Red Flag Policy

L&C has established an Identity Theft Prevention Program to detect, prevent and mitigate identity theft. The Program consists of policies and procedures to insure that any financial transactions you may have with the College are protected and secure from inappropriate access. Warning signs, or “red flags,” that signal possible attempts at identity theft such as suspicious patterns of activity in an account are monitored. When detected, specific steps are be taken to prevent a red flag from escalating into a costly incident of identity theft.

Purpose

This Program establishes reasonable processes and procedures for identifying and mitigating identity theft of covered accounts.

Definitions

• Covered Account means an account in which the payments for services are conducted in multiple payments or transactions or when there is a foreseeable risk of identity theft. A covered account would include any account where the full payment for services is not made at the time of services, including

  • Allowing students to pay tuition in an installment plan; and
  • Allowing students to obtain clinical/dental services which will be charged to their Student Health Plan.
• Identity Theft means fraud committed using the identifying information of another person.
• Red Flag means a pattern, practice or specific activity that indicates the possible existence of Identity Theft.
• Service Provider means an organization that performs an activity in connection with a covered account.

Policy

• The Identity Theft Prevention program establishes reasonable policies and procedures to combat identity theft in connection with opening and maintaining a covered account, including methods to:

  1. Identify relevant Red Flags based on the risk factors associated with Covered Accounts
  2. Institute policies and procedures for detecting Red Flags
  3. Identity steps staff will take to prevent and mitigate Identity Theft
  4. Create a system for regular updates and administrative oversight to the program.

Procedure

Lewis & Clark will periodically perform a risk assessment to determine the types of Covered Accounts maintained, the methods used to open Covered Account, methods used to provide access to Covered Accounts and previous experience with identity theft.

1. Appendix A identifies the Red Flags that would be most relevant to Lewis & Clark as well as suggested response to a detected Red Flag.
   1. Once a Red Flag has been detected, all Covered Account transactions are to be placed on hold and the event reported to The Vice President of Enrollment Services, who will determine ongoing response activities.
2. In order to impede identity theft, Lewis & Clark staff may verify student identity by:
   1. Requiring picture identification at new student orientation;
   2. Requiring picture identification when conducting any paperwork related to a covered account;
   3. Verifying identification of student before providing any information via telephone or other form of written exchange. The student identifiers will include:
      1. Name as it appears in student file
      2. Date of birth
      3. Last 4 digits of SSN or Student Identification Number
3. In order to mitigate the likelihood of Identity Theft occurring with respect to Covered Accounts, Lewis & Clark may take the following prevention steps with respect to its internal procedures to protect student identifying information:
   1. a. All established policies that apply to the protection and security of student information will apply to the protection and security of student’s identifying information. Examples include and are not limited to policies for:
      1. Use, transmission and storage of paper documents and electronic media containing personal identifying information
      2. Use and storage of lap tops
      3. Network and software security
   2. Avoid the public accessibility of the full social security number in electronic database and/or other related written documents and limit disclosure of such information to a need to know basis
      1. In the event the full social security number is needed for continuation of services (i.e., needed for insurance benefit confirmation), access to this information will be on a need to know basis
   3. Avoid the use of the full social security number as a student identifier
   4. Any data storage media, including intake logs and other written work sheets used to transmit student’s personal information to the posting location which are otherwise not retained, will be shredded prior to placing in the trash
   5. Student identifying information that is required to be retained on site will be in a secure location, i.e., locked office, locked file cabinet, with access limited to staff with a need to know
   6. Any student personal identifying information transported to an external location will be at all times maintained in the direct control of an authorized Lewis & Clark employee who will maintain reasonable procedures to protect the confidentiality of the information.
4. The Vice President of Enrollment Services has been given authority and responsibility for the implementation and administration of the Program. These responsibilities include, but are not limited to:
   1. Ensure training of staff who have a role in complying with elements of the Program
   2. Review any incidents of actual and/or potential identity theft and determine which response and mitigation steps should be taken in a particular situation
   3. Periodic review of the effectiveness of the Program
   4. Update the Program to reflect the addition or removal of Covered Accounts and changes in risks to students/covered account holders from Identity Theft.
5. Lewis & Clark will require contractually that a service provider that performs activities in connection with Covered Accounts has established and follows their own Identity Theft Prevention Program.
6. All information resulting from investigation into actual and/or potential identity theft will be considered confidential and will not be disclosed unless required by state or federal law.
7. The FTC’s Template Red Flag Program is incorporated into this policy and attached hereto as Appendix B.

APPENDIX A