Information Technology
Information Technology Policies

Purpose
The University of Rochester recognizes the vital role information technology plays in the University’s missions and related administrative activities as well as the importance in an academic environment of protecting information in all forms.  As more information is used and shared in a digital format by students, faculty and staff, both within and outside the University, an increased effort must be made to protect the information and the technology resources that support it.  Increased protection of our information and Information Technology Resources to assure the usability and availability of those Resources is the primary purpose of this Policy.  The Policy also addresses privacy and usage of those who access University Information Technology Resources. 

Section I - Introduction

I.  General Principles

A. Academic Freedom.

Academic freedom is a fundamental University value.  This Policy will be administered in a manner that supports the principle of academic freedom. 

B. Supportive Academic Environment.

The University of Rochester seeks to provide a supportive working, living, learning and clinical environment.  To accomplish this, we actively look for ways to encourage exchange and discourse, to bring together faculty, students, and staff, and to build a community that encourages all of its members to succeed and grow.  

C. Accountability for University Resources.

All members of the University community have responsibility to protect University resources for which they have access or custodianship.  Members of the University community are accountable for their access to and use of University resources.

D. Personal Use and Privacy.

The University recognizes that students, faculty and staff have reasonable expectations of privacy in their uses of Information Technology Resources.  However, rights to privacy are constrained in the University environment because (1) the University owns and supplies these Information Technology Resources to its faculty, staff and students fundamentally for the purpose of accomplishing its academic and patient care missions, (2) the Information Technology Resources contains many closely shared environments and resources and the rights of other users must be taken into account and (3) legal and ethical restrictions apply.  Individuals may have access to unconstrained use through private or commercial systems located at their residence or elsewhere.  Resources or systems owned and maintained by the University for the benefit of the academic community are primarily intended for use for the University, not personal or business communications. 

E. Relationship to Division or Departmental IT Policies.

Divisions and Departments within the University may adopt additional information technology policies that are specific to their operations, provided that such requirements are consistent with this Policy and the unit provides a copy of more specific unit policies to the University Chief Information Officer.  In the event of inconsistency, the provisions of this Policy will prevail, unless the more specific policies are necessary to meet legal requirements governing certain types of information, in which case the more specific legal requirements and related policy will take precedence.

II.   Scope

A. People to Whom Policy Applies.

This Policy applies to everyone who accesses University Information Technology Resources, whether affiliated with the University or not, whether on campus or from remote locations, including but not limited to students, faculty, staff, contractors, consultants, temporary employees, guests, and volunteers.  By accessing University Information Technology Resources, the user agrees to comply with this Policy.

B. Definition of Information Technology Resources.

Information Technology Resources for purposes of this Policy include, but are not limited to, University-owned transmission lines, networks, wireless networks, servers, exchanges, internet connections, terminals, applications, and personal computers.  Information Technology Resources include those owned by the University and those used by the University under license or contract, including but not limited to information recorded on all types of electronic media, computer hardware and software, paper, computer networks, and telephone systems.  Information Technology Resources also includes, but is not limited to, personal computers, servers, wireless networks and other devices not owned by the University but intentionally connected to the University-owned Information Technology Resources (other than temporary legitimate access via the world wide web access) while so connected.

Section II – Privacy

I. Access Restrictions for Personal Communications

The University will not, without user permission, monitor, review or otherwise access Personal Communications (defined below) sent or received (e.g., email), created or stored on Information Technology Resources, except pursuant to the Access Procedures set forth in Section II, which permits access when determined reasonable by a senior administrative officer or for Information Technology Management.  The reasons for which access to Personal Communications can be granted include, but not are limited to, the following circumstances:

  • To investigate or prevent a violation of law or University Policy;
  • To protect health or safety or to provide assurance to the University or to health or other regulators or law enforcement authorities that harm has not occurred to patients, students or others;
  • To minimize or stop computer activity that interferes with the University’s network or other computer operations;
  • To comply with a subpoena, warrant, court order or similar legal process, including a discovery request or a litigation stay order issued by or investigation undertaken by the Office of Counsel in connection with a potential claim in anticipation of litigation; OR
  • When the user is unwilling, unable or unavailable to consent, to access Personal Communications needed by another University employee in order to fulfill a teaching, research, patient care or other legitimate University function. 

