Embedded Files
CHA Data Classification Levels
CHA Data Classification Levels
- The CHA Data Classification Levels define four classifications (sensitivity levels) for CHA institutional data. The examples below help illustrate what level of security controls are needed for certain kinds of data. You can also view examples of data by a person's CHA role. In some instances, data classification level is determined by the security controls mandated by federal regulations or prevailing industry standards, identified in parentheses next to the data example.
Restricted Classification:
- Disclosure could cause severe harm to individuals and/or CHA, including exposure to criminal and civil liability.
- Has the most stringent legal or regulatory requirements and requires the most prescriptive security controls.
- Legal and/or compliance regime may require assessment or certification by an external, third party.
- Research information classified as by an IRB or otherwise required to be stored or processed in a high security environment and on a computer not connected to the CHA data networks
- Certain individually identifiable medical records and genetic information, categorized as extremely sensitive
- High Risk Confidential Information (HRCI) and research information classified an IRB and GDRP EU Regulation compliance
- Information commonly used to establish identity that is protected by state, federal, or foreign privacy laws and regulations
- Data Examples:
- Attorney - client privileged information
- Controlled Unclassified Information (CUI)
- Export controlled information (ITAR, EAR)
- Sensitive identifiable human subject research
- Social Security numbers
High Classification:
- Disclosure could cause significant harm to individuals and/or CHA, including exposure to criminal and civil liability.
- Usually subject to legal and regulatory requirements due to data that are individually identifiable, highly sensitive, and/or confidential.
- Individually identifiable genetic information
- National security information (subject to specific government requirements)
- Passwords and CHA PINs that can be used to access confidential information
Data Examples:
- Building plans and associated information
- Contracts with third-party entities
- Donor records (individual)
- Employee records (multiple types)
- Emergency planning information
- Human subject research
- Immigration documents (such as visas)
- Intellectual or other proprietary property
- IT service management information
- Public safety and security information
- Student education records (FERPA)
- Telecommunications systems information
- CHA nonpublic financial information
Moderate Classification:
- Disclosure could cause limited harm to individuals and/or CHA with some risk of civil liability.
- May be subject to contractual agreements or regulatory compliance, or is individually identifiable, confidential, and/or proprietary.
Data Examples:
- Staff, and resident and student directory information (unless there is a privacy block)
- General institutional and business information not classified as Restricted, High, or Moderate
- Information in the public domain
- Public websites
- Published research (barring other publication restrictions)
- Research Awards
- Research Proposals
- Unpublished research data (at the discretion of the researcher)
Low Classification:
- Encompasses public information and data for which disclosure poses little to no risk to individuals and/or CHA.
- Anyone regardless of institutional affiliation can access without limitation.
Applicable CHA Policies
Applicable CHA Policies
You are responsible for complying with the policies and standards below. The information on this page help you meet that responsibility.
- Under Review and Consideration
Page updated
Report abuse