Overview

This guidance addresses security and privacy when using Artificial Intelligence (AI) in university activities. The university is exploring how this rapidly evolving technology can support education, research and innovation, and health care. This guidance will be updated as new tools and vendors enter the university’s technical environment.

The Information Technology department and others are working to understand how generative AI systems protect the security and privacy of the information they collect, especially University Data.

AI Use with University Data

NEOMED’s University Data is information created, collected, maintained, transmitted or recorded by or for the university to conduct university operations. All University Data must be assigned one of four security classification levels (L1-L4), as required by the University Data Policy, which establishes the need to protect University Data. For details about the classifications and the types of information in each category, consult the Security & Privacy section of the IT Knowledge Base.

What AI tools may I use with University Data?

Consult the Approved AI Tools Registry for the current list of approved tools. NEOMED is actively evaluating AI platforms and software incorporating AI tools, and the registry will be updated as software is vetted and approved.

What Data may I use in Approved AI tools?

As best practice, use only Public (L1) or Internal (L2) University Data in approved AI tools. Restricted (L3) and/or Highly Restricted (L4) data may be included when necessary for your education, business or research use case. Because all software carries a risk of security incidents and data disclosure, enter only the data necessary to achieve your goal. Consult the Approved AI Tools Registry for the current list of approved tools and the maximum allowable data classification level.

What if I want to use an AI tool not listed on the Approved AI Tools webpage?

University community members should not enter any University Data that is categorized above the Public (L1) level into unvetted/unapproved AI tools.

Privacy and Information Integrity

Before using Copilot without signing in with your university username and password, or using another unvetted AI platform, consider how the service handles the information you enter. Many AI companies state that they can access account information and all inputs used to generate a response. If this information is disclosed, cybercriminals could use it to create malware, phishing email campaigns or other cyber scams. Separately, prompts could be used to train the underlying large language model, potentially causing information from a prompt to be inadvertently exposed to another user.

When using any generative AI tool, including Copilot, check both the accuracy of its output and whether its content is subject to copyright restrictions. Cross-reference the information to confirm that it is accurate: these systems can make up, or “hallucinate,” data. Also consider whether the output includes copyright information and is therefore subject to regulations governing its use.

If you have concerns that University Data has been compromised, reach out to the IT Help Desk. We are all responsible for keeping University Data secure, especially as AI becomes more widely available.