Policy and Procedure

Table of Contents | Index | Internal Audit Web

OPERATING POLICY AND PROCEDURES

Purpose

The purpose of this Operating Policy is to promote an understanding of the procedure to ensure the privacy and proper handling of social security number and other personal information of students, prospective students, faculty, staff, alumni, and other persons officially associated with Mississippi State University.

Background. Mississippi State University (MSU) is committed to protecting personal information and to deterring identity theft of its students, faculty, staff, alumni, and others with whom it has an official association. In the normal practice of conducting university business, MSU collects and maintains confidential information related to its students, employees, alumni, and other individuals associated with MSU. The university is committed to protecting personal and confidential information and properly handling and maintaining such data.

Policy

MSU is required to collect social security numbers (SSNs) from all employees of the university, all tuition-paying students, students receiving financial aid, and other individuals for which state and federal law require the reporting of SSNs. If there is no legal requirement to collect a SSN from a particular individual, MSU will not require such an individual to provide their SSN and will not deny any service as a consequence. MSU will not disclose the social security number of any individual to anyone outside the Mississippi Institutions of Higher Learning (IHL) system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

Procedure

1.  MSU Identifier. MSU issues a unique, nine-digit number (the MSU ID number) to every student, employee, alumnus, and other person within MSU computerized record systems, and this is the primary identifier for persons in those systems.

2.  Collection of SSN. MSU will continue to collect SSNs as permitted by law for official use within the Mississippi IHL system. Social security numbers will be released to entities outside the Mississippi IHL system only: (1) as allowed by law; or (2) when permission is granted by the individual; or (3) when MSU’s legal counsel has approved the release. As permitted by law, MSU can release SSNs to an external entity when it is acting as MSU’s contractor or agent and has proper safeguards in place to prevent unauthorized release or discovery by third parties.

3.  Oversight of SSN Usage. The Information Security Committee is charged with oversight and coordination of the university’s Information Security Program. It reviews significant security incidents, including those involving SSNs, and recommends appropriate action and remediation.

4.  Approvals for SSN Information. Only approved systems will contain SSN data. Likewise, only approved university employees, including approved student workers and approved graduate assistants, will have access to SSN data. Approval must be obtained from the Information Security Committee. Forms for requesting approval are maintained on the Information Security website. Each university employee, student worker, and graduate assistant approved for access to SSN data must have on record within the department or unit a signed Employee SSN Confidentiality Statement.

5.  Transmission of SSN in Electronic Data Files. Social security numbers will be transmitted electronically off the campus system only through encrypted mechanisms, unless otherwise approved by the Information Security Committee.

6.  Retention and/or Disposal of Documents containing SSNs. All essential documents containing SSNs, both paper and electronic, will be stored in a secure fashion. Non-essential documents will be destroyed in a secure fashion.

7.  Form Approval and Disclosures. All university forms and documents that ask an individual to provide his or her SSN must have prior approval of the University Information Security Committee. All forms must use disclosure language substantially similar to the language below.

a.  Applicants to MSU for Enrollment. In the admissions and scholarship selection process, the social security number is used to assist in matching test scores and transcripts of the applicants. The social security number is not the primary student identifier, and it will not be required for student identification purposes. Applicants will be issued a permanent MSU ID number which will serve as their unique identifier on campus. MSU will not disclose the social security number of any applicant to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

b.  Students. The social security number is not the primary student identifier, and it will not be required for student identification purposes. Students receive a permanent MSU ID number which serves as their unique identifier on campus. MSU must report names and social security numbers to the IRS for every tuition-paying student. The Department of Student Financial Aid also has reporting requirements in which social security numbers must be supplied. If any student receives compensation from the university because of employment or other reasons, federal law requires that we report to the IRS that compensation along with the recipients’ social security number. MSU will not disclose the social security number of any student to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

c.  Employees. Mississippi State University is required by federal law to report all compensation of employees, along with their name and social security number, to federal and state agencies, e.g. the IRS. The social security number of an employee is not used as the primary identifier of the employee; a university-issued MSU ID number is used as the primary identifier for the employee. MSU will not disclose the social security number of any employee to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

d.  Others Associated with the University. For individuals who are receiving any compensation, Mississippi State University is required by federal law to report the compensation, along with their name and social security number, to the IRS, and therefore such individuals are required to supply their SSNs. The social security numbers of these other associated persons are not used as the primary identifiers in the MSU system; a university-issued MSU ID number is used as the primary identifier for these individuals. MSU will not disclose the social security number of any individual to anyone outside the Mississippi IHL system except as allowed by law or with permission from the individual or as approved by MSU legal counsel.

8.  Compliance with Policy. All MSU employees will abide by the provisions of this policy and will act to ensure the security of SSNs and other confidential information. A violation of this policy will result in disciplinary action and could result in termination of employment.

Related Policies. The following are MSU policies which have relevance and application to social security number usage:

• OP 01.10 Information Security Policy

• OP 01.12 Use of Information Technology Resources

• OP 01.25 Privacy of Electronic Information

Review

This OP will be reviewed by the Provost and Executive Vice President at least every four years.

For information about this policy, contact the responsible/reviewing department hyperlinked above.