I posted earlier on my efforts as Records Manager at UCSC.
Currently, I am doing similar work for a power utility. As you can
imagine there are some similarities and differences.
This could be much longer, but I'll speak to 2 major differences and 1
major similarity.
Major Difference: Computing System Standards
At the University I spent a lot of time identifying where PII (Personal
Identity Information) resided and working to educate staff. Like most,
our university had very few computing standards and many relatively
independent IT groups, so finding electronic PII was quite an effort. We
did not focus on PII in paper format, except in the case of Medical
Records in our Student Health Center (to meet HIPPA/HIPAA) and Staff HR.
At the utility we have a solid computing standards, centrally managed IT
environment and it is relatively easy to ID computing systems and where
PII resides.
Major Difference: Prolific PII
PII in an academic institution can exist in many contexts: academic
records, financial records (students and parents), experiment
information, faculty and student disciplinary records, recruiting
records, identification cards, insurance waivers, gym membership,
department records, faculty class lists, employee records, etc... Folks
may recall that UC, like many U's, used ssn's for student numbers until
a few years ago, so all the boxes of graded exams in the hallways had
ss#'s and names out for the public to paw through at their leisure. It
is amazing that ID theft did not happen more often!
As you can imagine, a utility has classic customer information, thus it
is not as prolific as an academic institution: bill payments (bank
account info), credit info, home address and phone, employee records,
and the like. I did have to initiate and expand a shredding program for
the company to meet FACTA requirements.
Major Similarity: Standards, Education, Responsibility, Accountability
When it comes down to it, the RIM program (here and at UCSC we called it
Information Asset Management - IAM - see sig below) must set the
standards (policy/guidelines/roles with reviewed by legal) and educate;
all employees (executives, admin staff and IT) must know their
responsibility around PII; All, even the RIM program must be held
accountable though audit for performing their roles.
Chuck Piotrowski
CVPS
www.cvps.com
This computer runs on Cow Power!
Information Asset Management (IAM) is the creation, control,
distribution, retention and final disposition of information in
accordance with laws, regulations and best business practices. The goal
is to ensure an open, compliant, efficient and cost effective
information environment at CVPS.
-----Original Message-----
From: Records Management Program [mailto:[log in to unmask]] On
Behalf Of J. Michael Pemberton
Sent: Monday, May 01, 2006 11:51 AM
To: [log in to unmask]
Subject: [RM] RIMs and ID Theft?
We're all interested in and concerned about identify theft. Have any
RIMs been directly involved in their organizations in addressing this
issue? If so, what kinds of initiatives have you undertaken?
Thanks,
Mike
J. Michael Pemberton, Ph.D., CRM, FAI
Executive Editor
Information Management Journal
c/o The School of Information Sciences
The University of Tennessee, Knoxville
1345 Circle Park Drive
Knoxville, TN 37996-0341
Phone: 865-974-6509
Fax: 865-974-4967
[log in to unmask]
http://www.sis.utk.edu/~pemberton/
Life: Information in Motion
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
|
