{"id":2563,"date":"2026-02-12T14:32:54","date_gmt":"2026-02-13T00:32:54","guid":{"rendered":"https:\/\/www.hawaii.edu\/infosec\/?page_id=2563"},"modified":"2026-02-13T13:45:01","modified_gmt":"2026-02-13T23:45:01","slug":"research-security","status":"publish","type":"page","link":"https:\/\/www.hawaii.edu\/infosec\/research-security\/","title":{"rendered":"Protecting Research Data"},"content":{"rendered":"<h2>Table of Contents<\/h2>\n<ul>\n<li><a href=\"#section-1\">Data Collection, Storage, and Retention<\/a><\/li>\n<li><a href=\"#section-2\">De-identification Strategies by Risk Level<\/a><\/li>\n<li><a href=\"#section-3\">Securing De-identified Data and Preventing Re-linkage<\/a><\/li>\n<li><a href=\"#section-4\">Storing Original Identifiable Data and Crosswalk Files<\/a><\/li>\n<li><a href=\"#section-5\">Security Controls for Systems Storing PII<\/a><\/li>\n<li><a href=\"#section-6\">Resources<\/a><\/li>\n<\/ul>\n<h2 id=\"section-1\">Data Collection, Storage, and Retention<\/h2>\n<p>The primary strategy for mitigating sensitive data risk is data minimization: evaluating what is strictly necessary and reducing the volume, identifiability, and retention period of project data.<\/p>\n<ol>\n<li>\n        <strong>Scrutinize Collection<\/strong><\/p>\n<p>Before starting your research, audit every intended data field. If a variable is not essential to your analysis, do not collect it. Avoid gathering highly sensitive Personally Identifiable Information (PII) such as Social Security Numbers, financial data, or Protected Health Information (PHI) unless there is a <strong>compelling rationale<\/strong> for doing so.<\/p>\n<p>When handling PHI, follow the <strong>HIPAA Safe Harbor method<\/strong>. This requires removing <a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/special-topics\/de-identification\/index.html\">18 specific identifiers<\/a> to prevent the re-identification of participants.<\/p>\n<p>Note: Unauthorized exposure of this data constitutes a breach, carrying severe financial and reputational consequences for the University.<\/p>\n<\/li>\n<li>\n        <strong>Purge Metadata and &#8220;Junk Data&#8221;<\/strong><\/p>\n<p>Regularly review datasets for unintentionally captured information that could compromise anonymity. This includes:<\/p>\n<ul>\n<li><strong>Digital Identifiers:<\/strong> Timestamps, IP addresses, and specific dates.<\/li>\n<li><strong>Socio-Demographic Outliers:<\/strong> Categories with small sample sizes that could lead to &#8220;deductive identification.&#8221;<\/li>\n<li><strong>Accidental PII:<\/strong> Incidental personally identifiable information entered by participants (e.g., in open-text fields).<\/li>\n<\/ul>\n<\/li>\n<li>\n        <strong>Define and Enforce Retention Periods<\/strong><\/p>\n<p>Data risk is a function of time: the longer it is held, the higher the risk.<\/p>\n<ul>\n<li>Establish a clear timeline for how long data will be kept post-analysis.<\/li>\n<li>Delete identifiable data once it is no longer required.<\/li>\n<li>Conduct periodic audits to ensure stored data complies with your retention policy.<\/li>\n<\/ul>\n<\/li>\n<li>\n        <strong>Maintain Data Oversight<\/strong><\/p>\n<p>Maintain an accurate, up-to-date inventory of where all research data is stored. Establish a &#8220;transfer of custody&#8221; process to ensure that datasets are not orphaned as team members or student researchers depart. Data should always be associated with a current, responsible lead to prevent security gaps.<\/p>\n<\/li>\n<\/ol>\n<h2 id=\"section-2\">De-identification Strategies by Risk Level<\/h2>\n<p>Following collection, prioritize the immediate removal or replacement of PII. De-identifying data breaks the link between sensitive variables and individual identities. Depending on your research requirements, you may apply multiple methods in tandem.