FIPA Breach Notification and Response Policy

1. Purpose

As required by the Florida Information Protection Act (“FIPA”), this Policy establishes institutional standards for the University of Florida (“UF”) to protect and secure data in electronic form containing Personal Information and to investigate, respond to, and mitigate the effects of any unauthorized access, use or disclosure in accordance with applicable law.

2. Applicability

This Policy applies enterprise-wide to the University of Florida (“UF”), including its direct support organizations (“DSOs”) and affiliated entities, as well as to UF Health and its DSOs and affiliated entities. This Policy applies to all members of the UF community, including faculty, staff, and students, as well as contractors, vendors, volunteers, and any other parties who create, access, process, transmit, maintain, or otherwise use Personal Information in electronic form.

3. Definitions

Breach of Security (“Breach”) means unauthorized access to data in electronic form containing Personal Information. Access to Personal Information by a UF employee or agent or any other person in good faith, when performed as part of their official duties, is not considered a Breach of Security unless the information is misused or further disclosed without authorization. A Breach does not include information that is encrypted, secured, or modified by any method or technology that removes elements personally identifying an individual or otherwise renders the information unusable. It also does not include information about an individual that has been made publicly available by a federal, state or local government entity.

FIPA Covered Entity means any commercial or government entity, including UF, that acquires, maintains, stores, or uses Personal Information.

Personal Information means an individual’s first name or first initial and last name in combination with any one or more of the following data elements for that individual: Social Security number; driver’s license or identification card number; passport, military, or other government identification number; financial account or credit/debit card number with the required security or access code; medical information, medical history, or diagnosis; or a health insurance policy or subscriber identification number. The term also includes a username or email address, in combination with a password or security question and answer, that would permit access to an online account.

Notification means the act of informing individuals affected by a Breach that their Personal Information was potentially compromised and steps they can take to protect themselves and their privacy.

4. Policy Statement

As required by FIPA, UF will take reasonable measures to protect and secure data in electronic form containing Personal Information. Upon discovery of a potential Breach, UF will investigate to determine whether Personal Information has been compromised and will take appropriate actions to mitigate harm and provide required Notifications in accordance with applicable law.

4.1. Reporting and Escalation

Upon receipt of a report or discovery of a potential Breach involving Personal Information, the UF Privacy Compliance Office (“UF Privacy”) will take appropriate action to investigate and mitigate adverse effects.

4.1.1 Responsibilities of UF Privacy

UF Privacy will:

• Receive, document, and retain privacy-related complaints and incident reports in a system maintained by UF Privacy.
• Conduct appropriate reviews and make Breach determinations in accordance with applicable law.
• Provide required Notifications in accordance with applicable law.

4.1.2. Reporting Known or Potential Breaches

Members of UF’s workforce who become aware of a known or potential Breach of Personal Information, or any other Breach involving information security or patient confidentiality, must immediately report it to their supervisor, the UF Information Security Office, UF Privacy, or the UF Privacy Hotline at 1-866-876-4472. Students or others who become aware of a known or potential Breach are encouraged to report the incident to the UF Information Security Office, UF Privacy, or the UF Privacy Hotline.

Any UF office or employee who receives such a report must promptly escalate the matter to UFIT and UF Privacy for Breach response and mitigation. Timely and accurate reporting and escalation are required to ensure effective investigation and mitigation.

4.2. Breach Response

UF Privacy will investigate any report or discovery of a Breach involving Personal Information to determine whether unsecured Personal Information has been, or is reasonably believed to have been, accessed, acquired, or disclosed and to assess the scope and impact of any resulting compromise to its security or privacy.

If a Breach requiring Notification is confirmed, UF Privacy will provide Notification to affected individuals and any required internal or external authorities within the timeframes mandated by UF regulation, policy, or applicable law.

4.3. Cost Responsibility

UF Privacy, in coordination with the UF Information Security Office, will determine the costs of a Breach response based on the circumstances of the Breach. A department, division, or unit determined to be responsible for a Breach may be responsible for associated response costs, including call center support and related services.

4.4. Policy Violations

Failure to comply with this Policy may result in disciplinary action up to and including termination. Parties that do not comply with this Policy may be permanently barred from UF’s facilities, services, or activities or subject to other restrictions. Failure to comply with this Policy may result in disciplinary action in accordance with applicable UF regulations and policies.

5. References and Related Information

Florida Information Protection Act (F.S. § 501.171)
Florida Digital Bill of Rights, §§ 501.701–501.722, Florida Statutes
UF Information Security Policy
UF Information Security Office Website
UF Compliance Hotline
UF Privacy Website
UF Privacy Training

History