Receiving a SSN from anyone other than the individual whose SSN is assigned is only appropriate if the disclosure is part of the University's business processes, and the SSN owner has received a disclosure as to how their SSN will be utilized including any secondary uses/disclosures. University/internal sharing of SSNs are permissible, so long as the SSN owner has been provided with the appropriate disclosure as to how their SSN will be utilized, and the appropriate data security measures have been taken.