Red Flag Identity Theft Prevention Program: Difference between revisions

<br />

<br /><br />

== Basis for Policy ==

Regents Policy 6.6.12, Red Flag Identity Theft Prevention Program; UNMC Policy No. 6055, Fraud.

== Purpose ==

The University of Nebraska Medical Center Red Flag Identity Theft Prevention Program is designed to reduce the risk of identity theft through detection, prevention and mitigation of patterns, practices or activities related to covered accounts ("Red Flags") that could be indicative of potential identity theft. The Fair and Accurate Credit Transactions Act (FACTA) contains program requirements at 16 CFR 681.<br /><br />

The Vice Chancellor for Business and Finance is responsible for implementing the Red Flag Identity Theft Prevention Program and has delegated day-to-day management to the Compliance Officer.

== Definitions ==

#''Covered Account'' means             

#''Red flag'' means a pattern, practice or specific activity that could indicate identity theft.

#''Service Provider'' means a vendor that provides services directly to UNMC related to Covered Accounts.

== Covered Accounts ==

Covered accounts maintained by UNMC include but are not limited to the following:

# Student accounts

# Patient accounts

== Identifying Red Flags ==

# Alerts, notifications or warnings from a consumer reporting agency, including notices of credit freezes, notices of address discrepancies, and receipts of consumer reports showing patterns of activities that are inconsistent with the history and usual pattern of activity of the account holder.

# Address discrepancies that cannot be explained.

#*unauthorized account changes or transactions.         

# Notice from customers, victims of identity theft, law enforcement authorities or other individuals regarding possible identity theft in connection with UNMC Covered Accounts.

== Detecting Red Flags ==

#The following actions will be taken as appropriate to confirm the identity of customers when they open and/or access Covered Accounts:             

#* Obtain appropriate personal identifying information (e.g. photo identification, date of birth, academic status, user name and password, address, etc.) prior to opening or allowing access to a covered account; or prior to issuing a new or replacement ID card.

#* Verify the accuracy of changes made to Covered Accounts that appear to be suspicious.

#Information systems containing Covered Account information shall be monitored by the appointed information system custodian/administrator to detect any unusual user activity that could indicate improper access to and/or use of consumer information.

== Responding to Red Flags ==

Any staff member encountering a Red Flag shall assess the situation to determine if potential identity theft exists. The assessment may determine that no risk of identity theft is present (i.e. a mistake has occurred, or the occurrence is readily explainable). If, after preliminary investigation, the employee suspects identity theft may have occurred, he/she shall notify the Compliance Officer.<br /><br />

# Notify campus security

# Notify the Covered Account holder if the holder is the identity theft victim

# Reopen a covered account with a new account number, close an existing account, and decline to open a new covered account as appropriate

# Attempt to identify the source of the Red Flag and take appropriate steps to prevent additional identity thefts.

== Oversight of Service Providers ==

UNMC may contract with vendors to provide services related to Covered Accounts. The contracting department shall maintain written certification from the vendor stating it complies with FACTA Red Flag Rule regulations. The department shall investigate any service provider occurrences indicating a potential lack of compliance, and take any necessary actions to mitigate potential risk.

== Program Education ==

All departments managing Covered Accounts shall provide education to current staff members and new hires on this policy and any internal department procedures created to implement it.

== Program Assessment and Reporting ==

# a summary of Red Flag Rule monitoring activities;

# a description of any identity theft incidents that have occurred and the response to them; and

This page maintained by [mailto:dpanowic@unmc.edu dkp].