You are here

Guidelines for the Secure Data Destruction of University Electronic Media Containing Confidential Information

Effective Date and Issuing Authority

Effective Date: November 23, 2011
Issuing Authority: Chief Information Security Officer

Scope

This guideline applies to all University faculty and staff (“employees”) who, during the course of their jobs at Temple University, may decide to dispose of computers or Electronic Media that contain confidential information. 

Purpose

Information protected or covered by regulations, such as FERPA, HIPAA, GLBA, PCI-DSS, Pennsylvania Breach of Personal Information Notification Act and other sensitive, private or personal information, must be protected at all times. In order to appropriately protect this information, measures must be taken to ensure that the confidentiality of the data is not compromised. Consistent with this business requirement, this guideline outlines the requirements employees must fulfill when disposing Electronic Media containing confidential information.

Temple University has implemented other guidelines, procedures and policies regarding privacy and information security. This guideline does not replace or supersede any of those guidelines, procedures and policies, but rather is intended to complement (and should be interpreted consistently with) other such university guidelines, procedures and policies.
 

Definitions

Terms defined in this guideline are intended to have the meaning ascribed to them by the respective University policies derived from federal, state or local regulation.

  1. Confidential Information – any proprietary University business information or research that is non-public, or contains Sensitive, Private or Personal Information, or Regulatory Protected Information
  2. Remnant Data - is the residual data that remains even after attempts have been made to remove or erase the data. This residue may result from data being left intact by a nominal file deletion operation, by reformatting of storage media that does not remove data previously written to the media, or through physical properties of the storage medium that allow previously written data to be recovered. Any data that can be recovered using forensic data recovery methods is considered Remnant Data.
  3. Education Records - Any record stored on Electronic Media maintained by the University or an agent of the University that is directly related to a student unless noted under FERPA as an exception.
  4. Electronic Media –Technology used to store or transport Confidential Information in electronic or digital form.  This includes, but not limited to, internal or external computer or printer hard drives, floppy or optical disks, CDs, DVDs, USB storage devices (such as thumb drives), digital storage cards (such as camera cards), cell phones, PDAs, Zip or Jaz drives, floppy disks, magnetic tapes (backup tapes), VHS tapes, cassette tapes. The University extends this definition to include media such as microfilm and carbon fax rollers, as well as any analog or other electronic storage media that is obsolete.
  5. Encryption - Encryption is the process of transforming information (referred to as plaintext) using an algorithm (called a cipher) to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key. The result of the process is encrypted information. Encryption can apply to an entire storage medium or to an individual file.
  6. Non Public Information (NPI) –personally identifiable financial information and any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available that should be given special protections to ensure that it is not disclosed to anyone unauthorized under the Gramm-Leach-Bliley Act (GLBA).
  7. Protected Health Information (PHI) – the definition given to information that should be given special protections to ensure that it is not disclosed to anyone unauthorized under the Health Insurance Portability and Accountability Act (HIPAA).
  8. Regulatory Protected Information – Data which is protected by federal, state or local law and includes, but is not limited to, PHI, NPI, and Educational Records.
  9. Secure Data Destruction – includes any method that ensures that Confidential Information that the data residing on Electronic Media is destroyed, leaving no residual data, and ensuring that the data irretrievable by any means. See Appendix A for a list of methods.
  10. Sensitive, Private or Personal Information – Any information that is not for public consumption and if that information were exposed or accessed in an unauthorized manner could cause harm to the University or any of its employees, faculty, students, or alumni.
     

Guidelines

  1. All Electronic Media containing Confidential Information scheduled for disposal or recycling must be erased using approved Secure Data Destruction. See Appendix A for a list of approved methods.
  2. Data Elements that needed to be protected can be referenced in the Personally Identifiable Information Guidelines.
  3. It is your responsibility to ensure that Electronic Media under your care that is destined for Secure Data Destruction (at the CRC or otherwise) is held in a secure location and that proper inventorying and handling of the Electronic Media takes place prior to scheduled pickup, or, up to the point of the delivery of the items to the CRC or any other designated secure location in transit for Secure Data Destruction.
  4. If you are employed by the Temple University Health System or Temple University Physicians, or other HIPAA covered entity, you may need to follow additional procedures outlined by the designated HIPAA Officer responsible for your area.

Appendix A – List of Methods Approved for Secure Data Destruction

As a general rule, any method that conforms to NIST 800-88 guidelines for data sanitation is considered approved by the Office of the Chief Information Security Officer. However, for specific recommendations or tools, please contact the Chief Information Security Officer before you decide on a specific method of destruction for your Electronic Media.

The data destruction processes adopted by the Computer Recycling Center have been approved by the Office of the Chief Information Security Officer.

The following are general classes of Electronic Media:

  • Magnetic Media – include, but not limited to, internal or external computer or printer hard drives (IDE, SCSI, SATA USB, or other type of connector), Zip or Jaz drives, floppy disks, magnetic tapes, VHS tapes, cassette tapes, etc.
  • Optical Media – include, but not limited to, laser disks, CDs and DVDs, etc.
  • Solid State Drives – include, but not limited to, USB storage devices (such as thumb drives), digital storage cards (such as camera cards), cell phones, PDAs, etc.