<\/p>\n<table class=\"table table-bordered\">\n<thead class=\"thead-light\">\n<tr>\n<th scope=\"col\">Strategy<\/th>\n<th scope=\"col\">Risk Level<\/th>\n<th scope=\"col\">Definition\/Process<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Anonymization<\/td>\n<td>Low<\/td>\n<td>The permanent, irreversible destruction of identifiers. Fully remove all direct and indirect identifiers so the individual can no longer be identified by any means.<\/td>\n<\/tr>\n<tr>\n<td>Pseudonymization<\/td>\n<td>Medium<\/td>\n<td>Replacing direct identifiers with a &#8220;key&#8221; or artificial code (e.g., UID-12345). Use a pseudo-random number generator to create unique IDs. Never use sensitive data (like SSNs) to derive these keys. The risk increases significantly if the &#8220;key&#8221; (the link between the code and the identity) is stored insecurely so store the key separately from the research dataset in an encrypted, access-restricted location<\/td>\n<\/tr>\n<tr>\n<td>Generalization &amp; K-Anonymity<\/td>\n<td>Medium<\/td>\n<td>Reducing the precision of data to make individuals harder to distinguish within a group. Convert specific values into broader ranges (e.g., recording &#8220;Age: 20\u201330&#8221; instead of &#8220;Age: 25&#8221;). Re-identification is still possible if the &#8220;pool&#8221; or sample size of a specific demographic is too small (socio-demographic outliers) so use the highest level of granularity your analysis can tolerate.<\/td>\n<\/tr>\n<tr>\n<td>Redaction &amp; Masking<\/td>\n<td>High<\/td>\n<td>Obscuring specific portions of a data field (e.g., XXX-XX-1234) or applying digital &#8220;black boxes&#8221;. Masking is often superficial and can be reversed (e.g., removing a shape layer in a PDF) or re-linked via quasi-identifiers in the surrounding text. Use only for visual presentation, not as a primary method for securing raw datasets.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 id=\"section-3\">Securing De-identified Data and Preventing Re-linkage<\/h2>\n<p>After performing de-identification, implement these safeguards to ensure data cannot be re-linked or de-anonymized by unauthorized parties.<\/p>\n<ul>\n<li><strong>Implement Separation Architecture:<\/strong> Never store de-identified datasets in the same environment as their &#8220;re-identification keys&#8221; (e.g., crosswalk files, salts, mapping tables, or tokens). Maintain a physical or logical barrier between the data and the keys to ensure that a breach of one does not compromise the other.<\/li>\n<li><strong>Sanitize File Paths and Metadata:<\/strong> Folder hierarchies and filenames can inadvertently leak context. For example, storing a de-identified file in \/Oahu\/Honolulu\/participant_data.csv reveals the geographic origin of the subjects. Using generic or coded naming conventions for directories and files is recommended.<\/li>\n<li><strong>Prevent Cross-Dataset Linkage:<\/strong> Individuals can often be re-identified by cross-referencing multiple &#8220;anonymized&#8221; datasets. For example, a pseudonymized patient ID in one file might be linked to another dataset containing the same birthdate or ZIP code. Use unique, non-overlapping keys for different projects and scrutinize how external datasets could be combined with your own.<\/li>\n<li><strong>Mitigate Quasi-Identifiers and Outliers:<\/strong> Data points that seem anonymous can become identifiable if the sample size is small. A &#8220;socio-demographic outlier&#8221; (e.g., a specific ethnicity in a small town) acts as a fingerprint. Review datasets for rare attributes and apply further generalization (e.g., grouping data into broader categories) to protect participant privacy.<\/li>\n<\/ul>\n<h2 id=\"section-4\">Storing Original Identifiable Data and Crosswalk Files<\/h2>\n<p>If original identifiers or &#8220;crosswalk&#8221; files (used to re-link data) must be retained, they require the highest level of security and access control. You must minimize the number of storage locations and, where possible, maintain these files in an offline environment. All digital PII and mapping files must be encrypted, whether stored online or offline.