Data Classification, Governance, and Access Control

Why Data Governance Matters

Every dataset carries risk. When a data analyst opens a health-clinic CSV, they are handling information that can expose individuals to discrimination, identity theft, or privacy violations. Data governance is the set of policies, procedures, and standards that control how data is collected, stored, used, shared, and destroyed. Without a governance plan, even well-intentioned analysts can misuse sensitive information simply because nobody defined the rules.

For data professionals, governance is not optional. Regulations such as the Health Insurance Portability and Accountability Act (HIPAA) impose legal duties on organizations that handle protected health information (PHI). Violations can result in civil and criminal penalties. Understanding governance principles is also tested on the CompTIA Data+, Microsoft PL-300, and related credentials.

The Data Dictionary

A data dictionary is a reference document that describes every field in a dataset. At minimum, each entry records the field name, data type (string, integer, date, etc.), a plain-language description, an example value, and a sensitivity level. The data dictionary serves two audiences: technical staff who build pipelines and non-technical managers who approve access. A well-written dictionary prevents misunderstandings about what a field actually contains — for example, clarifying whether a field labeled `ins_code` holds a payer identifier or a plan-type code.

Build the dictionary before doing anything else with a new dataset. Auditing fields at the start forces you to notice unexpected columns, missing values, and potential identifiers you might otherwise overlook.

Four-Tier Classification

A widely used classification scheme organizes data into four tiers based on the harm that unauthorized disclosure could cause:

Tier 1 — Public: Information already released to the general public or that carries no disclosure risk (e.g., the clinic's street address).

Tier 2 — Internal: Information that is not secret but is intended only for internal staff (e.g., aggregate visit counts by month). Unauthorized disclosure is inconvenient but not severely harmful.

Tier 3 — Confidential: Information that could harm individuals or the organization if disclosed improperly (e.g., insurance plan codes linked to a patient). Access is limited to staff with a demonstrated business need.

Tier 4 — Restricted: The most sensitive data, including direct identifiers and clinical diagnoses. Unauthorized disclosure could cause serious harm — legal liability, discrimination, or identity theft. Access requires explicit authorization and strong controls. In a healthcare context, PHI such as names, dates of birth, ZIP codes that could re-identify a patient, and diagnosis codes typically falls here.

NIST SP 800-188 provides practical guidance on de-identification techniques — methods that reduce the risk of re-identification so that certain fields can be reclassified to a lower tier. Suppression (removing a field entirely), generalization (replacing a specific value with a range), and perturbation (adding statistical noise) are common techniques.

Role-Based Access Control (RBAC)

Role-Based Access Control assigns permissions to job roles rather than to individual people. When someone changes jobs, you update their role assignment — you do not have to rewrite dozens of individual permission rules.

A minimum viable RBAC scheme for a health-clinic dataset might include:

• Analyst: Read access to Tier 1–3 fields; no access to Tier 4 identifiers; no export of individual records; may export aggregated results.
• Manager: Read access to Tier 1–4 fields for operational review; limited write access to annotate records; may not export raw Tier 4 data outside the secure environment.
• External Auditor: Read-only access to Tier 1–2 fields and de-identified versions of Tier 3 fields; no access to Tier 4; all sessions logged.

The principle of least privilege underlies every RBAC design: grant only the minimum access a role needs to accomplish its legitimate tasks. This limits the damage if an account is compromised.

Retention Schedules

A retention schedule specifies how long each category of data must be kept and when it must be destroyed. Retention decisions balance legal requirements, operational needs, and privacy risk. For healthcare data, HIPAA sets minimum retention standards for medical records at the federal level, and many states set longer periods — always check applicable state law. Data kept longer than required is a liability, not an asset. Your schedule should document the legal or policy basis for each retention period so an auditor can verify it.

Secure disposal matters as much as the schedule itself. Deleting a CSV from a desktop is not sufficient; organizations use methods such as cryptographic erasure, secure overwrite, or physical destruction of storage media depending on the sensitivity tier.

Breach Notification

Despite controls, breaches occur. HIPAA requires covered entities to notify affected individuals, the U.S. Department of Health and Human Services, and in some cases the media, within defined timeframes following discovery of a breach involving unsecured PHI. A breach-notification flowchart in your governance plan maps the decision steps: detect the incident → assess scope → determine whether PHI was involved → notify appropriate parties → document the event. Every employee who handles Tier 3 or Tier 4 data should know who to call first when something goes wrong.

Safety and Ethical Considerations

In data science, 'safety' includes data safety. Always work with synthetic or properly de-identified data in training and development environments — never load real patient records into a personal laptop or unsecured cloud folder. Lock screens when stepping away from workstations. Use version-controlled, access-logged repositories for governance documents so changes can be audited. Report any accidental exposure of real PHI to your supervisor immediately, following the breach-notification plan. These habits protect individuals whose data you steward and protect you from professional and legal risk.