Policies & Regulations
Laws and Regulations That Apply to UH Information Security
Hawaiʻi Revised Statutes
State laws that establish data breach notification requirements, define what constitutes protected personal information, and set obligations for any entity handling data belonging to Hawaiʻi residents.
HRS 92F - Uniform Information Practices Act (UIPA)
Requires the University to open government records for public inspection except Social Security numbers, personal records, etc.
HRS 487J - Social Security Number Protection
Requires the University to protect an individual’s Social Security number.
HRS 487N - Security Breach of Personal Information
Requires the University to provide notice if there has been a security breach of personal information.
HRS 487R - Destruction of Personal Information Records
Requires the University to securely dispose of personal information.
External Laws and Regulations
Federal laws, industry standards, and defense requirements that the organization must comply with based on the types of data it handles, the populations it serves, and its contractual obligations. These mandates dictate how sensitive information is protected, who can access it, how breaches are reported, and what technologies may or may not be used in the operating environment.
HIPAA - Health Insurance Portability and Accountability Act
Regulates the use, disclosure, and protection of individuals’ health information.
FERPA - Family Educational Rights and Privacy Act
Requires the University to provide students with access to their education records, an opportunity to have the records amended, and some control over its disclosure.
FISMA - Federal Information Security Management Act
Requires federal agencies to implement an information security for information/information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor (e.g. UH), or other source.
GLBA - Gramm-Leach-Bliley Act (“Safeguards Rule”)
Regulates how non-public personal information is to be protected.
CMMC - Cybersecurity Maturity Model Certification
Framework established by the Department of Defense (DoD) to verify that contractors and subcontractors have implemented required security measures to safeguard sensitive unclassified information.
FACTA - Fair and Accurate Credit Transactions Act (“Red Flags Rule”)
Requires an identity theft prevention program to identify and detect red flags and to prevent and mitigate identity theft.
PCI-DSS - Payment Card Industry Data Security Standards
Requires the University to implement security controls around cardholder data to reduce credit card fraud.
DMCA - Digital Millennium Copyright Act (“OCILLA”)
Requires the University to take action on copyright infringement that originates on the network.
NDAA Section 889 - National Defense Authorization Act, Section 889
Purchasing restrictions on federal contracts that involve covered telecommunications equipment or services.
Policies
UH Policies related to Information Security
Internal policies established by the University of Hawaiʻi system that govern how institutional data is classified, accessed, stored, and protected. These policies define roles and responsibilities, set acceptable use standards, and establish security requirements for university systems, networks, and personnel handling sensitive information.
EP 2.210 - Use and Management of Information Technology Resources Policy
Describes the appropriate use of UH information technology resources which applies to students, faculty, staff, and authorized guest users.
EP 2.214 - Institutional Data Classification Categories and Information Security Guidelines
The objective of this executive policy is to organize UH Institutional Data into data classification categories based on different levels of security risk and penalties that may result from the inadvertent exposure and inappropriate disclosure of those data.
EP 2.215 - UH Institutional Data Governance Policy
Establishes system-wide standards to protect the privacy and security of data and information under the stewardship of the University.
Institutional Records Management
Establishes institutional requirements for responsible records management.
EP 2.217 - UH HIPAA Policy
To ensure that UH complies with the Health Insurance Portability and Accountability Act
EP 2.218 - Online Approvals of Internal University Transactions
Describes institutional requirements regarding the use of online approvals and signatures
EP 2.219 - Student Online Data Protection Requirements for Third Party Vendors
This Policy sets forth the University’s expectations of how our Student Data shall be managed by external parties.
EP 7.208 - Systemwide Student Conduct Code
Describes the rules and regulations that UH students must comply with.
EP 8.200 - Policy on Contracts and Signing Authority
Policy on contracts that details Information Technology and Data Commitments that must be met before contracts are signed.
AP 2.215 - Mandatory Training on Data Privacy and Security
To describe the mandatory training and continuing education requirements for UH employees, students, and affiliates
AP 7.022 - Procedures Relating to Protection of the Educational Rights and Privacy of Students
Establishes procedures governing a UH student’s access to their own education records and access to education records by the public and other governmental agencies.
AP 8.710 - Credit Card Program
Procedures for processing credit card transactions in accordance with University policies, banking and payment card industry requirements, etc.