Drexel University is committed to protecting the privacy and confidentiality of the personal information entrusted to us. Members of the Drexel community have a shared responsibility to report suspected or confirmed privacy incidents promptly to their supervisor or manager, the Chief Privacy Officer, Privacy Program Services, or to the Drexel Compliance Hotline.

What Is a Privacy Incident?

A privacy incident is any unauthorized use or disclosure of Personally Identifiable Information (PII). PII is any information that could potentially be used to identify a particular person.

Examples of personally identifiable data include but are not limited to:

• Full name
• Home address
• Email address
• Social security number
• Passport number
• Driver’s license number
• Credit card number
• Date of birth
• Telephone number
• Health information
• Student non-directory information (please see the Family Educational Rights and Privacy Act (FERPA) Policy for more information)

How Do I Report a Privacy Incident?

If you know or suspect that there has been an unauthorized use, disclosure, theft or loss of PII, please report it immediately to:

• Your supervisor or manager for escalation to the Privacy Program Services Department; or
• Privacy Program Services Department directly at privacy@drexel.edu.

You can also report a privacy incident online or via telephone using the Drexel Compliance Hotline, if the alleged incident suggests improper conduct or violation of law or Drexel policy. The Drexel Compliance Hotline is a confidential reporting hotline hosted by an external, third-party provider, EthicsPoint. Reports to the Drexel Compliance Hotline may be made anonymously.

When reporting a privacy incident, please try to be as detailed as possible and include the below information:

• The date the incident was discovered
• The specific information disclosed
• The names of the individuals involved
• How the incident happened
• Any remedial actions taken following detection
• The department contact for follow-up questions

What Happens After I Report a Privacy Incident?

Privacy Program Services will review your report and conduct an investigation into the incident. We may reach out to you with additional questions or to update you regarding the status of your report.

If the investigation determines that we must notify affected individuals or regulatory agencies about the incident, Privacy Program Services will provide that notice pursuant to Drexel’s Breach Notification policy.

You will not be subject to retaliation or harassment for reporting a privacy incident.