. . "Sensitive information must be protected from unauthorized access, modification, transmission, storage or other use, and is generally available to members of the university community who have a legitimate purpose for accessing such information." . . .