SOCIAL SECURITY ADMINISTRATION

UNIVERSITIES' USE OF SOCIAL
SECURITY NUMBERS AS STUDENT
IDENTIFIERS IN REGION IV

December 2004

A-08-05-15034

AUDIT REPORT

Mission

We improve SSA programs and operations and protect them against fraud, waste, and abuse by conducting independent and objective audits, evaluations, and investigations. We provide timely, useful, and reliable information and advice to Administration officials, the Congress, and the public.

Authority

The Inspector General Act created independent audit and investigative units, called the Office of Inspector General (OIG). The mission of the OIG, as spelled out in the Act, is to:

Conduct and supervise independent and objective audits and investigations relating to agency programs and operations.
Promote economy, effectiveness, and efficiency within the agency.
Prevent and detect fraud, waste, and abuse in agency programs and operations.
Review and make recommendations regarding existing and proposed legislation and regulations relating to agency programs and operations.
Keep the agency head and the Congress fully and currently informed of problems in agency programs and operations.

To ensure objectivity, the IG Act empowers the IG with:

Independence to determine what reviews to perform.
Access to all information necessary for the reviews.
Authority to publish findings and recommendations based on the reviews.

Vision

By conducting independent and objective audits, investigations, and evaluations, we are agents of positive change striving for continuous improvement in the Social Security Administration's programs, operations, and management and in our own office.

MEMORANDUM

Date: December 9, 2004

To: Paul D. Barnes
Regional Commissioner Atlanta

From: Assistant Inspector General for Audit

Subject: Universities' Use of Social Security Numbers as Student Identifiers in Region IV (A-08-05-15034)

OBJECTIVE

Our objective was to assess universities' use of Social Security numbers (SSN) as student identifiers and the potential risks associated with such use.

BACKGROUND

Millions of students enroll in educational institutions each year. To assist in this process, many colleges and universities use students' SSNs as personal identifiers. The American Association of Collegiate Registrars and Admissions Officers found that half of member institutions that responded to a 2002 survey used SSNs as the primary student identifier. Although no single Federal law regulates overall use and disclosure of SSNs by colleges and universities, the Privacy Act of 1974, the Family Educational Rights and Privacy Act, and the Social Security Act, contain provisions that govern disclosure and use of SSNs. See Appendix A for more information on the specific provisions of these laws.

We selected a sample of 16 educational institutions in Region IV. For each selected school, we interviewed university personnel and reviewed school policies and practices for using SSNs. In addition, we identified two schools that no longer used SSNs as student identifiers and determined reasons for this change and best practices that could be adopted by other schools. See Appendices B and C for additional details regarding the scope and methodology of our review and a list of the universities we contacted, respectively.

RESULTS OF REVIEW

Based on our interviews with university personnel and reviews of school policies and practices, we are concerned about universities' use of SSNs as student identifiers. We identified numerous instances in which universities used SSNs as the primary student identifier or for other purposes, even when another identifier would suffice. Based on our previous audit and investigative findings, we know that unnecessary use of SSNs increases the potential for unscrupulous individuals to illegitimately gain access to these numbers and misuse them, thus creating SSN integrity issues. Some university personnel with whom we spoke shared our concern and have taken steps to reduce SSN use.

UNIVERSITIES' USE OF SSNs IS WIDESPREAD

Despite the increasing threat of identity theft, some colleges and universities continue to use SSNs as primary student identifiers. Our visits to eight colleges and universities and telephone interviews with eight others in Region IV disclosed that universities' use of SSNs is widespread. We determined that some colleges and universities used SSNs for student identification cards, applications for admissions, class registration, access to computer systems, class rosters, grade reports, and billing notices.

In addition, we identified numerous instances nationwide in which universities requested that prospective students provide their SSNs on postcards. Colleges and universities routinely send postcards to be completed by prospective students who have requested information about the school. These postcards, in addition to name, address and graduation information, request the prospective student's SSN. Displaying such information on a postcard increases the risk of SSN misuse and unnecessarily subjects the prospective student to the possibility of identity theft.

Exhibit 1: Postcard Requesting Student SSN

One university official told us his State has an electronic transcript request system that requires SSNs. This State-wide student database requires that SSNs match and track students across educational institutions. Other university officials told us their school uses the SSN because it is a universal identification number. Although students may request that the school assign a random nine-digit identification number, officials told us the school does not encourage this practice. University officials also told us that campus bookstore personnel ask students for their student identification number (which is their SSN) to track students' book purchases.

