SSN Information for staff
The University drafted its policy on the collection, maintenance, and dissemination of Social Security numbers in order to protect the privacy and legal rights of its faculty, staff, and students. This policy cannot be successful without the active participation of those staff members that have access to employee and student SSNs. SSNs should never be stored unencrypted on workstations, laptops, or other portable data storage devices. Nor should SSNs ever be sent through email.
The University has removed SSNs from most computing systems. Consequently access to SSNs is generally not needed by University faculty and staff. All employees are encouraged to review practices involving SSNs by,
- Questioning whether Social Security numbers are truly required for a given procedure or practice (can the UIN be used instead?)
- Ensuring that printed documents containing Social Security numbers are destroyed in a secure manner (e.g., shredder, confidential recycling bins)
- Reviewing reports released to third-parties - SSNs cannot be released outside of the University without the consent of the Social Security number Coordinators. The exception is the release to governmental bodies with an explicit legal right to SSNs, such as the IRS.
Federal law requires that anytime a Social Security number is requested, the electronic or physical form used to collect the number should be clearly marked as to whether this request is voluntary or mandatory. When requesting the SSN, you need to explain: 1) whether submission is mandatory or voluntary; 2) by what authority the number is solicited; and 3) what uses will be made of it. Taken together these three items comprise a disclosure statement. All disclosures statements require approval by the SSN Coordinators.
SSNs will still be maintained in U of I systems where appropriate. University employees with questions about the Social Security number policy should feel free to contact their campus SSN Coordinator.
An extended set of approved disclosure statements are also now online.
Specific Staff SSN Issues
Many
of the questions asked concern the use of Social Security numbers
when processing travel vouchers, fellowships, grants, and
reimbursements or similar processes. Most existing University
systems still rely on the Social Security number to identify
individuals and in many circumstances the SSN is required by
the IRS (particularly where compensation is involved).
It is important to note that the University is entitled to use the
SSN internally if it has an individual's SSN. However in most
circumstances it is not appropriate to force an individual to
provide his or her SSN, even if they are an employee. Units
should attempt, where ever possible, to collect the
individual's UIN and use it to lookup the SSN. The SSN can
then be used on an internal form or submission to an
administrative system to speed processing.
A number of specific situations are outlined below.
Accounts Receivable, ATOs, Travel Advances
State law requires the university to provide SSNs on any receivable
over $1000 for collection purposes. The SSN coordinators and
University Counsel are discussing the legality of this
requirement with the State Comptroller's office. In the
meantime, the requirement stands.
The difficulty here is that a person may have other charges already
on his/her account and your charge may push him/her over the
$1000 limit. So, unless the Comptroller's office changes its
requirement, we must continue to ask for the SSN/FEIN for all
accounts receivable transactions. Note that ATOs (air travel
orders) and travel advances are considered to be receivables,
so we will continue to need SSNs on these forms as well.
Please note that as stated above, when working with faculty, staff, or students, please request their UIN and use departmental records to lookup the SSN and then complete any paperwork with the SSN.
A disclosure statement will be required:
"The University is required by the State Comptroller to collect
a Social Security Number when extending credit to an individual. If
an account becomes delinquent, the SSN will be provided to the
state or to a private collection agency to assist in the
settlement of the debt. Provision of the SSN is voluntary; if
you do not wish to provide one, you may pay in advance with a
check or credit card."
Fellowships
Fellowship payments to international students are reported to the
IRS per federal statute, so we are justified in asking for an SSN
from international students. There is no equivalent statute for US permanent residents and citizens.
Fellowships are processed through Payroll, and therefore we may
currently continue to ask for an SSN under the exemption
granted to systems in place prior to 1975. The SSN
coordinators will write a disclosure statement that explains
this. However, after the Banner system is installed, we will
not be able to require SSN for domestic fellowship recipients.
Travel Grants
The Graduate College processes many small travel grants through an
invoice-voucher. Their process requires them to collect receipts
after the fact, so these grants are really treated as
reimbursements for tax purposes and are not taxed or reported
individually outside the university. As with travel
reimbursements, having an SSN on the voucher would speed up
the processing and data entry by Payables staff because of the
ability to pull the data from Paymaster. However, there is no
legal justification for requiring an SSN on these forms. If the
Graduate College can look up the SSNs and enter them on the
voucher, it will save time in Payables, but the Graduate
College may not ask the student for an SSN on the Travel Grant
application.
