Data Security

Level Data Classification and Examples (abridged version)
5 Information that would cause severe harm to individuals or the University if disclosed.
  • Research information classified as Level 5 by an IRB or otherwise required to be stored or processed in a high security environment and on a computer not connected to the Harvard data networks
  • Certain individually identifiable medical records and genetic information, categorized as extremely sensitive
4 Information that would likely cause serious harm to individuals or the University if disclosed.
  • High Risk Confidential Information (HRCI) and research information classified as Level 4 by an IRB
  • Personally identifiable financial or medical information
  • Information commonly used to establish identity that is protected by state, federal, or foreign privacy laws and regulations
  • Individually identifiable genetic information that is not Level 5
  • National security information (subject to specific government requirements)
  • Passwords and Harvard PINs that can be used to access confidential information
3 Information that could cause risk of material harm to individuals or the University if disclosed.
  • Research information classified as Level 3 by an IRB
  • Information protected by the Family Educational Rights and Privacy Act (FERPA) to the extent it is not covered under Level 4 including non-directory student information and directory information about students who have requested a FERPA block
  • HUIDs associated with names or any other information that could identify individuals
  • Harvard personnel records (employees may discuss terms and conditions of employment with each other and third parties)
  • Institutional financial records
  • Individual donor information
  • Other personal information protected under state, federal and foreign privacy laws not classified as Level 4 or 5
2 Information the disclosure of which would not cause material harm, but which the University has chosen to keep confidential.
  • Unpublished research work and intellectual property not in Level 3 or 4
  • Research information classified as Level 2 by an IRB
  • Patent applications and work papers, drafts of research papers
  • Building plans and information about the University physical plant
1 Public information.
  • Research data that has been de-identified in accordance with applicable rules
  • Published research
  • Published information about the University
  • Course catalogs
  • Directory information about students who have not requested a FERPA block
  • Faculty and staff directory information


For additional research-related DSL guidance, refer to Information Security's Research Data Examples