Ohio Administrative Code › Title 3339 - Miami University › Chapter 3339-3 - In General › Section 3339-3-22 - Confidential information policy

Current through all regulations passed and filed through July 1, 2024
Miami university collects, stores, and distributes large
				amounts of information essential to the performance of university business.
				This information represents a valuable university asset. Although a large
				portion of university information is public, a portion of our information is
				protected by state and federal laws. To comply with these laws and protect the
				university community, the university has the right and obligation to protect,
				manage, secure, and control information (whether in hard copy or stored as
				electronic data) in its possession.
Information protected by federal or state law may not be shared
				with unauthorized persons or posted online at a site
				that can be accessed by unauthorized persons. These laws include the
				federal privacy act which protects social security numbers, the family
				educational rights and privacy act which protects personally identifiable
				student records, the gramm-leach-bliley act which protects consumer financial
				information, and the health insurance portability and accountability act which
				protects personal health information. All employees, faculty and staff, bear
				responsibility for protecting confidential information from unauthorized
				disclosure. This is true whether this information is stored on paper, a network
				computer, on a laptop, on a personal digital assistant or other device.
Information that is protected by law may only be disclosed to
				authorized persons.
Examples of confidential information include: social security
				numbers, disability status, health and medical information, student advising
				records, student grades, student disciplinary records, consumer financial
				information, banner student identification numbers, trade secrets, credit and
				debit card numbers, and coursework produced by
				students.
Social security numbers are used primarily for student
				financial assistance and employment tax-related matters. If unique
				identification of an individual is required, an identifier other than a social
				security number should be used. The recommended identifier to use is the banner
				plus number. An appropriate security plan and the written consent of the
				information security officer is required before any university office is
				permitted to collect and/or maintain social security numbers.
Each faculty and staff member must assume responsibility for
				protecting confidential information from unauthorized exposure. This means you
				must do the following:
(A) Understand and follow Miami's responsible
			 use of computing resources policy
(B) Consult the information security office
			 if you are uncertain whether certain information is confidential
(C) Consult the information security office
			 if you are uncertain how to safeguard confidential information
(D) Understand and follow the Miami
			 university computing security policy
(E) Protect your computer password and change
			 it according to standards published by the information security office in the
			 it services knowledge base at
http://ithelp.muohio.edu
(F) Not provide access to confidential
			 information to any other person unless authorized to do so
Ohio law requires the university to take certain actions in the
				event of unauthorized disclosure of confidential information. You must report
				any suspected disclosure of confidential information to unauthorized persons to
				the information security officer (call 529- 9252 immediately and report that
				you suspect that confidential information has been disclosed). In addition to
				reporting the theft of any laptop, personal digital assistant or other device
				that contains confidential information to the appropriate law enforcement
				authorities, you must immediately report the loss/theft of any laptop, personal
				digital assistant or other device that contains confidential information to the
				information security office.