School of Medicine & Public Health – Data Encryption

Layout for printing
Policy Number:
SMPH-6015
Old Policy Number:
60.15
Responsible Office:
SMPH Cybersecurity

School of Medicine and Public Health (SMPH) Policy

Rationale/​Purpose:

The School of Medicine and Public Health (SMPH) is committed to maintaining the privacy, confidentiality, and security of university-owned data. This policy supports a comprehensive governance, risk, and compliance (GRC) program and serves to be consistent with information security best practices associated with organizational information security management. The purpose of this policy is to set forth requirements and expectations related to and supporting information system data encryption.

Definitions:
Asymmetric key
A type of encryption key consisting of a public key and a private key. For example, public key infrastructure (PKI) uses asymmetric keys.
Confidentiality, integrity, and availability (CIA)
  • Confidentiality: Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information
  • Integrity: Guarding against improper information modification or destruction, which includes ensuring information non-repudiation and authenticity.
  • Availability: Ensuring timely and reliable access to and use of information.
Cryptographic key
A parameter used in conjunction with a cryptographic algorithm that determines its operation in such a way that an entity with knowledge of the key can reproduce, reverse, or verify the operation while an entity without knowledge of the key cannot.
Data
Information, whether electronic or hard copy, that is collected, stored, transferred, or reported for any purpose.
Encryption
Obscuring data by a reversible transformation using an algorithm.
Public key
A type of encryption key made available to the public. Used to encrypt outgoing data and decrypt message digest when verifying a digital signature.
Private key
The hidden half of a public/private key pair used in an asymmetric cryptosystem. Encrypting with private keys and decrypting with public keys are used for digital signatures.
Symmetric key
A private key that is used for both encryption and decryption.
Scope:

This policy applies to all SMPH departments, centers, and institutes.

Policy:

This policy establishes requirements of necessary controls and processes supporting the implementation of effective encryption methodologies while ensuring the confidentiality, integrity, and availability of departmental and SMPH information systems and university-owned data. This policy maintains that:

  1. Encryption mechanisms are required for systems that store and/or transmit university-owned data.
  2. Documentation of the encryption process and how it is implemented is required at SMPH and the department levels.
  3. Additional use of cryptography may be required in accordance with applicable laws, regulations, policies, etc.
  4. Cryptographic mechanisms are required for university-owned data traveling inside, outside, and between SMPH-controlled networks and non-SMPH-controlled networks wherever possible.
  5. Cryptographic mechanisms are required with third parties, partners, and affiliates wherever possible.
  6. Cryptographic keys are considered high-risk data and must follow the minimum requirements below regarding key management. Cryptographic keys and these requirements are subject to and may change in accordance with HIPAA (Health Insurance Portability and Accountability Act of 1996).
    1. Asymmetric keys must be changed, at a minimum, every two years. Symmetric keys must be changed annually, at a minimum.
    2. Keys must be destroyed according to vendor recommendations when they are no longer needed.
    3. Keys must be backed up and recoverable when access to encrypted data is critical.
    4. Access to keys must be restricted to only authorized and authenticated users.
    5. Access to keys must be logged and follow SMPH, UW–Madison, and UW System logging and data retention policies.
    6. An inventory of keys must be kept that includes who has access to which keys and who delegates this access. This must be reviewed at least annually at a departmental level.
  7. Cryptographic mechanisms, the type of cryptography, and documentation regarding cryptographic mechanisms are to be reviewed annually at a departmental level.
  8. Networks containing encrypted data are to be physically and/or logically separated from other networks wherever possible.
  9. Connections to encrypted data or to systems containing encrypted data through external networks are to exist only through managed connections in accordance with SMPH, UW–Madison, and UW System security architecture and policies.
  10. This policy will be reviewed/revised on a defined schedule as set forth by SMPH.  
Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:

SMPH Data Encryption Guidance Document

IT: Storage and Encryption Standard

IT: Policy Glossary

External References:

45 C.F.R.§ 164.308 Administrative safeguards

45 C.F.R. § 164.310 Physical safeguards

45 C.F.R.§ 164.312 Technical safeguards

45 C.F.R. § 164.314 Organizational requirements

45 C.F.R. § 164.316 Policies and procedures and documentation requirements

FIPS 140-3 Security Requirements for Cryptographic Modules

NIST SP 800-53, Revision 5, Security and Privacy Controls for Federal Information Systems and Organizations

NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management: Part 1 – General

NIST SP 800-57 Part 2 Rev. 1, Recommendation for Key Management: Part 2 – Best Practices for Key Management Organizations

NIST SP 800-131A Rev. 2, Transitioning the Use of Cryptographic Algorithms and Key Lengths

UWS Administrative Procedure 1031.B: Information Security: Data Protections

UWS Policy 1000: Information Security: General Terms and Definitions

Policy Administration

Approval Authority:
Dean, School of Medicine and Public Health
Policy Manager:
SMPH Cybersecurity Governance, Risk, & Compliance (GRC) Manager
Contact:
SMPH Cybersecurity Governance, Risk, & Compliance (GRC) Manager -- Amy Diestler, adiestler@wisc.edu, (608) 263-4623
Effective Date:
10-01-2019
Date Issued:
10-01-2019
Revised Dates:

01-14-2020, 08-26-2019, 12-20-2021

Retrieved:
01-17-2025 16:48:51