Social Security Number: Difference between revisions

[[Identification Card]] | [[Secure Area Card Access]] | [[Privacy/Confidentiality]] | [[Computer Use/Electronic Information]] | [[Confidential Information]] | [[Protected Health Information (PHI)]] | [[Notice of Privacy Practices]] | [[Access to Designated Record Set]] | [[Accounting of PHI Disclosures]] | [[Patient/Consumer Complaints]] | [[Vendors]] | [[Fax Transmissions]] | [[Psychotherapy Notes]] | [[Facility Security]] | [[Conditions of Treatment Form]] | [[Informed Consent for UNMC Media]] | [[Transporting Protected Health Information]] | [[Honest Broker]] | [[Social Security Number]]

Policy No.: '''6075'''<br />

Effective Date: '''DRAFT'''<br />

Revised Date: ''''''<br />

Revised Date: ''''''<br />

UNMC shall not use Social Security Numbers to identify students, employees, research subjects, alumni, donors, potential students, and affiliates outside of those uses specifically required by law, such as financial aid, payroll and benefit functions.

Social Security Numbers (SSNs) - including any portion of the full nine digits-shall not be electronically collected, transmitted, or stored by members of the workforce unless specifically authorized in writing by authorized individuals as outlined in this policy. Individuals or departments that collect, transmit or store SSNs will take steps necessary to secure this data using best practices identified by the Information Security Office.

The following individuals are authorized to approve use of Social Security Number.

*Employees - Assistant Vice Chancellor Human Resources

*Students - Assistant Vice Chancellor Academic Affairs

*Other - Senior Associate Vice Chancellor for Business and Finance

*UNMC is responsible for safeguarding and protecting Social Security Numbers against loss, tampering, and disclosure to individuals. The safeguarding of confidential information in any form includes when the information is stored and/or being transferred outside the facility (see UNMC Policy No. 6073, [[Transporting Protected Health Information]]).

*Workforce members who suspect a Social Security Number violation must report it immediately to their respective manager, the Privacy office, or Information Security Office. A full investigation of the suspected violation shall be conducted. Staff who wish to remain anonymous may report the suspected violation to the Compliance Hotline at 1-866-568-5430. Sanctions shall be imposed for substantiated breaches or failure to report suspected violations.  

Sanctions for violations of privacy or information security policies may include scholastic or employee corrective action up to and including student dismissal or termination of employment. (See UNMC Policy No.1098, [http://wiki.unmc.edu/Corrective/Disciplinary_Action Corrective and Disciplinary Action Policy]).  

:*Student Number

*In the event that the Social Security Number of a student must be maintained, a form [http://www.unmc.edu/its/security/procedures/ssn-use.docx Request to Use Social Security Number] must be completed and submitted to the Information Security Office who will facilitate approval from the Assistant Vice Chancellor for Academic Affairs. If Social Security Number must be used and stored in a database, the use of the student’s Social Security Number must comply with [http://www.unmc.edu/its/security/procedures/database-security.html ITS Database Security Procedures].

*ITS shall be available to assist in identifying alternatives to use of Social Security Number. Alternatives which should be considered, include but are not limited to:

*In the event that the Social Security Number of an employee must be maintained, a form [http://www.unmc.edu/its/security/procedures/ssn-use.docx Request to Use Social Security Number] must be completed and submitted to the Information Security Office who will facilitate approval of the Assistant Vice Chancellor for Human Resources for approval. In cases where the employee Social Security Number must be stored in a database, the database must comply with [http://www.unmc.edu/its/security/procedures/database-security.html ITS Database Security Procedures].

*In the event that the Social Security Number of a research subject must be maintained, a form [http://www.unmc.edu/its/security/procedures/ssn-use.docx Request to Use Social Security Number] must be completed and submitted the Information Security Office who will facilitate approval from the Institutional Review Board. In cases where the research subject Social Security Number must be stored in a database, the database use must comply with [http://www.unmc.edu/its/security/procedures/database-security.html ITS Database Security Procedures].

*ITS shall be available to assist in identifying alternatives to use of Social Security Number.

*In the event that the Social Security Number must be maintained, an a form [http://www.unmc.edu/its/security/procedures/ssn-use.docx Request to Use Social Security Number] must be completed and submitted to the Information Security Office who will facilitate approval from the Senior Associate Vice Chancellor for Business and Finance for approval. In cases where the Social Security Number must be stored in a database, the database use must comply with [http://www.unmc.edu/its/security/procedures/database-security.html ITS Database Security Procedures].

If the request to use Social Security number is approved, the Information Security Office will send the approval document to the unit management and requestor.

If the request to use Social Security number is disapproved and the requestor wishes to appeal the decision, the Vice Chancellor for Business and Finance will be asked to review the request and render a final decision.

Periodically the Information Security Office will generate reports which will identify the storage locations of Social Security Numbers. These reports will be distributed to unit management for review. The intent of the report is to help unit management know where Social Security Numbers are used within their unit.

The Information Security Office will maintain the exception forms. The forms will be reviewed periodically to verify that the exception is still valid.  

'''''Workforce''''' means students, employees, the medical staff, volunteers, trainees, and other persons whose conduct, in the performance of work for UNMC is under the direct control of UNMC, whether or not they are paid by UNMC.

*UNMC Policy No. 6045, [[http://wiki.unmc.edu/Privacy/Confidentiality Confidentiality and Information Security]]

*UNMC Policy No. 6051, [[http://wiki.unmc.edu/Computer_Use/Electronic_Information Computer Use and Electronic Information Security]]

*UNMC Policy No. 1098, [http://wiki.unmc.edu/Corrective/Disciplinary_Action Corrective and Disciplinary Action Policy]

*[http://www.unmc.edu/its/security/procedures/database-security.html ITS Database Security Procedures]

*[http://www.unmc.edu/its/security/information-security-plan.pdf Information Security Plan]

*[http://www.unmc.edu/its/security/procedures/destruction-confinfo.html Destruction of Private and Confidential Information Procedures]

*[http://info.unmc.edu/wiki/index.php/Faculty_Handbook UNMC Faculty Handbook: Operating Procedures]

* [http://www.unmc.edu/studentservices/_documents/handbook.pdf Student Handbook]