<\/p>\n<p><strong>Storage Options and Requirements<\/strong><\/p>\n<ol>\n<li>Physical Media (Paper): Keep printed surveys or identifiable materials in a locked safe or high-security cabinet. Access must be strictly limited and logged.<\/li>\n<li>Removable Digital Media (External Drives\/USBs): Use Full Disk Encryption (FDE) or containerized encryption for all devices. When not actively in use, these devices must be stored in a secured physical location (e.g., a locked safe).<\/li>\n<li>\n        Live Networked Systems: Ideally, keep systems containing PII offline. If network connectivity is required:<\/p>\n<ul>\n<li>Network Restriction: Limit server access to specific, authorized hosts.<\/li>\n<li>Account Separation: Use unique credentials for the crosswalk database. Do not share administrative rights or accounts between identifiable and de-identified environments.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><\/br><\/p>\n<div id=\"yellow-info-box\">\n<p>If you manage a system that stores, processes, or transmits PII, it is <strong>mandatory<\/strong> to ensure it meets the <a href=\"#section-5\">Security Controls For Systems Storing Research Data with PII<\/a>.<\/p>\n<\/div>\n<p><\/br><\/p>\n<table id=\"section-5\" class=\"table table-bordered\">\n<thead class=\"thead-light\">\n<tr>\n<th scope=\"col\" colspan=\"2\">\n<h2>Security Controls for Systems Storing PII<\/h2>\n<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<th scope=\"col\" colspan=\"2\">\n<h3>Technical Configuration Requirements<\/h3>\n<\/td>\n<\/tr>\n<tr>\n<th scope=\"col\">Category<\/th>\n<th scope=\"col\">Requirement<\/th>\n<\/tr>\n<tr>\n<td>Patching<\/td>\n<td>Apply security patches monthly; use automated patching where available. No End-of-Life (EoL) devices allowed (End-of-Life refers to hardware or software that no longer receive security fixes from their manufacturer).<\/td>\n<\/tr>\n<tr>\n<td>Authentication<\/td>\n<td>Passwords must be 14+ characters with complexity. <strong>MFA is required<\/strong> for remote and privileged access.<\/td>\n<\/tr>\n<tr>\n<td>Endpoint Security<\/td>\n<td><a href=\"https:\/\/www.hawaii.edu\/infosec\/assets\/sentinelone\/\">SentinelOne<\/a> must be installed on all devices.<\/td>\n<\/tr>\n<tr>\n<td>Data Discovery and Management<\/td>\n<td>Perform monthly <a href=\"https:\/\/www.hawaii.edu\/infosec\/resources-tips\/spirion\/\">Spirion<\/a> scans for unknown PII.<\/td>\n<\/tr>\n<tr>\n<td>Encryption<\/td>\n<td>Use strong encryption (i.e. AES-256) for volumes. Use Full Disk Encryption (FDE) (BitLocker\/FileVault) for physical media and container encryption (Cryptomator\/VeraCrypt) for files. For Databases, implement Transparent Data Encryption (TDE) and Column-Level Encryption for sensitive fields.<\/td>\n<\/tr>\n<tr>\n<td>Vulnerability Management<\/td>\n<td>Perform weekly vulnerability scans with an <a href=\"https:\/\/www.hawaii.edu\/infosec\/assets\/vuln-scan\/\">approved vulnerability scanner<\/a>. Remediate vulnerabilities based on severity: Critical (15 days), High (30 days), and Medium (90 days).<\/td>\n<\/tr>\n<tr>\n<td>System Hardening<\/td>\n<td>Implement <a href=\"https:\/\/www.hawaii.edu\/infosec\/assets\/config-guide\/\">CIS Level 2 Benchmarks<\/a> at the OS, database, and application levels.<\/td>\n<\/tr>\n<tr>\n<td>Backups<\/td>\n<td>\n                Maintain <strong>encrypted<\/strong> backups of data. Follow the 3-2-1-0 rule for effective backups:<\/p>\n<ul>\n<li><strong>3 Copies of data:<\/strong> Maintain the primary source plus two encrypted backups<\/li>\n<li><strong>2 Different media types:<\/strong> Use at least 2 distinct formats (e.g., local disk and a secure cloud)<\/li>\n<li><strong>1 Offline\/Off-site Copy:<\/strong> Keep one copy offline and immutable to prevent against ransomware or a physical disaster<\/li>\n<li><strong>0 Errors:<\/strong> Regularly perform recovery testing to ensure the integrity of the restoration process.