Protecting Personally Identifiable Information

Many departments at MSU Denver handle sensitive and confidential information about our students and fellow colleagues, known as Personally Identifiable Information (PII). Safeguarding PII is imperative due to the high risk posed to individuals and university in the event of improper disclosure.

What is PII?

PII includes any information that can be used to uniquely identify, contact, locate, or impersonate an individual, or that can be combined with other information to do so.

General PII

General PII provides general information about a person but is not considered sensitive unless it is paired with other PII. General PII includes:

  • Name
  • Email address
  • Home address
  • Phone number

Sensitive PII

Sensitive PII can, on its own, uniquely identify, contact, locate, or impersonate an individual. It is always considered confidential. Sensitive PII includes:

  • Social Security Number (SSN)
  • Educational records protected by FERPA
  • Driver’s license number
  • Passport number
  • Alien registration number
  • Financial account numbers (bank, credit card, etc.)
  • Biometric identifiers
  • Protected Health Information (PHI), which is protected by HIPAA

Combining PII Increases Risk

Some pieces of information are harmless on their own but become identified and therefore sensitive, when combined with another identifier. For example, a zip code alone doesn't identify a person, but a zip code paired with a date of birth can narrow identification down to a very small group of people, or even a single individual. Because of this "re-identification risk," the following become sensitive PII when paired with another identifier:

  • Last 4 digits of SSN
  • Mother’s maiden name
  • Date of birth
  • Place of birth
  • Medical information
  • Account passwords
  • Citizenship or immigration status
  • Ethnic or religious affiliation
  • Sexual orientation
  • Criminal history
  • Zip code

MSU Denver’s Commitment to Protect PII

MSU Denver is committed to protecting the PII of its students, faculty, staff, and other individuals associated with the University. Please do your part in protecting the PII entrusted to you.

It is the responsibility of all departments and employees to:

  • Take stock. 
    Know what PII you have in your files and on your computers.
  • Scale down.
    Keep only what you need, and only for as long as you need it. Refer to the university's records retention schedule for guidance on how long specific records must be kept. 
  • Lock it.
    Protect the information you keep, using both physical security (locked cabinets, clean-desk practices) and electronic security (access controls, encryption).
  • Pitch it.
    Properly dispose of what you no longer need.
  • Share and store cautiously.
    Never send PII via email or store it on unauthorized cloud services. Only use university-sanctioned, access-controlled storage for sensitive PII. Check with your department or the ITS Service Desk if you're unsure whether a given tool or platform is approved for this purpose.
  • Report it.
    Immediately report all suspected or confirmed privacy incidents to the ITS Service Desk.

Properly Handling PII at Work

Consider the following when handling PII:

  • PII could be in your file cabinet, in your desk, on your computer, laptop, memory stick, PDA, etc.
  • Collect only the information you are legally allowed to collect and only what you need to perform your specific business function.
  • Follow procedures for shredding documents containing PII, including CDs and other physical media.
  • Adopt a "clean-desk policy": don't leave documents with PII visible on your desk.
  • Lock up documents with PII overnight and on weekends.
  • Lock your computer when you step away from the keyboard.
  • Don't leave sensitive PII in a voicemail message or send it by email or text.
  • Protect printed or faxed documents that contain PII.
  • Don't take or send MSU Denver records containing PII or other confidential information home unless authorized to do so.
  • When PII must be stored electronically, make sure it is encrypted, both at rest and when it is transmitted.
  • Use strong passwords and never share them.

If PII Is Lost, Exposed, or Breached

Consider the following when handling PII:

  • Report the incident immediately to the ITS Service Desk, don't wait to confirm the full scope before reporting.
  • Preserve any evidence (e.g., don't delete emails or wipe a device) until ITS has advised on next steps.
  • ITS will assess the scope of the exposure, determine notification obligations under applicable law and university policy, and guide affected departments through the

Want to learn more?

Print Article