{"id":6776,"date":"2025-09-06T15:04:51","date_gmt":"2025-09-06T22:04:51","guid":{"rendered":"https:\/\/www.hmc.edu\/cis\/?page_id=6776"},"modified":"2025-10-15T17:24:30","modified_gmt":"2025-10-16T00:24:30","slug":"ai-guidelines","status":"publish","type":"page","link":"https:\/\/www.hmc.edu\/cis\/ai-at-hmc\/ai-guidelines\/","title":{"rendered":"Using AI with HMC data"},"content":{"rendered":"\n

The following guidelines are offered to the HMC community to help with decisions about what AI can be used with what data.
<\/p>\n\n\n\n

\n

Step 1. Understand data classification.<\/h2>\n\n\n\n

“P3 and P4 data can only be used in systems that are approved by the college.<\/strong>“<\/p>\n\n\n\n

Data classification is the process of classifying data according to levels of confidentiality and the protection that it requires.\u00a0 The HMC Data Classification Standard<\/a> breaks college data down into \u201cP\u201d (for \u201cprotection\u201d) levels based on the consequences to the college of unauthorized access or modification of that data.\u00a0

There are four protection levels specified in the standard, from \u201cP4 – High\u201d down to \u201cP1 – Public\u201d. \u00a0 The protection levels are heavily driven by the potential consequences to the college of unauthorized disclosure or modification. \u00a0 The higher the protection number, the more serious the consequences and the more stringent the protections.\u00a0 For example, P4 includes Social Security Numbers, P3 covers personnel records, P2 non public emails that don\u2019t contain P3 or P4, and P1 is essentially \u201cpublic\u201d.\u00a0

There are more details about the data classification standard in the Questions and Answers section<\/a>.<\/p>\n\n\n\n

Step 2. Understand which AI is approved for which data.<\/h2>\n\n\n\n

“Only Google Workspace for Education, Microsoft 365 for Education and Workday can be used on P3 and P4 data.”<\/strong><\/p>\n\n\n\n

Table explaining the relationship between AI tools and HMC data protection levels.<\/a> (Requires HMC Credentials)<\/p>\n\n\n\n

Step 3. Understand the approval process.<\/h2>\n\n\n\n

“Make sure you know whether the AI you\u2019re interested in is on the college approved list or not.  If it is not, you cannot use it with P4 and P3 data but you can still use it with P2 data and P1 data. “<\/strong><\/p>\n\n\n\n

The college has an approval process for software purchases that includes contract review, cyber-security assessment, risk management and accessibility review.  When any given academic or administrative department is interested in purchasing a software application, several other departments\/offices at the college carry out a review. The offices that perform this review work include the Office of Financial Affairs, Computing and Information Services, Risk Management and Legal Affairs, and Communications and Marketing.<\/p>\n\n\n\n

The following are our current AI requirements for systems that may be used on P3 and P4 data:<\/p>\n\n\n\n