Protection and Handling of the Social Security Number (SSN) of VA Beneficiaries and Students

Revision: June 11, 2026

Objective

It is, at AU, always a principal rule to guarantee the protection of the identity and confidentiality of beneficiaries’ Social Security Number (SSN), ensuring that it is not shared with third parties and that its internal handling is carried out under strict security measures.

Applies to all administrative, academic, and operational personnel who handle VA-beneficiary informationcontainingan SSN.

Responsible

  1. RegistrarOffice
  1. Administrative and VA-certifying personnel

Procedure

  1. Limitation of SSN use: The SSN will be used solely for strictly necessary internal purposes, such as the unique identification of the student in official records.
  1. Restricted access: Only authorized personnel will have access to theSSN,through secure credentials and based on job-relatedneed.
  1. No sharing with third parties: Sharing documents or informationcontainingthe SSN with parties external to the institution isstrictly prohibited. If an identifier isrequired, the student number or another approved alternative identifier will be used.
  1. Secure handling and storage: Documentscontainingthe SSN will be stored in secure systems, with controlled access and encryption whenever possible. Physical documents will be stored in locked filing cabinets or restricted areas.
  1. Redaction or encryption: When sharing information with authorized third parties, the SSN must be removed or encrypted (for example, leaving only the last four digits visible). Example: XWK-YZ-1234
  1. Training and awareness: Personnel will receive annual training on data protection and proper SSN handling.
  1. Oversight and audit: Periodic audits will be conducted to verify compliance with these measures.

Supporting Documentation

  • Updatedprivacy and data protection policy.
  • SSN use policy (Institutional Catalog).
  • Evidenceof securely using the SSN for VA site visits, using the provided link and an official asrequired.