APS 38.6 – Identity Theft Prevention: Red Flag Rules

(Approved by authority of the President)

Purpose

In its capacity as a creditor, the University is subject to 16 CFR 681, “Identity Theft Rules,” which requires the establishment of a written Identity Theft Prevention Program for covered accounts. To protect existing consumers, reduce risk from identity fraud, and minimize potential damage from fraudulent new accounts with the least possible impact on business operations, the University establishes this Identity Theft Prevention Program (program). Additional policies and procedures may be imposed by University entities that have unique types of covered accounts.

Scope

The program policies and guidelines apply to University entities, departments, and employees when conducting business activity relating to University covered accounts.

Definitions

Covered Account―A consumer account that the University offers or maintains primarily for personal purposes and that involves multiple payments for goods or services provided by the University, or any other account for which there is a reasonably foreseeable risk of identity theft. Covered accounts may include but are not limited to tuition receivables, student loans and collections, and patient billing.

Identity Theft―Fraud committed using the identifying information of another person.

Personally Identifiable Information―An individual’s first name and last name and at least one of the following data elements: social security number, driver’s license number or identification card number, account number, credit card number, debit card number, security code, access code, or password of an individual’s covered account.

Red Flag―A pattern, practice, or specific activity that indicates the possible existence of identity theft.

Responsibilities

The University designates institutional officials to administer, oversee, and monitor the program. Student Fiscal Services is responsible for administration of the program for all non-UW Medicine offices. UW Medicine Compliance administers UW Medicine Identity Theft Prevention Programs under applicable clinical governance structures.

Policy Statements

The University requires the identification of covered accounts and the identification, detection, and appropriate response to relevant red flags that may indicate identity theft. The Identity Theft Prevention Program is reviewed and updated periodically to reflect changes in risks, business practices, systems, and regulatory requirements.

The University requires reasonable policies and procedures to verify the identity of individuals requesting services associated with covered accounts, to protect the confidentiality of identifying information, and to investigate and respond to suspected unauthorized activity.

The University requires service providers that support covered accounts to maintain appropriate controls to detect and prevent identity theft and to cooperate with the University in responding to suspected incidents of identity theft.

The University provides training to employees and officials for whom interaction with covered accounts is reasonably foreseeable and reports on program effectiveness to the Board of Regents on an annual basis.

1. Identify Covered Accounts

University units responsible for covered accounts shall implement reasonable procedures to verify the identity of individuals requesting services, protect the confidentiality of identifying information, and investigate potentially unauthorized activity.
Units with a significant number or unique type of covered accounts shall establish additional procedures appropriate to their operational risks.
The University shall comply with applicable requirements related to address discrepancies, including verification of address information and notification to consumer reporting agencies when appropriate.
The University shall continue to meet applicable requirements under related federal and state privacy and information security laws and University policies.

2. Identification and Detection of Red Flags

The University recognizes that the following types of notices, documents, personal information, and activities may be indicators or red flags that an individual’s identity may be compromised:

2.1. Alerts, Notifications, or Warnings from a Consumer Reporting Agency

A fraud or credit alert is included with a consumer report.
A notice of credit freeze on a consumer report is provided from a consumer reporting agency.
A consumer report agency provides a notice of address discrepancy.
A consumer report indicates a pattern of activity inconsistent with the history and usual pattern of activity of a customer.

2.2. Suspicious Documents

Documents provided for identification appear to have been altered or forged.
The photograph and/or physical description on the identification is not consistent with the appearance of the customer presenting the identification.
Other information on the identification is not consistent with information provided by the person opening an account or presenting the identification.
Other information on the identification is not consistent with readily accessible information that is on file with the University.
An application appears to have been altered or forged, or gives the appearance of having been destroyed and reassembled.

