"In other cases, there may be data that must be kept secure because it contains confidential information, such as patient records and radiological data.At any rate, its good that the university is taking steps to curb phishing, but ultimately the responsibility lies on them, as they own the data (via work for hire)." . . . .