Presenting to Executives - Harvard...
Transcript of Presenting to Executives - Harvard...
Presenting to Executives October 21, 2014
2
Agenda
• Welcome and Workshop Overview
• Common Grounding
• Expert Panel Discussion
• Apply and Share
• Case Study
• Small Group Exercise
• Report Out
Welcome and Workshop Overview Who We Are
Community of Practice
HUIT PMO
• Identify and embracing existing PM community
• Collaborate and problem solve • Share experience, approaches and
techniques • Provide direct input to HUIT PMO on
needs and challenges • Serve as vehicle for training, mentoring,
and coaching
• Improve effectiveness of project management across HUIT
• Establish common philosophy and language
• Collect and transparently report project and portfolio status
• Support, develop, and provide guidance to HUIT community of project managers
3
Common Grounding
Expert Panel Discussion
4
Facilitator Andrew Amrhein Managing Director, PMO Harvard Business School
Panel Members
Marika Rueling Chief of Staff Office of the Executive Vice President Liam Schwartz Associate Director for Strategic Analytics Office of Institutional Research Bob Wittstein Managing Director, Administrative Technology Services Harvard University Information Technology
Apply and Share
Case Study > Original Presentation
5
Title Protecting Student and Employee SSNs
Audience Higher Education User Group Conference for Oracle customers
Purpose Inform conference attendees about Northwestern University’s initiatives to protect the privacy of student and employee SSNs
Duration ~ 30 minutes
Protecting Student and Employee SSN’s Session #20415 March 13, 2006
Alliance 2006 Conference
Nashville, Tennessee Last updated 3/ 13/ 2006
7
Your Northwestern University Presenters
Suzanne Anderson University Registrar and Director of Student Enterprise System
Ann Dronen Associate Director of Student Enterprise System
Kathy Tessendorf Director of Human Resources Information
8
Overview
Today we will discuss the numerous initiatives that Northwestern University has and will
implement to protect the privacy of student and employee Social Security Numbers.
9
Agenda/Contents
• SSN’s were everywhere!
• Why we needed to change our ways
• Getting organized
• Obstacles and challenges
• Specific actions
• There’s more to do!
10
About Northwestern University
Northwestern
University is a
private institution
founded in 1851.
11
About Northwestern University
We have 18,000
students and two
campuses; one in
Evanston, and one
in Chicago.
12
We have 11 Schools and Colleges
Weinberg College of Arts and Sciences Communication Education and Social Policy Engineering and Applied Science Medill School of Journalism School of Music Graduate School Kellogg School of Management School of Law Feinberg School of Medicine Continuing Studies
13
About Northwestern University
We have 6,700 benefit-eligible employees
and produce 20,000 W-2’s.
14
A little about our use of Oracle
• Initial Implementations: • HR – 1997 • Student Administration – 1998-2000 • Financials – planned for 2007
• HR and SA are on separate databases
15
Our HR System
• Modules Implemented • Position Management • Base Benefits • Payroll • FSA • E-Recruit
• Version • Currently on 8.3 • On our way to 8.9 (planned for April 2006)
16
Our SA System
• Modules Implemented • Academic Advisement • Admissions • Campus Community • Financial Aid • Student Financials • Student Records
• Currently on Version 8.0
17
Before PeopleSoft, SSN’s were everywhere!
• SSN was used as the identifier for both students and employees
• SSN was the unique identifier for most, if not all, student and employee-related systems
• SSN was prominently displayed on ID cards, Benefits Cards, Forms, Reports, Lists & Labels!
