Privacy Information

Privacy Information

Policy 9.10B: Data Access Policy

I. Policy

Quincy College (QC) shall approve access to Sensitive Institutional Data in order to ensure that access to sensitive data is authorized, that sensitive data with a need for protection are used appropriately and that authorized access complies with the QC Privacy Policy and relevant state and federal laws.

Institutional Data shall be classified in accordance with the Data Classification and Protection Standard to identify the level of confidentiality needs, legal requirements, and minimum standard protections for the data before access is granted.

Access to Sensitive Institutional Data is approved by the appropriate Vice President, Director, or his/her designee. A Data Steward may be designated to oversee data quality and permissions. The appropriate Vice President or Director shall grant access in compliance with institutional policies and all relevant regulations (e.g. FERPA, HIPAA and GLBA). Only those employees, affiliates, and systems that need the access to perform their job duties or mission shall have access to Sensitive Institutional Data. In the case that a Data Steward is not designated, the data in question are owned by the Dean, Vice President, or department head of the unit that originates the data.

Access to Social Security Number (SSN) data shall not be granted to an employee unless approval has been granted by a College Vice President or a Vice President’s designee.

All access by individuals to Sensitive Institutional Data shall be controlled by reasonable measures to prevent access by unauthorized users.

Data Users must responsibly use data for which they have access including only using the data for its intended purpose and respecting the privacy of members of the College community. Data Users must maintain the confidentiality data in accordance with the applicable laws and the Data Classification and Protection Standard. Authorized access to Sensitive Institutional Data does not imply authorization for copying, further dissemination of data, or any use other than the use for which the employee was authorized. The Vice President or his/her designated Data Steward retains the right to approve and grant access to Sensitive Institutional Data.

Scope
This policy applies to access to Sensitive or Restricted data maintained by the College or a party acting on the behalf of the College. This policy does not apply to data or records that are personal property of a member of the College community, research data, or data created and/or kept by individual employees or affiliates for their own use. Requests for records by the public are outside of the scope of this policy and shall be referred to Human Resources, Institutional Research & Assessment, or the Office of Student Records. This policy also does not apply to situations in which the College is legally compelled to provide access to information.

II. Definitions

Access: Flow of information between a store of data and a user, system, or process. A user, system, or process is considered to have access to data if it has one or more of the following privileges: the ability to read or view the data, update the existing data, create new data, delete data or the ability to make a copy of the data. Access can be provided either on a continual basis or, alternatively, on a one-time or ad hoc basis. Transferring any data from one party to another in any medium is tantamount to permitting access to those data.

Institutional Data: Those data, regardless of format, maintained by the Quincy College (QC) or a party acting on behalf of QC for reference or use by multiple College units. Institutional Data does not include data that is personal property of a member of the College community, research data, or data created and/or kept by individual employees or affiliates for their own use. Examples of Institutional Data include student education records, payroll records, human resources records, and enterprise directory records.

Sensitive Institutional Data: Those Institutional Data that contain information that can be classified as either “sensitive” or “restricted” using the QC Data Classification and Protection Standard. Some examples of Sensitive Institutional Data include Institutional Data that are personally identifiable in nature and contain Social Security Numbers, Credit Card Numbers or other financial account numbers, HIPAA protected health information, or FERPA protected student education records.

Data Steward The individual responsible for the data. The Data Steward is usually the dean, vice president, or unit head of the College unit that creates or originates the Institutional Data or his/her designee.

Data User: An individual that has been authorized to access data for the performance of his/her job duties.

III. Procedure

Each College department/unit is responsible for implementing, reviewing and monitoring internal policies, practices, etc. to assure compliance with this policy.  The Office of Technology & Mission Support is responsible for enforcing this policy.

Vice Presidents, Directors, or appointed Data Stewards shall ensure that procedures for requesting and approving access to Sensitive Institutional Data exist and are followed. Data Stewards shall also implement procedures for regularly auditing access to Sensitive Institutional Data and revoking access when it is no longer needed or authorized. Procedures may vary from Data Steward to Data Steward as necessary to accommodate different Data Steward mission/resources/etc. and different groups of Data Users. However, all procedures shall include sufficient tracking for requests, approvals, and revocations such that authorized access to Sensitive Institutional Data is auditable.

A Vice President, Director, or Data Steward may delegate the ability to approve access to Sensitive Institutional Data to trusted individuals in designated roles. A Data Steward may delegate by creating procedures through which the designee may approve access by employees that have certain pre-approved roles and responsibilities. Data Stewards retain the responsibility for ensuring that all access to Sensitive Institutional Data is authorized, appropriate, and complies with relevant legal requirements; the responsibility does not transfer to designees.

Access to Sensitive Institutional Data by external parties shall be governed by individual contractual agreement or memoranda of understanding if the third party is a governmental organization. Such contractual agreements shall be approved by the Information Technology department and by the appropriate QC designated Data Steward.

Violations
Violation of this policy may incur the same types of disciplinary measures and consequences as violations of other College policies, including progressive discipline up to and including termination of employment, or, in the cases where students are involved, reporting of a Student Code of Conduct violation.

Violation of this policy may also result in termination of contracts or commitments to vendors and other affiliates. Legal action may be pursued where appropriate.

Data Classification and Protection Standard
Data can be classified either in terms of its need for protection (e.g. Sensitive Data) or its need for availability (e.g. Critical Data). Use the information below to classify data in terms of its need for protection or its availability. The four categories are Public, Internal, Sensitive, and Restricted.

Public Data
Data can be disclosed without restriction. Examples – Directories, Maps, Syllabi and Course Materials, de-identified data sets, etc.

Internal Data
Confidentiality of data is preferred, but information contained in data may be subject to open records disclosure. Examples – email correspondence, budget plans, etc.

Sensitive Data
Data confidentiality required by law, policy, or contractual obligation. Loss of confidentiality or integrity will cause significant damage to QC’s reputation or could cause harm to QC stakeholders. Sensitive information is typically redacted from open records disclosures (e.g. Student ID numbers, student records, etc.).

Restricted Data
Restricted data requires privacy and security protections. Special authorization may be required for use and collection. Examples – data sets with individual Social Security Numbers (or last four of SSN), credit card transaction or cardholder data, patient health data, financial data, etc.

Protection of information is mandated by law or required by private contracts. Loss of confidentiality or integrity will cause significant damage to QC’s reputation or could cause harm to QC stakeholders. Records with restricted information are typically not open for public inspection.

Supportive Data
Supportive data is necessary for day-to-day operations, but is not critical to QC’s or to a Department/Unit’s mission or core functions. Examples – course materials, meeting minutes, workstation images, etc.

High-priority Data
Availability of data is necessary for departmental function. Destruction or temporary loss of data may have an adverse effect on college or departmental mission, but would not affect university-wide function.

Critical Data
Critical data have the highest need for availability. If the information is not available due to system downtime, modification, destruction, etc., the College’s functions and mission would be impacted. Availability of this information must be rigorously protected.

See the table below for minimum standard protection requirements for each category of data when being used or handled in a specific context (e.g. Sensitive Data sent in an email message). Please note that the below protection standards are not intended to supersede any regulatory or contractual requirements for handling data. Some specific data sets, such as student records data, credit/debit card data, healthcare data, and financial account data, may have stricter requirements in addition to the minimum standard requirements listed below.