Lehigh G Suite: Best practices for data security

Lehigh and Google have negotiated contractual terms and conditions that protect the privacy and confidentiality of university student, faculty, and staff data in the Lehigh Google Suite of services. The contract ensures that we continue to own our data; that Google will not share this data; and that Google will not data mine for commercial purposes. Google will keep our data in perpetuity, delete it when requested, and will not display advertisements within the suite of Core Apps. For an explanation of Google’s privacy and security policies, see:

Under these terms, you can use G Suite to conduct university activities that are aligned with your role at the university.

Sensitive Data at Lehigh

Lehigh classifies sensitive data into types and provides guidelines for safe handling of this data. The sections below discuss sensitive data and G Suite. If you have questions, contact Lehigh Information Security specialists at security@lehigh.edu.

Read these relevant policies:

Email is not secure

Email is an unsecured medium for sharing sensitive information. Lehigh has enabled and enforced data encryption in transit for all email going to or being read via the Lehigh gmail service either by the Web browser (HTTPS) or via IMAP clients (SSL). Although most email services now use encryption in transit, it is not guaranteed that a remote system is using encryption. Think of email as communicating via postcard -- it offers little in the way of security or privacy.

G Suite and sensitive data

The following paragraphs provide information about some common types, or classifications, of Lehigh data, and storage on G Suite (e.g., Drive). Briefly though, these types of data should never be stored in Lehigh G Suite or stored or transmitted via email. To view detailed policies on handling of sensitive data, view the Classification of Data Tables.:

Family Educational Rights and Privacy Act (FERPA) Data. The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. Per Lehigh’s data classification policy, FERPA-protected records (and other confidential information “stored in an encrypted form within the personal network (LAN) file space of the individual and must not be backed up to a cloud storage service.”
Personally-identifiable Information (PII). Personal identifiers, including Social Security, tax identification, driver’s license, and bank account numbers, listed in the Breach of Personal Information Notification Act, as well as other legally confidential data, are protected information.
Financial Information (payment/credit card information). Pursuant to federal laws, Lehigh has a duty to safeguard every type of nonpublic, personally identifiable financial information. In addition, Lehigh must protect payment/credit card data and related account information. Examples include information provided on an application for a credit card, payment history, and account balance information.
Health Insurance Portability Accountability Act (HIPAA) and Protected Health Information (PHI). Individually-identifiable health information is lega