Telephone and Fax Security Policy

• Bylaws
• Policy Document
• Procedures
• Guidelines
• Form

June 2, 2004

June 2, 2004

PURPOSE

To establish a policy and procedure for transmission of protected information via telephone or fax machine that complies with Federal and State regulations.   

POLICY

It is the policy of SUNY Fredonia to protect the confidentiality and integrity of student, employee, and campus private information as required by State and Federal law, union contracts, professional ethics and accreditation agencies.  This policy applies to both internal and external telephone requests for confidential information.

Circumstances– The following circumstances outline when information may be released via telephone, following verification of the caller’s identity.

• Situation where the original results or mailed copy will not meet the immediate needs of the requester.  

• For internal requests, during system downtime, when information cannot be accessed via the computer systems.

• Only the Offices of Student Accounts and Financial Aid will disclose information to parents, and in those offices only financial information will be discussed.

Verification of Identity– The identity of the internal or external individual requesting information and the authority of the individual to have access to the information, if unknown, must be verified.

• Students will provide their Your Connection ID.

• Employees will identify themselves by name, title, department, home address, and home telephone number.  Personnel will verify the information in the most recent publication of the Faculty/Staff Directory or through the Human Resources Office.

• Parents will provide their son or daughter’s date of birth, Fredonia ID, or other verifiable identifying information.  (OFFICE OF STUDENT AFFAIRS IS VERIFYING THIS.)

• If the request is from an external organization (i.e., financial institution, government office, police department), the requestor should be informed that the request for confidential information must be documented on official agency letterhead and faxed using SUNY Fredonia’s fax policy to the appropriate number.  

• Requestors deemed unauthorized to receive confidential information will be directed to the Vice President for Student Affairs for further review of the request.

Sensitive Information– Personnel should not disclose sensitive information via telephone unless the conditions stated above (circumstances and verification of identity) and requirements under the Family Educational Rights and Privacy Act are met.  Examples of sensitive information include, but are not limited to:

• Health information

• Academic grades or assessments

• Financial information

• Social Security number

In cases where students have restricted their directory information, no information related to that individual may be released.

Voice/Answering Machines

• Protected information shall not be left on voicemail/answering machines.

Fax Machines

The following guidelines should be followed when faxing information.

• Place fax machines in areas with less traffic.  Fax machines should not be placed in public areas where there is faculty, staff, or student traffic.

• A confidential fax cover sheet should be used indicating “Confidential Information Enclosed”.

• A warning should be placed on the bottom of the fax cover sheet.  “Important Warning: This message is intended for the use of the person or entity to which it is addressed and may contain information that is privileged and confidential, the disclosure of which is governed by applicable law.  If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this information is strictly prohibited.  If you have received this message by error, please notify us immediately and destroy related message.”

• Make sure the fax cover sheet includes:  Date and time, sender’s name, authorized recipient’s name, number of pages transmitted, information regarding verification of receipt.

• Make sure the fax transmittal has received the proper authorization.

• Limit the faxing of confidential information to urgent or non-routine situations when mail or other delivery is not feasible.

• Regularly empty the fax tray so confidential information does not remain exposed on the fax machine for long periods of time.

• Confirm the accuracy of fax numbers.  All commonly used fax numbers should be programmed into the fax machine to prevent misdialed numbers.

• Verify confirmations of outgoing faxes to prevent information being sent to the incorrect recipient.

• In the event of a misdirected fax, ensure improperly faxed documents are either immediately returned or destroyed by the recipient.