Duke University Policy on the Collection, Storage, and Use of Social Security Numbers

While it is important to ensure that departments have the information necessary to their functions, the increased use of Social Security Numbers as identity verification puts members of the Duke community at greater risk for identity theft. The Office of the Chief Information Officer has studied these concerns and has produced a paper about them, which you can find online at www.security.duke.edu/SSNwhitepaper.doc. In accordance with these recommendations and the directive issued by Dr Tallman Trask III, the current policy on the collection, storage, and use of Social Security Numbers at Duke is:

Departments wishing to collect, store, or use SSNs in any way must:

• Show compelling institutional need,
• Receive approval from the Executive Vice President and the Chief Information Officer, and
• Permit yearly audits (including server and application security) to ensure safe SSN handling

As of this writing, the only institutional groups permitted to collect, store, and use SSNs are:

• the Identity Management System
• SAP
• SISS
• Alumni and Development System

All others must meet the requirements above.