Maintaining Confidentiality, Integrity, and Availability
4.1 Maintaining Confidentiality of Information
Most types of university information (records) are defined as either "Confidential" or "Open" (public) within UNT Policy 10.10, the University Records Retention Schedule. Information that is classified as confidential cannot be disclosed or disseminated to the public (people who aren't employees of the university with a need to know this information). Much of the information about our students (grades, financial aid status, Social Security numbers, etc.) is confidential.
All of us--faculty members, custodians, administrative assistants, secretaries, computer support staff, vice presidents--have a responsibility to protect information about our students from public disclosure. It doesn't matter whether this information is on the central computer, on a printout, a computer screen, a diskette, a CD-ROM, etc. The Family Education Rights and Privacy Act (FERPA) of 1974, guarantees students the right to protect all information that is not classified as "open directory" information.
Some of the records, other than student records, which are designated as confidential include:
Open Directory Information about students may or may not be flagged to be "withheld from the public", which means that this information can not be posted on bulletin boards or on websites inappropriately. To be certain that a student’s record is not protected check with the Registrar's Office.
The following items are considered open director information for students:
Some students request that open directory information also be withheld from the public. These students are identified within Enterprise Information System (EIS). Please see FERPA Compliance at UNT or contact the Registrar's Office for additional information (http://www.unt.edu/ferpa/index.html). All UNT employees who regularly deal with student information should attend FERPA training, available through the Registrar's Office. Open directory information includes general information (as listed) but ALL OTHER STUDENT INFORMATION IS CONFIDENTIAL!
Unless otherwise restricted, the Texas Public Information Act (also known as the Texas Open Records Act) does not prohibit the disclosure of the records of Texas state agencies- this includes universities. Some information about employees who work for Texas state agencies (including UNT) can be disseminated to the public. This information includes (but is not limited to):
Employees may restrict disclosure of their social security number, home address, and home telephone number, by contacting Human Resources. Requests for information from the public should be referred to the university attorney. See http://www.oag.state.tx.us/AG_Publications/txts/2004publicinfohb_3_01.shtml for more information about the act.
Is the information accurate? Is it complete? How do we know?
Unless our information is accurate and complete, it's pretty much useless and it may even be dangerous. Almost all of our data is sensitive in this respect. Grades, salaries, research data, and most other records and documents must be protected from unauthorized modification or destruction. How?
4.3 Ensuring the Availability of Information
Every office should have a contingency plan to address disasters or problems such as fire, theft, water damage, vandalism (including data loss from virus or hackers), loss of key employee, hardware failure, network unavailability, etc. The Computing and Information Technology Center (CITC) must plan for the loss of the enterprise information system and other critical systems needed for the business operations of the University. Other departments must plan how they will cope if their own systems are damaged, or if CITC administered systems are unavailable for an extended period (possibly up to three weeks). Contingency plans should address the most critical functions, such as registering students, paying employees and vendors, disbursing financial aid, etc.
Contingency Plans are basically made up of procedures and lists. Sometimes simple plans are the best and they're certainly better than no plan at all. Procedures should address how to accomplish basic tasks without computers/networks: who does what, what should be done first/second/..., how do you restore files from backup, etc.
Lists should include:
A contingency plan is never really "finalized." Some of the information in the lists change frequently and should be updated and disseminated. Departments should test their plans periodically to ensure that contingency procedures are still practical, files can be restored, etc. Plans should provide short as well as extended periods when critical resources may be unavailable. See the “Checklist Criteria For Business Recovery” (sponsored by FEMA) guide for more information on developing a contingency plan, http://www.fema.gov/ofm/bc.shtm.
In the event of a disaster, will you be able to recover the files that have been lost? Your files (electronic data, e-mail correspondence, etc.) should always be backed up (copied) and placed in a secure location- especially those files that you do not use on a daily basis, yet may be critical to your office operations.
Here are a few ideas to help you with the Backup process:
Several measures may actually help to prevent a disaster. These could include: