NORTHFIELD BOARD OF EDUCATION FILE CODE: 3250.1
Northfield, New Jersey
Policy
IDENTITY THEFT
The risk to the Northfield School District, its employees, students, vendors and contractors from data loss and identity theft is of significant concern to the board. In an effort to prevent, protect against and reduce the risk from identity fraud or damages related to the loss or misuse of sensitive information and minimize potential damage to the district from fraudulent new accounts, the board directs the superintendent to:
A. Identify risks that signify potentially fraudulent activity within new or existing financial, payroll, personnel and student accounts;
B. Detect risks when they occur in paper and/or electronic records including financial, payroll, personnel and student data;
C. Set guidelines in the districts Standard Operating Procedure/Internal Controls Manual on credit card security that is consistent with Payment Card Industry Data Security Standard SAQ B;
D. Respond to any identified or actual security breach to determine if fraudulent activity has occurred and act if fraud has been attempted or committed; and
E. Periodically review the accounts for any identifiable risks.
Sensitive Information
Sensitive information regarding personnel or student records and financial accounts includes the following items whether stored in electronic or printed format:
A. Credit card Information, including any of the following:
1. Credit card number (in part or whole)
2. Credit card expiration date
3. Cardholder name
4. Cardholder address
B. Tax Identification numbers, including:
1. Social Security numbers
2. Business Identification numbers
3. Employer identification numbers
C. Payroll information, including, among other information:
1. Paychecks
2. Pay stubs
D. Payroll deduction plan check requests and associated paperwork.
E. Student food services accounts.
F. All medical information collected by the school district for any employee, student or vendor, including but not limited to:
1. Doctor names and claims
2. Insurance claims
3. Prescription
4. Any related personal medical information
G. Other personal information belonging to any employee, student, vendor or contractor, examples of which include:
1. Date of birth
2. Address
3. Phone numbers
4. Maiden name
5. Names
6. Customer number
H. District personnel are encouraged to use common sense judgment in securing confidential information and comply with board policies 3570 District Records, 4112.6/4212.6 Personnel Records, 5125 Student Records and the Open Public Records Act. If an employee is uncertain of the sensitivity of a particular piece of information, the employee should contact their supervisor. In the event that the district cannot resolve a conflict between this policy and the Open Public Records Act, the district shall contact the Government Records Council.
Hard Copy Records
All employees, students, vendors and contractors shall comply with the following security guidelines for the maintenance of paper documents:
A. File cabinets, desk drawers, overhead cabinets, and any other storage space containing documents with sensitive information will be locked when not in use;
B. Storage rooms containing documents with sensitive information and record retention areas will be locked at the end of each workday or when unsupervised;
C. Desks, workstation, work areas, printers and fax machines, and common shared work areas will be cleared of all documents containing sensitive information when not in use;
D. Whiteboards, dry-erase boards, writing tablets, etc. in common shared work areas will be erased, removed, or shredded when not in use;
E. When documents containing sensitive information are discarded they will be placed inside a locked shred bin or immediately shredded using a mechanical cross cut or Department of Defense (DOD)-approved shredding device. Locked shred bins are labeled “Confidential paper shredding and recycling.” District records, however, may only be destroyed in accordance with board policy 3570.
Electronic Distribution
All employees, students, vendors and contractors shall comply with the following security guidelines for the maintenance of electronic records:
A. Internally, sensitive information may be transmitted using approved e-mail. All sensitive information must be encrypted when stored in an electronic format in accordance with board policies 3570 District Records and 6142.10 Technology.
B. Any sensitive information sent externally must be encrypted and password protected and only to approved recipients. Additionally, a statement such as this should be included in the e-mail:
“This message may contain confidential and/or proprietary information and is intended for the person/entity to whom it was originally addressed. Any use by others is strictly prohibited.”
C. All security protocols issued in the district’s technology plan and acceptable use policy.
NJSBA Review/Update: June 2011
Adopted: October 24, 2011
Key Words
Identity theft, Fraud, Sensitive information, Payment for Goods and Services, Bills, Credit Card Security
Legal References: N.J.S.A. 18A:19-1 Expenditure of funds on warrant only; requisites
N.J.S.A. 18A:19-2 Requirements for payment of claims; audit of claims in general
N.J.S.A. 18A:19-3 Verification of claims
N.J.S.A. 18A:19-4 Audit of claims, etc., by secretary; warrants for payment
N.J.S.A. 18A:19-4.1 Account or demand; audit; approval
N.J.S.A. 18A:19-9 Compensation of teachers, etc., payrolls
N.J.S.A. 18A:22-8.1 Transfer of amounts among line items and program categories
N.J.S.A. 2C:21-17 Impersonation, theft of identity
N.J.A.C. 6A:23A-6.10 Financial system and payment approval process
N.J.A.C. 6A:23A-16.8 Petty cash funds
Possible
Cross References: *3320 Purchasing procedures
*3326 Payment for goods and services
*3327 Relations with vendors
*4112.6/4212.6 Personnel Records
4142/4242 Salary checks and deductions
*5125 Student Records
*6142.10 Technology
*Indicates policy is included in the Critical Policy Reference Manual.