18
Why we needed to change our ways…
• FERPA
• HIPAA
• Federal & Illinois Laws
• Increased nationwide awareness
• Identify theft
19
Getting organized…
• Formed an “SSN Committee” with a primary mission to remove SSNs
• Established and updated University policies
• University established a “Compliance Director” (new position) • Assists in enforcing policies
20
Forming the SSN Committee…
• Chairs • Director of Information Technology Management Systems • Director of Human Resources Information • Director of Student Enterprise System
• Identified major systems using SSN
• Identified representative from each area to participate on the committee
21
The SSN Committee Mission
Identify and oversee initiatives to
protect the privacy of SSN’s
22
Initial activities of the SSN Committee…
•Defined additional systems with SSN
•Prioritized systems to be addressed
•Identified obstacles
•Established a target date to remove SSN for each system
23
Highlights of our SSN Policy
• Approved use is required
• Appropriate treatment of SSN
• Grandfathering • E.g. old record cards
• Exception Process
24
Major systems with SSN include…
• Human Resources
• Student Administration
• Alumni Relations
• Wildcard
• Bursar Check Cashing
• Housing / Food Service
• Athletics
• Student Loans
• Financial Management System
• Library • Kellogg Graduate School • Research Systems • Student Health • Parking • American Express • Labor Distribution
25
Obstacles and challenges
• Old Systems • Field Formats
• Health Care providers
• Coordination of vendor changes
• Interdependency of SSN across systems
• Resistance to change
26
Interdepencies in the use of SSN’s
Banks
Blackboard NetIDsOnlineDirectory
Wildcard
Library
RegulatoryAgencies
Alumni
Parking
Time Entry
EmployeeVerification
CUFS
BenefitVendors HRIS SES
StudentAffairs
27
Transforming People & Processes - HR
• Changed payroll and HR forms to Employee ID
• Took off SSN from Wildcard and announced the change so replacements could be issued
• Sent out notices about the danger of displaying and using SSN as identifier
• Forced Department representatives to start identifying employees by ID number
28
System Actions - HR
• Customized to mask SSNs by roles
• Tightened up security access to SSN’s
• Removed SSN’s from Queries
• SSN not displayed in self-service / electronic forms
• Removed SSN from Employee Table
• Removed / minimized SSN in interfaces
29
Transforming People & Processes - SA
• Changed from SSN to EMPLID for Student ID
• Self-Service Lookup for Student ID
• Changed forms to require new Student ID
• Removed SSN references from phone and web
30
Transforming People & Processes – SA (cont’d)
• New Student ID Cards with no SSN
• Later changed all Student ID Cards
• No verification by SSN
• Personnel changes to stop asking for SSN
31
System Actions - SA
• People/Student Data Split • Significantly limited access to People Data
• SSN Masking – few exceptions
• Removed SSN’s from Queries
• SSN not displayed in self-service
• Removed / minimized SSN in interfaces
32
System Actions - Interfaces
• Interfaces both within Northwestern Community and with outside vendors
• Do not allow transmission of SSN unless absolutely necessary
33
Interfaces – Technical Requirements
• Specific and Secure File Transfer Protocol
• Encryption
• No direct transfer into Production System
34
SSNs in Interfaces - Exceptions
We have a documented exception
policy and process if an SSN is
necessary on an interface
35
There’s more to do!
•Departmental Servers
•Local Management Information Systems
•Individual Workstations • Software package to assist
Apply and Share
Case Study > Developing an Executive Presentation
36
Title Protecting Student and Employee SSNs
Audience Executive management of a peer institution
Purpose Brief executive management about Northwestern University’s issues and remediation plan
Duration ~10 minutes
Apply and Share
Case Study > The Executive Presentation
37
Problem: Student and employee SSNs are used internally within information systems and externally on ID cards, forms, etc., for identification
Call to Action
• FERPA
• HIPPA
• Federal and state laws
• Identify theft
• Increased awareness
Challenges
• Old systems
• Health care providers
• Coordination with external vendors
• Interdependencies across systems
• Resistance to process changes
Remediation
• Institute SSN usage policy and compliance director position
• Develop alternate identifier for students and employee
• Remove or restrict access to SSNs within information systems
• Remove SSNs from forms, ID cards, and online displays
• Change business processes to not verify identity by SSN
• Utilize encryption and secure file transfer protocol when SSN transmission is required
• Launch communication and training program for community
Apply and Share
Small Group Exercise
38
Step Action
1 Divide into groups of 4 to 5
2 Choose a report, presentation, etc., to serve as the basis for an executive briefing • Copies of Harvard’s Staff Mobile Phone Policy are available as source material
3 Develop a one page executive briefing outlining the key points of your source material
4 Nominate a speaker to report your group’s results
Apply and Share
Report Out
39
Please share:
1. Concepts/tips you applied when creating your executive briefing
2. Challenges of the exercise
3. Lessons to pass along to others