2.3. Suspicious Personal Identifying Information

Personal identifying information provided is not consistent with external information sources used by the University.
Personal identifying information provided by the customer is not consistent with other personal identifying information provided by the customer.
Personal identifying information provided is associated with known fraudulent activity as indicated by internal or third-party sources used by the University.
The social security number provided is the same as that submitted by other persons opening an account or other customers.
The address or telephone number provided is the same or similar to the account number or telephone number submitted by an unusually large number of other persons opening accounts or to other customers.
The person opening the account fails to provide all required personal identifying information on an application or in response to notification that the application is incomplete.
Personal identifying information provided is not consistent with personal identifying information that is on file with the University.
If the University uses a challenge question, the customer cannot provide authenticating information beyond that which generally would be available from a wallet or consumer report.

Shortly following the notice of a change of address, the University is made aware of a new cell phone number or the addition of authorized users on the account.
A new revolving credit account is used in a manner commonly associated with known patterns of fraud.
An account is used in a manner that is not consistent with established patterns of activity on the account.
An account that has been inactive for a reasonably lengthy period of time is used.
Mail sent to the customer is returned repeatedly as undeliverable although transactions continue to be conducted in connection with the account.
The University is notified of unauthorized charges or transactions in connection with a customer’s account.

2.5. Notice from Customers, Victims of Identity Theft, Law Enforcement Authorities, or Other Persons Regarding Possible Identity Theft in Connection with Covered Accounts

The University is notified by a customer, a victim of identity theft, a law enforcement authority, or any other person that a fraudulent account has been opened.

2.6. Compromised Systems

Detection of compromised or breached systems that store covered accounts or personally identifiable information.

2.7. Additional Red Flags

The University recognizes that additional red flags may be identified by University entities, units, and/or departments for specific types of covered accounts.

3. Responding to Red Flags

The University will respond appropriately to identified and detected red flags in order to prevent and mitigate identity theft. The response will be commensurate with the degree of risk posed.

Once potentially fraudulent activity is detected, an employee must act quickly as a rapid appropriate response can protect customers and the University from damages and loss.

Approved standards and responsive action must be maintained by each unit based upon business and technical needs. The University recommends the following responses to red flags:

Alert and involve a business unit manager;
Notify designated University official;
Monitor a covered account for evidence of identity theft;
Where appropriate, change any passwords, security codes, or other security devices;
Close an existing covered account;
Reopen a covered account with a new account number if needed;
Contact customer;
Request additional documentation to validate identity;
Handle per regulatory requirements under law if applicable;
Handle per applicable University privacy and information security policies;
Notify law enforcement or regulatory entity; or
Determine no response is warranted under the particular circumstances.

4. Administration of the Program

4.1. Board Approval of Written Program

The Board of Regents adopted the program on July 16, 2009.

4.2. Designation of University Official

The University has designated the Senior Vice President for Finance, Planning & Budgeting, and for UW Medicine, the CEO of UW Medicine, Executive Vice President for Medical Affairs, and Dean of the School of Medicine, to be the program’s two institutional officials. These officials are responsible for implementing program policies, seeing that entity specific procedures are established, assigning responsibility for investigating and responding to red flags, periodically reassessing entity operations to verify where covered accounts are opened and maintained, recommending program modifications as needed, generating periodic status reports, and reporting annually to the Board of Regents’ Finance and Asset Management Committee on the effectiveness of the UW Identity Theft Prevention Program.

4.3. Training

The University will train all employees, officials, and contractors for whom contact with covered accounts is reasonably foreseeable. Training also will be provided as changes to the program are made. Training will include operating procedures for identifying and detecting identity theft as well as responding to identity theft.

4.4. Security Practices of Contractors and Service Providers

The University expects all third party contractors and service providers who handle covered accounts to follow and be compliant with all federal, state, and local laws or regulations that are applicable to the University, as well as University policies and procedures that are relevant to the underlying contract between the parties. The specific terms and issues of such compliance are addressed in the University contractual documents.

4.5. Reporting Requirements

Annual reporting requirements will be presented to the Board of Regents’ Finance and Asset Management Committee.

Responsible Office and Additional Information

For additional information, contact one of the following offices:

Student Fiscal Services
UW Medicine Compliance

History

July 16, 2009; RC, June 20, 2012; [Renumbered from APS 35.2] March 3, 2026.

For related policies, see:

APS 2.6, Information Security Controls and Operational Practices.

Table of Contents