 

The access restrictions and approval process of this Policy do not apply to electronic communications and records supporting University Communications when accessed by authorized individuals for the purpose of carrying out University Business.  The approval process described below applies only if access is sought to Personal Communications. 

“Personal Communications” are limited to faculty and student research, teaching, learning or personal (i.e. non-University related) emails, documents and correspondence.  All other emails, documents, and correspondence prepared by a faculty member, student or employee in connection with his or her job responsibilities are defined as “University Communications” and may be accessed as needed for the purpose of carrying out University Business without seeking prior approval.

“University Business” refers to the University’s activities and functions, including, but not limited to, administrative functions in the areas of teaching, student life, patient care and research, as well as supportive administrative services.  It includes all information related to patient care, although this information is subject to HIPAA and other patient privacy restraints. 

II. Access Procedures

A. University Communications

University Communications may be accessed for the purpose of carrying out University Business by individuals with authority to deal with communications related to their subject matter without prior permission from a University official.  The purpose of the access is critical to the determination that prior permission from a University official is not necessary for access.

It is understood in the environment of Information Technology Resources that there may not always be a physical separation of electronic records between University Business and Personal Communications.  If material is found during a legitimate search for University Communications that indicates a potential violation in Personal Communications of University policy, including this Policy, or illegal use, the individual(s) involved in the search should halt the search, secure the relevant Information Technology Resources and seek permission to access the Personal Communications under the procedure set forth under section B.  Users are reminded of the General Principle in Section I that resources and systems owned and maintained by the University are intended for use for the University and not for personal or business communications.  Individuals who want unconstrained use and privacy should use private or commercial systems located at their residence or elsewhere, not University IT Resources.  Individuals using University IT Resources should recognize that complete privacy is not assured and should refrain from creating or keeping on University IT Resources communications that they wish to keep private.

B. Personal Communications

Anyone seeking access to Personal Communications (see definition in section I) without user consent must first present to a senior University official (President, Provost, Vice President of the University or Medical Center, Dean, CEO of Strong Memorial Hospital, Director of LLE or Director of MAG, and Vice Provost and Chief Information Officer, the “Official”) reasonable cause for gaining such access.  (See section I for examples of reasonable cause).  If the initiator of the request is a senior University Official, the request must be approved by another senior University Official.  If the initiator of the request is the University President, the request must be approved by the Vice President and General Counsel.  An individual cannot initiate a request for access and also be part of the decision-making process.  Permission should generally be sought from the official in charge of the school or division relevant to the search if that official is available.

In requesting access to Personal Communications without user consent, the person seeking access should provide to the Official relevant information available to support the reasonable cause.  The request regarding access should be in writing (email is preferable) to the Official with a copy sent to the Vice President and General Counsel.  The decision of the Official must be in writing (email is preferable) directed to the person requesting access with a copy to the Vice President and General Counsel and, if access is granted, a copy to the Information Technology team member who will oversee access. The Office of Counsel will retain a record of access requests and decisions for three years.  The Official may also consult with the General Counsel, as needed. 


If access is granted, the Official should designate a Director-level member of the University Information Technology Service or relevant other Information Technology unit, as appropriate, to conduct the access and review or to directly supervise the review and access if carried out by a technician with the appropriate skills.  To the greatest extent practicable, the ITS staff should access or review only communications or data necessary to meet the purpose underlying the request.  If other information is gathered by necessity or accident, it should be returned to the user or securely discarded at the end of the investigation.  The ITS reviewer should communicate his or her findings from the access or review to the individual whose request for access or granted or to such other person(s) as the Official designated.

Generally, the user will be notified that access has been granted.  In some circumstances, however, notice will not be given, such as in those cases when notice would compromise the reviewer’s ability to achieve the underlying reason for the request, when a court or law enforcement agency directs the University not to give notice, when notice is impracticable under the circumstances or when the review is not directed at a particular user.  The officer who grants access must decide in each case whether notice to the user is appropriate.

