- Collection of SSNs for University records
- SSNs may be collected and recorded when needed by federal or state governmental agencies or by outside third parties mandated to collect SSN information (example: health care providers, students’ loans, etc.).
- PHSU employees authorized to collect SSNs may request an SSN during the execution of their duties if a primary means of identification, such as the UPI number, is not known or available.
- PHSU employees may not collect SSNs, except for those purposes noted below. Enrollment: Those wishing to enroll in academic offerings at the
- PHSU- both credit and non-credit - may be required to provide an SSN for secondary identification purposes. IRS regulations require PHSU request an SSN as a Taxpayer ID number for use in tax reporting. In addition, any student applying for Financial Aid must provide an SSN to the University. If a person enrolling in PHSU academic offering - credit or non- credit - cannot provide a SSN, certain services, such as transcripts, enrollment verification, tax reporting and financial aid may not be available to the individual and the University cannot guarantee a complete academic record for the individual.
- Immigration Law: An SSN may be collected as necessitated by immigration law or regulations.
- Certification Exams/Cooperative Experiences/Internships: An SSN is required to be collected and reported for students who are taking certification exams if mandated by the certifying agency. Students participating in internships OR Coop experiences may also require the student to provide an SSN for the other entity.
- Employment: Any person employed by PHSU must provide an SSN as the taxpayer ID number as directed by the IRS. This includes all employees, including part-time and student employees. Providing the SSN is a condition of employment. Applicants for employment must also provide a SSN, if requested, for mandatory background checks.
- Employee Benefits: If required by a benefits provider, the SSNs of dependents may be collected to receive service. PHSU may also release an employee’s SSN to benefit providers.
- Payment for Personal or Professional Services: Any person providing services to PHSU as an independent contractor, invited speaker (honorarium) or research subject for which payment will be made, must provide an SSN as the taxpayer ID number per IRS regulations. These taxpayer ID numbers will be stored in the Finance Department as part of the vendor record.
- Other Entities: The SSN may be released to entities outside PHSU where required by federal or state law, regulation, or procedure, or if the individual grants permission.
- Maintaining the Security and Privacy of SSNs
- All records containing SSNs, whether on or off-line, will be considered confidential information and should be maintained appropriately to protect the confidentiality and integrity of this information.
- PHSU will take reasonable precautions to protect SSNs for all individuals who provide it.
- An SSN may not be used as a primary identifier in PHSU system.
- When records including SSNs are no longer needed, disposal of the records must follow University information retention and destruction policies and procedures.
- SSNs are confidential data and may not be used for the purposes of data mining.
- SSN’s may not be used, in part or in whole, as a user ID or password for accessing a computer system or for generating any type of identifier.
- SSNs in their entirety or in any portion may not be used nor posted where they can be exposed to the public, including timecards, class rosters, grade rolls and bulletin board announcements.
- SSNs may not be used as an identifier for the collection of data for research or academic purposes.
- Security Controls for Computer Systems Maintaining SSNs
- Systems storing SSNs must contain security controls that protect the integrity and confidentiality of this information. Controls must include:
- Authorization controls that require a user ID and password and that restrict access to information on the system based on an individual’s job responsibilities.
- Network security controls, in which any system with SSNs must be protected by a network firewall and any other security control ordered by the IT Department.
- SSNs Shared with Third Parties
- SSNs may not be shared with third parties, with the exceptions of:
- As required or permitted by law.
- With the consent of the individual.
- Where the third party is an agent or contractor for the University and has demonstrated that controls are in place to prevent unauthorized distribution.
Sanctions
It shall be the responsibility of each unit/Department of PHSU to meet the requirements set forth in this policy. Violation of this policy may result in disciplinary action up to and including termination of employment. Violation may also result in civil and criminal penalties based on state and federal privacy statutes. PHSU acknowledges that a violation of this Policy is subject to administrative penalties from the Consejo de Educación Superior not less than $500 up to $5,000. (Law 186 for 2006, Article 2.)
Additional Information
For additional information about this policy, or to file a report, contact the University’s Compliance Officer.
|