The College of St. Scholastica believes that their institutional data is a valuable resource. This resource may only be used in a legal, ethical and responsible manner. This Data Access Policy establishes and defines the responsibilities and roles of users who are granted access to institutional data.
The College provides employees with the information they need to do their jobs. An employee will be granted privileges consistent with their job duties to access public, confidential and private information about faculty, staff, students, alumni and donors.
All employees who are granted access to institutional data must complete the online Annual Confidentiality Training (ACT) which outlines student data security measures, responsibilities and policies at the College of St. Scholastica. The ACT is located on the web at https://www2.css.edu/app/ferpa/info/. Each user should know his/her responsibilities as defined in this tutorial. Each user shall read, understand and sign off on confidentiality statement at the end of the Annual Confidentiality Training within two weeks after receiving access to the Banner system provided.
Scope of THE COLLEGE Information Policy
This policy statement establishes measures for the protection, access and use of The College of St. Scholastica’s administrative electronic information.
It also defines the responsibilities of all who access and manage this data and equipment. Offices may have individual guidelines that supplement, but do not supplant or contradict, this policy statement. Data entrusted to the College by other organizations (e.g., foundations and government agencies) are governed by terms and conditions agreed upon with those organizations. Specific issues not governed by such agreed terms shall be governed by this policy.
Institutional data (electronic and paper) consists of information stored in any college database or on paper that contains information on past, current or future students, employees, donors or friends. This policy is primarily concerned with administrative data stored on college servers, scanned images within Banner Document Management or in administrative paper files. Other organizations on campus (i.e. the Human Subjects Review Committee) are responsible for research or academic data.
Institutional data is owned by the institution and is a vital College asset. We are ALL stewards of the College’s data. All institutional data, whether maintained in the central database or copied into other data systems, remain the property of the College and are governed by this policy statement.
Institutional Data Use
Institutional data shall be used only for the legitimate business of The College of St. Scholastica. Data shall be used only as required in the performance of job functions. Under no circumstances shall anyone use personally identifiable private/confidential institutional data in any publication, seminar, or professional presentation, or otherwise release data, in any form, outside the College without prior written approval from the appropriate data steward and/or the appropriate executive officer(s). Data must never be left on any system to which access is not controlled (i.e. a computer hard drive, USB drive, etc.).
As a general principle of access, institutional data (regardless of who collects or maintains it) shall be shared among those employees whose work can be done more effectively by knowledge of such information. Though the College must protect the security and confidentiality of data, the procedures to allow access to data will not unduly interfere with the efficient conduct of College business.
All who use institutional data have the right to expect the data to be accurate. All who maintain institutional data have the responsibility to keep them accurate.
Employees of the College are required to have knowledge of and adhere to the regulations of the Family Educational Rights and Privacy Act (FERPA). Employees who work with protected health information must be knowledgeable of and adhere to the regulations of the Health Insurance Portability and Accountability Act (HIPAA).
Three Categories of Data
The categories of College Data are differentiated principally by two factors: 1) who is permitted access, and 2) by restrictions on handling, disclosure or use of the data. College Data is classified into three categories:
Confidential Information is defined in the MN State Statute Ch 167, #2121, as an individual’s first name or first initial and last name in combination with any one or more of the following: social security number, driver’s license or Minnesota ID number, bank or credit card account numbers or access codes.
Confidential information, due to its nature, requires more control with respect to access or disclosure. Confidential information may be accessed by College personnel with a legitimate need-to-know, based on their role within the College, or as authorized by the relevant College official.
Confidential information will normally not be disclosed outside the College or to those without a need-to-know. Disclosure of confidential data outside the College will take place only with the advance authorization of the relevant data steward and approval by at least one Vice President.
Confidential data must be stored on network servers in a secure environment. Confidential data must be redacted from documents scanned into the Banner Document Imaging System unless properly secured. Confidential data must not be downloaded or saved to desktop computers or laptops unless that computer is encrypted. Even deleted files can be recovered and accessed using inexpensive data recovery tools.
Confidential data must not be downloaded and stored on USB drives or other peripheral devices without that device being properly encrypted. Encrypted USB devices may be purchased through the IT Purchasing Officer.
Confidential data must not be transferred via e-mail, file transfer protocol (ftp) or any other network application without being encrypted.
Printed reports containing confidential data must be kept secure and should be properly disposed of via shredding when no longer needed. Each person is responsible for security, privacy and control of the confidential data in their possession.
Private Information includes, but is not limited to: religion, marital status, student grades, passwords, employee phone, employee date of birth, employee address, donor name and donation, gender, ethnicity, citizenship, citizen visa code, veteran and disability status, and emergency contact information. The College considers this private Information and employees are required to follow this policy.
Private information, because of its highly sensitive nature or because of legal restrictions, requires strict access control and limited disclosure. Private information may be accessed by College personnel with a legitimate need-to-know, based on their role within the College, and as authorized by their supervisor or the appropriate data steward.
Disclosure of private information outside the College or to those not authorized by the relevant College official will normally not be allowed; however, any disclosure of private information will be made only with advance authorization of the relevant data steward and approval by at least one Vice President.
Public Information or data that may be freely accessed or disseminated at the discretion of the relevant College official. Public information is often called “directory information.” Examples include: public relations news releases, directory information (that has not been otherwise restricted from public disclosure), general web sites and academic publications.
