Sent: 2012-04-18
From: Training & Development
To: Employees
Subject: Identity Protection Act Awareness
Greetings,
As an EIU employee you may work directly with or indirectly view Social Security Numbers (SSN) as part of your daily tasks.
The information below pertains directly to the Identity Protection Act (5 ILCS 179) regarding Social Security Numbers and required information you must know as an employee at Eastern Illinois University.
Education on the Identity Protection Act (5 ILCS 179) is very important as Social security numbers are confidential and every attempt is being made by the State of Illinois and Eastern Illinois University to protect that information.
Please review the Act in its entirety.
The (5 ILCS 179) Identity Protection Act Summary:
The State of Illinois has passed the (5 ILCS 179) Identity Protection Act to assure the limitation, security, and protection of SSN used at State and Local government entities. The act focuses on 3 major aspects that are prohibited beginning July 1, 2010 unless required to do so by law:
*Restricts the use of Social Security Numbers at public institutions and agencies.
*Requires security and protection of allowed Social Security Number use.
*Allows the public to know exactly how Social Security Numbers are used.
Among many of the restrictions are the following that are prohibited:
*Publically post or display in any manner an individual's SSN.
*Print an individual's SSN on any card required for the individual to access products or services.
*Require an individual to transmit his/her SSN over the internet, unless where the connection is secure or the SSN is encrypted.
*Print an individual's SSN on any materials that are mailed to the individual, through the U.S. Postal Service, and private mail service, electronic mail, or any similar method of delivery, unless State or Federal law requires the SSN to be on the document to be mailed.
With Respect to Social Security Numbers, don't:
*Collect, use or disclose SSNs unless required by federal or state law or business imperative.
*Collect, use or disclose SSNs unless authorized by the University.
*Collect, use or disclose SSNs in a way other than authorized.
*Publicly post or display SSNs.
*Print SSNs on an identification card.
*Transmit SSNs electronically, including via email, websites, electronic forms or over the Internet unless encrypted.
*Send SSNs through the postal mail, campus mail or via private mail service unless required by State or federal law.
*Require SSNs to allow access to a website.
*Store documents, physical or electronic, containing SSNs longer than necessary.
With respect to Social Security numbers, do:
*Collect, use or disclose SSNs only in the authorized manner.
*Disclose the purpose of the collection, use or disclosure of SSNs when asked.
*Encrypt any SSN sent over the Internet or email.
*Use a fully sealed envelope that hides the SSN from view when sending SSNs through postal mail, campus mail or via private mail service.
*Keep documents with SSNs in cabinets/areas that are locked at all times.
*Document the purpose and need for the collection, use or disclosure of SSNs.
*Identify each person within your area that will need to collect, use or disclose SSNs.
*Remove SSNs from all paper and electronic documents that do not require this information.
*Use Eastern Illinois University's E-number for all forms and other internal needs unless SSN use is allowed and listed on Stated Purpose list.
*Secure all documents in a locked location when not in use.
*Keep all electronic data in a protected file system.
All employees have the responsibility of ensuring the protection of SSN at EIU whether you work directly or indirectly with the SSN.
It is your responsibility to report any misuse of the handling of the SSN to General Counsel, 217-581-7249. The misuse may be purely unintentional but if we all work together we can stop any breaches of security from happening at EIU. The person who owns the social security number is counting on your cooperation.
According to the Act, Sec. 45, any person who intentionally violates the prohibitions in Section 10 of this Act is guilty of a Class B misdemeanor. However, many breaches of security are not intentional and can occur due to lack of education and misunderstanding.
Annual awareness is required by the Act for all employees. Additional computer based training is required for employees identified by the University who collect, use or disclose SSN in an authorized manner. Those identified will be notified to take the additional training.
Further information:
IGP 133.2 http://castle.eiu.edu/auditing/IGP/policy133.2.html
Identity Protection Act http://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3174&ChapterID=2&Print=True
SSN Stated Purpose List: http://www.eiu.edu/ipa/Stated_Purpose.php
For information regarding the Identity Protection Act, please contact:
General Counsel
217-581-7249
2102 Blair Hall
