Integrity in action:
Safeguarding confidential information

We conduct business in a complicated, fast-paced, and service-oriented culture. Requests for information pour in through e-mail, error reports, telephone inquiries, surveys, drop-in visits, and other means of communication too numerous to mention.

In response, we gather, store, retrieve, and analyze a wide range of data. Ready access to data is essential for good customer service, but an easy and quick reporting culture has given rise to concerns for privacy.

What?s all the fuss about?

Focusing attention on this issue is important for a couple of reasons. First, Purdue?s culture values integrity. We take this seriously. A formalized Statement of Integrity actually spells out our responsibilities to act ethically and in a manner that builds trust. Confidentiality is an integral part of integrity.

Another reason is risk. The list of laws enacted to safeguard information is growing. Health Insurance Portability and Accountability Act (HIPAA) and Gramm-Leach-Bliley (GLB) privacy rules are the most recent additions to the protections already in place from Americans with Disability Act (ADA), Family Educational Rights and Privacy Act (FERPA), Worker?s Compensation (WC) and various other laws that have shaped the way we do business. Improper disclosure of private information is harmful and damages reputations. In addition to resources required for investigating and correcting problems, the law allows for civil penalties against individuals and/or institutions found to be in violation of the law.

It makes good business sense to raise awareness and offer guidelines to members of the Purdue community to help them deal with information thoughtfully and carefully.

What is confidential?

Purdue is a large, decentralized, and diverse organization; we are subject to many overlapping rules and regulations. It?s simply not possible to define every situation and every data element that might be considered confidential. However, some categories of information clearly require cautious and discrete use. All supervisors and business office staff should be careful about sharing the following kinds of information:

* Age * Gender

* Disability status * Social Security number

* Home address and telephone * Salary history

* Benefits enrollment choices * Medical claims, diagnosis, or injury reports

* Performance issues * Deduction amounts taken from pay

* Termination reasons * Credit card transaction data

* Student records

Some departments at the University require special training if the primary function of one of its units is receiving and transmitting protected information. Specialized training has been developed for these areas.

Shhhhh. It?s not just confidential at your desk.

Integrity requires congruence between your professional life and your personal habits. Conversations overheard, chats by the coffee pot, and information that comes to you incidentally need to be treated with the same caution as a letter or e-mail correspondence that lands on your desk.

After you move to another position, private information remains confidential. Reporting to another department or organization does not relieve you of the responsibility of safeguarding protected information.

Tips, techniques, and best practices

Here are ways you can help protect confidential information.

Telephone:

	Check out your surrounding while you are on the telephone. Who can overhear? Discuss confidential information quietly.
	If you cannot speak directly to the person you need to reach, leave generic messages.