Regulated Data Storage Matrix
Before using an IT tool to send, store or share institutional information, review the Guidelines for Storing Regulated Data at ODU. Information in the matrix below applies only to ODU enterprise versions of the services. Data that can be stored in an ODU OneDrive account, for example, should never be stored in an employee’s consumer OneDrive account.
How to interpret the Regulated Data Matrix
Use Permitted There are no technical, policy or contractual issues that prohibit the sharing of this data type with appropriate intended users using this service. If you have questions about who you can share data with, contact the data owner.
Use Restricted Use of this service with the regulated data type is restricted and special approval is needed. Please contact the IT Security Operations office at itshelp@odu.edu for more information.
Use Prohibited Use of this service with the regulated data type is prohibited. Do not use this service to send, store or share the regulated data type.
Select One:
Public Data |
Confidential Data |
Restricted Data |
|||||
Data Types |
Public DataDirectory Information, any university information publicly available
|
FERPAStudent Grades, Student class schedule, UIN, Advisor Student Notes, Financial Aid data. Note: Banner is the system of record for all academic data
|
Confidential Data Not Covered by FERPAInternal departmental information, non-public university information not covered by another category
|
PCI-DSSCredit Card Numbers, Bank Account and Routing Numbers
|
HIPAAPersonal Health records, Health Insurance Data
|
PII(Institutional Data) SSN, Driver License Numbers, Passport Numbers, Biometrics, combinations of information used to identify an individual
|
GLBAFinancial Aid, Customer financial transaction records
|
| OneDrive for Business
An enterprise service that allows users to store, share and edit files within online Office apps as part of Microsoft Office 365.
|
2 | 2 | |||||
| Google Drive
An enterprise solution that allows users to store, share and edit files as part of Google Apps.
|
6 | ||||||
| Microsoft Teams/SharePoint
An online collaboration space that is part of Office 365.
|
1,2 | 1 | |||||
| ITS Network Shares
Network drives only accessible on the ODU network and managed by ODU ITS.
|
1,2 | 1 | 4,5 | 4 | 4 | ||
| Local Workstation or Laptop
University-owned and personal devices. (Additional precautions are required for portable and personal devices not managed by ODU ITS.)
|
2,3 | 2,3 | 3,4 | 3,4 | |||
| Portable Storage
Thumb drives, portable hard drives or any other portable device that is capable of storing files.
|
2,3 | 2,3 | |||||
Legend
| 1 | In restricted folders with access limited to only ODU employees who have a need to know. |
| 2 | Temporary files or working copies that are non-authoritative and not source documents. |
| 3 | With approved methods of encryption. Please contact the Security Operations office at itshelp@odu.edu for more information. |
| 4 | With the review and approval of the Security office. |
| 5 | HIPAA compliance includes business office practices in addition to secure storage. A person within the department of office must be responsible for HIPAA compliance. |
| 6 | We are researching options for Google Drive to become compliant with FERPA regulations. |