Storage Guide NIH

Main Rules for Securing Data at NIH:

• Datasets containing personal data should, if possible, be pseudonymized - and the code key stored separately.
• The dataset must be secured with access control and labeled with classification when stored in NIH's cloud solution (Microsoft 365 or Azure).
• Data should generally not be stored solely on a personal PC/Mac. Electronic records on a personal PC/Mac must be encrypted. This is usually ensured by NIH-managed machines having encrypted hard drives.
• The most secure form of electronic storage is central data storage with extra secure access control (TSD or Educloud from UiO).
• Physical datasets should be stored locked, preferably in a safe.
• The requirements also apply to personal data in administrative processing as well as various institutional professional systems. Here, each professional system will have different security requirements based on the purpose.
• Datasets with personal data must, as far as possible, be pseudonymised.

Storage: File Server, Cloud or Secure Zone?

• Datasets containing personal data stored on a file server or in a cloud solution (Microsoft 365) should generally be pseudonymized. NIH's file servers and cloud solution have access-controlled zones. If linkage keys are stored with the data, the file with the linkage key must be encrypted with a strong password. Alternatively, the linkage key can be stored in a locked cabinet at the institute.
• Insufficiently pseudonymized data and datasets containing sensitive personal data should be stored in one of NIH's secure zones, Educloud or TSD, both operated by UiO. This also applies to data in formats that pose special privacy challenges (audio, image, film, and biometric or genetic data). Educloud and TSD can also be used for sharing data with external researchers. Access is managed via the owner of the instance/project in Educloud or TSD.
• See separate rules for biological material.

Storage options - what can be stored where:

See classification guide for additional information categories of research data.

Notes on the storage guide:

• Data should, where possible, be classified with sensitivity labels. This is implemented in Office365. The sensitivity labels are identical to the categories in NIH's classification guide.
• Red data can be stored on a computer with an encrypted hard drive. NIH-owned devices have encrypted hard drives.
• Emails containing red data can be sent internally at NIH between NIH users. If emails containing red data are to be sent to external recipients, the content must be encrypted before sending. Such emails CANNOT be synchronized to privately owned computers, tablets, or mobile phones.
• Red data should not be downloaded or extracted to home areas, computers without encrypted disks, or other storage locations that cannot store red data, including privately owned devices.
• According to the IT regulations, institutional data should not only be stored on a local hard drive. No backup is taken of the local hard drive.
• Yellow data can be processed on a private computer/device if the device follows NIH's guidelines for the use of private computers/devices.
• Red data can be stored in shared areas or administrative systems after a separate assessment and possible facilitation.
• OneDrive is the user's home area, and files in this area should only be shared if it is temporary and incidental. Teams should be used for collaboration and shared document storage.
• All NIH-related communication should take place via NIH's email system and with your NIH address as the sender.
• Public360 can handle black data, but due to legislation, it is not permitted to store health data in this system. These must either be referenced or redacted before being entered.