Some University employees, to perform their assigned duties, must have special privileges to access hardware and software, including specific files.  Such employees are expected to abide strictly by this Policy, and are subject to discipline, including termination, for violating it.

In emergency situations in order to prevent destruction of equipment or data, it may be necessary for the University to seize or otherwise secure computers or other information technology pending initiation under this Policy concerning access to the information contained therein.  The University reserves this right with respect to information technology governed by this Policy.

C. Information Technology Management and Audit

The University may use mechanisms to manage the information technology operations, including (but not limited to) spam and virus detection and elimination; limitation of network volume or blockage of access to specify file types or sites; or restriction of access to sites that present a security risk to the University’s systems or experience high volumes of network traffic unrelated to the academic missions of the University.  Use of such mechanisms must be approved by Director level University Information Technology (University IT) staff or any other person designated by the Chief Information Officer and must be consistent with legitimate University business needs.  It may be necessary for the Office of University Audit or the University’s outside auditors in the course of an audit to access Information Technology Resources and information stored thereon.  Audits are authorized by the Board of Trustees or by a senior University officer and are governed by protocols that protect unnecessary disclosure of information.

Section III - Data Classification and Access Restrictions

Access to information owned by the University is generally broadly consistent with the concept of academic freedom and the open nature of the institution.  However, there are types of information where access must be restricted and caution in handling and storing the information is necessary.
This policy is not intended to replace or supersede the specific policies identified below, and any conflicts will be controlled by the specific policies and not this one.

I. Legally Restricted Information:

The disclosure and use of the following types of information is restricted by law.  See the specific policies referenced for a more specific definition of each type of information and of the rules and procedures concerning its use

A. Social Security Numbers (SSN)

http://www.rochester.edu/it/policy/SSN-PII/

B. Patient Protected Health Information (HIPAA)

https://intranet-secure.urmc.rochester.edu/policy/HIPAA/PolicyManual.asp

C. Student Information (FERPA)¹

http://www.rochester.edu/registrar/policies.html

D. Financial Account, Credit and Debit Card Information

http://www.rochester.edu/adminfinance/treasury/nocard.html
http://www.rochester.edu/adminfinance/treasury/docs/ecommerce.pdf

E. Employee Personnel Records

http://www.rochester.edu/working/hr/policies/pdfpolicies/108.pdf
http://www.rochester.edu/working/hr/policies/pdfpolicies/404.pdf

Access and Use: Legally Restricted Information must be stored, used and disclosed to others only on a need to know basis to permit the individual faculty or staff member to perform their University functions for which the information was acquired and for which it is maintained.  Access to legally restricted information must be carefully safe-guarded. Protection of Legally Restricted Information from disclosure to or unauthorized access by anyone who does not have a legitimate need to access the information to comply with requirements of the law or to carry on necessary University functions is a primary responsibility of the Custodian. Alternatives to using Legally Restricted Information should be identified and used whenever possible.


Disclosure of Legally Restricted Information to a third party agent or vendor is permitted only if the agent or vendor assumes a legally binding obligation to safe-guard the use and disclosure of the information.  Contact the Office of Counsel for appropriate contractual language.

Storage and Protection:  Legally Restricted Information in paper form must be stored in locked or otherwise secured areas when not in active use.  Legally Restricted Information in electronic form must be stored in secure designated data centers or, if authorized to be stored elsewhere, only in encrypted (or similarly protected) form.  It must not be stored on desktop, laptop or other portable devices or media without encryption or similar protection. Contact Information Technology (University IT or ISD) or a Privacy Officer for advice and assistance.

Transmission: Reports and communications should not include Legally Restricted Information unless essential to perform the function for which the communication is made.  Transmission of Legally Restricted Data must be by secure methods.  If Legally Restricted Data is transmitted by e-mail or other electronic transmission, it must be encrypted or otherwise adequately protected.  Contact Information Technology (University IT or ISD) or a Privacy Officer for advice and assistance.

