Introduction

Certain categories of information are classified as high risk, either because the exposure of this information can cause harm or because the information is specifically protected under law or under contract. Extra care must be taken to protect high-risk confidential information in both electronic and paper form. Improper access to or release of high-risk confidential information may be subject to legal reporting requirements. (See Section 9.2: Reporting Security Breaches.) Such information is subject to legal requirements when being disposed of.(See Section 9.1: Disposition and Destruction of Records.)

High-Risk Confidential Information includes a person's name in conjunction with the person's Social Security, credit or debit card, individual financial account, driver's license, state ID, or passport number, or a name in conjunction with biometric information about the named individual. High-risk confidential information also includes human subject information (see Section 1.2) and personally identifiable medical information (see Section 1.3).