Examples include name, student date of birth, student home and campus address, e-mail address, student telephone listing, student’s parent’s name and address(es), major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, photograph(s) and the most recent previous educational agency or institution attended. Measures should be taken to ensure the individual does not have a confidentiality hold.
If an individual is both an employee and a student, the information should be considered as a student.
Types of Access
Query-only access enables the user to view, analyze and download, but not change, institutional data. Once information is downloaded, however, data can, but should not, be altered in word processing documents or spreadsheets. Downloaded information should be used and represented responsibly.
Maintenance access provides both inquiry and update capability. Maintenance is defined as add, delete and change. This capability is generally limited to the offices directly responsible for the collection and management of the data. This access is available to administrators and users who have an authorized need to change institutional data in the routine performance of their job duties. Each user of administrative information is assigned appropriate combinations of query-only and maintenance access to specific parts of the administrative information system. The types of access are determined by the data stewards (see definition below).
Each user is assigned appropriate combinations of query-only and maintenance access to specific parts of the administrative information system. The types of access are determined by the data stewards.
Institutional Ownership: Institutional data is a College resource. Although individual offices, departments, programs or schools may have responsibilities for portions of college data, the College itself retains ownership of and responsibility for the data. The College shall appoint data stewards to manage specific elements of institutional data. The group of the College’s appointed data stewards and the Institutional Researcher will comprise the Data Oversight Committee which, led by the College’s Manager of Enterprise Information Systems, is responsible for implementing this policy, as set forth below.
Data Stewards: Data steward responsibilities are central for maintaining College operations. Data stewards should identify a backup. Data stewards are responsible for ensuring the accuracy, completeness, integrity, and as appropriate, the confidentiality of College information.
Data stewards are responsible for the accuracy and completeness of data files in their areas. Data stewards, in collaboration with the Institutional Reporting Committee and the Banner Implementation Group, are also responsible for the maintenance and control of the administrative information system’s validation and rules tables, business process which define how business is conducted at St. Scholastica and the integrity of all coding and data entry processes. Data stewards shall provide education and training to individuals with respect to access and manipulation of institutional data.
A data steward, usually an administrator of a major College office or department, may make data available to others within his or her purview for use and support of the unit’s functions. Data stewards shall define access control principles and restrictions on use and handling for the data for which they are assigned responsibility, consistent with data categorization described above.
Before granting access to data, the data steward shall be satisfied those protection requirements have been implemented and that a “need to know” is clearly demonstrated. By approving end-user access to institutional data, the data steward consents to the use of this data within the normal business functions of administrative and academic offices. Access to College data shall not be granted to persons unless there is an established “need to know.”
Data stewards will be required to review all security authorizations at least annually for their area and make additions or deletions as necessary.
The data stewards for the College of St. Scholastica are as follows:
|Admissions||Enrollment Management Data Systems Manager|
|Alumni-Development||Executive Director, Development/Annual Gifts and Campaign Support|
|Human Resources||Human Resources Information Specialist|
|Financial Aid||Director, Financial Aid|
Information Supervisors: All levels of administrative management shall ensure that, for their areas of accountability, each information system user knows his/her responsibilities as defined in this policy and that their office environment is secure with regard to institutional data.
Supervising administrators shall ensure a secure office environment with regard to all institutional information systems. Administrators shall validate the access requirements of their staff according to job functions, before submitting requests for the provision of access.
Information Users: Each user is responsible for all transactions occurring during the use of his/her login and password. Passwords must never be shared for any reason.
Individuals are responsible for understanding all data elements that are used. If a person does not understand the meaning of a data element, he/she should consult the appropriate data steward or his/her supervisor.
Users must exercise due care in using the institution’s electronic information systems, to protect data files from unauthorized use, disclosure, alteration or destruction. Each person is responsible for security, privacy and control of his/her own data.
Users may not:
- Disclose data to others, except as required by their job responsibilities
- Use data for their own personal gain, nor for the gain or profit of others
- Access data to satisfy their personal curiosity
- Use institutional data (in detail or summary) in any publication, seminar or professional presentation without permission of the relevant college official
Misuse or inappropriate use by individuals will result in revocation of the user’s access privileges.
The Chief Information Officer shall oversee the implementation of this policy statement, review requests for exceptions to the policy and manage disputes concerning use and stewardship of centralized electronic institutional data and institution-wide information systems.
The Information Technologies department shall insure that a variety of security measures are in place. It shall maintain the central institutional database and insure data security, integrity, and availability to all who have been granted access to it. Central database system backup will be performed on a regular basis. A disaster recovery plan will focus on minimizing the disruption caused when the central computing facility is inoperative. Regular upgrade and maintenance of the central hardware and software will occur to protect the College’s information. The cost of data protection should be commensurate with the value of data and the legal implications of the loss of such data.
The Information Technologies department shall process requests for data access through data stewards and serve as the initial point of conflict resolution in instances where requests for access conflict with this policy.
Violation of this Policy
Appropriate procedures shall be followed in reporting any breach of security or compromise of safeguards. Any person engaging in unauthorized use, disclosure, alteration or destruction of College data in violation of this policy shall be subject to appropriate disciplinary action, including dismissal or prosecution under applicable state and/or federal laws.