Skip to main content

Regulated Data Chart

This article applies to: Regulated Data

Before using any Cornell service to send, store, or share institutional information, review Regulated Data: Guidelines for Campus IT Software and Services.

Using the Regulated Data Chart

The Regulated Data Chart provides guidance to help you choose appropriate technology tools for sending, storing, and sharing institutional information. Before choosing a tool to send, store, or share institutional information, ask two questions:

  • Question 1: Does the Regulated Data Chart permit use of this IT service with the data type I am interested in working with?
  • Question 2: Do my department/unit policies and my data steward permit use of this IT service with the data type I am working with and for the way(s) I am using the data? If you don't know, check with your supervisor. See University Policy 4.12 (Data Stewardship and Custodianship) for the list of data stewards.

If the answer to both questions is yes, you may use the IT tool to send and store the university data in question.

Important notes for chart users:

  • Information in the Regulated Data Chart applies exclusively to Cornell's enterprise version of the service listed. It does not extend to consumer or personally acquired versions of these services, or to third-party applications associated with these services. You must use Cornell's enterprise version to be in compliance with legal, contractual, and policy rules surrounding Cornell's institutional information.
  • The Regulated Data Chart does not apply to data associated with faculty research unless that research falls under a regulation or contract.
  • Your department/unit policies and your data steward ultimately govern whether you can use a particular service to send, store, or share regulated data. The guidance of the Regulated Data Chart by itself is not sufficient.

Regulated Data Chart

  • Calendar
  • Collaboration Services
  • Blogs (WordPress)
  • Yes
  • No
  • No
  • No
  • No
  • Caution(i)
  • Electronic Lab Notebooks
  • Email
  • ePortfolio
  • Event Support and Media
  • Service Management Suite
  • Lecture Capture
  • Managed Servers
  • Password Management
  • Plagiarism Detection
  • Printing Services
  • Storage Services
  • Student Information Management
  • Survey Tool
  • Video Streaming, Hosting, and Video Signage
  • Web Hosting Services
  • Web Services
  • Web and Video Conferencing

Regulated and High-Risk Data Definitions

FERPA (Education Records): Education records (i.e., files and documents which contain information related to an identifiable student) are protected by the Family Educational Rights and Privacy Act (FERPA). Examples: class lists, grade rosters, records of advising sessions, grades, financial aid applications. See University Policy 4.5, Access to Student Information.

HIPAA (Health Records): Certain health information is protected by the Health Information Portability and Accountability Act (HIPAA) and is considered high-risk data if it is individually identifiable and held or transmitted by a covered entity. Examples: health records, patient treatment information, health insurance billing information. The HIPAA-covered entities at Cornell are Weill Cornell Medicine (WCM), Cornell Health, Benefit Services (both for the Ithaca campus and WCM), and University Counsel.

Personal Identifiers (High-Risk Data): Personal identifiers are Social Security numbers, credit or debit card numbers, driver’s license (or non-driver identification) numbers, bank account numbers, visa or passport numbers, protected health information subject to the Health Insurance Portability and Accountability Act (HIPAA), and personal financial information subject to the Gramm-Leach-Bliley Act (GLBA). These are considered high-risk data when they appear in conjunction with an individual’s legal name or another identifier.

GLBA (Bursar Records): Cornell’s Bursar records are protected by the Gramm–Leach–Bliley Act (GLBA), also known as the Financial Services Modernization Act, and also by the Family Educational Rights and Privacy Act (FERPA).

Human Subjects: Sensitive identifiable human subject research data (i.e., information that reveals or can be associated with the identities of people who serve as research subjects) is regulated by the Federal Policy for the Protection of Human Subjects (also called the “Common Rule”). Examples: names, fingerprints, full-face photos, a videotaped conversation, or information from a survey filled out by an individual.

Export Controlled Research: Export Controlled Research is protected by International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR). Sending, or otherwise making available, export-controlled information to a foreign national, either in or outside of the United States territory, is an export. Similarly, storing export-controlled information on a cloud computing server or another third-party server that is located in a foreign country or accessible by foreign nationals is an export. Example: dual-use technology used for scientific advancement as well as military applications.

Credit Card Payment Processing: Credit card numbers used for payment processing are regulated through a trade association agreement with the Payment Card Industry (PCI). Examples: credit card numbers, names, and other information used for payment processing.

Restricted Research Data: Restricted Access Research Data Sets. Example: census data.

About this Article

Last updated: 

Tuesday, October 12, 2021 - 1:32pm

Was this page helpful?

Your feedback helps improve the site.