Ohio Administrative Code › Title 3356 - Youngstown State University › Chapter 3356-4 - University Property and Use of Equipment › Section 3356-4-13 - Sensitive information/information security

Current through all regulations passed and filed through July 1, 2024
(A) Policy statement. Youngstown state
			 university ("YSU" or "university") creates and maintains sensitive information
			 as part of normal operations. Appropriate safeguards and procedures protect the
			 integrity, availability, and confidentiality of sensitive information. All
			 university employees and individuals who have access to sensitive information
			 have a responsibility to properly handle and secure such information.
(B) Purpose. To establish guidelines for the
			 identification and safeguarding of sensitive information (i.e., information
			 that should not be disclosed within or beyond Youngstown state university
			 without proper authorization and safeguards).
(C) Scope. This policy applies to university
			 employees (including student employees,
			 customers, volunteers, vendors, contractors, board members, university
			 affiliates, and any others who use or are 
								granted
			 access to university sensitive information.
(D) Definitions and information
			 classifications (for the purposes of this policy).
(1) "Sensitive information." Information that
			 the university has a legal, regulatory and/or business interest obligation to
			 protect. Sensitive information transcends the medium on which it is stored or
			 communicated and is sensitive regardless of whether it is in verbal, paper,
			 electronic, or any other format.
(2) "Personal information." Highly sensitive
			 information that the university is required to protect often due to governing
			 laws, including Family Educational Rights and Privacy Act ("FERPA"),
			 the Gramm-Leach-Bliley Act ("GLBA"),
			 the Health Insurance Portability and
			 Accountability Act ("HIPAA"), and payment card industry data security standard
			 ("PCI DSS"). Compromise of personal information has specific negative
			 consequences and requires that the university take specific actions. This
			 category encompasses information not freely available that can be associated
			 with a particular individual, including:
(a)
			 Social security number.
(b) Credit
			 card numbers.
(c) Driver's license
			 number.
(d) Date and place of
			 birth.
(3) "Confidential
			 information." Sensitive information having different degrees of sensitivity but
			 still requiring that confidentiality must be maintained. Included is
			 information that must be very closely safeguarded, such as:
(a) Trade secrets.
(b) Employee benefit information.
(c) Student information
			 (non-directory).
(d) Account
			 passwords/personal identification numbers ("PINS").
(e) Digitized signatures.
(f) Encryption keys.
(g) Medical records.
(4) "YSU public information." Information
			 that has been specifically declared and approved as public by YSU. It includes
			 information such as student directory information to the extent permitted under
			 FERPA or records approved as public by the general counsel's office in response
			 to a public records request.