Another university official told us her school began using SSNs as student identifiers when it converted from the quarter to semester system in 1977. She told us this practice gave students a consistent number they could remember. Also, another university official told us the student identification card includes the SSN. Students use this card for check cashing, registration, transcript request, and book vouchers. Further, other university officials told us some students include their SSNs on tests and research papers.

Although we did not identify instances in which individuals misused students' SSNs at the schools we contacted, we believe the potential for such activity exists. In fact, university personnel acknowledged the potential risks for identity theft and fraud, and some have taken steps to reduce their reliance on SSNs. One university official told us her school plans to stop using the SSN as the primary student identification number by fall 2007 and will only use it for financial aid and tax purposes.

POTENTIAL RISKS ASSOCIATED WITH COLLECTING AND USING SSNs

While the schools we selected did not report any instances of identity theft or fraud, many universities' collection and use of SSNs entail certain risks. Each time an individual divulges his or her SSN, the potential for a thief to illegitimately gain access to bank accounts, credit cards, driving records, tax and employment histories and other private information increases. We believe the following examples illustrate students' risk of exposure to such activity. Because many universities still use SSNs as the primary student identifier, students' exposure to identity theft and fraud remains today.

A university professor in Washington was indicted on 33 counts of mail fraud in a scam using students' SSNs. The professor allegedly accessed the university's records system and used students' information to obtain new SSN cards by posing as a parent. The professor then allegedly used the SSNs to obtain credit cards and birth certificates.

California authorities arrested a man suspected of stealing the names and SSNs of 150 college students and using that information to obtain credit cards and charge over $200,000 in the students' names.

A New York school notified about 1,800 students that their SSNs and other personal information had been posted on a university website. The university shut down the website and apologized to the students in an e mail.

A student at a Texas university was accused of hacking into the school's computer network and downloading the names and SSNs of over 55,000 students, faculty, and alumni.

A gentleman discovered a computer printout in a trash bin near a Pennsylvania university listing SSNs and other personal data for hundreds of students.

SOME UNIVERSITIES AND STATES HAVE TAKEN STEPS TO LIMIT SSN USE

Numerous incidences of identity theft at colleges and universities and the recognition that SSNs are linked to vast amounts of personal information have led some schools to reconsider the practice of using SSNs as primary student identifiers. Several schools have taken steps to reduce their reliance on SSNs or have turned to alternative identifiers. In addition, some States have enacted laws to regulate college and university use of SSNs.

For example, in 2003, the Georgia Institute of Technology (Georgia Tech) stopped using SSNs of students, faculty, and staff on identification cards and as the primary means of identification in campus databases because of increased identity theft concerns. To replace SSNs, Georgia Tech created the Georgia Tech Identification Number, a unique number the school uses to identify students in most major campus databases. The Associate Registrar told us the conversion from using SSNs as the primary student identifier took about 2 years of planning but was not difficult. In fact, she stated the actual conversion took only 1 weekend. Georgia Tech has provided information to other schools to assist them in their SSN conversion efforts. Georgia Tech collects SSNs for certain services, for example, payroll, immigration and financial aid.

In 2003, the University of Florida replaced the SSN as a student identifier and key to student records with an eight-digit public identification number to reduce the visibility of the SSN during normal university business. The University of Florida changed to an eight-digit number so students would not confuse it with their SSN. Students also have a Gatorlink username and password for on-line class registration and other applications. According to the University Registrar, the conversion from SSNs to an eight-digit student identifier was challenging as it affected every administrative system. He told us it took the university 1-2 years of planning before the conversion. The Registrar also told us that faculty members no longer have access to students' SSNs. While some university offices (admissions, registrar, student financial affairs and university financial services) still need SSNs to perform their duties, faculty and staff do not ask for SSNs, and students are informed that University personnel should not ask for their SSN. The University Registrar told us the University of Florida offices will not collect or use SSNs unless they are needed for State and federally mandated requirements.

Other colleges and universities have taken steps to limit SSN use. Arizona State University, the University of Michigan, Penn State University, the University of Maryland, the University of Illinois, and the University of Texas have specific policies regarding SSN disclosure and use and have stopped using SSNs as the primary student identification number. In addition, several States, including Arizona, New York, Maryland, Rhode Island, and Wisconsin have enacted laws to regulate college and university SSN use.

