Meloria • Ever Better
Search Tools Main Menu

Am I a custodian?

You are not a custodian of Social Security Numbers if your only involvement with other people’s SSNs is when you …

… are a user of computer systems whose access controls are administered by others;
… are a user of paper files or microfiche that are returned at the end of the workday to a secure storage area whose access controls are administered by others.

You might be a custodian of SSNs if …

… you have copies of

  • performance evaluations,
  • job applications and resumes,
  • personnel action forms,
  • enrollment applications and transcripts,
  • FRS reports (e.g. cum salary),
  • travel & conference expense reports,
  • Requests for Payment,
  • research databases,
  • extracts from clinical systems,
  • curricula vitae (CVs),
  • financial aid applications,
  • grant proposals, and
  • similar documents created at a time when SSN was routinely used as a primary identifier

Or if you …

… are the administrator of a computer

  • software application that controls access to data that include SSN;
  • file server directory (e.g. "file share") that includes files or databases containing SSN;
  • SharePoint site that includes files or lists containing SSN;

… are the administrator of a department or unit or off-campus medical practice that

  • tracks performance ratings, salary programs, credentials for teacher certification, etc., in computer files stored on a departmental computer or on a file server at a University data center;
  • oversees student admissions and/or financial aid processes;
  • keeps paper-based personnel files, including forms such as I-9 and W-9, on your faculty, staff, student employees, and contractors;
  • keeps paper-based patient files;

… are the investigator or coordinator of a research project that

  • receives a data extract containing SSN from another computer system;
  • verifies the identity of subjects by SSN;
  • pays stipends to participants;
  • hosts data for a multi-site study;

… are the sponsor or manager of a University contract under which

  • an outside party collects or maintains records that contain SSN;

… retain any printed report containing SSN.

Last modified: January 18, 2009