Nursing Care of the Patient with Aneurysmal Subarachnoid Hemorrhage: A Clinical Practice Guideline (Guideline & Webinar)-APPENDIX B - Data Classification and Handling Guidelines

APPENDIX B - Data Classification and Handling Guidelines

Pdf Summary

Oakleaf’s Data Classification and Handling Guidelines define four levels of information sensitivity:

- <strong>Restricted:</strong> The most sensitive data, often subject to legal or contractual requirements, including many forms of customer PII/NPI. Unauthorized disclosure could cause significant business, regulatory, legal, or reputational harm.
- <strong>Confidential:</strong> Highly valuable internal information, such as employee PII/NPI, payroll, accounting, and financial data. Disclosure could cause moderate harm.
- <strong>Private:</strong> Oakleaf-owned or entrusted information that may be shared with authorized parties who have a business need, but not with the general public. Disclosure is expected to cause minimal or no harm.
- <strong>Public:</strong> Information approved for unrestricted internal and external sharing.

Information created or received for work is <strong>Private by default</strong>, unless it requires a higher classification or is approved for public release. Combined systems or datasets inherit the most restrictive classification of their contents. Restricted, Confidential, and Private information must not be released publicly. Changing its format or storage medium is permitted only if equivalent security controls remain in place. Exceptions require CEO and CISO approval.

Controls become stricter with sensitivity. Restricted and Confidential data generally require encryption, access controls, and careful handling in transmission, printing, copying, mailing, and disposal. Restricted data cannot be stored on mobile devices or in cloud storage; Confidential data is also prohibited on mobile devices, though secure cloud storage is permitted. Third-party access requires approval, and Restricted data requires an NDA. Private data has fewer mandatory controls, while Public data has few restrictions.

The guidelines define NPI/PII as a person’s name or initial and surname combined with specified identifiers, such as government ID, financial account, or health information. The document also provides examples of classified employee, client, business, and technology data, and notes that client-specific security requirements must be followed.

Keywords

data classification

information sensitivity

restricted data

confidential data

private data

public data

PII

NPI

access controls

encryption