Body
Overview
This article explains how sensitive data is labeled in Microsoft 365 and provides guidance on how clients can apply sensitivity labels to emails, documents, and other content within Microsoft applications to help protect privacy and data.
Table of Contents
Microsoft 365 Sensitivity Labels
UIC currently uses the following sensitivity labels within Microsoft 365:
Sensitivity Label Explanation
| Public |
Information approved for public sharing. No protection is applied. |
| Internal |
Non-public UIC business information intended for UIC students, faculty, and staff use only. |
| Confidential |
Sensitive or restricted information requiring additional protection, excluding protected health information (PHI) |
| Confidential-HIPAA |
Protected Health Information (PHI) requiring additional safeguards under HIPAA. |
By default, Microsoft documents are assigned the Internal sensitivity label. Users should change the label when the content requires a different level of protection. If you are unsure which label is appropriate, select Internal or Confidential. For additional guidance, please contact your Unit Information Security Officer.
More details and examples can be reviewed at the Data Classifications web page.
Where You Will See Sensitivity Labels
Sensitivity labels are available in:
- Outlook (email)
- Word
- Excel
- PowerPoint
- SharePoint
Labels can be applied when creating or editing content.
How to Apply a Sensitivity Label
In Outlook (Email)
- Create a new email
- Select the Sensitivity icon from the message toolbar
- Choose Public, Internal, Confidential, or Confidential-HIPAA
- Send the email
In Word, Excel, or PowerPoint
- Open the document
- Select Sensitivity in the toolbar, then select the appropriate label
- Save the file
Automatic Encryption of Emails
UIC has enabled automatic encryption for certain emails when sensitive information is detected.
What This Means
- Emails containing Internal/Confidential data (such as personal, academic, or financial information) may be automatically encrypted
- Encryption may occur even if a sensitivity label is not manually selected
- Recipients may be required to verify their identity before accessing the email
Examples of Information That May Trigger Encryption
- Student records or identifiers
- Financial or payroll information
- Sensitive personal data
- Regulated or restricted university data
This protection helps prevent accidental disclosure and ensures that data is accessible only to authorized recipients.
What Happens When a Label Is Applied?
Depending on the label:
- Emails or documents may be encrypted, meaning that only the intended recipient will be able to open and read the message and its attachments
- External sharing may be limited or restricted
- Content may require authentication to open
- Protections remain in place even if the file is forwarded or downloaded
- Retention policies may be applied
Best Practices for UIC Faculty and Staff
- Apply a sensitivity label before sharing content
- Use Confidential-HIPAA for protected Health Information (PHI) requiring additional safeguards under HIPAA, and Confidential for sensitive or restricted information that should not be shared outside of UIC.
- Do not remove labels to bypass security restrictions
- When in doubt, choose the more restrictive label
Frequently Asked Questions
Can I share labeled content externally?
It depends on the label and recipient. Confidential and Confidential-HIPAA content will restrict or block external access.
Why was my email automatically encrypted?
Microsoft 365 detected sensitive information and applied encryption to protect the content.
Will recipients outside UIC be able to open encrypted emails?
Yes, but they may need to verify their identity or use a one-time passcode.
Where To Get Support
If you have questions or encounter issues related to sensitivity labels, please reach out to the Technology Solutions Service Desk at it.uic.edu/service-desk.