Gramm-Leach-Bliley Act (GLBA)

The objectives of the GLBA Safeguards Rule are to:

• Ensure the security and confidentiality of customer information, including nonpublic personal information (NPI).
• Protect against any anticipated threats or hazards to the security of such information.
• Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to customers.

To comply, a covered institution must develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards appropriate to the organization’s size and complexity, nature, and scope of activities, and sensitivity of NPI at issue.

Requirements include:

• Designating an employee(s) to coordinate the information security program.
• Performing a risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (including NPI) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assessing the sufficiency of any safeguards in place to control these risks. At minimum, the risk assessment must include consideration of risk in each relevant operational area, including:

• • Employee training and management.
  • Information systems, including network and software design, as well as information processing, storage, transmission, and disposal.
  • Detecting, preventing, and responding to attacks, intrusions, or other systems failures.
• Implementing information safeguards to control identified risks and regularly testing or otherwise monitoring the effectiveness of the safeguards’ key controls, systems, and procedures.
• Overseeing service providers by taking reasonable steps to select and retain providers capable of maintaining appropriate safeguards for NPI and requiring them by contract to implement and maintain such safeguards.
• Evaluating and adjusting the information security program in light of the results of the required testing/monitoring, any material changes to operations or business arrangements, or any other circumstances that may have a material impact on the program.

NPI is any “personally identifiable financial information” that the College collects about an individual in connection with providing a financial product or service, including student financial aid and other business transactions, unless that information is otherwise “publicly available.” NPI includes:

• any information an individual gives you to get a financial product or service (for example, name, address, income, Social Security number, or other information on an application);
• any information you get about an individual from a transaction involving your financial product(s) or service(s) (for example, the fact that an individual is your consumer or customer, account numbers, payment history, loan or deposit balances, and credit or debit card purchases); or
• any information you get about an individual in connection with providing a financial product or service (for example, information from court records or from a consumer report).

 Following are examples of NPI that may be obtained in connection with the delivery of a financial product or service:

• Account balances
• ACH numbers
• Bank account numbers
• Credit card numbers
• Credit ratings
• Date and/or location of birth
• Driver’s license information
• Income history
• Payment history
• Social Security numbers
• Tax return information
• Name, address, phone number on an application for financial aid

More information about what Nonpublic Personal Information includes and does not include can be found on the Federal Trade Commission site.

The Written Information Security Plan outlines safeguards the College follows to secure nonpublic personal information to ensure compliance with the GLBA.  Mandatory annual training in GLBA compliance, including safeguarding of NPI, is assigned to all College employees.

Organizational units that collect/maintain NPI that must be safeguarded are typically involved in the provision or servicing of student loans, other extensions of credit, and collection services.

If your department collects, processes, maintains, or otherwise handles NPI that is obtained when the College offers or delivers a financial product or service to an individual for personal, family, or household purposes, your department must comply with the GLBA Safeguards Rule. If your department accesses or maintains protected data (even if the unit does not have primary responsibility for offering the financial product or service), you must comply with the Safeguards Rule.

Following are examples of administrative, technical, and physical safeguards that should be implemented at the departmental level to protect NPI:

Administrative

• Limit access to customer information to employees who have a business reason to see it.
• Provide regular training and reminders to all employees of the requirement to keep customer information secure and confidential.

Technical

• Know where sensitive customer information is stored electronically and store it securely. Make sure only authorized employees have access.
• Take steps to ensure the secure transmission of customer information.
• Dispose of customer information in a secure way.
• Maintain up-to-date and appropriate programs and controls to prevent unauthorized access to customer information.
• Use appropriate oversight or audit procedures to detect the improper disclosure or theft of customer information.

Physical

• Know where sensitive customer information is stored physically and store it securely. Make sure only authorized employees have access.
• Dispose of physical NPI through a secure shredding service.
• Ensure that storage areas are protected against destruction or damage from physical hazards, like fire or floods.

The Burrell College of Osteopathic Medicine has implemented several policies and standard operating procedures (SOPs) to secure any financial nonpublic personal information that is collected and stored by the College. These policies and SOPs outline steps those at the College take to ensure all NPI safeguarding and policy compliance.

Relevant Policies:

• B1042 Confidentiality
• B2050 Data Security
• B2060 Acceptable Electronic Communications Use
• B2090 Records Retention
• B7525 Compliance Training
• B9030 Secure Student Records

All Policies can be found here.

Relevant Standard Operating Procedures:

• ADM.005 Admissions Transference of Records
• FIN.007 Creation New Accounts Chart Accounts Maintenance
• FIN.008 Financial Human Resource System Access Control
• GA.004 Records Retention
• IT.002 Institutional Data Security
• IT.004 Data Encryption And Transfer
• IT.006 Information Security Plan
• SA.007 Student Record Tracking
• SA.021 Background Check and Drug Screening

All Standard Operating Procedures can be found here.