such storage.

5. TRANSMISSION AND TRANSPORTATION

   1. Transmission of Sensitive Data via email and email attachments is not permitted, except between approved University Health Care Components pursuant to the HIPAA Hybrid Entity Policy.
   2. Use of other messaging services (e.g., voicemail, text, Skype, FaceTime, Blackboard Collaborate) to transmit/share Sensitive Data is strictly prohibited.
   3. Faxing Sensitive Data is only permitted if the following criteria is met:
      1. The receiving fax machine is in a secure location;
      2. A cover sheet accompanies the transmission clearly indicating the recipient; and,
      3. The recipient has been alerted to transmission and is able to receive it.
   4. Faxes including Sensitive Data must never be stored on the fax machine or emailed.
   5. Other transmission channels for Sensitive Data (e.g., SecureFTP, LiquidFiles, S-HTTP) must be encrypted. The source and destination devices must be appropriately secured and approved by the University for storage of Sensitive Data.
   6. Transportation of Sensitive Data from one location to another must:
      1. Always be supervised;
      2. Be in a secure container (physical);
      3. Be encrypted and password protected (electronic);

6. DISPOSAL

   1. Physical copies of Sensitive Data no longer essential must be shredded with a secure, cross-cut shredder.
   2. University-owned devices that have accessed Sensitive Data and are no longer essential must be sanitized prior to being reassigned or sending to surplus.
   3. All computers, fax machines, and other electronic devices that have stored or received Sensitive Data are required to have the hard drive sanitized (or destroyed) and the memory erased before reassigning it or sending it to surplus.

7. DEFINITIONS

   1. “Data Steward” means the University executive officers or their designees who have planning and policy-level responsibilities for data in their functional areas and have management responsibilities for recognized University Information Systems
   2. “Least Privilege” means granting the minimum system resources and authorizations that it needs to perform its function or restricting access privileges of authorized personnel to the minimum necessary to perform their job.
   3. “Security” means the strategies for managing University Sensitive Data to ensure the confidentiality (the rules that limit access), integrity (the assurance that data will remain uncorrupted), and availability (the assurance that data will continue to be available) of it, including the requirements to collect, store, transmit, and access Sensitive Data.
   4. “Supported Operating System” means the entity providing the OS, be it a vendor, open source, or individual, is actively and routinely providing and deploying patches and security updates for the OS.
   5. “University Business Need” means operations designated as essential to the academic, administrative, research, and outreach needs of the University.
   6. “University Information Systems” means applications that are on the campus network, require authentication, and are used to support the academic, administrative, research, and outreach activities conducted at the University (e.g., STAR, MAP, WVU+kc, eCampus).

Related Documents

• Data Classification Policy