Destruction:  When a record containing Legally Restricted Information is no longer needed, it must be disposed of in a manner that makes the Legally Restricted Data no longer readable or recoverable.  Destruction of paper records containing Legally Restricted Data normally should be accomplished by shredding. Destruction of electronic records containing Legally Restricted Data begins with deleting the data from its storage location.  Contact Information Technology (University IT or ISD) or a Privacy Officer for additional advice and assistance.

Specific Rules for FERPA¹: Student information is governed by FERPA and the University policies implementing FERPA.  Because of the extensive educational activities of the University, many people within the University community have a legitimate need to access and transmit student records.  The confidentiality of student records must be safe guarded, but the strict rules for storage and destruction of Legally Restricted Information set forth in this Policy are not always appropriate for student records.  See the specific University policies on FERPA referenced above or contact the Registrar for more specific guidance.  

Reporting Unauthorized Disclosure of Legally Restricted Information: Prompt reporting of unauthorized disclosure of Legally Restricted Information is essential for the University to meets its obligations under law, regulation, and contract.  The University will not take disciplinary action against any person solely because of his or her good faith reporting of a disclosure.  Individuals who report violations of this Policy will be protected from retaliation resulting from providing information.  Individuals who report violations of this Policy to the Hotline can remain anonymous.

Immediately report any suspected unauthorized disclosure of or access to an SSN or material containing SSNs to any of the following:

  University  Medical Center
Privacy Officers 585-273-1804  585-275-7059
Information Technology Security   585-273-1804    585-784-6115
Office of Counsel 585-273-5824    585-758-7619
Compliance Hotline 585-756-8888 585-756-8888

II. Confidential Information:

Information can be sensitive or proprietary and the University users may have reasons to treat it as confidential.  Confidential Information includes many of the communications or records of the Board of Trustees and senior administrators.  It includes faculty research or writing before publication or during the intellectual property protection process.  It includes information that the University has agreed to hold confidential under a contract with another party.  There are other examples.

Restriction of Information as Confidential: If a faculty or staff member is responsible for information that is sensitive, proprietary or otherwise in need of confidential treatment, the individual should clearly label the information “Confidential”.  The word Confidential should be placed prominently on the information in a form appropriate to the medium in which it exists with an understanding that the purpose of the label should be to warn others clearly that this information is Confidential and should be treated accordingly.

Storage, Transmission, Access and Destruction: The rules set forth in the section dealing with Legally Restricted Information should be applied to all Confidential Information.

III. Internal University Use Only Information:

Much information necessary for people to perform their work at the University is properly available to others at the University, but is not appropriate to be known by the general public.  Information for Internal University Use Only is protected behind electronic firewalls or in private paper files in secured offices and is not accessible by the public at large.  This is appropriate and will continue.  Common sense and good practice dictate that this information remains accessible on a need to know basis by employees and sometimes by students, but not accessible by the media or outsiders.  Examples are: budgets, strategic or unit business plans, proposals, contracts, many policies and procedures, correspondence, grant related documents, financial records, etc.

IV. Public Information:

Public information is information that is available to all members of the University community and may be made available to the general public.  The University reserves the right to control the content and format of Public information.  Examples include the University’s audited financial statements, schedule of classes, approved census facts and the information on the public University website.

Section IV - Use

I. Responsibilities of Users

A. Responsible, Efficient Use Related to University Purposes: 

Access to University resources is a privilege granted to members of the University community that carries with it the responsibility to use resources for University related activities, responsibly and efficiently.  The responsibilities and limitations that are inherent in academic culture and ethics, or are required by law or University policy, apply in the context of technology just as they apply in other contexts in the University.

Any personal use of University Information Technology Resources, as opposed to use to further the University’s business and academic, research, patient care missions, should be incidental, intermittent and minor; should not interfere with the mission of the University; and should be consistent with applicable law and University Policy.  Legitimate use of a computer, computer system or network does not extend to whatever is technically possible.  Users must abide by all applicable restrictions, whether or not built into the operating system or network and whether or not they can be circumvented by technical means.

University Policies that govern personal conduct and use of University facilities apply to the use of all University resources, including information technology, in addition to the specific rules related to information technology contained in this Policy.

