Source: http://policies.unc.edu/policies/breach-protocol/
Timestamp: 2017-02-22 06:10:03
Document Index: 146447149

Matched Legal Cases: ['§ 75', '§ 132', '§ 14', '§ 132', '§ 14', '§ 7001', '§ 1681']

Data Security Breach Protocol - UNC Policies, Standards and Procedures
Home / Policies / Data Security Breach Protocol Data Security Breach Protocol
In accordance with the Identity Theft Protection Act of 2005, North Carolina General Statutes § 75-60 et seq. and § 132-1.10 of the Public Records Act (together, the “Act”), the University of North Carolina at Chapel Hill (the “University”) is required to safeguard certain information of patients, employees, students, vendors, and other individuals who provide information covered by the Act to the University. This protocol enables the University to comply with the Act.
1. Security Breach. An incident of unauthorized access to and acquisition of unencrypted and unredacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm to an individual. Any incident of unauthorized access to and acquisition of encrypted records or data containing personal information along with the confidential process or key shall constitute a security breach. Good faith acquisition of personal information by an employee or agent of the University for a legitimate purpose is not a security breach, provided that the personal information is not used for a purpose other than a lawful purpose and is not subject to further unauthorized disclosure.
2. Identifying Information. Under the Act and N.C.G.S. § 14-113.20, the following is considered identifying information pursuant to the Act (excluding some identifiers eliminated by N.C.G.S. § 132-1.10 for State agencies):
e. Personal Identification (“PIN”) Code as defined in N.C.G.S. § 14‑113.8(6).
1. Internal Notification. Any University employee or student who becomes aware of a suspected or actual security breach (“breach”) must report the matter immediately by calling the Information Technology Response Center (IT Response Center) at 919-962-HELP (919-445-4357). The IT Response Center is available to field such reports 24 hours a day, 7 days a week. If the breach involves the loss or theft of University-owned equipment, the employee or student must also notify the Department of Public Safety by calling (919) 962-8100.
e) Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports. [1]
2) Providing the affected individuals with information about how to alert credit agencies to potential fraud and identity theft. [2]
1) Written notice,
2) Electronic notice for those persons for whom the University has a valid email address and who have agreed to receive communications electronically if the notice provided is consistent with the provisions regarding electronic records and signatures for notices legally required to be in writing set forth in 15 U.S.C. § 7001, or
3. Delayed Notice. Notice shall be delayed if law enforcement informs the University that disclosure of the breach would impede a criminal investigation or jeopardize national security. A request for delayed notification must be made in writing or documented contemporaneously by the University in writing, including the name of the law enforcement officer making the request and the officer’s agency engaged in the investigation. The required notice shall be provided without unreasonable delay after the law enforcement agency communicates to the University its determination that notice will no longer impede the investigation or jeopardize national or homeland security.
Substitute notice will include posting a notice on the University’s website, emailing the affected persons if the University has their email addresses, and notifying major statewide media.
5. Additional Notice Requirements. If a security breach involves more than 1,000 persons, the University will provide written notice of the timing, distribution, and content of the notice to the Consumer Protection Division of the North Carolina Attorney General’s Office, as well as to all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a(p). In addition, the University will submit to the Consumer Protection Division a completed “North Carolina Security Breach Reporting Form” which includes the number of North Carolina residents affected and the total number of persons affected. [3]
At least annually, the University Committee for the Protection of Personal Data (UCPPD) will review all incidents of potential or actual security breaches and make recommendations to the Chancellor’s Cabinet for institutional improvements in order to minimize such occurrences in the future.
Information Security Policy: http://its.unc.edu/files/2012/03/ccm1_033440.pdf
HIPAA “Minimum Necessary” Policy: http://research.unc.edu/files/2012/11/ccm3_032069.pdf
[3] See http://www.ncdoj.gov/Protect-Yourself/2-4-6-Avoid-Consumer-Scams.aspx © 2017 The University of North Carolina at Chapel Hill