CONCLUSION AND RECOMMENDATIONS

Despite the potential risks associated with using SSNs as primary student identifiers, many colleges and universities continue this practice. While we recognize that SSA cannot prohibit colleges and universities from using SSNs as student identifiers, we believe SSA can help reduce potential threats to SSN integrity by encouraging schools to limit SSN collection and use. We also recognize the challenge of educating such a large number of educational institutions. However, given the potential threats to SSN integrity, such a challenge should not discourage SSA from taking steps to safeguard SSNs. Accordingly, we recommend that SSA:

1. Coordinate with colleges/universities and State/regional educational associations to educate the university community about the potential risks associated with using SSNs as student identifiers.

2. Encourage colleges and universities to limit their collection and use of SSNs.

3. Promote the best practices of educational institutions that no longer use SSNs as student identifiers.

AGENCY COMMENTS AND OIG RESPONSE

SSA agreed with our recommendations. We believe SSA's response and planned actions adequately address our recommendations and will help strengthen SSN integrity. The full text of SSA's comments is included in Appendix D.

Steven L. Schaeffer
Appendices

APPENDIX A - Federal Laws that Govern Disclosure and Use of the Social Security Number
APPENDIX B - Scope and Methodology
APPENDIX C - Educational Institutions Contacted
APPENDIX D - Agency Comments
APPENDIX E - OIG Contacts and Staff Acknowledgments

Appendix A
Federal Laws that Govern Disclosure and Use of the Social Security Number
The following Federal laws establish a general framework for disclosing and using the Social Security number (SSN).

The Privacy Act of 1974 (5 U.S.C. § 552a, note; Pub. L. No. 93-579, §§ 7(a) and 7(b))

The Privacy Act of 1974 provides that it is unlawful for a State government agency to deny any person a right, benefit, or privilege provided by law based on the individual's refusal to disclose his/her SSN, unless such disclosure was required to verify the individual's identity under a statute or regulation in effect before January 1, 1975. Further, under Section 7(b), a State agency requesting that an individual disclose his/her SSN must inform the individual whether the disclosure is voluntary or mandatory, by what statutory or other authority the SSN is solicited, and what uses will be made of the SSN.

The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99)

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. FERPA applies to those schools that receive funds under an applicable program of the U.S. Department of Education. Under FERPA, an educational institution must have written permission from the parent or eligible student to release any personally identifiable information (which includes SSNs) from a student's education record. FERPA does, however, provide certain exceptions in which a school is allowed to disclose records without consent. These exceptions include disclosure without consent to university personnel internally who have a legitimate educational interest in the information, to officials of institutions where the student is seeking to enroll/transfer, to parties to whom the student is applying for financial aid, to the parent of a dependent student, to appropriate parties in compliance with a judicial order or lawfully issued subpoena, or to health care providers in the event of a health or safety emergency.

The Social Security Act

The Social Security Act provides that "Social Security account numbers and related records that are obtained or maintained by authorized persons pursuant to any provision of law, enacted on or after October 1, 1990, shall be confidential, and that no authorized person shall disclose any such Social Security account number or related record." (42 U.S.C. §405(c)(2)(C)(viii)). The Social Security Act also provides that "[w]hoever discloses, uses, or compels the disclosure of the social security number of any person in violation of the laws of the United States; shall be guilty of a felony…"
(42 U.S.C. §408(a)(8)).

Appendix B
Scope and Methodology
To accomplish our objective, we

interviewed selected university personnel responsible for student admissions/registrations;

reviewed Internet websites of 18 colleges and universities that we contacted;

reviewed applicable laws and regulations; and

reviewed selected studies, articles and reports regarding universities' use of Social Security numbers as student identifiers.

We visited eight educational institutions and interviewed personnel at eight others to learn more about their policies and practices for using Social Security numbers as student identifiers. In addition, we identified two schools that no longer used Social Security numbers as student identifiers and determined reasons for this change and best practices that could be adopted by other schools. The Social Security Administration entity reviewed was the Office of the Deputy Commissioner for Operations. We conducted our audit from June through September 2004 in accordance with generally accepted government auditing standards.

Appendix C
Educational Institutions Contacted
We interviewed personnel at 18 educational institutions in Region IV. The following table shows the names and locations of these schools as well as their total student enrollments.

