Q: Is it safe to store Level 1 or Level 2 University data in the cloud?
Q: What is the definition of University data?
Q: Is it safe for me to store Level 1 or Level 2 data on Dropbox?
Q: Can I send sensitive information through e-mail?
Q: How do I share sensitive University data if I can't use e-mail?
Q: Is e-mail a safe way to send medical (HIPAA) data?
Applicable References and Legislative Resources
Q: Are online storage solutions like Google Drive and Dropbox appropriate for class work as well as personal files?
A.Yes. Cloud storage is appropriate for storing class work and personal files. It is very convenient because you can access the files from wherever you are as long as you have an Internet connection. The CSU has a contract with Google that protects the ownership and privacy (but not the security) of files you store in their system, but no similar arrangements exist with Dropbox or any other provider of cloud storage solutions, so files stored with these other providers are more vulnerable.
Q: Is it safe to store Level 1 or Level 2 University data in the cloud?
A: No. Currently available cloud storage solutions do not provide the level of protection required for Level 1 or Level 2 data. The full definitions of Level 1 and Level 2 data.
Q: What is the definition of University data?
A: University data covers any item of information that is collected, maintained, and used by the University for the purpose of carrying out the business of the University, subject to or limited by any overriding contractual or statutory regulations. University data may be stored either digitally or on paper and may take many forms, including, but not limited to, text, graphics, images, sound, and video. Research data, scholarly work by faculty or students, and intellectual property that does not contain personally identifiable information or other data protected by law or University policy is not considered University data, nor is an individual’s own personally identifiable information (PII) unless it's used as described above. University data must be available to the University and other individuals as required under University policies and is subject to CSU Policy & Standards, CSU, Chico Data Classification, and other appropriate controls depending on the sensitivity of the data.
Q: Is it safe for me to store Level 1 or Level 2 data on Dropbox?
A: No. Dropbox does not provide the level of protection required for the storage of Level 1 or Level 2 data. There are no contracts or agreements with the University that protect the privacy, ownership, or confidentiality of the data stored on Dropbox servers.
Q: Can I send sensitive information through e-mail?
A: No. Sensitive data, and in particular University data that has been classified as Level 1 protected data, should never be sent via e-mail, either in the body of the e-mail or in an attachment, unless that data has been encrypted using Chico State approved strong encryption.
Alternatively, you can store the sensitive data in a system protected by password security and send an e-mail containing a link to the data. Communication involving student records should use the Chico State portal whenever possible. Using the Portal provides a better student and faculty experience and ensures that messages are securely and reliably delivered to the correct person.
You can also save sensitive data on a University-managed system that requires a password, such as a file server, and send a link to the data in an e-mail.
Below are some resources for secure information sharing:
Q: How do I share sensitive University data if I can't use e-mail?
A: You have several options:
Below are some resources for secure information sharing:
Q: Is e-mail a safe way to send medical (HIPAA) data?
A: No. E-mail is not safe for HIPAA data, which is subject to similar rules as Level 1 protected data. HIPAA (the Health Information Portability and Accountability Act) requires that any electronic transmissions containing protected health information (PHI) be encrypted using strong encryption. Messages containing PHI that are transmitted over unencrypted e-mail are archived and can be transmitted onwards by every program or device that receives them. E-mail messages, their attachments, and archives are highly vulnerable to improper disclosure and may put both the University and the provider sending the e-mail at risk.
Related Federal Laws and Regulations
Related CA State Laws and Regulations
