Policy No. 4:01:05:00

CLEVELAND STATE COMMUNITY COLLEGE Cleveland, Tennessee

SUBJECT: Protection of Sensitive Data and Deterrence of Identity Theft

Reference:   TBR Policy 4:01:05:60 Subject: Identity Theft Prevention Policy;
TBR Policy 1:08:00:00 Subject: Information Technology Resources
         

  1. Purpose
    The purpose is to define "sensitive data" and establish guidelines and procedures for protecting sensitive data, deterring identity theft, and supporting compliance with state and federal laws and TBR policy. This supplements federal and state laws and TBR polices. 
  2. Definition
    Sensitive college data includes, but is not limited to:  Personal Identifiable Information (PII): such as social security numbers, credit card numbers, bank and other financial institution account numbers, health insurance plan identification numbers, driver’s license numbers, dates of birth, and other similar information associated with an individual student or employee which can potentially be used to uniquely identify an individual and that if misused, might enable assumption of that individual's identity ("identity theft") to compromise an individual’s personal or financial security.
  3. Name Change
    Name change requests are done in either the Human Resources (HR) Office for employees or Records Office for students.  No change of name request will be accepted by phone. No name change shall be permitted by individuals through computerized self-help options.  Requests will require documentation of identity to allow the name change request to be processed.  Either a state issued driver’s license, a valid United States passport, marriage license, social security card, or court document may serve as documentation of identity.  The provided document must be reviewed by college staff to confirm that it shows the new name.
  4. Address Change
    To assure that no person may change another person’s address the following guidelines shall to be adhered to as is reasonable.  It is the responsibility of the employee or student to update current address information in a timely manner.  Address change requests are done in either the Human Resources (HR) Office for employees or the Records Office for students.  Except for determining state of residency, proof of new address is not required.  No address change shall be permitted by individuals through computerized self-help options.  No address change shall be processed by phone.  Documents accepted to identify the student are a state issued driver’s license, a valid United States passport, or other government issued photo identification.
    1. The HR staff may use their discretion on accepting address change requests as many employees are known to the HR staff.  If judged necessary, the HR office may require documentation of employee identity to process an address change request.  
    2. The Records office shall process address change requests for students by form with reasonable effort to verify identity.  Address change requests by students are not permitted by phone.
  5. Credit Card Data
    Credit card data shall not be recorded or stored on college documents or electronic files upon college equipment.  Credit card processing will be performed by contracted service providers on behalf of the college.  Those contracted to provide such service must meet with credit card processing compliancy requirements. World Wide Web (WWW) transactions using credit card information are performed on offsite web site servers and storage devices whether for college purchases or student payment of fees.  No credit card information is permitted to be stored on college managed computer systems.
  6. College ID Card
    The college must verify the student’s identity at the time of issuance of the student identification card through review of driver’s license or other government-issued photo identification.  Reference TBR Policy 04:01:05:60 section 5.

Internal Review & Approval:  President’s Cabinet, June 6, 2011

Implemented / Revised:  June 10, 2011