Summary
Sites containing student education records (FERPA) or protected health information (HIPAA) require special security and governance measures. This article outlines the steps to initiate and manage compliant SharePoint sites, including required approvals and sensitivity labeling. Please review SharePoint: USNH SharePoint Usage Guidelines and Governance
Content
Overview
- FERPA stands for the Family Educational Rights & Privacy Act (the Buckley Amendment). It is a federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA defines students’ rights broadly, giving the student the right to control to whom their education record is released. See Family Educational Rights & Privacy Act (FERPA) for more information.
- HIPAA stands for the Health Insurance Portability and Accountability Act. This act, passed by Congress in 1996, is an expansive set of rules that includes, among other items, the establishment of national standards for the privacy and security of electronic health care transactions and records. See HIPAA FAQs for more information.
Compliance Checklist for SharePoint
1 - Initial Consultation
-
Important: The SharePoint Admin team does not determine whether data is covered by FERPA, HIPAA, or other regulatory requirements. That determination must be made by the site owner, department, data steward, or other responsible business authority prior to consultation. SharePoint Admins provide guidance on platform capabilities, security controls, and configuration options based on the requirements identified by the data owner.
Contact the SharePoint Admin team before creating a site containing FERPA or HIPAA data. This allows discussion of required security controls, sensitivity labels, and compliance protocols. Reach out via this service form: https://td.usnh.edu/TDClient/60/Portal/Requests/ServiceDet?ID=649
2 - Sensitivity Label
- A Purview sensitivity label is required to enforce protection settings on sites containing regulated data. Labels may include encryption, external sharing restrictions, and guest access limitations. To request a label or a consultation, submit a request to the SharePoint Admin team.
3 - Site Configuration
- Ensure At least two site owners are assigned.
- Limit membership to authorized personnel only, and apply least-privilege access principles.
- Anyone links and anonymous sharing will not be permitted on the site. External access must be explicitly approved and monitored if not managed via the sensitivity label.
- Auditing and regular reviews of sharing activity.
4 - Ongoing Management
- Perform periodic site usage reviews to validate that sensitive data remains under appropriate control.
- Update permissions immediately when staff roles change.
- Maintain the sensitivity label and update it if the site’s data classification changes.
5 - Incident Response Readiness
-
If you suspect that protected data has been exposed through a SharePoint site, immediately report the incident through the USNH Cybersecurity Incident Reporting process. In addition, notify the site owner and SharePoint Admins as appropriate so that access can be reviewed and secured while the incident response team conducts its assessment. Maintain documentation of site permissions and configuration to support compliance reviews or investigations.
Why This Matters
- Federally mandated laws require strict control and auditing of records protected by FERPA and HIPAA.
- Sensitivity labels and restricted access ensure data is not unintentionally exposed. For example:
- Encryption remains intact even if documents are downloaded or shared externally.
- SharePoint and OneDrive support label-based DLP and e-discovery.
- Non-compliance can lead to serious legal repercussions, financial penalties, and reputational damage.
Need Support or Approval?
Reach out to the SharePoint Admins through TeamDynamix and reference this article. Please include:
- Description of data type and sensitivity (FERPA/HIPAA)
- Proposed site name and purpose
- Request for a specific sensitivity label
- List of initial site owners
For additional information, please review SharePoint: Applying or Changing a Sensitivity Label on your SharePoint Site
Further Readings
SharePoint: USNH SharePoint Usage Guidelines and Governance
USNH Provided or Licensed Software
SharePoint: Applying or Changing a Sensitivity Label on your SharePoint Site
Need additional help?
For assistance concerning site creation, content sharing, file synchronization, or other common SharePoint, OneDrive, Teams, or Office app activities, we recommend our Microsoft 365 Learning sites:
Learn more about the great tools our Microsoft 365 Learning sites offer!
Visit the Technology Help Desk Support page to locate your local campus contact information or to submit an online technology support request. For password issues you must call or visit the Help Desk in person.