Identity Theft Rules Cover Non-Profits, Including Institutions of Higher Education

Created by Rodney J. Petersen (EDUCAUSE) on October 8, 2008

New federal regulations to address identity theft go into effect November 1, 2008, and are likely to affect colleges and universities in nuanced ways. Compliance will require careful study and collaboration among business officers, human resources, legal counsel, student services, IT, and other affected campus units. The rules require users of consumer reports to develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency. They also require that institutions develop and implement an Identity Theft Prevention Program for combating identity theft in connection with new and existing accounts.

The "Red Flags Rules" apply to "creditors" with "covered accounts", according to guidance issued by the Federal Trade Commission. The guidance indicates that "where non-profit and government entities defer payment for goods and services, they, too, are to be considered creditors". It also explains that a "covered account" is alson an account "for which there is a foreseeable risk of identity theft." It is quite possible that student or employee loans, including the payment of tuition over time, are examples of accounts that are covered by the new rule. The rule requires the development and implementation of "a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account."

A related rule requires users of consumer reports to "develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency." This provision would likely cover credit checks, possibly including criminal background checks, that are conducted for employees.

Institutions who are striving to come into compliance should consult the Final Rules, FTC Guidance, and seek the advice of legal counsel.

For more information, consult a Resource Page established by EDUCAUSE.

Rodney's blog
Login or register to post comments
648 reads

		Identity Theft Rules Cover Non-Profits, Including Institutions of Higher Education Created by Rodney J. Petersen (EDUCAUSE) on October 8, 2008 New federal regulations to address identity theft go into effect November 1, 2008, and are likely to affect colleges and universities in nuanced ways. Compliance will require careful study and collaboration among business officers, human resources, legal counsel, student services, IT, and other affected campus units. The rules require users of consumer reports to develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency. They also require that institutions develop and implement an Identity Theft Prevention Program for combating identity theft in connection with new and existing accounts. The "Red Flags Rules" apply to "creditors" with "covered accounts", according to guidance issued by the Federal Trade Commission. The guidance indicates that "where non-profit and government entities defer payment for goods and services, they, too, are to be considered creditors". It also explains that a "covered account" is alson an account "for which there is a foreseeable risk of identity theft." It is quite possible that student or employee loans, including the payment of tuition over time, are examples of accounts that are covered by the new rule. The rule requires the development and implementation of "a written Identity Theft Prevention Program that is designed to detect, prevent, and mitigate identity theft in connection with the opening of a covered account or any existing covered account." A related rule requires users of consumer reports to "develop reasonable policies and procedures to apply when they receive a notice of address discrepancy from a consumer reporting agency." This provision would likely cover credit checks, possibly including criminal background checks, that are conducted for employees. Institutions who are striving to come into compliance should consult the Final Rules, FTC Guidance, and seek the advice of legal counsel. For more information, consult a Resource Page established by EDUCAUSE. Washington Update \| Cybersecurity \| Cybersecurity Policy \| fraud \| ID Theft Red Flags \| Identity and Access Management \| Identity Theft \| Student Services Rodney's blog Login or register to post comments 648 reads
		© Copyright 1999-2009 EDUCAUSE Need Help? \| Feedback \| Privacy Policy
	Unless otherwise noted, EDUCAUSE holds the copyright on all materials published by the association, whether in print or electronic form. In certain cases the work remains the intellectual property of the individual author(s) (see Special Circumstances). Content from conference speeches, presentations, blogs, wikis and feeds reflect the opinions of the author, and not necessarily those of EDUCAUSE or its members.