Learning Management Collection Data Security

Learning Management Collection Access Prerequisites
Those who have a PennKey and wish to gain access to the Learning Management collection in the Data Warehouse may submit the Data Warehouse Access Request Form for Learning Management Data. University employees must have their forms signed both by their supervisor and by the senior business administrator for their school or center. Employees of the University of Pennsylvania Health System (UPHS) must obtain the signature of their Knowledge Link Administrator. When Data Administration receives the completed access request form, the user is granted access to view all of the Learning Management data in the Warehouse. Data Administration notifies the user via E-mail when access has been granted.

Releasing Data Outside the University or UPHS
Those who have access to the Learning Management data in the Warehouse are not necessarily authorized to disclose that data outside the University or UPHS. If you receive an external request for Learning Management data, refer the requester to the Director of Research Compliance Training & Systems.

Keep a Log
You might want to keep a log of the reports you create, even if you are giving it to someone within the University or UPHS. The log might include:

• Who requested the data.
  
• When they made the request.
  
• What data they requested.
  
• Why they requested the data/how they planned to use it.
  
• What query and/or report you used.

Releasing Data Within the University or UPHS
Within the University or UPHS, Learning Management data may be disclosed only if it is needed to do the business of the University or UPHS, and only to those who need to know the information in order to do their jobs. If you are not sure whether to fulfill a request for Learning Management data, ask the Director of Research Compliance Training & Systems.

Questions you should ask to help decide whether to fulfill a request for Learning Management data:

• Who wants the information?
  
• Why do they want the information?
  
• For what purpose will the information be used?
  
• If they pass the information on to someone else, for what purpose will that person use it? Note: Usually, the data should be for the requestor's use only. No data should be posted in a public place including the World Wide Web.
  
• How will they secure the information once they have it?
  
• How will they dispose of the information when they are done with it? For example, hard copy reports should be shredded.

Learning Management data should not be sent via e-mail unless it is encrypted. Business Objects users may securely send Learning Management data to each other by sending Desktop Intelligence Documents using the Business Objects server infrastructure. For more information, see the section about Sharing documents with other users in the documentation on the Business Objects XI Release 2 Upgrade.

Desktop Security
Query Results. Business Objects writes files to the desktop client under the subdirectory specified when the files are saved. The default directory is C:\Documents and Settings\username\My Documents\My Business Objects Documents\userDocs\ (where username is the User Name you enter when you log on to Business Objects). If you click the Save and Close button on the Query Panel before saving the file as a Desktop Intelligence Document, the file will store the query and the formatting for the report(s) that present the data retrieved by the query; the data itself will not be stored. However, if you run or refresh the query and then save the file as a Desktop Intelligence Document, the file will store the query, the formatting for the report(s), and the data. Business Objects also enables you to save the data in other formats. You must see to it that any sensitive data stored on your personal computer is safeguarded through physical security, access control software, or encryption.

• Examples of physical security are locked offices and locked keyboards.
  
• Examples of access control software are a screen saver with password protection (which your computer has been set up to initiate at startup) or specialized desktop security software.
  
• If you encrypt your query results, you will need to decrypt them before accessing them with Business Objects.

Warehouse Access
When a computer is left signed to an account, it is easy for someone to gain unauthorized access. Either sign off from your account before you leave your computer or restrict access by some other means (physical security or access control software).

For more information on security and privacy, contact the University's Office of Information Security.