...

ROWAN UNIVERSITY POLICY

Title:

...

Acceptable Use Policy
Subject: Information

...

Security 
Policy No: ISO:2013:01
Applies: University-

...

Wide
Issuing Authority:

...

 Senior Vice President for Information Resources and

...

Technology and Chief Information Officer
Responsible Officer:

...

Information Security Officer
Date Adopted: 07

...

/01

...

/2013
Last Revision: 10

...

/12/2023
Last Review:

...

_____________________________________________________________________________________________

1. PURPOSE

This policy sets forth the acceptable uses regarding the access and use of the University's electronic information and information systems.

1. ACCOUNTABILITY

Under the direction of the President, the Chief Information Officer and the University's Chief Information Security Officer shall implement and ensure compliance with this policy. The Vice Presidents, Deans, and other members of management will implement this policy.

1. APPLICABILITY

This policy applies to all members of the Rowan community who access and use the University's electronic information and information systems. This policy and Rowan's "Code of Conduct" also govern access and use of the University's electronic information and information systems originating from non-Rowan computers, including personal computers and other electronic devices. The access and use of electronic information provided by research and funding partners to Rowan is also governed by this policy.
The use of information systems acquired or created through use of University funds, including grant funds from contracts between the University and external funding sources (public and private), are covered by this policy. This includes University information systems that are leased or licensed for use by members of the Rowan community.

1. DEFINITIONS
2. Availability – the expectation that information is accessible by Rowan when needed.
3. Cloud Services – Consumer and business products, services and solutions delivered and consumed on-demand, using the cloud service providers' pooled resources, and delivered over a broad network, such as the Internet.
4. Confidentiality – the expectation that only authorized individuals, processes, and systems will have access to Rowan's information.
5. Confidential Information – the most sensitive information, which requires the strongest safeguards to reduce the risk of unauthorized access or loss. Unauthorized disclosure or access may 1) subject Rowan to legal risk, 2) adversely affect its reputation, 3) jeopardize its mission, and 4) present liabilities to individuals (for example, HIPAA and HITECH penalties). See the Information Classification policy for additional information.
6. HIPAA – Health Insurance Portability and Accountability Act of 1996.
7. HITECH – Health Information Technology for Economic and Clinical Health Act.
8. Information System – consists of one or more components (e.g., application, database, network, or web) that is hosted in a University campus facility, and which may provide network services, storage services, decision support services, or transaction services to one or more business units.
9. Integrity – the expectation that Rowan's information will be protected from improper, unauthorized, destructive, or accidental changes.
10. Internal Information – data that is owned by the University, is not classified Confidential or Private, and is not readily available to the public. For example, this includes employee and student identification numbers and licensed software.
11. Mobile Computing Device – including, but not limited to, laptops, netbooks, tablets, smartphones (BlackBerry, iPhone, etc.) and mobile broadband cards (also known as AirCards® and connect cards).
12. Private Information – sensitive information that is restricted to authorized personnel and requires safeguards, but which does not require the same level of safeguards as confidential information. Unauthorized disclosure or access may present legal and reputational risks to the University. See the University's Information Classification policy for additional clarification.
13. Privileged Information – refers to attorney-client communication.
14. Public Information – information that is readily available to the public, such as the information published on web sites.
15. Removable Media – including, but not limited to, CDs, DVDs, copier hard drives, storage tapes, flash devices (e.g., CompactFlash and SD cards, USB flash drives), and portable hard drives.
16. Social Media – refers to tools that allow the sharing of information and creation of communities through online networks of people.
17. Rowan Community – faculty, staff, non-employees, students, attending physicians, contractors, covered entities, agents, and any other third parties of Rowan.
18. REFERENCES
19. The Rowan Code of Conduct - http://www.Rowan.edu/complweb/code/
20. Breach Notification Policy -http://www.rowan.edu/open/compliance/hipaa/hipaa_breach.php

1. HIPAA Policies – http://www.rowan.edu/compliance/

1. IT Acquisition Policy - http://www.rowan.edu/adminfinance/controller/purchasing/documents/ITAcquisitionPolicy1-1-2014.pdf

1. POLICY

Users are given access to Rowan's electronic information and information systems specifically to assist them in the performance of their jobs and education. They are not provided for personal use. They are responsible for all activity conducted using their computer accounts. Access and use of the University's electronic information and information systems is a revocable privilege.
The University expects users will access and use the University's electronic information and information systems in a manner that:

1. Does not compromise the confidentiality, integrity, or availability of those assets; and
2. Reflects the University's standards as defined in the Code of Conduct and its body of policies, and in accordance with all applicable federal, state, and local laws governing the use of computers and the Internet.

...

11/17/2022

I.   PURPOSE

This policy sets forth the acceptable uses regarding the access and use of Rowan University's electronic information and information systems.

II.  ACCOUNTABILITY

Under the direction of the President, the Chief Information Officer and Information Security Officer shall ensure compliance with this policy. The Vice Presidents, Deans, and other members of management will implement this policy in their respective areas.

III.  APPLICABILITY

This policy applies to all members of the Rowan Community who access and use the University's electronic information and information systems. 

IV.  DEFINITIONS

Refer to theRowan University Technology Terms and Definitions for terms and definitions that are used in this policy.

V.  POLICY

1. The University expects users will access and use the University's electronic information and information systems in a manner that:

   1. Does not compromise the confidentiality, integrity, or availability of those assets; and

   2. Reflects the University's standards as defined in the Code of Conduct/Statement of Principles and its body of policies, and in accordance with all applicable federal, state, and local laws governing the use of computers and the Internet.

2. These obligations apply regardless of where access and use originate: Rowan office, classroom, public space, lab, at home, or elsewhere outside the University.

3. The rules stated in this policy also govern the use of information assets provided by the State of New Jersey, other state and federal agencies, and other entities that have contracted with Rowan to provide services to their constituents and/or clients.

4. Schools, units, and departments may produce more restrictive policies. Therefore, users should consult with their department if there are any other restrictions in place that supplement this policy.

5. This policy and Rowan's Code of Conduct/Statement of Principles also govern access and use of the University's electronic information and information systems originating from non-Rowan computers, including personal computers and other electronic devices. The access and use of electronic information provided by research and funding partners to Rowan are also governed by this policy.

6. The use of information systems acquired or created through the use of University funds, including grant funds from contracts between the University and external funding sources (public and private), are covered by this policy. This includes University information systems that are leased or licensed for use by members of the Rowan Community. Users are given access to Rowan's electronic information and information systems specifically to assist them in the performance of their jobs and education. They are not provided for personal use. They are responsible for all activity conducted using their computer accounts. Access and use of the University's electronic information and information systems is a revocable privilege.

7. Rowan recognizes that all members of the Rowan Community have an expectation of privacy for information in which they have a substantial personal interest. However, this expectation is limited by Rowan's need to comply with applicable laws, protect the integrity of

...

1. its resources, and protect the rights of all users and the property and operations of Rowan University. As such, Rowan reserves the right to access, quarantine, or hold for further review any files or computing devices on

...

1. Rowan's network or its information technology resources if there is just cause to believe that university policies or laws are being violated or if such access is necessary to comply with applicable law or conduct university business operations.

2. Information created, stored, or accessed using Rowan information systems may be accessed and reviewed by Rowan personnel for legitimate systems purposes, including but not limited to the following:

   1. Emergency Problem Resolution

   2. To measure, monitor, and address the use, performance, or health of the University's information systems, or to respond to information security issues. Internet usage may also be monitored when using the University's network, including when using Rowan's remote access services.

   3. To create data backups of electronic information stored on Rowan's information systems.

   4. To respond to User Requests

      Such access shall require approval by the

      approved by the Office of General Counsel.

3. Information may be accessed, reviewed, and provided to an external party at the University's discretion without prior notification with adequate cause and subject to review of the Office of General Counsel to comply with applicable law and to conduct normal university operations. Examples include, but are not limited

   to the following: Compliance with the New Jersey Open Public Records Act ("OPRA") which requires disclosure of electronic records and other data on the rowan system subject

   to the following:

   1. Compliance with the New Jersey Open Public Records Act ("OPRA") which requires disclosure of electronic records and other data on the Rowan system subject to exemptions under OPRA

   exemptions under OPRA. Requests will be reviewed by the Records Custodian/OPRA officer in conjunction with the Office of General Counsel.
   2. Compliance with a valid subpoena, court order, or discovery request. Requests will be reviewed by the Office of General Counsel.
   3. Audits, investigations, or inquiries undertaken by governmental entities or appropriate internal investigators or units

      . Requests will be reviewed by the Records Custodian/OPRA officer in conjunction with the Office of General Counsel.

   4. To conduct necessary business operations.
4. All electronic information created, stored, or transmitted by use of Rowan's information systems is the property of the University, unless otherwise explicitly noted.
   1. Requirements:

5. 1. Compliance with a valid subpoena, court order, or discovery request. Requests will be reviewed by the Office of General Counsel.

   2. Audits, investigations, or inquiries undertaken by governmental entities or appropriate internal investigators or units. Requests will be reviewed by the Office of General Counsel.

   3. To conduct necessary business operations.

6. All electronic information created, stored, or transmitted by use of Rowan's information systems is the property of the University, unless otherwise explicitly noted

   President/CEOs, Vice Presidents and Deans must:
7. Distribute copies of this policy to all members of their organizations.
8. Ensure that each member of their respective organizations receives periodic training and awareness about acceptable use of Rowan's electronic information and information systems.
Communicate any additional restrictions they have established governing their members use of the University's electronic information and information systems

.

9. Technicians and System Administrators

   have greater

   have greater ability to access information stored on and transmitted through Rowan's information systems. As such, Technicians, Systems Administrators, and others with

   network

   privileged access shall not access such information unless such access is necessary for the purposes outlined above, for systems purposes, or unless such access is supported by adequate cause and reviewed by the Office of General Counsel.

10. Prohibited Actions

    1. The list of prohibited actions is not intended to be comprehensive. The evolution of technology precludes the University from anticipating all potential means of capturing and transmitting information. Therefore, users must take care when handling sensitive information. Refer to Rowan's Information Classification

...

1. 1.  and Data Governance policies for types of information that are considered sensitive and/or contact Rowan's Information Security Office for guidance.

   2. Users,

...

1. 1. at minimum, will ensure that they do not:

      1. Distribute information classified as Confidential or Private, or otherwise considered or treated as privileged or sensitive information, unless they are an authoritative University source for, and an authorized University distributor of that information and the recipient is authorized

         to receive that information. (For examples of Confidential and Private information, see the appendix in the University's Information Classification policy.)

         to receive that information. 

      2. Share their passwords with other individuals or institutions (regardless if they are affiliated with Rowan or not) or otherwise leave them unprotected.

      3. Attempt to uninstall, bypass, or disable security settings or software protecting the University's electronic information, information systems, or computer hardware.

      4. Engage in unauthorized attempts to gain access or use the University's electronic information, information systems, or another user's account.

         Technicians,

         Users with privileged access, such as Technicians and Systems Administrators,

         and others with network access

         shall not engage in unauthorized access, use, or review of information or data, without appropriate approvals.

      5. Use third-party email services to conduct sensitive University business or to send or receive Rowan information classified as Confidential, Private or

         Private

         Internal or otherwise considered privileged or sensitive information.

      6. Use email auto-forwarding to send University information (regardless of classification) to non-Rowan email accounts (see Restricted Services).

      7. Distribute or collect copyrighted material without the expressed and written consent of the copyright owner or without lawful right to

         do so, such as in the case of fair useAs per the Joint Commission, they do not use texting for communicating health care orders (see Restricted Services, section 6)

         do so, such as in the case of fair use.