For students living in the dormitories with ResNet as their sole Internet Service Provider alternative, reasonable personal use is permitted subject to the rest of the provisions of this Policy. 

B. Integrity of Information Technology Resources:

Members of the University of Rochester community should respect the integrity of Information Technology Resources.  The following restrictions apply to all users except as authorized for Information Technology Resources staff in order to allow them to provide operations support.

  1. Unauthorized Modification and Destructive Programs:  Except for programs and files that users create, modify and maintain in the normal course of business, users may not attempt to modify without proper authorization University Information Technology Resources, documents or work products of others or attempt to crash or interfere with information technology operations.  Users may not tamper with any software protections or restrictions placed on Information Technology Resources.
  2. Authorized use: Users may use only their own computer accounts and use them only in the manner and to the extent authorized.  Users may not supply false or misleading data nor use another's password in order to gain access to Information Technology Resources.  Users may not subvert or attempt to subvert the restrictions associated with any computer account.
  3. Accountability: Users are responsible for all use of their computer account(s) and equipment and can be held accountable for misuse even if by others if they have not used reasonable care.  They should make appropriate use of the system and network-provided protection features and take precautions against others obtaining access to their Information Technology Resources.  Each user is responsible for maintaining individual password security (or other account security).
  4. Encroaching on Others’ Access and Use: Users may not encroach on others' use of Information Technology Resources.  Such prohibited activities include, but are not limited to: tying up computer resources; sending harassing messages; sending frivolous or excessive messages, including chain letters, junk mail, and other types of broadcast messages, either locally or over the Internet; inappropriate or excessive use of ITS support staff time or inappropriate or excessive use of the system, including network, bandwidth or  storage; introducing computer viruses, worms, Trojan Horses, or other rogue programs to University of Rochester hardware or software or  failing to take appropriate steps to prevent the introduction of such; physically damaging systems; and running inefficient programs when efficient ones are available.
  5. Deceptive Practices: Users may not use or create links to the University Information Technology Resources that are not authorized or that cloak or hide the identity of the user or the fact that the system used belongs to the University. 
  6. Identity of Users: All users, including, but not limited to, those standing behind local routers and wireless routers and firewalls, must be identified or identifiable when using the University systems and network.

C. Copyrights and Licenses:  

Users of University Information Technology Resources must comply with copyright and licensing restrictions and with applicable university policies.  University Information Technology Resources may not be used to violate copyright or the terms of any license agreement.  Unauthorized downloading and distributing copyrighted material is prohibited.  The University recognizes that the purpose of copyright is to protect the rights of the creators of intellectual property and to prevent the unauthorized use or sale of works.  No one may use University Information Technology Resources to inspect, modify, distribute, or copy proprietary data, directories, programs, files, disks or other software without proper authorization.

D. Publication, Defamation and University Reputation: 

Users must remember that information distributed through the University's Information Technology Resources is a form of publishing, and publishing standards apply.  Anything originating from the University network or website may be interpreted by others to represent UR and not just an individual.  Even with disclaimers, the students, faculty and staff may appear to represent the University, requiring the use of appropriate language, behavior and style so as not to damage the reputation of the University or incur liability.  Users must refrain from stating or implying that they speak on behalf of the University and from using University trademarks and logos without authorization to do so.


E. Publicly Available Electronic Communication:

Publicly available electronic communications created and maintained by individual faculty or administrative staff that are housed on or linked from the University servers or use the University domain, including, but not limited to, web pages, chat rooms, and web logs (also known as blogs), must follow all the usage rules as set forth in this Policy.

  1. University, School or Departmental Electronic Communication Resources: University, School or Departmental electronic communication resources, such as Official Faculty or Administrator Web Pages, should contain only material germane to University and/or academic matters.
  2. Personal Electronic Communication Resources: Faculty and administrative staff may establish personal web sites, chat rooms, web logs (also known as blogs) and other forms of publicly available electronic communications using University Information Technology Resources on separate pages  that are linked to their page on official University, School or Departmental electronic communication provided that the personal electronic communication page must carry in a prominent place this statement: “The views, opinions and material expressed here are those of the author and have not been reviewed or approved by the University of Rochester.”  Personal electronic communication resources hosted on University Information Technology Resources must follow all the rules set forth in this Policy, except that they may contain personal information not germane to University business. 

