2.12 Training and Communication | Information Security & Privacy

Policy

Each School and central administration must identify and provide training for staff members who are involved in the use or processing of Confidential and High Risk Confidential Information.

Each School must ensure that security requirements and related expectations are properly communicated to their faculty members.

Discussion

Training should be made available to all university employees who deal with any confidential information.

General security awareness and data stewardship training is sufficient for employees not dealing with high risk confidential information (HRCI). Employees dealing with HRCI should receive more detailed and comprehensive training relating to the specific information they are dealing with.

Researchers should work with their IRBs to determine what type of training is appropriate.

Training should be undertaken annually. The training process should be one that tracks participation and ensures that all employees dealing with HRCI take the training.

Note that Massachusetts law requires that those employees who are involved in the use or processing of High Risk Confidential Information be properly trained.