Video Conferencing Tools

• Note regarding Zoom: The details below are based on the University's main Zoom account. Some schools and organizations operate under their own, separate agreements, and may not provide the same features, integrations, or means of access. Speak to your local IT support team if you are unsure whether or not this is applicable to you.

• If you intend to share any form of sensitive information or are uncertain if the information you will be sharing is considered sensitive, you should speak to your local IT support team before making any decisions.
• Video or audio recording (including taping, recording, photographing, screen capture, and other methods of capture) for purposes other than instruction is prohibited without a strong rationale, and only if the host provides advance notice and opportunity to opt-out of video/audio participation. Students in a class and/or meeting participants are prohibited from recording, of any kind, without written permission from Penn and the instructor. See Privacy Using Zoom for full recording requirements.
• For official direction on what constitutes different degrees of data sensitivity, please see the Data Risk Classification page.

High Risk Data (except HIPAA/PHI, Credit Card, or SSN data)

• I would like to share data that is regulated by law or could potentially have a significant adverse impact to Penn or an individual. This includes things such as personal financial information, HR records, information from personal IDs, donor information and non-public gifts, etc.
• Please note:  If you are looking to share HIPAA/ PHI, Credit Card or Social Security Numbers do not use this table, see their individual tables for those data types below.

Moderate to Low Risk Data

• I would like to share data that may not generally be available to the public. This includes things such as student education records that are not High Risk, University directory information, non-public internal policies and memos, etc.

HIPAA/PHI

• I would like to share HIPAA-protected data or other Protected Health Information (PHI).
• Zoom accounts sharing HIPAA data must be licensed under the University's Enterprise Agreement, and not to an agreement specific to a school or center.
• Where HIPAA data or PII will be part of video conferences it is important to consider whether the other locations where this data will be stored, including storage of meeting recordings, are sufficiently secure and meet regulatory requirements. Consult your local IT support to ensure appropriate controls and security measures are in place.

*When sharing HIPAA-protected data via BlueJeans or Zoom you must use individually generated Meeting IDs, and not your personal, static meeting room. Be sure to consult with your local IT team for assistance.

**When recording meetings that contain HIPAA-protected data in BlueJeans or Zoom, be aware that if those videos are downloaded off of the hosted service, you must be certain that any location they are stored is also HIPAA compliant. Be sure to consult with your local IT team to discuss options for video storage.

FERPA

• I would like to share student education records.

SSN

• SSNs generally should not be shared unless communication of the SSN is necessary to comply with legal requirements or other business or IT processes.
• Note: Any use of these tools to share SSNs must comply with the Penn Social Security Number Policy.

Credit Cards

• You may not share credit card data using any of these tools.
• The Treasurer’s office is responsible for issuing credit card merchant accounts and for overseeing policies and procedures regarding payment processing. All credit card processing arrangements require the approval of the Treasurer's Office.