Research Computing provides a home for your research data in the Standard and High Security Zones. This table is designed to help you determine the sensitivity of your data and find a suitable platform for the data.
Learn more about Research Computing storage
| Standard Security Zone (SSZ) | High Security Zone (HSZ) | ||||
| Storage | Computing Environments | Storage | Computing Environments | ||
| Data Classification | Research Project & Standard | Afton/Rivanna | Research Project & Standard | Ivy VM | Rio |
| Public | Y | Y | Y | Y | Y |
| Internal-Use | Y | Y | Y | Y | Y |
| Sensitive | Y | Y | Y | Y | Y |
| Highly-Sensitive | N | N | Y | Y | Y |
| Health Research Data with PHI1 (including Limited Datasets)2 | N | N | Y | Y | Y |
| Health Research Data without PHI (including De-Identified Datasets)3 | Y | Y | Y | Y | Y |
| CUI4 | N | N | Y | Y | N |
| Controlled-Access Data5 | N | N | Y | Y | Y |
| FERPA6 | N | N | Y | Y | Y |
| ITAR7 | N | N | Y | Y | N |
| PCI-DSS8 | N | N | N | N | N |
1 Because Research Computing is outside the UVA Health covered entity, only health research data collected under an IRB-HSR approved protocol with a waiver of HIPAA authorization may be stored on the High Security Zone. Clinical operations data protected under HIPAA are not permitted.
Protected Health Information (PHI) is any information in the medical record or designated record set that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service such as diagnosis or treatment. More information can be found at the IRB-HSR HIPAA page.
2 Limited datasets are health research data where direct identifiers are removed, but may contain indirect identifiers including, complete dates, age, city, state, and complete ZIP code.
3 De-identified datasets contain no protected health identifiers. Note: identifiers can be recoded such that the source information is anonymized (e.g. date shifting, urban/rural determinations vs. ZIP codes, randomly generated subject identifier, etc.)
4 Controlled Unclassified Information (CUI). CUI data is information the government creates or possesses that requires safeguarding or dissemination controls when handling. More information can be found See ORS CUI for more information.
5 Controlled-access data are protected NIH data made available to only authorized users through security measures that verify the identity of requesters and their intended data use. These requirements apply even when the data are de-identified or do not include explicit restrictions on subsequent use.
This includes controlled-access data downloaded from the following controlled-access data repositories: Database of genotypes and phenotypes (dbGaP), BioData Catalyst, NCI Genomic Data Commons, The NHGRI Genomic Data Science Analysis, Visualization, and Informatics Lab-Space (AnVIL), National Institute of Mental Health Data Archive (NDA), NIA Genetics of Alzheimer's Disease Data Storage Site (NIAGADS).
The full list of controlled-access repositories can be found at the NIH CADR.
6 Family Educational Rights & Privacy Act (FERPA). FERPA is a federal law that governs access to student education records. This includes personally identifiable information (PII) like name, SSN, date of birth, grades, and course schedules.
See UVA Policy FERPA for more information.
7 International Traffic in Arms Regulations (ITAR). This includes military technology and software, technical data, and services.
More information can be found at the ORS Export controlled page.
8 Payment Card Industry Data Security Standards (PCI-DSS). PCI-DSS is a set of security standards that define how payment card data should be protected. This includes data containing debit card or credit card information.
See UVA PCI policy for more information.