Interim Process for the Use of the Social Security Number on Boulder Campus Databases

The University of Colorado at Boulder urges great care when maintaining Social Security Numbers (SSN's) in departmental databases. Generally, you should not collect and retains SSN's unless you have a valid business purpose to do so.  If you think you have a valid purpose, you should receive guidance from the appropriate campus authorities for obtaining, storing and using such data.
 
Guidelines for Using SSN's

The following information will help you decide if you need to use SSN's at all and, if you do, how to protect your system.

1. The protection of SSN's is required by multiple federal and state regulations.  Those who are entrusted with this information must take care to ensure that SSN's are not publicly available.  
2. Do not use the SSN as a primary identifier or login for students, staff, faculty, customers, or other individual.  House Bill 03-1175 mandates that the Social Security Number (SSN) should not be used as the primary identifier.  The effective date for the law was July 1, 2004.  Systems which require students to login are strongly encouraged to use CU-Access.
3. There are a few cases in which it is valid to collect and store the SSN. 
   • When tracking is required by federal regulation or statute.
   • For university admissions purposes.
   • As a way to report certification, such as teacher licensure.
   • When extending credit to a customer or possible use in the collection of a debt.

Contact Information

If you think you have a compelling and valid need to retain SSN's, contact the following campus resources to authorize your use and to receive guidance on securing your systems.  

• If you are storing SSN's on students, please contact the Campus Data Steward for Student Data, Barbara Todd, in the Registrar's Office at 303-492-2459 and by e-mail at Barbara.Todd@colorado.edu.
• For information about securing those systems and to be in compliance with the campus's Minimum Security Standards for restricted data, please contact Dan Jones in Information Technology Services.