ºÃÉ«µ¼º½

Data Classification and Handling Policy

ºÃÉ«µ¼º½ faculty, staff, and student employees have varying access to electronic information that is sensitive and confidential. ºÃÉ«µ¼º½ considers the protection of such information and its electronic infrastructure from unauthorized use to be a key responsibility of all faculty, staff, and student employees. Failure to act in accordance with College guidelines may result in disciplinary and/or legal action.

Sensitive information must be stewarded in an ethical, professional, and legal manner at all times. All institutional electronic data, regardless of how they are stored, remain the property of the College and are governed by this policy.

By law, certain institutional data may only be released with proper authorization, in compliance with applicable federal and state laws concerning storage, retention, use, release, and destruction of data. Users are encouraged to seek guidance from an appropriate supervisor, senior officer, or the chief information officer if it is unclear whether or not specific information is sensitive.

Sensitive data shall be used only as required in the performance of College duties, and may not be inspected, copied, altered, deleted, shared, granted access to, or used in any other manner, except as required in the performance of those job duties.

Reed community members are responsible for the security, privacy, and control of data in their care, access privileges entrusted to them, and their username/password. If there is reason to believe that the user's username/password is known by or has been used by another person, the user must immediately notify an appropriate supervisor, senior officer, or the chief information officer. Reed community members must take every reasonable precaution to prevent unauthorized access to sensitive data. Such data shall not be presented or shared inside or outside the College without prior approval from the appropriate supervisor or senior officer of the College. Sensitive data should never be left on any device to which access is not controlled.

When using the institution's electronic information systems, care must be exercised to protect data from unauthorized use, disclosure, alteration, or destruction. Users must understand the definition of sensitive information in the context of their job responsibilities and take steps to ensure that co-workers, staff, and student employees understand existing statutes and policies (such as FERPA, HIPAA, Donor Bill of Rights, Digital Millennium Copyright Act, GLBA, GDPR, etc., and College departmental guidelines that may supplement this agreement). Before granting access to sensitive information, users should be satisfied that a "need to know" is clearly demonstrated. Users should seek guidance from an appropriate supervisor, senior officer, or the chief information officer when the appropriate use of, or the granting of access to, such information is unclear.

It is a violation of College policy, and may be a crime, for individuals to attempt to gain access to College electronic data that they do not need in the performance of their job or to which they are not authorized to have access.

Data in the Moderate, High, and Restricted classifications are all considered “sensitive.” Sensitive college data should only be collected, stored, and shared when there is a specific business need and must be handled in a way that's consistent with its level of risk.

Restricted (sensitive)

High (sensitive)

Moderate (sensitive)

Low