Legal Review: General Counsel assesses legal obligations and liability
Student Notification: Affected students are notified within 48 hours when possible, including:
Description of the breach and information compromised
Steps the University is taking to address the incident
Protective measures students can take
Contact information for questions and support
Regulatory Reporting: Breach reported to appropriate agencies as required by law
Remediation: Security vulnerabilities are addressed and systems are hardened
Documentation: Comprehensive incident report prepared for review
Post-Incident Review: Lessons learned and policy updates implemented
Third-party service providers must notify the University within 24 hours of discovering any breach involving student data. The vendor's incident response obligations are specified in service agreements.
Students, faculty, or staff who believe a privacy violation has occurred should report concerns to the Office of the Registrar.
All complaints are investigated promptly and confidentially:
Complaint is received and documented
Preliminary review determines if a policy violation occurred
Investigation conducted with interviews and evidence gathering
Findings documented and reported to the complainant and the relevant parties
Corrective action taken if the violation confirmed
Follow-up ensures resolution and prevents recurrence
Violations of this policy may result in disciplinary action:
Students: Academic integrity violations, suspension, or expulsion under the Student Code of Conduct
Faculty and Staff: Counseling, training, suspension, or termination under employment policies
Vendors: Contract termination and legal remedies
CONTACTS:
Office of Online Education
HISTORY: