SSN Information for Staff

The University drafted its policy on the collection, maintenance, and dissemination of Social Security numbers in order to protect the privacy and legal rights of its faculty, staff, and students. This policy cannot be successful without the active participation of those staff members that have access to employee and student SSNs. SSNs should never be stored unencrypted on workstations, laptops, or other portable data storage devices. Nor should SSNs ever be sent through email.

The University has removed SSNs from most computing systems. Consequently access to SSNs is generally not needed by University faculty and staff. All employees are encouraged to review practices involving SSNs by,

• Questioning whether Social Security numbers are truly required for a given procedure or practice (can the UIN be used instead?)
• Ensuring that printed documents containing Social Security numbers are destroyed in a secure manner (e.g., shredder, confidential recycling bins)
• Reviewing reports released to third-parties - SSNs cannot be released outside of the University without the consent of the Social Security number Coordinators. The exception is the release to governmental bodies with an explicit legal right to SSNs, such as the IRS.

Federal law requires that anytime a Social Security number is requested, the electronic or physical form used to collect the number should be clearly marked as to whether this request is voluntary or mandatory. When requesting the SSN, you need to explain: 1) whether submission is mandatory or voluntary; 2) by what authority the number is solicited; and 3) what uses will be made of it. Taken together these three items comprise a disclosure statement. All disclosures statements require approval by the SSN Coordinators.

SSNs will still be maintained in U of I systems where appropriate. University employees with questions about the Social Security number policy should feel free to contact their campus SSN Coordinator.

An extended set of approved disclosure statements are also now online.

Specific Staff SSN Issues

Many of the questions asked concern the use of Social Security numbers when processing travel vouchers, fellowships, grants, and reimbursements or similar processes. Most existing University systems still rely on the Social Security number to identify individuals and in many circumstances the SSN is required by the IRS (particularly where compensation is involved).

It is important to note that the University is entitled to use the SSN internally if it has an individual's SSN. However in most circumstances it is not appropriate to force an individual to provide his or her SSN, even if they are an employee. Units should attempt, where ever possible, to collect the individual's UIN and use it to lookup the SSN. The SSN can then be used on an internal form or submission to an administrative system to speed processing.

A number of specific situations are outlined below.

Accounts Receivable, ATOs, Travel Advances

State law requires the university to provide SSNs on any receivable over $1000 for collection purposes. The SSN coordinators and University Counsel are discussing the legality of this requirement with the State Comptroller's office. In the meantime, the requirement stands.

The difficulty here is that a person may have other charges already on his/her account and your charge may push him/her over the $1000 limit. So, unless the Comptroller's office changes its requirement, we must continue to ask for the SSN/FEIN for all accounts receivable transactions. Note that ATOs (air travel orders) and travel advances are considered to be receivables, so we will continue to need SSNs on these forms as well.

Please note that as stated above, when working with faculty, staff, or students, please request their UIN and use departmental records to lookup the SSN and then complete any paperwork with the SSN.

A disclosure statement will be required:
"The University is required by the State Comptroller to collect a Social Security Number when extending credit to an individual. If an account becomes delinquent, the SSN will be provided to the state or to a private collection agency to assist in the settlement of the debt. Provision of the SSN is voluntary; if you do not wish to provide one, you may pay in advance with a check or credit card."

Fellowships

Fellowship payments to international students are reported to the IRS per federal statute, so we are justified in asking for an SSN from international students. There is no equivalent statute for US permanent residents and citizens.

Fellowships are processed through Payroll, and therefore we may currently continue to ask for an SSN under the exemption granted to systems in place prior to 1975. The SSN coordinators will write a disclosure statement that explains this. However, after the Banner system is installed, we will not be able to require SSN for domestic fellowship recipients.

Travel Grants

The Graduate College processes many small travel grants through an invoice-voucher. Their process requires them to collect receipts after the fact, so these grants are really treated as reimbursements for tax purposes and are not taxed or reported individually outside the university. As with travel reimbursements, having an SSN on the voucher would speed up the processing and data entry by Payables staff because of the ability to pull the data from Paymaster. However, there is no legal justification for requiring an SSN on these forms. If the Graduate College can look up the SSNs and enter them on the voucher, it will save time in Payables, but the Graduate College may not ask the student for an SSN on the Travel Grant application.

