FERPA & Red Flag Rule

Red Flag Rule

Red Flag Identity Theft Prevention Program

The Federal Trade Commission (FTC) issued a regulation known as the Red Flag Rule (Sections
114 and 315 of the Fair and Accurate Credit Transactions Act), to be implemented no later than
May 1, 2009 that is intended to reduce the risk of identity theft. This policy is intended to detect,
prevent, and mitigate opportunities for identity theft at Yeshiva Mercaz Hatorah of Belle Harobor
(YMHBH). The Red Flag Rule applies to YMHBH because YMHBH offers or maintains covered
accounts.

Identity theft is fraud committed or attempted using the identifying information of another
person without authority.

A covered account includes all student accounts of loans that are administered by the Rabbinical
Seminary.

A red flag is a pattern, practice or specific activity that indicates the possible existence of identity
theft.

Personally, identifiable information includes the first, middle or last name in combination with
the following items whether stored in electronic or printed format: Consumer’s Date of Birth,
Address, Telephone or wireless numbers, Social Security number, Government-issued
identification number, Maiden name, or Account number. Also included is Credit card
information or Medical information for any customer.

Existing Policies and Practices
Many offices at YMHBH maintain files, both electronic and paper, of student biographical,
academic, health, financial, and admission records. These records may also include student billing
information, Perkins Loan records, and personal correspondence with students and parents.
Compliance with Gramm-Leach –Billey Act (GLB), Family Educational Rights and Privacy Act
(FERPA), and Payment Card Industry security standards (PCI), system and application security,
and internal control procedures provides an environment where identity theft opportunities are
mitigated. Records are safeguarded to ensure the privacy and confidentially of students, parents,
alumni and employees.

Parents may obtain information with a signed FERPA release form submitted by the student at
the discretion of the institution. Staff who have access to data have been versed on the FERPA
regulations that state information is not provided unless approved in writing.
The student is required to give written authorization to the Registrar’s Office if their information
is permitted to be shared with another party. A FERPA disclosure statement is available to
students informing them of their rights under FERPA.

Occasionally, YMHBH will extend short term credit to a student for payment of their bill which
thus creates a covered account. If we receive information of an address change (which is a red
flag), we verify the change by contacting the student before making the change in the system.
Access to non-directory student data in our system is restricted to those employees of the
YMHBH with a need to properly perform their duties. These employees are trained to know
FERPA and “Red Flag” regulations.

Social Security numbers are not used as identification numbers and these data are classified as
non-directory student data.

All paper files are required to be maintained in locked filing cabinets when not in use. All offices,
when not occupied are to be locked.
Staff is required to report all changes in name, address, telephone or marital status to the
Administrative Office as soon as possible; they also must periodically verify those persons listed
as contacts in case of emergency, and those persons designated as beneficiaries to life and/or
retirement policies.

YMHBH is sensitive to the personal data (unlisted phone numbers, dates of birth, etc.) that it
maintains in its personnel files and databases. We will not disclose personal information, except
by written request or signed permission of the employee, or unless there is a legitimate business
“need-to-know”, or if compelled by law.

Every effort is made to limit the access to private information to those employees on campus
with a legitimate “need-to-know”. Staff who have approved access to the administrative
information databases understand that they are restricted in using the information obtained only
in the conduct of their official duties. The inappropriate use of such access and/or use of
administrative data may result in disciplinary action up to, and including dismissal from YMHBH.
YMHBH’s official personnel files for all employees are retained in the office. Employees have the
right to review the materials contained in their personnel file.

Detecting Red Flag Activity
• Address discrepancies
• Presentation of suspicious documents
• Photograph or physical description on the identification consistent with the appearance
of the person presenting the identification
• Personal identifying information provided is not consistent with other personal
identifying information on file with YMHBH
• Documents provided for identification that appear to have been altered or forged
• Unusual of suspicious activity related to covered accounts
• Notification from students, borrowers, law enforcement, of service providers of unusual
activity related to a covered account
• Notification from a credit bureau of fraudulent activity
• FAFSA fraud alert

Responding to Red Flags
Should and employee identify a “red flag” (patterns, practices and specific activities that signal
possible identify theft), they are instructed to bring it to the attention of the Administrative Office
immediately. The administrator will investigate the threat of identity theft to determine if there
has been a breach and will respond appropriately to prevent future identity theft breaches.
Additional actions may include notifying and cooperating with appropriate law enforcement and
notifying the student or employee of the attempted fraud.

Oversight of service providers
Mercaz Hatorah of Belle Harbor currently does not employ outside contractors for administrative
functions.

Administration of the Program
The Executive Director of YMHBH shall be responsible for the development, implantation,
oversight and continued administration of the Program. Operatio0nal responsibility of the
Program will be delegated to appropriate employees as selected by the Executive Director.

Periodic Update of Plan
This policy will be re-evaluated on or about the first day of each calendar year to determine
whether all aspects of the program are up to date and applicable in the current business
environments, and revised as necessary.

Copyright Policy

Copyright infringement is the act of exercising, without permission or legal authority, one or more of the exclusive rights granted to the copyright owner under section 106 of the Copyright Act (Title 17 of the United States Code). These rights include the right to reproduce or distribute a copyrighted work. In the file-sharing context, downloading or uploading substantial parts of a copyrighted work without authority constitutes an infringement. Penalties for copyright infringement include civil and criminal penalties. In general, anyone found liable for civil copyright infringement may be ordered to pay either actual damages or “statutory” damages affixed at not less than $750 and not more than $30,000 per work infringed. For “willful” infringement, a court may award up to $150,000 per work infringed. A court can, in its discretion, also assess costs and attorneys’ fees. For details, see Title 17, United States Code, Sections 504, 505. Willful copyright infringement can also result in criminal penalties, including imprisonment of up to five years and fines of up to $250,000 per offense. For more information, please see the website of the U.S. Copyright Office at www.copyright.gov.