PERAC Memo #8 - 2002: E-Mails and Confidential or Personally Identifiable Information

E-Mails and Confidential or Personally Identifiable Information

Summary

This memo warns that e-mail is not a secure medium and advises retirement boards not to transmit confidential or personally identifiable member/retiree information (e.g., Social Security numbers, birth dates, addresses, bank/credit card data) via e-mail, since PERAC cannot guarantee its security. Boards should specifically avoid sending actuarial valuation data files containing such identifiers by e-mail, pending PERAC's development of a secure transmission method (e.g., VPN); no other action is required beyond adopting safer transmission practices.

Full Text

Memorandum # 8/2002

M E M O R A N D U M TO: All Retirement Boards FROM: Joseph E. Connarton, Executive Director RE: E-Mails and Confidential or Personally Identifiable Information

DATE: February 1, 2002

Since e-mail communications can be intercepted, stored, forwarded, altered and misused, PERAC strongly advises all retirement boards against including confidential or personally identifiable information about any member or retiree in any e-mail. Because PERAC does not currently encrypt incoming e-mail, we cannot guarantee or insure the privacy, confidentiality and or security of any e-mail or any attachment(s) that may be submitted via the Commission’s web site, or by e-mail in general.

Personally identifiable or confidential information means any medical information or other information that could reasonably be used to identify a member or a retiree, including name, personal address, personal e-mail address, Social Security Number, birth date, bank account information, credit card information, or any combination of information that could be used to identify an individual.

Actuarial valuation data files for active and retired members that include the aforementioned data elements must not be transmitted to PERAC or any other source via e-mail.

PERAC is exploring technologies, such as virtual private networks, which would allow secure transmission of personally identifiable information and confidential information via the Internet. We will keep you posted about our findings as developments warrant.

If you have any questions about electronic transmission of personally identifiable or confidential information about your membership, please contact Barbara Phillips, PERAC General Counsel, at 617-666-4446, extension 902.
M E M O R A N D U M - Page Two TO: All Retirement Boards FROM: Joseph E. Connarton, Executive Director RE: E-Mails and Confidential or Personally Identifiable Information DATE:

Finally, I am enclosing for your convenience, PERAC’s publication catalog that provides you with a list of our educational materials. Please contact Communications Manager, Sarah Kelly, at extension 970 if you would like copies of any of these publications. You may also use the order form on the last page of the catalog.