If you have any questions about the proper handling of data, please contact
Information Security.
The full policy is available at the
Classification of Data Policy and Table.
The tables below show which services and devices are approved for each class of Lehigh data. Classes I through III are Confidential Information. Class IV is public, unrestricted information. When a service is not listed, treat it as not approved and contact Information Security before use.
Acceptable Approved for this data class
Not acceptable Do not use for this data class
With exclusions Approved only under the conditions in the linked footnote
Under evaluation Not yet approved for any confidential data
AI Services
| Service | Confidential Information | Public | |||
|---|---|---|---|---|---|
| Class I Critical – PHI1 |
Class I Critical – non-PHI |
Class II Restricted |
Class III Institutional / Proprietary |
Class IV Public / Unrestricted |
|
| Google Gemini AI (with Lehigh account)**Includes Gems, NotebookLM, AI Studio | Not acceptable | With exclusions** | Acceptable | Acceptable | Acceptable |
| DataCamp7 | Not acceptable | Not acceptable | With exclusions7 | Acceptable | Acceptable |
| LibreChat | Not acceptable | Not acceptable | Not acceptable | Acceptable | Acceptable |
| Claude (Anthropic) | Not acceptable | Not acceptable | Not acceptable | Acceptable | Acceptable |
| Zoom AI8 | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| Microsoft Copilot | Under evaluation | ||||
| Keenious | Under evaluation | ||||
| Adobe Firefly | Under evaluation | ||||
| Sandbox | Under evaluation | ||||
| otter.ai / read.ai (meeting note tools) | Do not use. These tools have aggressive marketing tactics. Use Zoom’s embedded tools instead. | ||||
| All other AI toolse.g. ChatGPT/OpenAI, Perplexity, Claude, etc. through a “Free” tier or not acquired through Lehigh’s central purchasing process | Not acceptable | Not acceptable | Not acceptable | Not acceptable | Acceptable |
Electronic Devices and Lehigh Hosted or Contracted Services
| Device or service | Confidential Information | Public | |||
|---|---|---|---|---|---|
| Class I Critical – PHI1 |
Class I Critical – non-PHI |
Class II Restricted |
Class III Institutional / Proprietary |
Class IV Public / Unrestricted |
|
| Lehigh owned, LTS-managed whole-disk-encrypted devicesIncluding, but not limited to: computers, network attached storage (NAS), and portable storage devices | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| Personally owned computers or storage devices | Not acceptable | Not acceptable | Not acceptable | Not acceptable | Acceptable |
| Unmanaged devicesLehigh owned or personal, e.g. mobile | Not acceptable | Not acceptable | Not acceptable | Not acceptable | Acceptable |
| Lehigh University LAN drive (H: I: J: drives) | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| Approved access-controlled LAN drive storage* | Acceptable | Acceptable | Acceptable | Acceptable | Acceptable |
| Web and storage space | Not acceptable | Not acceptable | Not acceptable | Acceptable | Acceptable |
| Ceph storage with LTS access control (R drive) | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
Cloud Storage and Hosted Services
| Service | Confidential Information | Public | |||
|---|---|---|---|---|---|
| Class I Critical – PHI1 |
Class I Critical – non-PHI |
Class II Restricted |
Class III Institutional / Proprietary |
Class IV Public / Unrestricted |
|
| AWS – Secure Research Cloud (SRC) | Acceptable | Acceptable | Acceptable | Acceptable | Acceptable |
| AWS – Lehigh Administrative Data Lake (LADL) | With exclusions | With exclusions | Acceptable | Acceptable | Acceptable |
| Confluence | Not acceptable | Not acceptable | Not acceptable | Acceptable | Acceptable |
| Course Site | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| DocuSign6 | With exclusions6 | With exclusions6 | Acceptable | Acceptable | Acceptable |
| Drupal and Lehigh hosted webpages | Not acceptable | Not acceptable | Not acceptable | Acceptable | Acceptable |
| Email – Lehigh Gmail4 | Not acceptable | Not acceptable | With exclusions4 | Acceptable | Acceptable |
| JIRA | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| Lehigh File Sender | Not acceptable | Acceptable | Acceptable | Acceptable | Acceptable |
| Lehigh Google Drive**Encrypted in transit and at rest. Note: Google stores data on servers located domestically and abroad. | With exclusions | With exclusions | With exclusions | Acceptable | Acceptable |
| Lehigh Dropbox for Business3Encrypted in transit and at rest. All data is stored in the US. | With exclusions3 | With exclusions3 | Acceptable | Acceptable | Acceptable |
| Personal Dropbox | Not acceptable | Not acceptable | Not acceptable | Not acceptable | Acceptable |
| Lehigh Microsoft OneDrive**Encrypted in transit and at rest | Not acceptable | Not acceptable | With exclusions | Acceptable | Acceptable |
| Qualtrics | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| REDCap5 | With exclusions5 | With exclusions5 | Acceptable | Acceptable | Acceptable |
| Slack (Lehigh licensed) | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| Zoom | Not acceptable | Not acceptable | Acceptable | Acceptable | Acceptable |
| Zoom – HIPAA2 | With exclusions2 | With exclusions2 | Acceptable | Acceptable | Acceptable |
Notes and Exclusions
- *
- Must be approved by Information Security or implemented by LTS in an approved configuration.
- **
- ITAR and Export controlled information under U.S. laws are excluded. Although ITAR and Export controlled information under U.S. laws are classified as Type II data, it cannot be stored on systems outside the US. In addition to storage restrictions on this type of data, there are also restrictions on sharing such data with foreign nationals of restricted countries. It is up to the data owner to determine whether any export-controlled data may be shared with someone or transported to a particular country. Guidance can be found at the US Department of Commerce Control List site.
- 1
- Protected Health Information (PHI).
- 2
- Zoom can be used for PHI or Class I data, but you MUST have your account converted to a HIPAA compatible account, and you will lose some Zoom functionality (i.e. cloud recording, breakout rooms, etc.).
- 3
- Dropbox for Business can be used for PHI or Class I data, but you MUST have a team drive set up by LTS and the Class I data placed in the C1 folder. Do not share any files externally.
- 4
- Class II data can be shared internally to other @lehigh.edu email addresses. FERPA does not allow us to share student data to external email addresses.
- 5
- REDCap needs to be appropriately configured for Class I or Class I PHI data.
- 6
- DocuSign must be set up by LTS to support Class I or Class I PHI data.
- 7
- DataCamp is a learning tool, and classes can be set up inside of DataCamp, which requires sharing enrollment information. DataCamp is not designed to process Class II information in a production environment. Please consult with LTS if you have use cases outside of the learning environment.
- 8
- The Zoom HIPAA version, which is used by a limited number of Lehigh faculty and staff, does not support some Zoom features like AI and cloud-based recording.