Federal Policies

• FERPA: FERPA protects the privacy of students' education records by setting forth strict instructions and limitations governing the release of information about students. Particularly sensitive information includes students' Social Security numbers, race or ethnicity, gender, nationality, academic performance, disciplinary records, and grades.
  • Your Obligations Under FERPA
  • Read FERPA Content
  • OSU's FERPA Tutorial
• Health Insurance Portability and Accountability Act of 1996 (HIPAA): HIPAA is a federal law comprised of three sets of regulations that establish and protect patient rights and disseminate standards for the protection of individually identifiable health information, otherwise known as protected health information (PHI).
  • Read HIPAA Content
  • Office of Human Resources Health Insurance Privacy Policy
  • The Ohio State University Medical Center Privacy Policy
• Payment Card Industry (PCI) Standards: A set of security standards created by the major credit card companies that applies to any organization that processes and/or stores credit or debit card information; the standards include requirements for security management, policies, procedures, network architecture, software design and auditing.
  • PCI Security Standards Council
• Gramm-Leach-Bliley Act: Sets forth key provisions on the collection and disclosure of consumer's personal financial information, such as bank account numbers.
  • Federal Trade Commission Overview of Gramm-Leach-Bliley
  • Gramm-Leach-Bliley Act Training at OSU
• FACTA Red Flags: Regulation intended to reduce the risk of identity theft. The regulation defines twenty-six alerts or red flags. A Red Flag refers to a pattern, practice or specific activity that indicates the possible existence of identity theft. The regulation is monitored by the Federal Trade Commission and goes into effect May 1, 2009.
  • Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003; Final Rule
  • FTC - Agencies Issue Final Rules on Identity Theft Red Flags and Notices of Address Discrepancy
  • List of Red Flags Outlined in the Regulation