Compile and maintain identifiable records with Social Security Numbers only when required by law

SSN2: New collection processes or new research grants effective on or after July 1, 2017: Identifiable records containing full SSNs may be compiled and maintained only to comply with a specific legal requirement. Full SSNs plus identifiable information may only be used or printed in documents where it is legally required. Identifiable records with full SSNs may not be compiled or maintained if there is no legal requirement for that specific data. For example, maintaining full SSNs only as a tool for differentiating records does not satisfy a legal requirement; the same purpose could be efficiently achieved by using truncated (last four digits) SSNs or alternate information, such as date of birth. If you collect and then need to transfer identifiable records containing full SSNs to a central service, such as Student Financial Services or University Financial Services, then the transfer must be secure and you must securely dispose of your copies of the identifiable records containing the full SSNs after that transfer is complete (see SSN3), unless you must retain the information because of a specific legal requirement.

How to Comply

Seek an exception to compile and maintain identifiable records with full Social Security Numbers when not required by law

In certain cases, there may be contracted business partners that require full SSN plus identifying information to complete specific transactions for us, but which do not fulfill a legal requirement for using a full SSN. For example, certain insurance providers may still identify policy holders according to a full SSN, and an alternate identifier or truncated SSN would break their processing service.

Read moreSeek an exception to compile and maintain identifiable records with full Social Security Numbers when not required by law