NPI Discovery and Risk Assessment Survey

Department

Respondent Name

Respondent Title or Role

Supervisor Name (if different from respondent)

Date Completed

Date

Does your department collect, access, or store nonpublic personal information (NPI), such as financial aid or bank account data?

Types of NPI handled

Approximate annual NPI volume

Who accesses systems or files containing NPI?

Do student employees or work-study students access systems or files containing NPI?

If yes, describe the type of access and how supervision is provided

Approximately how many staff currently have access to systems containing NPI?

How does NPI typically enter your department?

Name the system(s) or software used to receive or enter the data

Do you receive an automated data feed or interface from an external system?

If yes, name the system and vendor

Where is NPI stored electronically?

Is electronic NPI encrypted at rest?

Where is physical paper NPI stored?

Do staff print or download NPI to a local computer, laptop, or removable media?

If yes, briefly explain why and how often this occurs.

How is NPI sent internally within the District?

How is NPI sent outside the District?

Is NPI ever emailed without encryption or a secure portal?

Is NPI shared with any outside vendor or third party?

If yes, list each vendor, the purpose of the data share, and the type of data shared

Is there a signed contract or data-sharing agreement in place for each vendor?

Physical documents containing NPI are stored in a locked cabinet or drawer when not in use

The office or room where NPI is stored is locked when unattended

The department follows a clean desk practice so NPI is not left visible on desks, printers, or fax trays overnight

Printed documents containing NPI are shredded, not simply thrown away, once no longer needed

How are staff logins managed?

If any logins are shared, which system(s) are affected and why?

When a workstation is left unattended, how often are screens locked or staff logged off?

Do staff ever take NPI, in paper or electronic form, home or off campus?

If yes, describe the circumstances and safeguards used.

Has your department experienced a suspected loss, theft, or unauthorized disclosure of NPI in the past three years?

If yes, briefly describe what happened without naming individuals

Attachments

Additional comments

Certification

NPI Discovery and Risk Assessment Survey

SECTION A - Respondent Information

SECTION B - NPI Discovery

SECTION C - Users

SECTION D - Data Types and Ingestion

SECTION E - Storage

SECTION F - Transmission and Third-Party Sharing

SECTION G - Physical Storage and Clean Desk

SECTION H - Access and Credentials

SECTION I - Incident History

SECTION J - Attachments and Sign-Off