What is PII?
Personally Identifiable Information, or PII, is a specific category of particularly sensitive data defined as:
- Unencrypted electronic information that includes an individual’s first name or initial, and last name, in combination with any one or more of the following:
- Social Security number (SSN).
- Driver’s license number or State-issued Identification Card number.
- Financial account number, credit card number*, or debit card number in combination with any required security code, access code, or password such as expiration date or mother’s maiden name that could permit access to an individual’s financial account.
- Medical information (any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional)
- Health insurance information (an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records)
A number of state laws require that Personally Identifiable Information (PII) is appropriately protected and that affected individuals must be notified of any reasonable suspicion of a compromise of that protection. The University is responsible for complying with these legal requirements and for providing employees with information about requirements and responsibilities relating to PII.
*Credit card information is also regulated by the Payment Card Industry (PCI) Data Security Standard, click here for more information
Data Management Practices for PII
In general, the best way to protect PII is not to have it in the first place. Overarching data management practices for individuals who work with this type of information are:
- Securely delete PII when there is no longer a business need for its retention on computing systems. Candidates for deletion include:
- Drafts and old versions
- Extra copies of files
- Old emails and attachments
- Anything that you no longer need for which you're not the office of record
- Anything with Social Security number (SSN), if there isn't a legitimate business need for its retention.
- Data that has exceeded its required retention period.
- Always shred or otherwise destroy PII before disposing of it.
- Truncate or de-identify PII that you must retain whenever possible.
- Protect all intact PII that you must retain by only storing it on protected network drives. Encryption can dramatically reduce the risks associated with stored PII.
- Restricted data, including PII, must be always encrypted during transmission.
UMass Chan data stewards with primary responsibility for the existence of PII are responsible for the security and use of that data in original systems as well as any downstream locations where the data may be sent. This includes ensuring appropriate education and training for employees with access to PII.
Common places where PII may be found
UMass Chan-related personal identity or sensitive information is likely to be found in files and email containing the following types of information. While this is not an all-inclusive list, you can use it as a guide to locate PII you may not be aware of so you can remove or protect it. Remember to check old and archival files and email, too.
- Student records, including old class lists
- Student rosters
- Financial aid and grade records
- Personnel or academic-related spreadsheets, databases, and files,
- Travel reimbursements submissions
- Health, medical, or insurance records
- Financial spreadsheets
- Old applications (job or student), performance evaluations or reference letters
- Credit card sale records
- Credit and collections records
- Research proposals or databases, research grant applications, or other Intellectual Property (IP)
- Data related to DMV pull notices