Refund payments

When the university is refunding money that was collected from an individual, it is not necessary to include an SSN on the invoice-voucher for the refund. Vouchers without SSNs will take longer for data entry staff to process.

SSN Compliance Worksheet

The University SSN Policy states: "II.2.All University forms and documents that collect Social Security numbers will use the language included below. It is understood that this language will be implemented on an ‘as reprinted' basis for existing paperwork, with a full compliance date of fall 2002." The "language below" refers to disclosure statements required by federal law. The following information is provided to insure that units and University employees that solicit SSNs are meeting Federal requirements when doing so.

The Privacy Act of 1974 requires that whenever a Social Security number is requested the electronic or physical form used to collect the number must be clearly marked as to whether this request is voluntary or mandatory. When requesting the SSN, you need to:

1. explain whether submission is mandatory or voluntary;
2. by what authority the number is solicited; and
3. what uses will be made of it.

Taken together, these three items constitute an SSN disclosure statement. Please note that all SSN disclosure statements are subject to the approval of the University of Illinois System SSN Coordinators.

How do you know if you need a disclosure statement?

If you answer yes to any of the following questions you must have an SSN disclosure statement:

Do you solicit an individual's SSN on a printed form?
Do you solicit an individual's SSN on an online form or application?
Do you request an individual's SSN at a point of service (e.g., help desk, register, teller)?

Does the disclosure statement have to appear on the form (or computer screen)? I've got 10,000 printed forms I'd rather not reprint.

It is acceptable to print the disclosure statement on a separate piece of paper and include it with the form, until the existing stock of forms is exhausted. If the form is also accompanied by a separate set of instructions, it is acceptable to include the disclosure statement in the instruction booklet and reference it by page number on the form (as in the example from the UIUC application below). However, it is preferable to mark whether the submission of the SSN is mandatory or voluntary directly on the form.

Electronic screens should always include on the display whether the submission of the SSN is voluntary or mandatory. It is acceptable to provide a hyperlink or similar contrivance to the full disclosure statement.

We ask students for their SSN when they walk into our office so we can help them (in order to find their records in a computer system) - do we need a disclosure statement and how do we distribute it?

Yes - and if you explain verbally when you ask for the SSN why you are asking, the vast majority of students will gladly provide it. However having a small stack of printed disclosure statements available to hand to students (or displayed on a wall) will prevent you from having to recite the same information over and over. It is advisable to have an alternate lookup mechanism in place for students that refuse to provide an SSN. The i-card office can provide access to a web based interface to an individual's demographic information (e.g., name, SSN, digital photo) keyed on their UIN (also known as their i-card number). This permits you to request the UIN in place of the SSN and still provide the usual service.

Okay, so how do I create or get a hold of an approved disclosure statement?

1. Please collect the following information:
   Department/Unit name
   How is the SSN utilized in your department?
   Is the SSN required or voluntary?
   If required, by what law, statute, act?
   Whose SSN do you collect (i.e. students, employees, etc.)?
   Who is allowed access to this information?
   What happens if someone refuses to provide his/her SSN?
   Could anything else (i.e. the University Identification Number) substitute for the SSN?
2. If you would like to create your own disclosure statement, use the collected information and the following template to create a draft disclosure statement. You may want to browse the samples provided to help guide you.

   Template
   The (dept / unit) requires your Social Security number for the purpose(s) of (fill in the purpose). We are required by (fill in the statute/law) to provide (fill in type of information, i.e. income) reports to (fill in organization). If you do not provide us your Social Security number, then (fill in the consequence). The University will not disclose Social Security numbers without the consent of the individual to anyone outside the University except as mandated by law.

3. Email the collected information (and draft statement if you created your own) to the SSN Coordinator for your campus.

Examples of Disclosure Statements