ChatGPT and Moderate Risk Data
In Fall 2026 the university approved Cornell-provided ChatGPT accounts for use with some moderate risk data. Read below for details and how you protect Cornell data when using this AI tool.
This article applies to: Generative AI Basic
Your Role in Data Security
All Cornell individuals are responsible for complying with university policies 4.12 (Data Stewardship and Custodianship), 5.10 (Information Security) and 4.21 (Research Data Retention). University Policy 4.5, Access to Student Information may also apply in certain circumstances.
Data Types
The university broadly classifies data by risk level. This page has more information about data risk, and the regulated data chart can help you identify what tools are safe for which kinds of data.
High Risk
No high risk, personal health information (PHI) or HIPPA data may be used with an AI tool.
Moderate Risk
This broad category covers most university data. If you are ever unsure about the safety of your unique dataset in an AI tool, contact a data steward or, in the absence of an applicable steward, your supervisor.
ChatGPT may not be used in peer review or IRB meetings. FERPA and international personal data require special consideration (see below).
Low Risk
Low risk data can be used with an AI tool. Broadly speaking, this includes public or openly-shared information, which carries the risk of negligible harm to individuals or the university.
Data in ChatGPT
ChatGPT is approved for moderate risk data, with special considerations for FERPA and international personal data.
FERPA
The Family Educational Rights and Privacy Act (FERPA) is a 1974 federal law protecting the privacy of student educational records. FERPA safeguards student privacy by limiting who may access student records, specifying for what purpose they may access those records, and detailing what rules they must follow when accessing the data.
Data covered by the FERPA law includes a broad category of data types, some of which fall under high-risk data. The most common examples of high risk data include:
- Student Financial Information, not limited to Financial Aid applications and records, the student’s Bursar account, work-study record, cost of attendance, and satisfactory academic progress. (The Gramm-Leach-Bliley Act or GLBA also covers financial information).
- High-Risk Personally Identifiable Information (PII): FERPA doesn’t explicitly describe this, but high-risk in Cornell’s classification of regulated data includes SSN, Payment Cards, Driver’s License, Visa or Passport, Bank Account numbers, and any official government ID in conjunction with the person’s legal name or other identifying information.
- Combined Personally Identifiable Information: Refers to situations when combined, otherwise low-risk information positively identifies a student with their educational record. An example might be some combination of NetID + Student’s Full Name + Home Address + a Parent’s Full Name + Phone Number + Date of Birth. If these were present in a Cornell Health record (also protected by HIPAA) or disciplinary context, it would be High Risk.
This table describes different FERPA data and the associated risk categories in full.
International Personal Data
The laws regarding data about individuals located outside the United States vary widely.
To use international personal data with ChatGPT, you must turn off web search first. Using a prompt that says (in essence) "don't search the web with this data" is not a reliable safeguard
Using FERPA Data in ChatGPT
The greatest risk to Cornell data happens when ChatGPT uses the web to search for answers to your prompts. While there are measures in place to protect institutional data, they are not always completely effective.
When using ChatGPT with FERPA data, you will need to use an AI Assistant specifically designed to handle FERPA queries. Instructions about how to access the AI Assistant through the Cornell assistant library will be available here once implemented.
Comments?
To share feedback about this page or request support, log in with your NetID