According to MSU's Institutional Data Policy (IDP, http://eis.msu.edu/documents/institutional_data_policy_dec10.pdf), student and employee ID numbers are examples Institutional Data that are classified as Confidential Data.

Institutional Data may be accessed and used "only for University purposes" and "must be used, stored, transferred, disseminated, and disposed of in ways that minimize the potential for their improper disclosure or misuse."

The restrictions are tighter for Confidential Data:

"Records that contain Confidential Data shall be properly secured to minimize the risk that the Confidential Data will be accessed, either intentionally or inadvertently, by individuals who do not need to see or use the Confidential Data for University purposes." The IDP does not define "properly secured." There are links to Securing Institutional Data in Appendix III (http://eis.msu.edu/sid/index.html) where you can find more links to best practices.

Our office has been instructed that A-PIDs cannot be transmitted via e-mail in combination with a student's name. Combining the two elements provides enough information to lead to identity theft.

The Registrar's Office can provide more information about policies and securing A-PIDs, and Human Resources can give you more info about Z-PIDs.

http://www.reg.msu.edu/
http://www.hr.msu.edu/

Gene


On 4/24/2013 9:29 AM, Tim Heckaman wrote: