You are not a custodian of Social Security Numbers if your only involvement with other people’s SSNs is when you …
… are a user of computer systems whose access controls are administered by others;
… are a user of paper files or microfiche that are returned at the end of the workday to a secure storage area whose access controls are administered by others.
You might be a custodian of SSNs if …
… you have copies of
- performance evaluations,
- job applications and resumes,
- personnel action forms,
- enrollment applications and transcripts,
- FRS reports (e.g. cum salary),
- travel & conference expense reports,
- Requests for Payment,
- research databases,
- extracts from clinical systems,
- curricula vitae (CVs),
- financial aid applications,
- grant proposals, and
- similar documents created at a time when SSN was routinely used as a primary identifier
… you are the administrator of a computer
- software application that controls access to data that include SSN;
- file server directory (e.g. “file share”) that includes files or databases containing SSN;
- SharePoint site that includes files or lists containing SSN;
… you are the administrator of a department or unit or off-campus medical practice that
- tracks performance ratings, salary programs, credentials for teacher certification, etc., in computer files stored on a departmental computer or on a file server at a University data center;
- oversees student admissions and/or financial aid processes;
- keeps paper-based personnel files, including forms such as I-9 and W-9, on your faculty, staff, student employees, and contractors;
- keeps paper-based patient files;
… you are the investigator or coordinator of a research project that
- receives a data extract containing SSN from another computer system;
- verifies the identity of subjects by SSN;
- pays stipends to participants;
- hosts data for a multi-site study;
… you are the sponsor or manager of a University contract under which
- an outside party collects or maintains records that contain SSN;
… you retain any printed report containing SSN.
Custodian Duties