To:  Deans, Directors, and Department Heads

From:  Robert F. Pack, Privacy Officer

Date:  June 1, 2005

Subject: Use and Management of Social Security Numbers

The University of Pittsburgh is committed to limiting its use of Social Security numbers (SSNs) and maintaining the confidentiality of those numbers that it does collect.  To that end, the University has developed a comprehensive policy to control the collection, management, and display of SSNs, and to limit its use as an identification number.

Effective immediately, SSNs may only be requested when clearly justified, such as when required by low or for business purposes with certain third party providers.  The collection of SSNs must be accompanied by an appropriate disclosure of its use.  On-line and off-line computer systems that maintain SSN data must have adequate security as certified by CSSD to protect its confidentiality and integrity.  Please refer to the specific actions below to ensure compliance with this policy.

Collecting SSNs:  SSNs may be collected and recorded when needed by federal or state governmental agencies or by outside third parties.  The collection of SSNs by any University unit must receive prior approval from the University’s Privacy Officer.

Disclosure:  Units collecting SSNs must accompany the collection with a disclosure statement as to the purpose of the collection.

Maintaining SSNs:  All records containing SSNs, whether computerized or paper, should be considered confidential information and maintained with appropriate management processes and security controls to protect the confidentiality and integrity of the information.

Data Mining:  SSNs are considered to be confidential information and may not be used for purposes of data mining.

Displaying SSNs:  If it is essential that an individual SSN be displayed (e.g., University pay stubs), all but the last four digits of the SSN must be masked.

E-mailing SSN’:  SSNs may not be included in e-mails, either as direct text or in an attachment.

Transferring SSNs:  SSN data moved from one computer to another over a network interface must be transferred using encryption controls such as crypto routers and Secure FTP to protect its integrity and confidentiality.  Data transfer methods using clear text, such as ftp, or ASCII files, are inherently insecure network interfaces and may not be used.

SSNs on Workstation and Local Databases:  Local departmental databases or spreadsheets containing Sun’s that are available through local servers or PC’s are not permitted.

Third Parties:    Third parties to whom SSNs are provided by the University must enter in a contractual agreement with the University to ensure that appropriate controls are in place to prevent their unauthorized release.

The full policy will soon be available on the University’s policy Web site.  Please refer to it to ensure that your unit is in full compliance.

Thank you for your attention to this important effort to ensure the adequate protection and security of personal information.