Related Information |
Information Privacy and Security
What information is protected? In general, protected data is non-public information about an individual, either student or employee. Examples include, but are not limited to, Social Security number, employee/student ID, private employee/student health information, passwords and PINs, student attendance and grade information, financial information, and financial aid information. To request further training on information privacy and security, contact Staff and Organizational Development, 913-469-8500, ext. 4437. Click here for the board policy: FERPA Family Educational Rights and Privacy Act (FERPA) The Family Educational Rights and Privacy Act (FERPA) of 1974, as amended, affords students certain rights with respect to their educational records. These rights include: 1. The right to inspect and review the student’s education records within 45 days of the day the college receives a written request for access. A student should submit to the registrar a written request that identifies the record(s) the student wishes to inspect. The registrar will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the registrar, the student shall be advised of the correct official to whom the request should be addressed. 2. The right to request the amendment of the student’s education records that the student believes are inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA. A student who wishes to ask the college to amend a record should write the college official responsible for the record, clearly identify the part of the record the student wants changed, and specify why it should be changed. If the college decides not to amend the record as requested, the college will notify the student in writing of the decision and the student’s right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing. 3. The right to provide written consent before the college discloses personally identifiable information from the student’s education records, except to the extent that FERPA authorizes disclosure without consent. The college discloses education records without a student’s prior written consent under the FERPA exception for disclosure to school officials with legitimate educational interests. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the college. A school official is:
Upon request, the college may also disclose education records without consent or notification to officials of another school in which a student seeks or intends to enroll. Items defined by the college as “directory information” may be released without a student’s written consent unless the student has provided written notification to the college that such information should not be released. The college designates the following to be directory information:
Students who wish to prevent disclosure of directory information must submit a Confidentiality Form to the Add/Drop desk in the Success Center (2nd floor Student Center). 4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the college to comply with the requirements of FERPA. The name and address of the office that administers FERPA is: Family Policy Compliance Office Gramm-Leach-Bliley Act The regulations under 16 CFR Part 314, published in May 2002 (May 23 Federal Register, p. 346484), stem from the Gramm-Leach-Bliley Act (the GLB Act or the Act) which was enacted in 2000 to repeal Depression-era restrictions prohibiting banks from engaging in “risky” financial practices under the Glass-Steagall Act. The law mandates extensive new privacy protections for consumers. The GLB Act requires financial institutions to take steps to ensure the security and confidentiality of customer records, such as names, addresses, phone numbers, bank and credit card account numbers, income and credit card account numbers, income and credit histories, and Social Security numbers. Colleges and universities are deemed to be in compliance with the privacy provisions of the GLB Act if they are in compliance with the Family Educational Rights and Privacy Act (FERPA). However, higher education institutions are subject to the provisions of the Act related to the administrative, technical and physical safeguarding of customer information.* How does GLB differ from FERPA? Both the GLB Act and FERPA have specific requirements regarding privacy of customer financial information. The difference however, is that the GLB Act has requirements pertaining to the actual administrative, technical and physical safeguarding of the customer financial information. *Colleges and Universities Subject to New FTC Rules Safeguarding Customer Information. NACUBO Advisory Report 2003-01, January 13, 2003. If you have questions about GLB, contact Susan Rider, manager, Business Office Services/Bursar, 913-469-8500, ext. 2439, srider@jccc.edu. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was enacted to improve the efficiency and effectiveness of the health care system. HIPAA protects individually identifiable health information (IIHI). All members of the JCCC workforce, including regular employees, temporary employees, volunteers, contractors or agents of JCCC who have access to IIHI are covered by HIPAA. IIHI encompasses virtually all health information that JCCC acquires in its capacity as an employer, if the information can somehow be linked to an individual. This includes information related to health benefits, such as benefit enrollment data, claims and attachments, explanations of benefits, medical records, treatment summaries, return to work releases and any medical notes. It also includes health information related to FMLA, ADA, workers’ compensation, disability claims and sick leave requests. Generally, IIHI is information, including demographic information collected from an individual, that:
Any employee medical information (such as return to work releases, physician restrictions and detailed sick leave reports that identify specific illnesses/injuries) that a department may have in its files should have been sent to the office of Human Resources for protection. This includes copies of original information a department may have already sent to Human Resources. That office will be solely responsible for the security and storage of this medical information (IIHI). Report of absence (ROA) forms for sick leave that only provide the number of hours sick can still be maintained within the department. However, if an employee had provided detailed reasons as to why he or she was sick (i.e., back surgery, diabetes, acute or chronic illness, etc.), the information should be sent directly to Human Resources as it may be considered PHI. Timecards or ROA forms submitted by an employee should not contain any specific medical information. Employees should now deliver any relevant medical information directly to the office of Human Resources. Employees will need to sign specific release forms in order for medical information to be disclosed. These forms are maintained in the office of Human Resources. Any IHII maintained within the department must be accompanied by a signed “Authorization for Release of Protected Health Information” form that has been approved by a designated HIPAA privacy official. A list of JCCC’s HIPAA privacy officials is maintained by Human Resources. If you have questions about HIPAA, contact Becky Centlivre-Meinke, Human Resource Director, 913-469-8500, ext. 3267, bcentliv@jccc.edu. Privacy Private information should be shared only with individuals who are required to have the information in order to fulfill their job responsibilities, i.e., on a need-to-know basis. Beyond that, you also have an obligation to protect the data. General tips for protecting data:
If you suspect private information is compromised, immediately contact your supervisor to determine the appropriate parties to notify. The following contacts may be helpful:
Today’s desktop workstations must be configured and used in a secure manner for two reasons. First, it is likely that some information housed on that computer is of a sensitive, confidential or proprietary nature. Therefore, only authorized individuals should have access to it. Liability may be incurred if information is not protected using generally accepted protection methods (“due diligence”) and that information is improperly disclosed. Second, the integrity of the system (operating system, application programs and data files) is critical. Applications must operate as expected, when expected, and the data they use must be complete and correct. The following guidelines will maximize the security of your workstation:
For more information on protecting against SPAM, pop-up ads, viruses, worms, browser highjacking, adware, spyware and phishing, please click on the link below. You will need Adobe Reader to open the file. Protecting Yourself and Your Computer Passwords Individuals are responsible for all activity occurring as a result of the use of their username and password on any system. A user account that becomes compromised could affect the user’s privacy and the privacy of other users. The use of a single username and password by multiple individuals is prohibited. Passwords should be treated as confidential information. Individuals should not give their password to another person, including IT staff, administrators, superiors, co-workers, friends or family members, under any circumstances. Do not use the “Remember my password” feature on Web sites or applications. Passwords should not be transmitted electronically over an unencrypted network or via e-mail. Passwords should not be kept in an unsecured written format, either on paper or electronically. If passwords must be kept in written format, they should be stored in a controlled access location. Hardcopy lists of passwords should be stored in a combination safe or other controlled access location. Electronic lists of passwords should be stored in an encrypted file. The following is a list of common password problems. You should avoid these types of passwords:
Here are a few guidelines for creating a secure password. Be creative! Try to choose a pattern that has meaning for you, but that no one else can guess.
Following are specific directions for changing passwords: Network Domain:
Banner:
Campus Pipeline:
If you need assistance with computer and password questions, contact the Computer Help Desk, ext. 3980. Generated IDs Each college employee has a JCCC-generated ID for his or her own protection. Read this excerpt from the Federal Trade Commission on identity theft: http://www.consumer.gov/idtheft/. By using the JCCC ID on forms instead of your Social Security number (SSN), you minimize the chance of your SSN being compromised. Examples of forms where the JCCC ID is appropriate are:
Many of these forms have been edited to reflect the change to the JCCC ID number. However, many departments are using up old stock. In these cases, you can substitute your JCCC ID in the space marked SSN. Some situations still do require a SSN, such as certain payroll or human resources forms. When in doubt, consult the recipient of the form for direction. A word of caution: If copies of any forms containing SSNs are still being stored in your department, they must be stored responsibly. In some cases they don’t need to be kept at all; always consult your departmental records retention policy. In those cases where the documents are to be discarded, even if the form itself isn’t of a confidential nature, the SSN is. Any documents containing SSNs should be securely shredded. Finally, if you don’t remember your JCCC ID, click on the "What’s my User Name or JCCC ID?" link in the upper right-hand corner of the college home page, then click the "Look up JCCC ID" link located in the pop-up window. "How can someone steal your identity? Identity theft occurs when someone uses your personal information such as your name, Social Security number, credit card number or other identifying information, without your permission to commit fraud or other crimes. "Identity theft is a serious crime. People whose identities have been stolen can spend months or years - and their hard-earned money - cleaning up the mess thieves have made of their good name and credit record. In the meantime, victims may lose job opportunities, be refused loans, education, housing or cars, or even get arrested for crimes they didn't commit." Changing Passwords Choosing a Secure Password Password Protection Sharing of User Names and Passwords General Computer Security Privacy HIPAA The GLB Act |
