Re: SSNs and patron record security

["Craig A. Summerhill" <summerhi at unr dot edu>]

On 3/24/2005, Sanda Card wrote:
> Do you still have SSN data in your patron records? [I would like to erase
> all SSN data!]

Yes.  However, we are in the process of phasing them out -- we
have recently implemented a new campus ID number.  As a matter
of fact, I'll be spending some time next week to work on getting
the patron record modified accordingly in preparation for loading
the new numbers.  (We need to overlay once using both SSN and the
new ID number, then I will delete the SSNs and modify load rules
to match on the new ID number.)

As you may be aware, modifying the patron record -- mid stream --
can be problematic.  All on-the-fly records for ILL and INN-REACH
lending, which are actually attached as a field to a patron record,
have to be updated following the record modification.  That updating
can only be done by Innovative staff to the best of my knowledge.


> If so, who has access to that data?
> Do student assistants, in particular, have any access?

Jamen McGranahan summed this up pretty well.  Unless you are going
to require a Circulation supervisor to check books out and update
patron data at the service points, you can't get away from giving
student workers read access to the data.  The Innovative system, to
my understanding, lacks the ability to mask individual variable
length fields.


> How do you secure SSN data to meet legal requirements?

Removing it from the Innovative patron records is your best bet
from a security-minded point of view.

In the past, there has been some reluctance to lose the SSN as it
is used for the purposes of pursuing patrons who have large fine
amounts and (more importantly) unreturned items which have reached
billing stage.  Collection agencies might do the work without the
SSN, but it will cost you a lot more.  However, our campus student
records / human resources systems have the data and access to those
systems is much more restrictive (including the employee who has
such access sign an acknowledgement form regarding patron privacy)

Therefore, our managers can pursue the SSN at collection time, as
needed.


--

   Craig A. Summerhill
   Applications Development Librarian
   University of Nevada, Reno
   Getchell Library 174A / Mail Stop 322
   1664 North Virginia Street
   Reno, NV   89557-0042

      (775) 784-6500 x227
      <summerhi at unr dot edu>