Faculty, students and administrative staff in their personal capacities may, of course, establish and use personal electronic communication resources not using University Information Technology Resources that do not comply with this Policy, but if such a personal electronic communication resource is linked to official electronic communication resources, the personal electronic communication must comply with all the rules of this Policy.

F. Prohibited Uses:

Use of University Information Technology Resources (including but not limited to electronic or email, instant messaging and similar systems) for any of the following is prohibited:

  1. Partisan Political Activity: University resources, including Information Technology Resources, are prohibited by law from being used for partisan political activities, including giving or receiving endorsements or funds in connection with a campaign for elective governmental office within the United States.  Individuals may, of course, express their opinions on and be involved with partisan political activities but they should do so as a personal activity (see Personnel Policy 112 on Political Activities for a general policy statement on these issues).  The name of the University or any of its schools or departments, including its website (except for personal pages with appropriate disclaimer as described above), may not be used in connection with partisan political activity.  If the University title of a faculty or staff member is used in connection with any partisan political activity, it must be accompanied by a statement that the person is speaking as an individual and not as a representative of the University.
  2. Illegal Activity: Use of University Information Technology Resources, must comply with all applicable laws, University rules and policies, and all contracts and licenses.  Users are responsible for ascertaining, understanding and complying with the laws, rules, policies contracts, and licenses applicable to their particular uses.
  3. Commercial Activity or Personal Gain: University resources, including Information Technology Resources, may not be used for or to transmit commercial or personal advertisements, solicitations, endorsements or promotions unrelated to the business of the University.
  4. Property or Identity of Others: University resources, including Information Technology Resources, may not be used to seek, use, transfer, disseminate or steal the property of others, including personal identity information, student records or individually identifiable health information, except as permitted by law, which generally only allows use of personal identity information on a legitimate need to know basis to permit the proper conduct of University business. Users should respect the privacy of other users and their accounts, regardless of whether those accounts are securely protected.

G. Security Risks and/or Sensitive Data:

Please consult the Information Technology Security Policy for more specific rules and suggestions concerning safe use of the system.  More specific rules also govern the use of some kinds of particularly sensitive data (for example, patient, student personnel and donor records). 

II. Warning about Using the System and the Internet 

The University cannot guarantee protection against the existence or receipt of material that may be offensive or guarantee privacy or security.  All users of electronic communications are warned that they may come across or be recipients of material they find offensive.  Those who use e-mail and/or make information about themselves available on the Internet are warned that the University cannot guarantee individuals’ protection from invasions of privacy and other possible dangers that could result from the individual's distribution of personal information.   Users should therefore engage in “safe computing” practices by establishing or agreeing to installation of appropriate access restrictions for their accounts, guarding their passwords, and changing them regularly.

Section V - Enforcement

Violations of this Policy will be handled under normal University disciplinary procedures applicable to the relevant persons or departments.  The University may suspend, block or restrict access to information and network resources when it reasonably appears necessary to do so in order to protect the integrity, security, or functionality of University resources or to protect the University from liability.  The University routinely monitors the use of Information Technology Resources to assure the integrity and security of University resources.  The University may refer suspected violations of applicable law to appropriate law enforcement agencies.

Violations of this Policy can result in disciplinary action up to and including separation from the University and/or exclusion from University programs, facilities and privileges.  Violations of law can lead to fines, injunctions and personal liability.

Section VI – Approval and Review

To continue to support University technology resources, further Policy and procedural development is planned.  Future Policy revision will likely include additional material concerning information security, data classification and network administration.  The Policy will be reviewed and may be changed.
Approved by President Joel Seligman on December 12, 2006.
Revision approved on January 7, 2009.

Section VII - Questions – Where To Ask

If you have questions, call or email:

General Counsel
Sue S. Stewart
sue.stewart@rochester.edu
585-273-5824

Chief Information Officer
David Lewis
david.lewis@rochester.edu
585-275-5240