Policy for Regulated Data on HiPerGator and HiPerGator-RV
HiPerGator and HiPerGator-RV can be used for storing and processing regulated data. Regulated data is defined as data that has requirements formulated in laws, regulations or contracts that must be adhered to when storing, moving or processing the data. The University of Florida recognizes three major data classes as defined in the Data Classification Policy https://policy.ufl.edu/policy/data-classification-policy/
All users of HiPerGator and HiPerGator-RV must at all times follow the basic safeguarding steps for all data storage and processing as explained in the mandatory information security awareness training https://it.ufl.edu/security/security-guidance/information-security-training/ for all data types, including open and sensitive data.
When a project chooses or is required by UF policy to use HiPerGator for working with restricted data, the project lead and team members must follow the procedures described in Procedures for Regulated Data.
Examples of data covered under these policies:
- Research projects that work with PHI or with Limited Data Sets can use HiPerGator for data storage and processing.
- Healthcare operational work with PHI can use HiPerGator for data storage and processing.
- Since Jan 25, 2025, the NIH Genome Data Sharing (GDS) policy requires that data is stored and processed on systems that meet the NIST 800-171r3 controls. NIH effectively considers human genome data to be PHI.
- Sponsored projects that require NIST 800-171 compliance (but are not export-controlled or ITAR). Some examples include some NASA projects.
- Student record data, covered under FERPA, for example:
- Helping identify students who could benefit from extra help and the form of that assistance.
- Helping instructors with possible auto-grading, teaching evaluation, etc.
- Controlled Unclassified Information (CUI), Controlled Technical Information (CTI), Covered Defence Information (CDI), Export Administration Regulations (EAR), and International Traffic of Arms Regulation (ITAR).
Policy effective March 17, 2023.
Last updated July 11, 2025