Texas A&M University, inclusive of Texas A&M Health, is required under Security Categorization (RA-2) to scan university-owned devices for sensitive information using a data loss prevention (DLP) method.
Spirion Sensitive Data Manager has been selected to perform DLP scanning. When sensitive information is discovered, such as Social Security information, you will be notified by Health IT with instructions for removing or isolating the data. Types of commonly scanned devices managed by Health IT include: computers and servers; flash drives and external hard drives; and Recycle Bin/Trash folders.
Types of Scanned Data
- Social Security Numbers
- Health Data, including Electronic Protected Health Information (ePHI) such as Explanations of Benefits (EOBs), lab results or insurance paperwork
- Immigration paperwork
- Critical Data
- Confidential Data
- University-Internal Data
How to Prevent Data Loss or Exposure
- Encrypt sensitive information on both your computer and external drives
- Do not use retail, off-the-shelf removable drives; instead use encrypted departmental fileshares or secure cloud storage services, such as Microsoft SharePoint, Teams or OneDrive or STAR – Amazon Web Services
- Disconnect and lock in a secure location any external drives that contain sensitive information when not in use, even if encrypted
- Remove sensitive information as soon as it is no longer needed, according to appropriate retention policies
- Empty your Recycle Bin/Trash since deleted files can still be recovered
- Never access university-related critical or confidential data from devices not managed by Health IT
Service Details
By default, Spirion is scheduled to scan in a passive mode, with weekly scheduled scans for sensitive information. Health IT has configured scanning to run in the background with as minimal performance impacts as possible on both computers and the network.
If cases of critical, confidential or university-internal information are found through active monitoring, the sensitive data will need to be addressed within seven (7) business days of receiving a notification from Health IT.
An example email notification is available to view, Spirion-DLP-Email-Example.pdf, if Spirion should identify sensitive information on your university-owned device(s).
View the TAMU-Health Spirion Sensitive Data Manager knowledge base article for more information.
Thank you for partnering with the Technology Services to maintain a secure and productive computing environment at Texas A&M Health.
Support Information
If you have any questions or need assistance regarding Spirion and data loss prevention, please contact the Health Technology Care Team.
Email: HealthTechCare@tamu.edu
Phone: 979.436.0250 or 979.845.8300 (Option 2)
Chat: health-bomgar.tamu.edu
Web: it.tamu.edu/health