Additional Guidance

HIPAA regulates the security and privacy of patient data, including clinical records and treatment information.  Harvard is a HIPAA hybrid entity, meaning that some parts of the organization are “covered functions” directly subject to HIPAA.

While the DSL4 security controls align with the minimum requirements of the HIPAA Security Rule, numerous additional operational and administrative controls are required to satisfy both the HIPAA Security and Privacy rules, and the regulation’s compliance requirements.  

Seek compliance guidance from the relevant Privacy officer at your covered entity. 
 

Payment card information is regulated by the PCI Data Security Standard (PCI DSS), a baseline of operational, administrative and technical controls for payment card account security. 

Harvard’s Office of Treasury Management publishes PCI compliance guidance and manages the annual compliance certification required for all Harvard entities that accept credit card payments.

As defined in section 4.1901 of the Federal Acquisition Regulation (FAR), FCI is “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government, excluding information provided by the Government to the public (such as that on public websites) or simple transactional information, such as that necessary to process payments” and applies to information residing in or transiting through an information system.  

Seek guidance from the Office of the Vice Provost for Research before executing federal contracts including the Safeguarding Clause 48 CFR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems. 

Cybersecurity Maturity Model Certification (CMMC) Level 1 focuses on basic cyber hygiene and the protection of federal contract information (FCI).  

See also: University Research Computing and Data (Univ RCD) Service 

CUI is a broad category of federal data that must be safeguarded in accordance with the NIST Special Publication 800-171 Protecting CUI in in Nonfederal Systems and Organizations.  Additionally, 32 CFR Part 2002 governs CUI handling.

Cybersecurity Maturity Model Certification (CMMC) Level 2 focuses on the protection of CUI. It includes the controls specified in NIST SP 800-171.

Seek guidance from the Office of the Vice Provost for Research before executing contracts or research agreements with federal requirements, particularly if: 

• Your sponsor designates certain data as CUI or subject to NIST controls.

• Your solicitations or contracts include references to:

  • NIST 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
  • 32 CFR 2002 Controlled Unclassified Information
  • 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
  • 252.204-7008 Compliance with safeguarding covered defense information controls
  • 252.204-7012 Safeguarding covered defense information and cyber incident reporting

  See also: University Research Computing and Data (Univ RCD) Service

The CJIS Security Policy is informed by presidential and FBI directives, federal laws, state laws, decisions made by the criminal justice community's Advisory Policy Board (APB), and National Institute of Standards and Technology (NIST) and has both a security and a compliance component.

The release of criminal offender record information (CORI) for research purposes may also be subject to Department of Criminal Justice Information Services regulations at the state level, such as MA 803 CMR. 

Seek guidance from the Office of the Vice Provost for Research before executing Data Use Agreements for criminal justice data with CJIS/DCJIS or MA 803 CMR terms.

FERPA is a regulation that protects the privacy of students and parents under section 444 of the General Education Provisions Act, as amended. It applies to education records, including “directory information” and determines how that information may be shared.  Before disclosing any student information, review the university’s FERPA overview  to determine if the “legitimate educational interest” bar is met and consult with the relevant school Registrar to determine and determine if any “FERPA blocks” apply to the data in scope. 

Numerous comprehensive privacy regulations stipulate data protection requirements that differ based on the type of personally identifiable data collected, where data subjects are located when the data is collected, and how that data may be utilized. Examples: 

• General Data Protection Regulation (GDPR) formally known as EU Regulation 2016/679  
• Personal Information Protection Law (PIPL), China’s comprehensive personal information and data privacy legislation.

In the U.S., data privacy requirements are shaped by state laws and regulatory enforcement rather than a single federal framework.     

Individuals protected by these and other similar regulations have data subject’s rights, such as choice and control over their personal information, and the right to erasure.  Entities collecting data from data subjects with such protections must be prepared to safeguard the collected data in accordance with the relevant regulatory framework and must be able to respond to data subject’s rights requests. 

The University Wide Privacy Principles should be incorporated into all processes involving personal information, including new and existing business operations, and human subjects research.  

Consult with OGC if necessary to clarify regulatory obligations prior to data collection.