Table of Contents | Index | Internal Audit Web

MISSISSIPPI STATE UNIVERSITY

PURPOSE

The purpose of this Operating Policy is to promote an understanding of the procedure to ensure the privacy and proper handling of social security number and other personal information of students, prospective students, faculty, staff, alumni, and other persons officially associated with Mississippi State University.

REVIEW

This OP will be reviewed every five years (or whenever circumstances require an earlier review) by the Associate Provost for Academic Affairs (APAA) with recommendations for revision presented to the President.

POLICY/PROCEDURE

Background and Philosophy

Mississippi State University (MSU) is committed to protecting personal information and to deterring identity theft of its students, faculty, staff, alumni, and others with whom it has an official association.  In the normal practice of conducting university business, MSU collects and maintains confidential information related to its students, employees, alumni, and other individuals associated with MSU.  The university is committed to protecting personal and confidential information and properly handling and maintaining such data.

Policy

The collecting of social security numbers (SSNs) is required of all employees of the university, all tuition-paying students, students receiving financial aid, and other individuals for which state and federal law require the reporting of SSNs.  If there is no legal requirement to collect a SSN from a particular individual, MSU will not require such an individual to provide their SSN and will not deny any service as a consequence.  MSU will not disclose the social security number of any individual to anyone outside the Mississippi Institutions of Higher Learning (IHL) system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

Procedures

1. MSU Identifier. By July of 2006, the SSN will no longer be used as the primary identifier of individuals associated with MSU.  MSU will issue a unique, nine-digit number (the MSU ID number) to every student, employee, alumnus, and other person within MSU computerized record systems. 

2. Collection of SSN.  MSU will continue to collect SSNs as permitted by law for official use within the Mississippi IHL system.  Social security numbers will be released to entities outside the Mississippi IHL system only:  (1) as allowed by law; or (2) when permission is granted by the individual;  or (3) when MSU’s legal counsel has approved the release.  As permitted by law, MSU can release SSNs to an external entity when it is acting as MSU’s contractor or agent and has proper safeguards in place to prevent unauthorized release or discovery by third parties.

3. Oversight of Usage of SSN.  A university staff member or administrator will be named the social security officer and will oversee the security of the data within the MSU computer systems and will make day-to-day decisions to implement SSN usage policies.  Policy changes and interpretation of policy will be recommended by the University Committee on Security of Personal Information.  The committee will be appointed by the President and will have representation from units which have extensive usage of social security numbers and from other units as appropriate.  The University Auditor and a representative of MSU legal counsel will serve as advisors to the committee and as ex officio members.      

4. Access to SSN Information.  Only approved university employees, including approved student workers and approved graduate assistants, will have access to SSN data.  In order to be authorized to view and use electronic SSN data, approval must be obtained with copies of such authorization sent to the social security officer.   Justification should be included as to why an individual needs access to the data.  For access to paper copies of documents that contain social security information, each person requiring such access should have on record within the department or unit a signed statement of confidentiality.

5. Transmission of SSN in Electronic Data Files.  Social security numbers will be transmitted electronically off the campus system only through encrypted mechanisms, unless otherwise approved by the Committee on Security of Personal Information.

6. Retention and/or Disposal of Documents containing SSNs.  All essential documents containing SSNs, both paper and electronic, will be stored in a secure fashion.   Non-essential documents will be destroyed in a secure fashion.

7. Form Approval and Disclaimers.  All university forms and documents that ask an individual to provide his or her SSN must have prior approval of the University Committee on Security of Personal Information.  All forms must use disclaimer language substantially similar to the language below.

1. Applicants to MSU for Enrollment.   In the admissions and scholarship selection process, the social security number is used to assist in matching test scores and transcripts of the applicants.  The social security number is not a permanent student identifier, and it will not be required for student identification purposes.  You will be issued a permanent MSU ID number which will serve as your unique identifier on campus.  MSU will not disclose the social security number of any applicant to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

2.  Students.  The social security number is not a permanent student identifier, and it will not be required for student identification purposes.  Students receive a permanent MSU ID number which serves as their unique identifier on campus.  MSU must report names and social security numbers to the IRS for every tuition-paying student.  The Department of Student Financial Aid also has reporting requirements in which social security numbers must be supplied.   If any student receives compensation from the university because of employment or other reasons, federal law requires that we report to the IRS that compensation along with the recipients’ social security number.  MSU will not disclose the social security number of any student to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

3.  Employees.  Mississippi State University is required by federal law to report all compensation of employees, along with their name and social security number, to federal and state agencies, e.g. the IRS.  The social security number of an employee is not used as the primary identifier of the employee; a university-issued MSU ID number is used as the primary identifier for the employee.  MSU will not disclose the social security number of any employee to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

4. Others Associated with the University.  For individuals who are receiving any compensation, Mississippi State University is required by federal law to report the compensation, along with their name and social security number, to the IRS, and therefore such individuals are required to supply their SSNs.  The social security numbers of these other associated persons are not used as the primary identifiers in the MSU system; a university-issued MSU ID number is used as the primary identifier for these individuals.  MSU will not disclose the social security number of any individual to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

8. Compliance with Policy.  All MSU employees will abide by the provisions of this policy and will act to ensure the security of SSNs and other confidential information.  A violation of this policy will result in disciplinary action and could result in termination of employment.

RESPONSIBILITIES

For information about this policy, contact the reviewing department.