Refund payments
When the university is refunding money that was collected from an
individual, it is not necessary to include an SSN on the
invoice-voucher for the refund. Vouchers without SSNs will
take longer for data entry staff to process.
SSN Compliance Worksheet
The University SSN Policy states: "II.2.All
University forms and documents that collect Social Security
numbers will use the language included below. It is understood
that this language will be implemented on an ‘as reprinted'
basis for existing paperwork, with a full compliance date of fall 2002."
The "language below" refers to disclosure statements required
by federal law. The following information is provided to
insure that units and University employees that solicit SSNs
are meeting Federal requirements when doing so.
The Privacy Act of 1974 requires that whenever a Social Security
number is requested the electronic or physical form used to
collect the number must be clearly marked as to whether this
request is voluntary or mandatory. When requesting the SSN,
you need to:
- explain whether submission is mandatory or voluntary;
- by what authority the number is solicited; and
- what uses will be made of it.
Taken together, these three items constitute an SSN disclosure statement. Please note that all SSN disclosure statements are subject to the approval of the Social Security number Oversight Committee.
How do you know if you need a disclosure statement?
If you answer yes to any of the following questions you must have an SSN disclosure statement:
Do you solicit an individual's SSN on a printed form?
Do you solicit an individual's SSN on an online form or application?
Do you request an individual's SSN at a point of service (e.g., help desk, register, teller)?
Does the disclosure statement have to appear on the form (or
computer screen)? I've got 10,000 printed forms I'd rather
not reprint.
It is acceptable to print the disclosure statement on a separate
piece of paper and include it with the form, until the
existing stock of forms is exhausted. If the form is also
accompanied by a separate set of instructions, it is
acceptable to include the disclosure statement in the
instruction booklet and reference it by page number on the form
(as in the example from the UIUC application below). However, it is
preferable to mark whether the submission of the SSN is
mandatory or voluntary directly on the form.
ssnapp2
Electronic screens should always include on the display whether the
submission of the SSN is voluntary or mandatory. It is
acceptable to provide a hyperlink or similar contrivance to
the full disclosure statement.
We ask students for their SSN when they walk into our office so we
can help them (in order to find their records in a computer
system) - do we need a disclosure statement and how do we
distribute it?
Yes - and if you explain verbally when you ask for the SSN why you
are asking, the vast majority of students will gladly provide
it. However having a small stack of printed disclosure
statements available to hand to students (or displayed on a
wall) will prevent you from having to recite the same
information over and over. It is advisable to have an
alternate lookup mechanism in place for students that refuse to
provide an SSN. The i-card office can provide access to a web based
interface to an individual's demographic information (e.g.,
name, SSN, digital photo) keyed on their UIN (also known as
their i-card number). This permits you to request the UIN in
place of the SSN and still provide the usual service.
Okay, so how do I create or get a hold of an approved disclosure statement?
- Please collect the following information:
Department/Unit name
How is the SSN utilized in your department?
Is the SSN required or voluntary?
If required, by what law, statute, act?
Whose SSN do you collect (i.e. students, employees, etc.)?
Who is allowed access to this information?
What happens if someone refuses to provide his/her SSN?
Could anything else (i.e. the University Identification Number) substitute for the SSN?
- If you would like to create your own disclosure statement, use
the collected information and the following template to create a
draft disclosure statement. You may want to browse the
samples provided to help guide you.
Template
The (dept / unit) requires your Social Security number for the
purpose(s) of (fill in the purpose). We are required by (fill in
the statute/law) to provide (fill in type of information,
i.e. income) reports to (fill in organization). If you do
not provide us your Social Security number, then (fill in
the consequence). The University will not disclose Social
Security numbers without the consent of the individual to
anyone outside the University except as mandated by law.
- Email the collected information (and draft statement if you created your own) to the SSN Coordinator for your campus.
Examples of Disclosure Statements