Skip to main content

Table of Contents

  1. Introduction
  2. Area Commission
  3. Information Technology
  4. Plans and Analysis
  5. Marketing
  6. Financial Affairs

    6-1-1 Annual Report

    6-1-2 Travel Authorization & Reimbursement

    6-1-4 Student Travel, Authorization & Reimbursement

    6-2-1 Professional Development Program

    6-2-2 Memberships in Professional Organizations

    6-2-3 Tuition Assistance

    6-3-1 Funds, Receipt and Deposit

    6-5-1 Budget Transfers

    6-5-2 Federal Funds, Expenditure & Control Of

    6-6-1 Budget Administrator Responsibility

    6-6-2 Invoice Payment Process

    6-7-1 Funds, Investment of Surplus

    6-8-0 Refunds Policy

    6-8-1 Refunds

    6-9-1 Authorized Signatures/Bank Withdrawals

    6-12-1 Capital Plant Fund

    6-13-0 Educational Fee Waiver Policy

    6-13-1 Educational Fee Waiver

    6-14-0 Student Fees Policy

    6-14-1 Checks - Information Required, Returned Checks and Credit Card Chargebacks

    6-15-0 Expenditure of Auxiliary Income

    6-15-1 Expenditure of Auxiliary Income Procedure

    6-16-1 Internal Auditing Department

    6-18-1 Red Flags Rule Identity Theft Prevention Plan

  7. Facilities Management
  8. Human Resources and Employee Relations
  9. Development
  10. Procurement and Inventory Control
  11. Auxiliary Enterprises and Printing Services
  12. Public Safety
  13. Division of Education
  14. Intentionally Left Blank for Future Use
  15. Intentionally Left Blank for Future Use
  16. Admissions and Registrar
  17. Student Services

NUMBER: 6-18-1 APPROVED DATE: 12-13-2010

BASED ON POLICY NUMBER AND TITLE: 2-13-0 EP 5: ASSET PROTECTION

Purpose To develop a procedure and plan for compliance with “Red Flags Rule” regulations.

Requirements
The “Red Flags Rule” requires financial institutions and creditors with covered accounts to develop and implement a written identity theft prevention plan as part of the Fair and Accurate Credit Transactions Act (FACTA) of 2003 and in the Code of Federal Regulations as "Detection, Prevention, and Mitigation of Identity Theft" (Title 16, Chapter 1, Subchapter F, Part 681). Plans must provide for the identification, detection, and response to red flags that may be indicative of identity theft activity. In addition, plans must include a periodic review process. Trident Technical College (TTC) has determined that the “Red Flags Rule” applies to the College’s operations.

