3339-3-22. Confidential information policy

Miami university collects, stores, and distributes large amounts of information essential to the performance of university business. This information represents a valuable university asset. Although a large portion of university information is public, a portion of our information is protected by state and federal laws. To comply with these laws and protect the university community, the university has the right and obligation to protect, manage, secure, and control information (whether in hard copy or stored as electronic data) in its possession.

Information protected by federal or state law may not be shared with unauthorized persons or posted online at a site that can be accessed by unauthorized persons. These laws include the federal privacy act which protects social security numbers, the family educational rights and privacy act which protects personally identifiable student records, the gramm-leach-bliley act which protects consumer financial information, and the health insurance portability and accountability act which protects personal health information. All employees, faculty and staff, bear responsibility for protecting confidential information from unauthorized disclosure. This is true whether this information is stored on paper, a network computer, on a laptop, on a personal digital assistant or other device.

Information that is protected by law may only be disclosed to authorized persons.

Examples of confidential information include: social security numbers, disability status, health and medical information, student advising records, student grades, student disciplinary records, consumer financial information, banner student identification numbers, trade secrets, credit and debit card numbers, and coursework produced by students.

Social security numbers are used primarily for student financial assistance and employment tax-related matters. If unique identification of an individual is required, an identifier other than a social security number should be used. The recommended identifier to use is the banner plus number. An appropriate security plan and the written consent of the information security officer is required before any university office is permitted to collect and/or maintain social security numbers.

Each faculty and staff member must assume responsibility for protecting confidential information from unauthorized exposure. This means you must do the following:

(A) Understand and follow Miami's responsible use of computing resources policy

(B) Consult the information security office if you are uncertain whether certain information is confidential

(C) Consult the information security office if you are uncertain how to safeguard confidential information

(D) Understand and follow the Miami university computing security policy

(E) Protect your computer password and change it according to standards published by the information security office in the it services knowledge base at http://ithelp.muohio.edu

(F) Not provide access to confidential information to any other person unless authorized to do so

Ohio law requires the university to take certain actions in the event of unauthorized disclosure of confidential information. You must report any suspected disclosure of confidential information to unauthorized persons to the information security officer (call 529- 9252 immediately and report that you suspect that confidential information has been disclosed). In addition to reporting the theft of any laptop, personal digital assistant or other device that contains confidential information to the appropriate law enforcement authorities, you must immediately report the loss/theft of any laptop, personal digital assistant or other device that contains confidential information to the information security office.

Effective: 10/17/2019
Promulgated Under: 111.15
Statutory Authority: 3339.1
Rule Amplifies: 3339-3-22
Prior Effective Dates: 10/17/2007, 11/14/2009, 11/05/2015