University-Approved AI Tools: Data Privacy Rules Every Student Should Know

The Thing Most Students Skip: Data Classification

Before you open any AI tool, there’s one concept worth understanding — how universities classify the data you might accidentally share.

Most institutions (including the University of Utah, which inspired this guide) break it down into three tiers:

Restricted data sits at the top. Think personally identifiable information (PII) and protected health information (PHI). This is the sensitive stuff — names tied to medical records, Social Security numbers, that kind of thing. Strict access rules apply.

Sensitive data covers employee and student information. Still protected, still requiring authorization. Not something you casually paste into a chatbot.

Public data is everything else — bus routes, public directories, general knowledge. This is the tier where most students actually operate day-to-day.

Here’s the practical takeaway: if you’re using AI to study for an exam, draft a generic email, or brainstorm essay ideas, you’re almost certainly working with public data. That’s the green zone.

The Three Tools You’re Probably Allowed to Use

Universities that have negotiated enterprise agreements with AI providers typically land on a short list of approved tools. At the University of Utah, that list looks like this:

The Rule That Catches People Off Guard

Here’s where students most often slip up: personal subscriptions don’t count.

Logging into ChatGPT with your personal Gmail account, even if you’re paying for it, does not meet university compliance requirements. The data protections negotiated by your institution only apply when you authenticate through your university account.

Same goes for any other tool on the approved list. The login matters as much as the tool itself.

What You Should Never Put in a Prompt

Unless you’re a healthcare worker using a specifically PHI-approved instance, the rule is simple: no PII, no PHI in your queries.

That means no patient names, no student ID numbers, no anything that could identify a real person in a sensitive context. Even if you think the tool is secure, the safest habit is to treat every prompt as if it could be read by someone else.

When in doubt, anonymize. Replace real names with placeholders. Strip out identifying details before you paste anything in.

So, Back to That Exam

You want to study. You’re working with public knowledge — course concepts, historical facts, practice problems. You’re not sharing anyone’s data.

In that case, any of the university-approved tools will do the job. Use them to:

• Generate practice questions from a topic
• Build flashcards from a concept list
• Explain a confusing idea in plain language
• Summarize a framework you’re trying to memorize

Just double-check the output. LLMs are confident even when they’re wrong, and no AI tool is a substitute for actually understanding the material.

Where to Go When You’re Unsure

Data privacy questions at the intersection of AI can get genuinely complicated. Most universities have an Information Privacy Office that handles exactly this — and if they don’t know the answer, they’ll route you to someone who does.

For University of Utah students specifically, ai.utah.edu is the central hub for approved tools and updated guidance. Policies evolve as new tools get reviewed, so it’s worth bookmarking.

The Bigger Picture

AI tools on campus aren’t a free-for-all, but they’re also not a minefield — as long as you understand the data layer underneath.

Know what kind of data you’re working with. Use the approved tools through your university account. Keep PII and PHI out of your prompts. And when the rules feel unclear, ask someone whose job it is to know.

That’s not just good compliance. That’s good digital hygiene — and it’ll serve you well long after graduation.