  1. “Red Flags Rule” Definitions
    1. Identity Theft: The fraudulent use of personal identifying information.
    2. Personal Identifying Information: Sensitive personal information (i.e., names, social security numbers, driver’s license numbers, financial account numbers, credit or debit card numbers, security or access codes associated with credit or debit card numbers, mothers’ maiden names, dates of birth, or other account data) that identifies students, employees or customers.
    3. Financial Institution: A state or national bank, a state or federal savings and loan association, a mutual savings bank, a state or federal credit union, any other person that, directly or indirectly, holds a transaction account belonging to a consumer, or other institutions that offer accounts where the consumer can make payments or transfers to third parties.
    4. Creditor: Businesses or organizations that regularly defer payment for goods or services; provide goods or services and bill customers later; or regularly grant loans, arrange for loans or the extension of credit, or makes credit decisions.
    5. Covered Account: Any account that a financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk of identity theft to customers or to the safety and soundness of the financial institution or creditor. Examples of covered accounts include student loans, particularly with overage payments, deferment of tuition payments (TTC payment plan), or other accounts that involve multiple payments or transactions.
    6. Red Flag: Suspicious patterns or practices, or specific activities that indicate the possibility of identity theft.
    7. Customer or Contractor: For the purposes of this plan, a customer or a contractor is a person and not an entity, e.g., a noncredit course instructor may be a contractor.
  2. Compliance Criteria Each division of the College, which has responsibility for covered accounts, will develop identity theft prevention plans specific to the day-to-day operational activities or processes for their division. Using the “Red Flags Rule” Identity Theft Prevention Plan Template, each division shall address identification, detection, and response to red flags as well as information on how their plans will be updated.
    1. Identification of Red Flags
      1. Risk Assessment
        1. Review the methods used to open and maintain covered accounts. Accounts opened online may differ from face-to-face contact.
        2. Evaluate the manner in which access is provided to accounts. Online access may require additional authentication or verification of identity.
        3. Review general business operations as to the relationship with covered accounts. For example:
          1. Does your staff have access to student records or a portion of records?
          2. Do you contract with third party entities that have access to sensitive information, such as student records?
      2. Categories of Common Red Flags
        1. Alerts, Notifications, and Warnings from a Credit Reporting Company
          1. A fraud alert on a credit report.
          2. A notice of credit freeze in response to a request for a credit report.
          3. A notice of address discrepancy provided by a credit reporting agency.
          4. A credit report having activity inconsistent with the student’s, employee’s, customers or contractor’s history.
        2. Alerts, Notifications, or Failed Processing by Credit or Debit Card Companies
          1. Electronic process refuses card.
          2. Credit or debit card is declined or over limit.
          3. Notification to seize credit or debit card.
        3. Suspicious Documents
          1. Identification that appears to have been altered or forged
          2. Inconsistent appearance between the student, employee, or customer presenting the identification and the photograph or physical description on the identification.
          3. Inconsistent information on the identification as compared to other documents or verbal statements presented by or on behalf of the student, employee, customer, or contractor.
          4. An application that appears to have been altered, forged, or torn up and reassembled.
        4. Suspicious Personal Identifying Information
          1. Addresses, telephone numbers, or other personal information that have been used on accounts known to be fraudulent
          2. Fake addresses, addresses used for mail drops, prison addresses, invalid telephone numbers, telephone numbers answered by answering services.
          3. Duplicate Colleague ID numbers of the same person.
        5. Suspicious Account Activity
          1. Mail sent to student, employee, customer, or contractor that is returned repeatedly as undeliverable although transactions continue to be conducted on the account.
          2. Information that the student, employee, customer, or contractor is not receiving mailed correspondences.
          3. Information concerning unauthorized charges to an account.
        6. Notice from Other Sources
          1. A student, employee, or customer reports that their identity has been compromised.
          2. Reports from law enforcement that a student, employee, or customer has been a victim of identity theft.
    2. Detection of Red Flags
      1. Determine the types of identity verification and authentication required for detecting red flags, e.g., government issued photograph IDs.
      2. Consider if additional verification or authentication methods are required for online, mail, or telephonic transactions.
      3. Decide if additional security measures are required for online transactions.
      4. Monitor for breaches in the handling of personal identifying information, identity verification or identity authentication, e.g., confidential information that has not been destroyed or transported securely.
    3. Response to Red Flags
      At a minimum, divisional plans should consider the following TTC guidelines as appropriate responses to red flags. Additional responses, specific to particular functions of the division or departments within the division, should also be included in the divisional plan.
      1. Monitor covered accounts for evidence of identity theft, fraud, etc.
      2. Report all suspected red flag activity to immediate supervisors for review and confirmation of a detected red flag.
      3. Determine if the red flag activity needs to be reported to Public Safety (criminal activity is suspected) or if no further response is warranted under the particular circumstances (criminal activity is not suspected and/ or the red flag can be explained). Catastrophic data breaches must be reported to the division’s Vice President, the Vice President for Information Technology, and Public Safety immediately.
      4. Delay or refuse to provide services to students, employees, and customers pending review and confirmation of a detected red flag.
      5. Notify students, employees, or customers when red flags have been confirmed.
      6. Change, or instruct the account owner to change, passwords, security codes, and other methods to access covered accounts.
      7. Close existing accounts to prevent further activity. Determine whether or not to open an account with a new Colleague ID number.
      8. Discontinue collections on accounts where red flags have been confirmed.
    4. Evaluations and Updates to Divisional Red Flag Plans
      At a minimum, annually evaluate divisional plans and update for:
      1. Changes to the Red Flags Rule.
      2. Changes in SBTCE, TTC, divisional, or other applicable business processes.
      3. Changes in technology (access, storage, maintenance, etc. of covered accounts).
      4. Changes in identity theft risks (new patterns used by identity thieves)
    5. Employee Training for Prevention and Mitigation of Identity Theft
      1. 1. Incorporate TTC’s Procedure 3-1-3 Information Security Plan into employee training. The FTC recommends the following key principles for data security (Protecting Personal Information: A Guide for Business):
        1. Take stock: Know what personal information is stored in files and on computers.
        2. Scale down: Keep only the documents and information needed for business processes.
        3. Lock it: Protect the information stored in files and on computers (physical and electronic security).
        4. Pitch it: Properly dispose (shred) documents and files that are no longer needed.
        5. Plan ahead: Create a plan to respond to security incidents.
      2. 2. Minimum training requirements
        1. Train all existing employees upon initial implementation of the TTC Red Flags Plan and the TTC Information Security Plan.
        2. Train all new employees.
        3. Provide periodic refresher training at least annually or after significant changes to the plan.
    6. Administration of Plan
      The vice presidents for each division will be responsible for their division’s plans, specifically to:
      1. Assign specific responsibilities for their plan’s implementation to person(s) within their division.
      2. Require that background and reference checks are performed before hiring new employees as identified in TTC Procedure 8-1-1 Employment Practices.
      3. Ensure compliance of all minimum training requirements (Section III E (2)).
      4. Require a procedure to delete access to sensitive information for employees who terminate from the college or transfer to another division, e.g., collect keys, remove access to computer applications, delete Sonitrol accounts, etc.
      5. Review staff reports on their division’s compliance with the Red Flag Rule.
      6. Approve important changes to their division’s plans.
      7. Monitor the activities of service providers to ensure they comply with the Red Flags Rule.
      8. Report the effectiveness of divisional plans to Cabinet on an annual basis and include:
        1. Successes in identifying risks of identity theft
        2. Significant incidents of identity theft and responses
        3. Monitoring practices for service providers
        4. Recommendations for major changes to the plan

Updated: 06-25-2021

Related Links

(c) Trident Technical College