School
Location
Student Enrollment

1
University of Florida
Gainesville, Florida
48,000

2
Florida State University
Tallahassee, Florida
36,683

3
University of Kentucky
Lexington, Kentucky
34,182

4
Georgia State University
Atlanta, Georgia
28,170

5
University of South Carolina - Columbia
Columbia, South Carolina
25,288

6
East Carolina University
Greenville, North Carolina
21,756

7
Middle Tennessee State University
Murfreesboro, Tennessee
21,163

8
Georgia Institute of Technology
Atlanta, Georgia
16,643

9
University of Alabama at Birmingham
Birmingham, Alabama
16,357

10
Mississippi State University
Starkville, Mississippi
16,226

11
Tennessee Tech University
Cookeville, Tennessee
9,107

12
Jefferson State Community College
Birmingham, Alabama
7,376

13
North Carolina Central University
Durham, North Carolina
7,191

14
Gulf Coast Community College
Panama City, Florida
5,341

15
Kentucky State University
Frankfort, Kentucky
2,315

16
Mississippi University for Women
Columbus, Mississippi
2,100

17
Atlanta Metropolitan College
Atlanta, Georgia
1,907

18
Anderson College
Anderson, South Carolina
1,600

Source: We determined student enrollment by reviewing university websites or one of the following websites: www.collegeboard.com or www.uscollegesearch.org.

Appendix D
Agency Comments

The Atlanta Region welcomes the opportunity to review and provide feedback on the OIG Draft Report, "Universities' Use of Social Security Numbers as Student Identifiers in Region IV" (A-08-05-15034).

We offer the following comments on the recommendations presented:

1. Coordinate with colleges/universities and State/regional educational associations to educate the university community about the potential risks associated with using SSNs as student identifiers.

Comments: The Atlanta Region supports this recommendation. We will stress to the institutions and educational associations in the Region the potential risks associated with using SSNs as student identifiers. We will work through our local offices to educate the colleges/universities throughout the Region.

2. Encourage colleges and universities to limit their collection and use of SSNs.

Comments: We are in agreement with this recommendation and we will discourage the collection and use of the SSN by colleges and universities.

3. Promote the best practices of educational institutions that no longer use SSNs as student identifiers.

Comments: We support this recommendation. We will seek information from various institutions and promote the best practices of educational institutions that no longer use SSNs as student identifiers.

Questions concerning these comments may be directed to Ray West of the RSI Programs Team at (404) 562-1321.

Paul D. Barnes
Regional Commissioner

Appendix E
OIG Contacts and Staff Acknowledgments
OIG Contacts
Kimberly A. Byrd, Director, (205) 801-1605
Jeff Pounds, Audit Manager, (205) 801-1606

Acknowledgments
In addition to those named above:
Neha Smith, Auditor-in-Charge
Kathy Youngblood, Senior Auditor
Susan Phillips, Auditor
Kimberly Beauchamp, Writer-Editor

For additional copies of this report, please visit our web site at www.ssa.gov/oig or contact the Office of the Inspector General's Public Affairs Specialist at (410) 965-3218. Refer to Common Identification Number A-08-05-15034.

Overview of the Office of the Inspector General

The Office of the Inspector General (OIG) is comprised of our Office of Investigations (OI), Office of Audit (OA), Office of the Chief Counsel to the Inspector General (OCCIG), and Office of Executive Operations (OEO). To ensure compliance with policies and procedures, internal controls, and professional standards, we also have a comprehensive Professional Responsibility and Quality Assurance program.

Office of Audit

OA conducts and/or supervises financial and performance audits of the Social Security Administration's (SSA) programs and operations and makes recommendations to ensure program objectives are achieved effectively and efficiently. Financial audits assess whether SSA's financial statements fairly present SSA's financial position, results of operations, and cash flow. Performance audits review the economy, efficiency, and effectiveness of SSA's programs and operations. OA also conducts short-term management and program evaluations and projects on issues of concern to SSA, Congress, and the general public.

Office of Investigations

OI conducts and coordinates investigative activity related to fraud, waste, abuse, and mismanagement in SSA programs and operations. This includes wrongdoing by applicants, beneficiaries, contractors, third parties, or SSA employees performing their official duties. This office serves as OIG liaison to the Department of Justice on all matters relating to the investigations of SSA programs and personnel. OI also conducts joint investigations with other Federal, State, and local law enforcement agencies.

Office of the Chief Counsel to the Inspector General

OCCIG provides independent legal advice and counsel to the IG on various matters, including statutes, regulations, legislation, and policy directives. OCCIG also advises the IG on investigative procedures and techniques, as well as on legal implications and conclusions to be drawn from audit and investigative material. Finally, OCCIG administers the Civil Monetary Penalty program.

Office of Executive Operations

OEO supports OIG by providing information resource management and systems security. OEO also coordinates OIG's budget, procurement, telecommunications, facilities, and human resources. In addition, OEO is the focal point for OIG's strategic planning function and the development and implementation of performance measures required by the Government Performance and Results Act of 1993.