Using Large Language Models (LLMs) Responsibly
🔐 Understanding Data Security Levels at Northwestern
Northwestern University classifies data into four levels based on sensitivity:
- Level 1: Public data (e.g., published works already available online)
- Level 2: Internal data (e.g., unpublished research, draft manuscripts)
- Level 3: Confidential data (e.g., Protected Health Information [PHI])
- Level 4: Highly restricted data (e.g., government-classified information)
Northwestern definitions:
📦 Reminder of where you can store PHI here
⚠️ What Can Be Used with Public LLMs?
Only Level 1 (public) data should be entered into publicly available LLMs such as:
- ChatGPT
- Claude
- Gemini
These tools may retain input data, share it with third-party providers, or use it for model training—posing risks even if the data doesn’t appear sensitive.
🏥 Feinberg School of Medicine Policy
Feinberg medical students must follow specific guidelines for using generative AI tools:
✅ Approved Tools for Higher-Sensitivity Data
Microsoft Copilot
- May be used for Level 2 data when signed in with your @northwestern.edu or @nm.org account
- Access via: https://m365.cloud.microsoft/chat or via your Outlook email (see screenshot) – you will know you are securely protected when you see the green shield in the upper righthand corner
- Northwestern University’s guidance on Generative AI tools
- The only approved tool for handling minimally necessary PHI (Level 3)
- Must be accessed via Citrix or VPN
- Access via: https://chat.nm.org
- Official Northwestern Medicine policy
🧪 Research Use and IRB-Approved Projects
For IRB-approved research involving sensitive data:
- Special accounts can be provisioned to use LLMs via Microsoft Azure
- Requires Limited Access Review and additional permissions
- Azure Access for Research Projects
- Consider local models on your NU/NM-managed device
LLM Tool Comparison for Sensitive Data Use
Tool |
Access Requirements |
Can Input Minimal Necessary PHI/PII? |
Data Level Allowed |
Public LLMs (ChatGPT, Gemini, Claude, etc.) |
Publicly accessible |
❌ No |
Level 1 only (Public data) |
Microsoft Copilot (NU) |
Sign in with @northwestern.edu |
❌ No |
Level 2 (Internal data) |
Microsoft Copilot (NM) |
Sign in with @nm.org |
❌ No |
Level 2 (Internal data) |
NM Chat |
Sign in via Citrix/VPN |
✅ Yes |
Level 3 (PHI/PII) |
Fully Local Models |
Depends on configuration and approval |
⚠️ It depends |
Case-by-case (requires review) |
Microsoft Azure OpenAI APIs |
Special research account + IRB + Limited Access Review |
⚠️ It depends |
Case-by-case (requires review) |