Employees

1. Supervisors must limit access to records containing SSNs to only those employees who need to use the numbers for the performance of their duties as University employees.
2. Supervisors of temporary employees must limit the level of access that those employees have to SSNs and must provide appropriate training regarding the sensitivity of SSNs to those temporary employees who are required to have access to SSNs.
3. All persons who have access to HRS, SIS, FRS or other electronic systems containing SSNs are required to sign a Confidentiality Agreement (see attached). Those departments and units that have access to HRS, SIS, FRS or other electronic systems containing SSNs are subject to internal audit.

1. Any forms that require a personal identifier must label that field as such and not as “social security number.” Exempt are forms on which the SSN must be used under applicable federal or state law.
2. SSNs may not be displayed on materials or documents that are widely seen by others, such as identification cards, badges, time cards, employee rosters, bulletin board postings, grade postings, web sites, and other materials.
3. Documents that include SSNs must be stored in a secure place. When possible, records containing SSNs, including back-ups, should be protected during storage by encrypting the numbers in electronic records or storing records in other media in locked cabinets.
4. When possible, printed reports and other documents should not list SSNs; if SSNs need to be included in printed documents, such documents should be accessible only to individuals that require the information for the performance of their duties.
5. Printed documents that contain SSNs must be securely destroyed when they are no longer needed, or upon the expiration of their retention based on the applicable University records retention schedule.

1. Electronic records containing SSNs may be stored only on University-owned electronic devices, and such devices must be secured against unauthorized access. Computer systems requiring the storage of SSNs should store them in a separate – if possible encrypted and password protected – data file.
2. Persons with access to HRS, SIS, FRS, or other electronic systems containing SSNs must take reasonable care to minimize the time that computer screens display SSNs and to shield computer screens displaying SSNs from those without a legitimate work-related reason to access the SSNs. Computer screens displaying SSNs should never be left unattended.
3. Information containing SSNs, or any part thereof (e.g., the last four digits of the SSN), may not be published on any University web site.
4. Employees may not share passwords to computer systems that provide access to screens displaying SSNs.
5. No University employee may require individuals to use SSNs as passwords or codes for access to Internet web sites or other services.
6. When computers are sent to surplus or transferred to another department, data containing SSNs must be destroyed (see Policy Statement #44, “Surplus Property Procedures,” and/or the ITS Procedures for Transferring a Computer to Another Person).
7. Users who borrow a University laptop computer for temporary use should ensure that any confidential information, including SSNs, that they may have stored on the computer’s hard drive in the course of such temporary use is removed before returning the computer to the University.

1. No University employee may require individuals to send their SSNs over the Internet or by email for a University-related purpose, unless the connection is secure or the SSN is encrypted.
2. Printed documents containing SSNs should not be sent through the mail, except on applications or on forms when required by law. When sending applications or documents required by law to include SSNs through the mail, the SSN should not be revealed by an envelope window. Where possible, the SSN field on forms or applications should be left blank, and the individual filling out the form should insert the SSN before returning the form or application to the University.

1. Protect the confidentiality of the SSNs and prohibit the third parties from re-disclosing SSNs, except as required by law;
2. Require such third parties to use effective security controls on record systems containing SSNs;
3. Hold such third parties accountable for compliance with the terms imposed, including monitoring or auditing their practices; and
4. Indemnify the University against any claims related to the third party’s disclosure of the SSNs in violation of the terms of the agreement.

• Policy Statement #66, Responsible Use of University Computing and Electronic Communication Resources (http://www.legal.uncc.edu/policies/ps-66.html),
• Policy Statement #10, Network Security (http://www.legal.uncc.edu/policies/ps-10.html),
• Policy Statement #69, Student Records (http://www.legal.uncc.edu/policies/ps-69.html),
• Policy Statement #59, Personnel Records (http://www.legal.uncc.edu/policies/ps-59.html),
• Policy Statement #44, Surplus Property Procedures (http://www.legal.uncc.edu/policies/ps-44.html),
• Policy Statement #37, Retention, Disposition, and Security of University Records (http://www.legal.uncc.edu/policies/ps-37.html) , and
• Policy Statement #102, Data and Information Security (http://www.legal.uncc.edu/policies/ps-102.html).

1. I will maintain my personal Records System password in confidence. I will not disclose it to any other person or authorize others to use it.
2. I will use my authorized access to Records System information only in the performance of the responsibilities of my position as a University employee.
3. I will comply with all controls established by the division of Business Affairs and Information Technology Services for the use of records maintained within a Records System.
4. I will avoid disclosure of Confidential Information to unauthorized persons without the appropriate consent or permission or except as permitted under applicable University policy and/or Federal or State law. I understand and agree that my obligation to avoid such disclosure will continue even after I leave the employment of UNC Charlotte.
5. I will exercise care to protect sensitive information against accidental or unauthorized access, modifications, disclosures, or destruction.
6. When discussing Confidential Information with other employees in the course of my work, I will exercise care to keep the conversation private and not overheard by others who are not authorized to have access to such Confidential Information.
7. I understand that any violation of this Agreement or University Policy Statement #102, “Data and Information Security,” will result in immediate termination of my access to Records Systems and may result in disciplinary action, including dismissal from employment, as well as criminal penalties or civil liability.

SMC – Banner
ITS
Atkins Library