Policy No: 2019 Responsible Office: Information Security Last Review Date: 02/09/2022 Next Required Review: 02/09/2027

Social Security Number (SSN) Protection

---

1. Purpose

The University of South Alabama (USA) collects social security numbers (SSNs) in the process of performing activities for the expressed purpose of supporting the University's mission. An individual's SSN is private and confidential, and every effort must be made to prohibit disclosure and/or improper usage. The purpose of this policy is to limit access to SSNs stored in USA’s files and databases to persons who require them in order to perform their jobs.

2. Applicability

This policy applies to all University divisions (except for USA Health) as well as all persons with access to any official University records.

3. Definitions

Social Security Number (SSN): A number that is given to each citizen of the U.S. by the government and that is used for the Social Security program and for official forms and records.

4. Policy Guidelines

4.1  Replacement of SSN's with Jag#'s Going Forward

The SSN shall not be requested on forms (electronic or paper) except as administered by those offices whose responsibilities require them to obtain SSNs for essential business purposes, including interaction with external agencies for which the SSN is the primary identifier. No reference to a SSN will be on any forms when such forms can use the USA assigned identification number (Jag #). Once a person has a USA assigned Jag #, that number will be used as the unique identifier for internal records and among USA information systems.

4.2  Elimination of Current/Past Use of SSN's Where Possible

Active measures will be taken to identify and secure, remove and/or destroy documents that contain SSNs. If records cannot be destroyed in compliance with The Records Disposition Authority Policy then, when possible, the SSNs will be masked. All University systems/servers hosting files which contain SSNs must be maintained and operated by the Computer Services Center (CSC).

4.3  Department Responsibility

Each department will assign a Data Custodian who will assist and determine the electronic files/records to be destroyed that contain SSNs. If the file cannot be destroyed, then arrangements must be made to move the file to a CSC file server. Storage of physical documents that contain SSNs must be kept in a locked cabinet when not in use or be under the control of the employee. When possible, forms and documents that are being scanned for permanent storage will have the SSN masked prior to scanning, and will not be indexed by SSN (this excludes records of students who attended USA prior to conversion to the Banner Student System. SSNs are the only unique student identifiers for these records and must be used).

4.4  Access to Older / Archived Records Containing SSN's

Access to screens or forms containing SSNs will be restricted to those individuals with an official need to access the SSNs. Electronic files containing SSNs shall not be stored on desktops, laptops, departmental servers, cloud services, portable media devices, or stored in email without explicit written permission from the Director of Information Security. The files containing SSNs approved for local storage must be encrypted; all unapproved files must be deleted.

4.5  SSN Breach Response

Any accidental disclosure or suspected misuse of SSNs must be reported immediately to the Director of Information Security, infosec@southalabama.edu, or at 460-6161.

4.6  Exceptions

4.6.1  Electronic records created when the SSN was the official University identifier and that have not been converted to non-SSN indexed ID, may continue to be indexed by SSN, but access to these records must be approved by the Director Information Security. Such access shall be restricted to those individuals with an official need to access the record.

4.6.2  Research projects, grant work, and contract work must follow the IRB, state, federal, and/or client laws or guidelines governing that work.

5. Procedures

Not Applicable.

6. Enforcement

Deliberate violation of this policy is subject to disciplinary action including the individual's use of information technology resources (such as suspension or termination of access, or removal of online material); the individual's employment (up to and including immediate termination of employment in accordance with applicable University policy); the individual's studies within the University (such as student discipline in accordance with applicable University policy); civil or criminal liability; or any combination of these, up to and including dismissal.

7. Related Documents

Not Applicable.