Seek an exception to compile and maintain identifiable records with full Social Security Numbers when not required by law

In certain cases, there may be contracted business partners that require full SSN plus identifying information to complete specific transactions for us, but which do not fulfill a legal requirement for using a full SSN. For example, certain insurance providers may still identify policy holders according to a full SSN, and an alternate identifier or truncated SSN would break their processing service. In such cases, the group with that business need should complete an online Full SSN Collection Exception Request for each system or process collecting or storing full SSNs for such purposes and submit it to the University Information Security office. New exception requests will be reviewed at least quarterly, and existing exception requests will be re-examined annually. Contact the Information Security Office at itsec-ec@harvard.edu to request access to the exception request form, as needed.