Confidential Data

Purpose

To protect confidential information vital to the College’s business. Information includes but is not limited to: all transactional records, student and employee information, memos, reports, etc.

Policy Statement

All employees must safeguard College confidential business information as part of their daily actions and work routines. Confidential data is defined in the “Data Classification Standard” listed at the bottom of this policy.

Applies to

All employees

Responsibilities

  • For authorized personnel confidential data may be made available on a need to know basis as and when required. For all other persons access to such information must be prohibited,
  • Unauthorized modification, transmitting or other dissemination of confidential information is strictly prohibited. Unauthorized dissemination of this information may result in disciplinary or legal action as appropriate,
  • Confidential information should be safely stored and protected while on file servers, network drives, workstations, and during any type of transmission. Authorized access should be enforced. Confidential information should be erased securely from network drives, file shares etc. after proper authorization.
  • Network or directory share information showing where the confidential information is stored must not be publicly viewable, 
  • Confidential data must not be emailed or faxed; unless there is no other method available to transmit the information. Upon prior authorization, confidential information sent via email must be sent from their official Bridgewater State College (username@bridgew.edu) email account,
  • Employees must not download and store confidential information unless encrypted on their personal computers, external hard drives, thumb/ pen drives and CD/DVD, or any removable device,
  • Printed reports that contain confidential data must not be left available to the public. All printed confidential data must be shredded or disposed of into locked bins,
  • Employees must not take printed or unencrypted confidential data off-campus,
  • Employees must not discuss confidential data in public,
  • All attachments or electronic files received from external sources must be scanned for viruses or malicious code in order to protect existing confidential information,
  • The College will periodically audit employees to insure compliance and enforcement of policy,
  • Any incidents of non-compliance may be reported to the Chief Information Officer (CIO).

Data Classification

Data Classification Standards (PDF)

 

Title: Confidential Data
Approved By: Bill Davis, Chief Information Officer
Approval Date: May 2005
Date of Last Revision: February 2008
Policy Category: Information Technology Division

 

 

Last Modified: July 2, 2008