Compliance & Policy Requirements

Depending upon the nature of the data being stored or transmitted, various local policies or legal requirement may apply toward its protection.

The following is a list of applicable policies as well as state and federal regulations.

Federal Laws and Regulations

• Communications Assistance for Law Enforcement Act (CALEA)
  Overview page with links to related governmental and other organizational sites:
  www.educause.edu/Resources/Browse/CALEA/30781
  Text of the law:
  www.askcalea.net/docs/calea.pdf
• Family Educational Rights and Privacy Act (FERPA)
  U.S. Department of Education, Final regulations (4/16/2004):
  www.ed.gov/legislation/FedRegister/finrule/2004-2/042104a.pdf
  Office of Student Life policy summary:
  www.brown.edu/Student_Services/Office_of_Student_Life/randr/federal/ferpa.html
  Student Employment FERPA Non-Disclosure / Confidentiality Agreement:
  http://financialaid.brown.edu/Content/Files/FERPAConfdAgre.pdf
• Federal Information Security Management Act (FISMA)
  The law:
  www.fismacenter.com/FISMA-final.pdf
  FISMA Center:
  www.fismacenter.com/
• Federal Trade Commission (FTC) Red Flags Rule
  FTC Extended Enforcement Policy; Identity Theft Red Flags Rule, 16 CFR 681.1:
  www.ftc.gov/os/2009/07/P095406redflagspolicy.pdf
  Fighting Fraud with the Red Flags Rule: A How-To Guide for Business:
  www.ftc.gov/redflagsrule
• Gramm-Leach-Bliley Act (GLBA)
  U.S. Senate Banking Committee, Financial Services Modernization Act, Summary of Provisions:
  http://banking.senate.gov/conf/grmleach.htm
• The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules
  U.S. Department of Health & Human Services resource site:
  www.hhs.gov/ocr/privacy/
  Overview from House Committee on Ways and Means:
  http://waysandmeans.house.gov/media/pdf/110/hit2.pdf
• Health Information Technology for Economic and Clinical Health (HITECH) Act
  U.S. Department of Health & Human Services resource site:
  www.hhs.gov/ocr/privacy/hipaa/understanding/coveredentities/guidance_breachnotice.html
• Higher Education Opportunity Act (HEOA)
  www2.ed.gov/policy/highered/leg/hea08/
  Brown's Compliance Statement:
  www.brown.edu/cis/policy/heoa.php
• Student and Exchange Visitor Information System (SEVIS)
  U.S. Immigrations and Customs Enforcement site:
  www.ice.gov/sevis/
  U.S. Department of State Overview:
  http://exchanges.state.gov/jexchanges/sevis.html
  
• Sarbanes-Oxley Act (SOX)
  U.S. Government Printing Office:
  www.gpo.gov/fdsys/pkg/PLAW-107publ204/content-detail.html
  Overview (courtesy of Addison-Hewitt Associates):
  www.soxlaw.com/

Brown's Policies

• Computing
  • Computing Information Services: Brown Information Checklist for Protecting Information
    www.brown.edu/cis/policy/protectinginfo.php
  • Computing Passwords Policy
    www.brown.edu/cis/policy/password.php
• Faculty
  • Faculty Rules & Regulations
    http://www.brown.edu/Faculty/Faculty_Governance/rules.html
• Researchers
  • Office of Sponsored Projects: Policies and Procedures
    http://research.brown.edu/rschadmin/osp_policies.php
  • Brown University Policy for Responding to Allegations of Research Misconduct
    http://research.brown.edu/policies/misconduct.php
  • Brown University Policies and Procedures for the Protection of Human Participants in Research
    http://research.brown.edu/policies/hrpo.php
  • Office of the Provost: Policies and Procedures Relating to Research Privacy
    www.brown.edu/Administration/Provost/policies/rpp.html
• Students
  • Principles of the Brown University Community: The Academic Code and Non-Academic Conduct
    www.brown.edu/Administration/Dean_of_the_College/academic_code/code.html
• Employees
• Human Resources: Policies and Practices Policy #20.063, Confidential Information and SW Piracy
  www.brown.edu/Administration/Human_Resources/policies/20.063.html
• Internal Audit: Records Retention Guidelines
  http://www.brown.edu/Administration/Internal_Audit/guidance/records
• Internal Audit: Brown University's Department Risk-Control Self-Assessment Tools
  http://www.brown.edu/Administration/Internal_Audit/guidance/risk.html (mail form)
  http://www.brown.edu/Administration/Internal_Audit/risk.pdf (PDF form)
• Health
  • Brown University Health Services: The Patient Bill of Rights and Responsibilities
    http://www.brown.edu/Student_Services/Health_Services/start/rights.html
  • Brown University Psychological Services: Statement of Confidentiality
    www.brown.edu/Student_Services/Psychological_Services/confidentiality.html
• General Safety
  • Department of Public Safety:
    www.brown.edu/Administration/Public_Safety/