What is Sensitve Data?

In general, sensitive data is information that can be damaging and/or violate privacy laws if it falls into the wrong hands. However, at IU the term sensitive data (or sensitive institutional data) has a specific and well-defined meaning. Furthermore, there are different classifications of sensitive institutional data as defined in the Classifications of Institutional Data document. These include:

Critical - This is the most sensitive classification and includes things like HIPAA-regulated medical data, student records like transcripts, banking information, social security numbers, and passport/visa numbers

Restricted - This includes things like demographic information (age, gender, ethnicity, etc) and payroll information.

University-internal - The most common piece of university-internal data is a person's University ID number but this classification also includes other IU internal things like position information and employment status

Public - Information in this category is not restricted and includes publicly accessible information like names, titles, and compensation.

This is in no way intended to be a complete listing of all the sensitive data types. Rather, it is just a summary to give you a feel for the different classes of sensitive data. You should read and familiarize yourself with this Data Storage and Handling tool. Note that you can select the type of data, and the tool will tell you the classification and the approved, secure handling instructions.

Please see the KB page Luddy School Account Security Recommendations need to create this page from the KB and put over here for information about securing your IU accounts and mobile devices so you are in compliance with IU security policies.

When you send an email, it typically goes across the network and is stored in what is called "clear text". What that means is that anyone with access to the network connection or files on the email server can read the email message. Encryption can be used to "scramble" the message so it cannot be read without a password. So, if sensitive information is sent using email, care must be taken to ensure that email leaving the IU mail system is encrypted. This page describes the mechanisms you can use to ensure the secure transmission of sensitive data via email so you are in compliance with IU security policies.

Critical Data

In most cases, you will want to avoid sending critical sensitive data via email if at all possible. This section applies only to non-critical sensitive data in the restricted and university-internal classifications (see previous section). If you have a need to send critical data via email, please contact the IT staff so we can discuss options and appropriate safeguards.

Special care must be taken when sending any sensitive data via email. First of all, if you can avoid sending sensitive data via email that is preferable. However, for many of us sending sensitive data via email is part of your job and hard to avoid. So, here is an option for sending non-critical sensitive data.

OME Services

IU has an OME (Office Message Encryption) encryption service that is extremely simple to use. All you have to do is put "[Secure Message]" (including the square brackets but not the double quotes) in the subject of the message and that's it. It doesn't get much easier than that! The way this works is as follows:

• If the message stays within the IU email system, it will not be encrypted.
• If the messages leaves the IU email system, it will be encrypted. So, if the message is sent or forwarded to a non-IU email address it will be automatically encrypted and the recipient will receive notification with instructions on how they can read the original message.

So, if you need to email non-critical sensitive data (including a 9-digit IU ID number) just put "[Secure Message]" (including the square brackets but not the double quotes) in the subject of the email and you are in compliance with IU email policy. Do note, however, that this requires that you be using the IU mail servers for your outgoing email. This will be true for most people using the IU mail system but if you are using a non-IU email system and have questions on how you can take advantage of this service, please contact the IT staff.