3-14 Social Security Number Privacy

• Effective date of this revision: September 11, 2006
• Contact for more information:  Office of General Counsel

PURPOSE

This policy is established in accordance with Section 4 of the Michigan Social Security Number Privacy Act. 

POLICY

Central Michigan University is committed to protecting the privacy of personal information of students, employees and others, including social security numbers. The University recognizes the importance of maintaining the confidentiality of this information. The University prohibits the unlawful acquisition or disclosure of social security numbers. The University will keep all social security numbers confidential, to the extent practicable. 

PR0CEDURE

Only employees whose job duties require exposure to information and documents containing social security numbers will  have access to them. The heads of other departments or units receiving social security numbers directly from employees or students must establish a process for approving persons who have demonstrated a need to have access to this information and must assure compliance with the section below on Physical Security Measures and Training. For access to employee information contained in the SAP system, the SAP security administrator must grant access after consultation with the director of the unit in which the accessing employee works. For access to student information in the Campus Management System, the Registrar must grant access after consultation with the director of the unit in which the accessing employee works. 

Unit supervisors or directors will assure that employees who do have access to social security numbers will be trained about the importance of keeping this information confidential, and affected employees will be reminded at least annually that this is one of their responsibilities. 

EMPLOYEES

Each employee is given a system-assigned ID that is used as the primary employee identifier. Social security numbers are obtained by the university and used for lawful purposes such as in connection with retirement accounts, taxes, payroll, health insurance and other benefits, background/credit checks and verification of identity. The social security number is still used for certain additional purposes, such as library records, but these uses are being phased out since the implementation of the Campus Management System. 

STUDENTS

The social security number is no longer the primary identifying number for students. Under the Campus Management System, each student is given a system-assigned ID that will be used as the primary student identifier. The University will continue to obtain and use students’ social security numbers for lawful purposes. The numbers are needed for specific reporting functions as required by state and federal law and are also required for, among other things, financial aid, reporting to the National Student Clearinghouse, attendance verifications, degree reporting, loan tracking, reporting of student income (including scholarships and grants) to taxing authorities and certain health services. In addition, the University will continue to use social security numbers as identifiers in the delivery of certain services such as library records and dining hall access until their use can be phased out.

OTHER DISCLOSURES

Social security numbers of students or employees may be used and disclosed when required by state and federal law, for the purposes of law enforcement, collection of debts owed to the University, investigations, claims, child support, and for other purposes not prohibited by law. 

PHYSICAL SECURITY MEASURES AND TRAINING

Units and departments are urged to review their business procedures and practices to determine whether they gather, possess or have access to social security numbers and, if so, whether such use and access is absolutely essential.

If deemed essential, units and departments must establish a system to protect the physical security of records containing social security numbers and prevent unauthorized access to and disclosure of this information. In addition, training of all unit/department personnel, including student employees, must be implemented so that all will use and follow the system.

DISPOSAL OF RECORDS

It is strongly recommended that originating units and departments not keep copies of any records containing social security numbers once data or records are forwarded to Human Resources, Faculty Personnel Services, Payables or other offices that must have that information.

When documents, including those on disks, containing a social security number are disposed of, such documents shall be shredded, burned or pulverized prior to disposal. Computers which have contained social security numbers shall be disposed of in compliance with the University Computer Disposal Policy.

SANCTIONS FOR THE VIOLATION OF THE POLICY

Employees found to have unlawfully acquired or disclosed another person’s social security number or to have violated this policy will be subject to discipline up to and including dismissal.

Students who have unlawfully acquired or disclosed a person’s Social Security Number or who have violated this policy will be subject to discipline up to and including dismissal.

In addition, any individuals violating this policy may be subject to penalties provided for by the Michigan Social Security Number Privacy Act.

Central Michigan University reserves the right to make exceptions to, modify or eliminate this policy. This document supersedes all previous policies, procedures and directives relative to this subject.