At the University of Michigan, data is categorized into four levels—Restricted, High, Moderate, and Low. These classifications determine the security requirements for projects or investments. For instance, data classified as High requires a detailed vendor security risk questionnaire, whereas Moderate data does not.

Learn more about the data classification levels.

Learn more about the information security requirements for each classification.

Learn more about Research Security and Compliance.

Learn more about Data Security & Privacy Sharing.

Learn more about Security and Privacy Controls for Information Systems and Organizations

Sensitive data at the University of Michigan is further divided into specific data types, largely based on regulatory requirements. These are commonly recognized categories such as Health Insurance Portability and Accountability Act (HIPAA), Family Educational Rights and Privacy Act (FERPA), Controlled Unclassified Information (CUI) and Federal Information Security Management Act (FISMA). Each data type has a designated university data steward responsible for governance, which includes:

• Assigning the appropriate classification based on sensitivity and criticality
• Approving standards and procedures for the day-to-day management of the data
• Defining the criteria for access

For example, the Michigan Medicine Corporate Compliance office serves as the data steward for HIPAA data. They alone have the authority to determine whether data qualifies as Protected Health Information (PHI) and to approve which technologies may be used with it.

Data stewards also approve specific university services for their data types. These approvals are listed in the Sensitive Data Guide, which also outlines special usage requirements. For instance, when storing PHI in Dropbox, you must use a Dropbox Team Folder.

It’s important to note that all data types still fall under a classification level. For example, Sensitive Identifiable Human Subject Research is classified as High, which means it requires many of the same safeguards as PHI.

Learn more about the Sensitive Data Guide.

Learn more about data stewardship at the university and who the data stewards are.

How to classify your data

Before entering the assurance process, it is essential to classify your data to determine the appropriate level of protection, security controls, and approval requirements. Determining the Data Classification Level helps identify potential risks and ensures that the right safeguards are applied based on the sensitivity of the information—whether it involves public, internal, sensitive, or restricted data. This step lays the foundation for an efficient and accurate Information Assurance: Michigan Medicine review, helping to protect both the institution and its researchers.

You can determine your data classification by using this guide.

If you need help classifying PHI, then submit a request here.