Social Security Numbers

LAWFULLY OBTAINED Social Security Numbers (SSNs) may be exchanged within the University among its various departments and divisions where necessary for the receiving department/division to perform its governmental duties and responsibilities, or as otherwise allowed or required by law. Note: Student SSNs are considered “education records” under the Family Educational Rights and Privacy Act (FERPA), and may be disclosed within the University only to “school officials, including teachers, within the University, whom the University has determined have legitimate educational interests.” See University FERPA Policy at http://sa.uncg.edu/handbook/wp-content/uploads/ferpa.pdf.

University departments that receive SSNs must utilize security measures to protect the information, including those found in all applicable University policies and procedures. Proper physical security measures include, but are not limited to, limited access to SSNs, and locked filing cabinets and offices.

With regard to electronic security measures, SSNs are considered “Restricted Data” pursuant to the UNCG Data Classification Policy at https://policy.uncg.edu/university-policies/data/. Electronic storage and transmission of SSNs must be accomplished in compliance with the UNCG Information Security Policy at https://policy.uncg.edu/university-policies/information_security/. Unless required by law, a SSN shall not be transmitted over the Internet, except where the connection is secure or the SSN is encrypted.

SSNs may not appear on any materials that are mailed, unless state or federal law or regulations allow or require that the SSN appear on the document to be mailed. A SSN that is permitted to be mailed may not be printed, in whole or in part, on a postcard or other mailer not requiring an envelope, or visible on the envelope or without the envelope having been opened.

Pursuant to the Federal Privacy Act, UNCG shall not deny to any individual any right, benefit, or privilege provided by law because of such individual’s refusal to disclose his/her SSN, except refusal to disclose after a request pursuant to the requirements of a statute.

SSNs shall not be intentionally printed or imbedded on any card required for an individual to access University services. Unless the connection is secure or the SSN is encrypted, an individual shall not be required to transmit his/her SSN over the Internet. An individual shall not be required to use his/her SSN to access an Internet web site, unless a password or unique personal identification number or other authentication device is also required to access the Internet web site.

UNCG may disclose “LAWFULLY OBTAINED” SSNs to persons or entities outside the University when allowed or required by law. The examples below are not an exhaustive list, and the persons making disclosures should refer to the University policies, statutes and regulations that apply to their particular department or division. Counsel can be consulted if questions about disclosure remain.

UNCG may “LAWFULLY OBTAIN” SSNs from persons or entities outside the University when allowed or required by law. The examples below are not an exhaustive list, and the UNCG employees obtaining SSNs should refer to University Policies and the statutes and regulations that apply to their particular department or division. Counsel can be consulted if questions remain. After UNCG receives the SSNs from persons or entities outside the University, it shall observe the security measures set forth in the section Security Measures above.

Student SSNs maintained by UNCG are Education Records pursuant to FERPA. As such, student SSNs and may not be disclosed except as permitted by FERPA. Generally, express written permission from the student is required for disclosure of this information to a third party. See the University FERPA policy at http://sa.uncg.edu/handbook/wp-content/uploads/ferpa.pdf and contact University Counsel with questions.

SSNs are considered “protected health information” (PHI) under privacy rules of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). As such, the use and disclosure of SSNs are subject to other restrictions under those rules and the UNCG policies that govern the use and disclosure of SSNs. Please contact the UNCG HIPAA Privacy Officer and the University HIPAA Policy at https://policy.uncg.edu/university-policies/HIPAA/ with any questions related to the proper use and disclosure of SSNs under the HIPAA Privacy rules.