<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<tr>\n<th scope=\"col\" colspan=\"2\">\n<h3>Access Control and User Management Requirements<\/h3>\n<\/td>\n<\/tr>\n<tr>\n<th scope=\"col\">Category<\/th>\n<th scope=\"col\">Requirement<\/th>\n<\/tr>\n<tr>\n<td>Manage user permissions to sensitive information [Maintain Access Control Lists (ACLs)]<\/td>\n<td>Document every account, who owns the account, and its specific access level (View, Edit, Delete). Document accounts with administrative access to systems.<\/td>\n<\/tr>\n<tr>\n<td>Principle of Least Privilege<\/td>\n<td>Grant only the minimum data access required for a specific task. Use secure analysis environments that prevent downloads if possible.<\/td>\n<\/tr>\n<tr>\n<td>Need-to-Know &amp; Timely Revocation<\/td>\n<td>Grant access per-study and revoke it immediately upon role changes, project completion, or University departure.<\/td>\n<\/tr>\n<tr>\n<th scope=\"col\" colspan=\"2\">\n<h3>Network Architecture Requirements<\/h3>\n<\/td>\n<\/tr>\n<tr>\n<th scope=\"col\">Category<\/th>\n<th scope=\"col\">Requirement<\/th>\n<\/tr>\n<tr>\n<td>Logical Separation<\/td>\n<td>Isolate systems containing research data from the general internet and the broader ÌÇÐÄVlog¹Ù·½ network.<\/td>\n<\/tr>\n<tr>\n<td>Subnetting<\/td>\n<td>Keep untrusted devices (printers, IoT) on separate subnets from sensitive data servers.<\/td>\n<\/tr>\n<tr>\n<td>Network Boundaries<\/td>\n<td>Use a firewall with a &#8220;Default Deny-all&#8221; rule. Log and monitor all database queries for security events such as high-volume or granular targeting of individual records.<\/td>\n<\/tr>\n<tr>\n<th scope=\"col\" colspan=\"2\">\n<h3>External Partnership Management and Security Requirements<\/h3>\n<\/td>\n<\/tr>\n<tr>\n<th scope=\"col\">Category<\/th>\n<th scope=\"col\">Requirement<\/th>\n<\/tr>\n<tr>\n<td>Data Use Agreements (DUA)<\/td>\n<td>Ensure signed agreements are in place for all third-party collaborators.<\/td>\n<\/tr>\n<tr>\n<td>Application Audits<\/td>\n<td>Verify that any third-party app integrating with your data meets the same security standards as your internal systems.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2 id=\"section-6\">Resources<\/h2>\n<ul>\n<li><a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/188\/final\">NIST 800-188: De-Identifying Government Datasets: Techniques and Governance<\/a><\/li>\n<li><a href=\"https:\/\/www.hhs.gov\/hipaa\/for-professionals\/special-topics\/de-identification\/index.html\">HIPAA Safe Harbor Method for De-identification<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Table of Contents Data Collection, Storage, and Retention De-identification Strategies by Risk Level Securing De-identified Data and Preventing Re-linkage Storing Original Identifiable Data and Crosswalk Files Security Controls for Systems Storing PII Resources Data Collection, Storage, and Retention The primary &hellip; <\/p>\n","protected":false},"author":138,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-onecolumn.php","meta":{"footnotes":""},"class_list":["post-2563","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages\/2563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/users\/138"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/comments?post=2563"}],"version-history":[{"count":27,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages\/2563\/revisions"}],"predecessor-version":[{"id":2618,"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/pages\/2563\/revisions\/2618"}],"wp:attachment":[{"href":"https:\/\/www.hawaii.edu\/infosec\/wp-json\/wp\/v2\/media?parent=2563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}