New Indiana Laws Affecting Information Security

Note: This article summarizes content that previously appeared in an e-mail message from President Adam W. Herbert dated June 23, 2006.

Three new laws passed by the Indiana legislature took effect on July 1, 2006, and affect how IU employees handle employee and student personal information. These laws impose certain obligations to protect the following types of information:

• Social Security Numbers
• Credit card numbers
• Financial account numbers
• Debit card numbers
• Security codes, access codes and passwords
• Drivers license numbers
• State identification card numbers

The three laws differ in certain ways, but basically require that the University:

• NOT disclose outside of IU more than the last four digits of an individuals Social Security Number unless we have the individual’s express written permission or the disclosure (1) is required by law or (2) falls within one of several relatively narrow exceptions;

• Dispose of the personal information described above in a secure manner, so that third parties cannot obtain and use (or misuse) that information; and

• Notify individuals whose personal information reasonably appears to have been exposed to unauthorized access as a result of a system security breach.

The Web site at itpo.iu.edu/policies/bestpractices/dataprotection.html contains further details concerning the university’s obligations under these new laws. Failure to comply with certain sections of these statutes can expose employees to criminal penalties.

Next: HIPAA Privacy Practices