“Confidential Information” refers to all types of data Levels 2-5. The higher the data level, the greater the required protection.
Level 2 is information the University has chosen to keep confidential but the disclosure of which would not cause material harm.
Level 2 information includes unpublished research work and intellectual property not in Level 3 or 4. Level 2 also includes information classified as Level 2 by an Institutional Review Board (IRB).
Examples:
Level 2 Requirements
View detailed requirements for users, devices, servers, and paper records.
Level 3 information could cause risk of material harm to individuals or the University if disclosed.
Level 3 information includes individually identifiable information which if disclosed could reasonably be expected to be damaging to reputation or to cause legal liability. Level 3 also includes research information classified as Level 3 by an Institutional Review Board (IRB).
Examples:
Data use agreements, research consent forms and other contracts under which Harvard personnel receive confidential information from outside parties often state specific data use and protection requirements. Harvard personnel working with such information must comply with such requirements. Use of such information must also comply with the applicable Harvard data security requirements if the contract calls for lesser levels of protection than the Harvard rules.
Harvard's Confidential Information policy does not restrict or limit the rights of employees to discuss terms and conditions of their employment, including salary and benefits, with each other or with third parties.
Level 3 Requirements
View detailed requirements for users, devices,servers, paper records, and working with vendors.
Level 4 information would likely cause serious harm to individuals or the University if disclosed.
Level 4 information includes High Risk Confidential Information (HRCI), as defined below, and research information classified as Level 4 by an Institutional Review Board (IRB). Level 4 also includes other individually identifiable information which if disclosed would likely cause risk of serious social, psychological, reputational, financial, legal or other harm to an individual or group.
“High Risk Confidential Information” means an individual’s name together with any of the following data about that individual: social security number, bank or other financial account numbers, credit or debit card numbers, driver’s license number, passport number, other government-issued identification numbers, biometric data, health and medical information, or data about the individual obtained through a research project.
Examples:
* Note on Medical Records and HIPAA: Harvard units or programs that are so-called "covered entities" under the Health Insurance Portability and Accountability Act (HIPAA) must comply with HIPAA’s data security rules. As of the effective date of this policy, the covered entities are University Health Services, Harvard Dental Services, and certain University benefits plans. Other units or programs may be required to comply with HIPAA data security rules for limited purposes under the terms of specific contracts, such as a business associate agreement. See HIPAA Advisory.
Level 4 Requirements
View detailed requirements for users, servers, paper records, and vendors.
Level 5 information would cause severe harm to individuals or the University if disclosed.
Level 5 information includes individually identifiable information which if disclosed would create risk of criminal liability, loss of insurability or employability, or severe social, psychological, reputational, financial or other harm to an individual or group.
Level 5 includes research information classified as Level 5 by an Institutional Review Board (IRB).
Examples:
Note: Due to the unique level of risk associated with Level 5, special precautions are required. Download the standalone set of Level 5 Requirements.