Cloud Storage Options
Cloud storage refers to any program owned or managed by a third party that allows you to upload your data using the Internet. An advantage of cloud storage is that you can easily access and synchronize your data from multiple devices anywhere in the world, and, when properly configured, you can share your information with anyone you want. Faculty, staff, and students can also collaborate easily and stay productive with document sharing in the cloud as well as real-time co-authoring across devices through Microsoft's Office 365 tools in the My UT Health intranet.
This type of online storage can make you more productive, but it also comes with security risks. In accordance with HOP 5.8.31 Cloud Computing and HOP 5.8.21 Data Classification, University employees must use an approved cloud storage provider when storing University data. The cloud products you choose must be based on the categories of data you intend to store. For instance, the University's hybrid cloud storage (MyCloud) is a unique service because it is the only University-approved cloud storage for sharing sensitive data with non-UTHSCSA faculty, staff, and students.
To help guide your decision, the University has designated the following solutions for cloud storage and collaboration in the table below:
|OneDrive for Business||MyCloud||Sharepoint Sites||Leased Mass Storage/Network Share|
|Availability||Available now (with limited support in Office 365)||Available now||Available now||Available now|
|Confidential Data 1|
|Protected Health Information (PHI)||N||Y||Y||Y|
|Student Identifiable Information (SII)||N||Y||Y||Y|
|Personally Identifiable Information (PII)||N||Y||Y||Y|
|Sensitive Digital Research Data||N||Y||Y||Y|
|Credit card||N 5||N 5||N 5||N 5|
|Social Security Number (SSN)||N||N||N||Y|
|Controlled Data 1||N||Y||Y||Y|
|Published Data 1||Y||Y||Y||Y|
|Personal Work Data 2||Y||Y||Y||Y|
|Support||Y (limited)||Y||Y (limited)||Y|
|File upload limit||10 GB||N/A||N/A||N/A|
|Storage quota||1 TB 3||Contract-based 4||N/A||Contract-based 4|
1 – See explanations for confidential, controlled, and published data in the table below
2 – “Personal Work Data” are the day-to-day files you create and work with as part of your job that don’t fall into the confidential, controlled, or published data categories (documents, spreadsheets, presentations, etc.)
3 – 1TB is the initial setup for OneDrive for Business storage but this amount can be increased by request
4 – Departmental pricing is based on the volume of data stored
5 – In compliance with PCI-DSS requirements
UT Health has implemented Data Loss Prevention (DLP) technology in OneDrive for Business (with Office 365) to prevent the storage of Protected Health Information (PHI) Social Security Numbers (SSN), and Credit Card data in accordance with HOP 5.8.31 Cloud Computing. This DLP technology blocks any file from being shared that it identifies as possibly containing PHI, SSN, or credit card data.
For more information on cloud storage, please contact InfoSec@uthscsa.edu to discuss the various solutions and to request an exception to the Cloud Computing policy, if necessary. For more information on types of University data, please refer to the table below.
Please review HOP 5.8.21 Data Classification for more information.
Information or data is classified as Confidential if it must be protected from unauthorized disclosure or public release based on State or Federal law or regulation, and by applicable legal agreement to the extent permitted by law.
||This classification is reserved for information that is protected from public release based on state or federal law, or a legally binding order or agreement.|
The Controlled classification applies to data that is not generally created for or made available for public consumption, but may be subject to release to the public through request via the Texas Public Information Act or similar State or Federal law.
||This classification likely encompasses the greatest volume of Data within the University.|
Published data includes all data made available to the public through posting to public websites, distribution through email, social media, print publications, or other media.
||Information can migrate from one classification to another based on the information life-cycle. Unpublished research may fit the criteria of “Controlled Information” until published, upon which it would become Published Information.|