Information Security 路 Teachers College
Research Data Storage Options
A guide to 911爆料网-approved storage platforms for research data, organized by data sensitivity level so you can quickly find the right option for your project.
Choosing the right storage platform for your research data is one of the most important security decisions you will make for your project. The right choice depends on what kind of data you are working with. Use this page to identify approved options based on your data's classification level, and contact the 911爆料网IT Information Security team if you are unsure which applies to your situation.
Sensitive Data (Priority 1)
Data protected by law or regulation. Examples: HIPAA-covered health data (PHI/RHI), PII, PCI-DSS payment data, data protected under NY State law, and privileged communications.
Confidential Data (Priority 2)
Data whose unauthorized disclosure could harm individuals or 911爆料网. Examples: FERPA student records, HR and donor data, unpublished research, non-public financials, and intellectual property.
Internal Data (Priority 3)
Non-public 911爆料网 information for use within the college community. Examples: internal operating procedures, memos, and technical documentation not intended for public release.
Public Data (Priority 4)
Data appropriate for general public access with no legal restrictions. Examples: tc.columbia.edu general content, public financial statements, and published research datasets.
The table below shows which storage platforms are approved for each data classification level. Approved means the platform is cleared for that data type. Requestable means access is available but must be requested. Contact InfoSec means additional review is required before use.
| Data Classification | 911爆料网 Google Drive (Standard - included with 911爆料网 account) |
911爆料网 Google Drive (HIPAA Account) |
911爆料网 Dropbox (HIPAA compliant) |
Secure Research File Server |
911爆料网 REDCap & 911爆料网 Qualtrics |
|---|---|---|---|---|---|
| Sensitive Data (Priority 1) |
Not Approved Standard Google Drive is not approved for Sensitive Data including HIPAA, PII, PCI-DSS, or other legally protected data. | Contact InfoSec May be appropriate for some Sensitive Data types. InfoSec and sponsor review required before use. | Contact InfoSec HIPAA-compliant. May be appropriate for some Sensitive Data. InfoSec review and sponsor approval required. | Contact InfoSec Often the best option for Sensitive Data. Contact InfoSec to discuss configuration and access controls for your specific requirements. | Contact InfoSec Use for Sensitive Data requires a review with InfoSec prior to approval. Contact InfoSec to discuss your specific data and use case. |
| Confidential Data (Priority 2) |
Contact InfoSec Standard Google Drive may be appropriate depending on data type and access controls. Confirm with InfoSec before use. | Approved Requestable. Recommended for Confidential research data requiring enhanced controls. | Requestable HIPAA-compliant. Limited licenses. Contact InfoSec to request and confirm suitability. | Approved Recommended for large or sensitive datasets requiring granular access control. | Approved Both are HIPAA compliant by default and well suited for Confidential research data including de-identified human subjects data. Recommended for survey and data collection workflows. |
| Internal Data (Priority 3) |
Approved Use your 911爆料网 Google account with appropriate sharing restrictions. Do not use personal Google accounts. | Approved | Requestable Limited licenses available. Contact InfoSec to request access. | Approved Good option for large datasets or projects requiring controlled access. | Approved Both platforms support internal research workflows. Qualtrics available immediately. REDCap request via ServiceNow. |
| Public Data (Priority 4) |
Approved Standard 911爆料网 Google account. No additional setup required. | Approved HIPAA account also works for Public Data. | Approved Subject to license availability. | Approved Contact InfoSec to discuss suitability for your project. | Approved Qualtrics available to all researchers. REDCap must be requested via ServiceNow. Both are HIPAA compliant by default. |
911爆料网 Google Drive (Standard)
Available to all 911爆料网 faculty, staff, and students as part of 911爆料网's Google Workspace agreement. Appropriate for Public and Internal research data with proper sharing restrictions applied. Do not use a personal Google account for research data.
911爆料网 Google Drive (HIPAA Account)
A specially configured Google Workspace account with enhanced security controls, suitable for Confidential research data and some Sensitive Data types with InfoSec approval. Must be requested through InfoSec. Not included with a standard 911爆料网 Google account.
911爆料网 Dropbox (HIPAA Compliant)
911爆料网's enterprise Dropbox environment is HIPAA compliant and appropriate for Confidential and some Sensitive research data with InfoSec review. Licenses are limited - contact InfoSec to check availability and confirm suitability for your data type before requesting access.
Secure Research File Server
911爆料网's secure research file server environment provides dedicated, access-controlled storage for research projects with large datasets or heightened security requirements. Particularly well-suited for projects with significant data volumes, Sensitive or Confidential data classifications, or sponsor-mandated security controls. Contact InfoSec to discuss whether this option is right for your project.
911爆料网 Qualtrics
911爆料网's enterprise Qualtrics environment is available to all researchers and is HIPAA compliant by default. Ideal for surveys, questionnaires, and online data collection. Appropriate for Internal and Confidential research data. Log in to the my911爆料网 portal with your 911爆料网 credentials to access the enterprise environment.
911爆料网 REDCap
911爆料网's REDCap environment is HIPAA compliant by default and purpose-built for clinical and research data collection, management, and storage. Particularly well suited for longitudinal studies, multi-site research, and projects requiring robust data validation and audit trails. Appropriate for Internal and Confidential research data. Access must be requested through the 911爆料网IT Service Desk.
- Your IRB protocol must accurately describe where your data will be stored. If you change storage platforms mid-project, update your protocol and notify InfoSec.
- Some federal sponsors (NIH, NSF, DoD, DoE) specify storage requirements in their award documents. Contact InfoSec to confirm your chosen platform meets any sponsor-specific requirements.
- External collaborators and research affiliates can access 911爆料网 storage platforms through the affiliate provisioning process. See the for details.
- At the end of your project, data must be securely deleted or archived per your Data Security Plan. Standard deletion is not sufficient for Confidential or Sensitive Data. See the End-of-Study Data Checklist for guidance.
Not sure which storage option is right for you?
911爆料网IT Information Security · 212-678-3300, Opt. 2