1.13 Identity Protection

Policy

Social Security numbers are confidential and protected by state and federal law, including the Family Educational Rights and Privacy Act (26 USC §1232g), the Privacy Act of 1974 (5 USC §552a) and the Illinois Identity Protection Act.  The Social Security number will be collected by Illinois State University only when required by law.  Except when required by law, individuals will not be asked to provide their social security number, verbally or in writing, at any point of service, nor will they be denied access to those services should they refuse to provide a social security number.  However, individuals may volunteer their social security number if they wish as an alternate means of locating a record.  The social security number will not be disclosed to individuals or agencies outside the University except as allowed or required by state or federal law, rules or regulations, or with permission from the individual. 

The Social Security number will be requested from all students, in order to comply with the requirement of the Internal Revenue Service to supply them with the name, address, and social security number of every tuition-paying student.  (The IRS relies on these lists to certify education related tax credits.)  In addition, the University is required to have a valid social security number before an individual can be entered into any business system involving financial transactions.  Thus, without a social security number, the University cannot grant an assistantship, waiver, or provide employment.  Providing a social security number is the safest way to ensure that these services are available with the least delay.

The University is required by federal law to report income along with social security numbers for all employees to whom compensation is paid.  Therefore, each University employee,  with specific exceptions as required by law, will be required to supply the University with a social security number for payroll, reporting and benefits purposes. 

Individuals who are affiliates or vendors will be required to provide a Social Security number or Tax Identification Number for mandated tax reporting purposes.

The Social Security number will not be used as the student ID, employee ID or process or record key in any university systems.

University systems and documents that require Social Security numbers will be maintained at help.illinoisstate.edu/informationsecurity. Requests for new processes requiring access to Social Security numbers should be directed to Administrative Information Systems, Data Administration (438-3611).

If the collection of Social Security Numbers is required, a statement must first be provided to the individual explaining the purpose or purposes for which the University is collecting and using the social security number, and whether the request is voluntary or mandatory.

All records containing Social Security numbers, whether on- or off-line, in electronic or physical format, are considered confidential information and will be maintained appropriately.  Any documents containing social security numbers must be redacted if required to be released as part of a public records request.  Therefore, any social security numbers requested from an individual should be placed on the document in a manner that makes it easily redacted.  If and when these records are no longer needed, disposal of the records must be handled in a secure fashion and follow the University Record Retention Policy (7.1.55).

Only University employees required to use or handle information or documents containing social security numbers will have access to such information or documents.  Those employees will be trained on the proper procedures for handling information containing social security numbers from the time of collection through the destruction of the information, in order to protect the confidentiality of social security numbers. 

Pursuant to state law, social security numbers MAY NOT:

• Be publicly posted or displayed in any manner
• Be printed on any card required for the individual to access products or services provided by the University
• Be required to be transmitted over the Internet, unless the connection is secure or the social security number is encrypted
• Be printed on any materials that are mailed, e-mailed or otherwise delivered to the individual, unless State or federal law requires the social security number to be on the document.  EXCEPTION:  Social security numbers may be included in applications and forms sent by mail, including, but not limited to, any material mailed in connection with documents sent as part of an application or enrollment process or to establish, amend, or terminate an account, contract, or policy or to confirm the accuracy of the social security number.  However, no social security number may be printed on a postcard or other mailer that does not require an envelope or is visible on an envelope without the envelope having been opened.
• Be used for any purpose other than the purpose for which it was collected
• Be required for an individual to access any University Internet website

This policy does not preclude University employees from using a social security number as needed to perform their duties and responsibilities or for internal verification or administrative purposes.

An employee or student who has substantially breached the confidentiality of social security numbers may be subject to disciplinary action or sanctions up to and including discharge or dismissal in accordance with University policies and procedures.