- Legal Review: General Counsel assesses legal obligations and liability
- Student Notification: Affected students are notified within 48 hours when possible, including:
- Description of the breach and information compromised
- Steps the University is taking to address the incident
- Protective measures students can take
- Contact information for questions and support
- Regulatory Reporting: Breach reported to appropriate agencies as required by law
- Remediation: Security vulnerabilities are addressed and systems are hardened
- Documentation: Comprehensive incident report prepared for review
- Post-Incident Review: Lessons learned and policy updates implemented
Third-party service providers must notify the University within 24 hours of discovering any breach involving student data. The vendor's incident response obligations are specified in service agreements.
Complaints
Students, faculty, or staff who believe a privacy violation has occurred should report concerns to the Office of the Registrar.
All complaints are investigated promptly and confidentially:
- Complaint is received and documented
- Preliminary review determines if a policy violation occurred
- Investigation conducted with interviews and evidence gathering
- Findings documented and reported to the complainant and the relevant parties
- Corrective action taken if the violation confirmed
- Follow-up ensures resolution and prevents recurrence
Violations of this policy may result in disciplinary action:
- Students: Academic integrity violations, suspension, or expulsion under the Student Code of Conduct
- Faculty and Staff: Counseling, training, suspension, or termination under employment policies
- Vendors: Contract termination and legal remedies
REFERENCES AND RELATED MATERIALS:
CONTACTS:
Office of Online Education
HISTORY: