Home Sensitive Data - Examples

Sensitive Data - Examples

Much of the data identified as sensitive is about individuals; this data is typically known as Private Personal Information (PPI).  Other data deemed sensitive by the University includes security information and sensitive legal documents.

Sensitivity is sometimes determined by the context in which the item appears, and could change over time. Therefore, it’s not feasible to provide an inclusive list of all sensitive data items. Rather, here is a list of examples:

• Private Personal Information (PPI)
• Private Personal Information Relating to Categories of Individuals
• Employee
• Student
• Protected Health Information
• Customer
• Research Subject
• Donor
• Private Personal Information Relating to Any Individuals
• Social Security Number
• Credit Card Information Protected under PCI-DSS
• Personal Information Protected under Michigan Notification of Security Breach
• IT Security Information
• Legally Privileged Information
• Classified Research Information

Private Personal Information (PPI)

Private Personal Information (PPI) is a category of sensitive information that is associated with an individual person. PPI may be used to:

• uniquely identify, contact, or locate a single person
• enable disclosure of non-public personal information

Personal information that is “de-identified” (aggregated in a way that does not allow association with a specific person) is not considered sensitive.

Appropriate protection of PPI that is not publicly available is required by federal and state regulations, contractual obligations and University policies. These regulations apply to PPI stored or transmitted on any type of media – electronic, paper, microfiche, and even verbal communication. 

PPI should be accessed only on a strict need-to-know basis and handled with care. For more information about protecting PPI, please refer to Privacy Matters. 

Private Personal Information Relating to Categories of Individuals:

Employee

• Social Security Number
• National ID Number
• Bank Account Numbers
• Tax Information (W2, W4, 1099)
• Date/Location of Birth
• Country of Citizenship
• Citizenship Status
• Visa permit Data
• Driver’s License
• Gender
• Ethnicity
• Disability Information
• Marital Status
• Military Status
• Criminal Record
• Home Address
• Grievance Information
• Discipline Information
• Leave of Absence Reason
• Benefit Information
• Health Information

Student

Examples of data items contained in student education records include but are not limited to:

• Grades / Transcripts
• Class lists or enrollment information
• Student Financial Services information
• Athletics or department recruiting information
• Credit Card Numbers
• Bank Account Numbers
• Wire Transfer information
• Payment History
• Financial Aid / Grant information / Loans
• Student Tuition Bills
• Ethnicity
• Advising records
• Disciplinary records

Information categorized as “Directory Information” under FERPA is considered public information, unless students specifically request that their directory information not be disclosed.  The University of Michigan has designated the following items as “Directory Information”:

• Name
• Permanent and Local Address and Telephone
• U-M School or College
• Class Level
• Major Field
• Dates of Attendance
• Degree Received and Date Awarded
• Honors and Awards Received
• Participation in Recognized Activities
• Previous Schools Attended
• Height and Weight of Members of Intercollegiate Athletic Teams

For more information about FERPA, please refer to http://www.umich.edu/~regoff/ferpa/ .

Protected Health Information

• Created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and
• Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.

Examples of information protected under HIPAA include:

• Patient Names
• Street Address, City, Country, Zip Code
• Dates related to individuals
• Phone Numbers
• Social Security Number
• Account Numbers
• Patient admission date
• Patient discharge date
• Medical record number
• Patient number: Facility assigned
• Unique patient number: ORS assigned
• Procedure dates
• Carrier codes (Insurance/HMO Name)
• Patient zip-code
• Health care professional ID
• Health care facility ID
• Fax number
• Health plan beneficiary numbers
• Email addresses
• Internet Protocol Address Numbers (IP addresses)
• Web Universal Resource Locators (URLs)
• Device identifiers and serial numbers
• Certificate/License numbers
• Vehicle identification numbers and serial numbers
• Full face photographic images and any comparable images
• Biometric identifiers such as finger and voice prints
• Any other unique identifying number, characteristic, or code.

For more information about HIPAA, please refer to www.med.umich.edu/u/compliance and www.hhs.gov/ocr/hipaa.

Customer

• Provided to obtain (or in connection with) a financial product or service
• Results from any transaction involving a financial product or service between the University and a customer

Examples of services or activities which the University may offer, which could result in the creation of customer information protected under GLBA include but are not limited to:

• Student (or other) loans, including receiving application information, and the making or servicing of such loans
• Credit counseling services
• Collection of delinquent loans and accounts
• Check cashing services
• Real estate settlement services
• Issuing credit cards or long term payment plans involving interest charges
• Obtaining information from a consumer report

Examples of customer private personal information include but are not limited to:

• Social Security Number
• Credit Card Number
• Account Numbers
• Account Balances
• Any Financial Transactions
• Tax Return Information
• Driver’s License Number
• Date/Location of Birth

For more information about GLBA, please refer to:
https://www.safecomputing.umich.edu/download/info_security_program_jan2007.pdf

Research Subject

• Research Results
• Medical Records
• Any other information collected about research subjects that can be directly linked to them

For more information about the protection of human subject information, please refer to:
http://www.hhs.gov/ohrp/humansubjects/guidance/45cfr46.htm#subparta
http://privacyruleandresearch.nih.gov/ 
http://grants2.nih.gov/grants/policy/coc/

Donor

• Name
• Degree Information (Graduating Class & Degree(s))
• Credit Card Numbers (this is typically not kept but in case it is)
• Bank Account Numbers
• Social Security Numbers
• Giving History (Amount/what donated)
• Telephone/Facsimile Numbers
• E-mail, URLs
• Employment Information
• Family information (spouse(s)/children/grandchildren)
• Medical History (alumni/family who have major medical procedures performed at UM Hospital)

Private Personal Information Relating to Any Individuals

Social Security Number

For more information, please refer to SPG 601.14 and to http://www.legislature.mi.gov/(umv2ac45dnxufayrcenxe545)/mileg.aspx?page=GetMCLDocument&objectname=mcl-Act-454-of-2004

Credit Card Information Protected under PCI-DSS

• Credit Card Numbers/Expiration Dates
• Transaction Information

For more information about the PCI Data Security Standard and its implementation at the University, please refer to
https://www.safecomputing.umich.edu/download/PCIComplianceAtUofMv1_1-Final.pdf

Personal Information Protected under Michigan Notification of Security Breach

The law covers personal identification information such as name, number, or other information that can be used for the purpose of identifying a specific person or providing access to a person’s records. Protected personal information includes but not limited to:

• name
• address
• telephone number
• driver license or state personal identification card number
• social security number
• place of employment
• employee identification number
• employer or taxpayer identification number
• government passport number
• health insurance identification number
• mother's maiden name
• demand deposit account number
• savings account number
• financial transaction device account number or the person's account password
• stock or other security certificate or account number
• credit card number
• medical records or information
• vital record

For more information please refer to:
http://www.legislature.mi.gov/documents/2005-2006/publicact/htm/2006-PA-0566.htm
http://www.legislature.mi.gov/(S(mpmedj55thbfd345f511zs55))/mileg.aspx?page=getObject&objectname=mcl-445-71

IT Security Information

• authentication (e.g., log on/off)
• network-based filtering (e.g., router Access Control List and firewall logging)
• authorization (e.g., audit trails enabled to record access to files or records)
• vulnerability scanning (e.g., the output generated by a vulnerability scanner against an asset)
• security incident response (e.g., per SPG 601.25, the description of a security incident)
• risk assessment  (e.g., the detailed report from a risk assessment process detailing risks that are present in a given system)
• security planning (e.g. the designs and documentation of security architectures and plans)

IT security data includes but is not limited to the following:

• access and authorization audit logs generated by operating systems, applications, and other protection-oriented processes
• login / logoff transactions (successful and unsuccessful)
• intrusion detection signatures, logs, and alerts
• firewall policies, logs, and alerts
• risk assessment results
• incident reports and details stemming from breaches and suspicious events
• vulnerability scanning results

• security configurations of computers, networks, and other IT elements

More about stewardship of IT Security Information at https://www.safecomputing.umich.edu/umonly/SecInfoFAQ.html