University of Tennessee system establishes privacy office; plans HIPAA review, GDPR work and privacy impact assessments

The University of Tennessee System described progress on a newly created system-level privacy office and outlined projects to strengthen data-protection practices across campuses.

Shawna Jennings, the system privacy director and associate general counsel, told the Audit and Compliance Committee she began meeting with campus IT and registrar officials across institutions to harmonize practices such as definitions of directory information under FERPA and to position the new office as a resource for campuses.

Jennings said her first 18 months included participation in development of a records management policy and membership on the university's AI policy working group. Ongoing projects include a CampusGuard engagement to assess which campus departments, clinics and units require HIPAA compliance; updates to public-facing information describing GDPR compliance and a plan to stand up a GDPR working group; development of a privacy impact assessment tool for new projects, contracts and systems; and an overhaul of system HIPAA policies to address gaps.

"A strong privacy program is more than just compliance with federal and state regulations or a set of policies and procedures," Jennings said. "It's about fostering a culture that deeply respects an individual's right to privacy." She said Meetings with a consultant and campus stakeholders were set to begin the week after the presentation.

Ending: The committee heard a system-level privacy status report and staff said work will continue on HIPAA assessments, GDPR coordination and a central privacy website and privacy impact assessment tool.