   2. User understands the HIPAA Privacy Security rules, especially with regard to Sensitive Electronic Information (SEI), Private Health Information (PHI), and Personally Identifiable Information (PII) and will abide by these rules,

...

1. 1. including understanding that they will be held accountable for the use of personal devices for conducting University business. (Refer to HIPAA policies located atwww.rowan.edu

...

1. 1. /compliance).

2. Anchor
   restricted restricted

   Restricted Services

   1. This list of restricted services is not intended to be comprehensive. The evolution of technology precludes the University from anticipating all potential means of storing, capturing and transmitting information. Therefore, when using third-party technology services not explicitly restricted in this policy, users must exercise care to not

...

1. 1. compromise sensitive Rowan information, particularly when confirmation of receipt or the identity of the recipient is required for business or legal purposes. Refer to Rowan's Information Classification and Data Governance policies for types of information that are considered sensitive and/or contact Rowan's Information Security Office for guidance.

   2. Restricted services include the following:

      1. Social Media 

         1. Social media tools or web content platforms cannot be used to communicate or store University information classified as Confidential or Private or otherwise considered privileged or sensitive by Rowan. Social media tools include, but are not limited to: Facebook, Twitter, LinkedIn, Instagram, Medium, Reddit, YouTube and Flickr.

         2. For additional requirements on the use of social media, see the Social Media Policy. 

      2. Professional Social Media

         1. Professional social media cannot

2. Social Media
3. Social media tools cannot

   1. 1. 1. be used to communicate or store University information classified as Confidential

   or Private or otherwise considered privileged or sensitive by Rowan. Social media tools include, but are not limited to:

• Social networking sites: e.g., Facebook, Google+, Myspace, LinkedIn
• Blogs
• Microblogging sites: e.g., Twitter
• Wikis
• Content-sharing services: e.g., YouTube (video) and Flickr (for photos, videos, etc.).

1. Online forums

The Rowan name or your Rowan email address cannot be used on social media sites for personal communications or postings.

1. Using the Rowan name or email address on social media sites to post information in a manner that may be interpreted as representing an official position of Rowan, or which may misrepresent the University's viewpoint. All postings where the user is identified as a member of Rowan should clearly communicate that "The views and opinions expressed are strictly those of the author. The contents have not been reviewed or approved by Rowan University."
2. Professional Social Media

The use of professional social media tools, such as Doximity and Sermo, cannot be used:

1. To discuss patient cases in a manner that compromises patient identity or privacy, or otherwise represents a violation of HIPAA's Privacy or Security rules, state or local privacy laws, or University policies.
2. To communicate or post information that could potentially reveal information classified as Confidential or Private or otherwise considered privileged or sensitive by Rowan, or which compromises the privacy of a member of the University community or its clients.
3. Cloud Services
4. Cloud Storage Tools

...

1. 1. 1. 1. or Private or otherwise considered privileged or sensitive by Rowan.

         2. The use of professional social media tools, such as Doximity and Sermo, cannot be used:

            1. To discuss patient cases in a manner that compromises patient identity or privacy, or otherwise represents a violation of HIPAA's Privacy or Security rules, state or local privacy laws, or University policies.

            2. To communicate or post information that could potentially reveal information classified as Confidential or Private or otherwise considered privileged or sensitive by Rowan, or which compromises the privacy of a member of the University community or its clients.

            3. For additional requirements on the use of social media, see the Social Media Policy. 
               

      2. Cloud Services, Collaboration and Storage 

         1. Third-party cloud storage services cannot be used to store University information classified as Confidential unless approved by the Information Security Office and Chief Information Officer. Google Drive and OneDrive are approved for storing Rowan Confidential information. Rowan Confidential information may only be stored in the Rowan IRT-managed instances of these cloud services.  It is not permissible to store Rowan Confidential information in personal cloud solutions nor those managed by other companies.

         2. Non-approved third-party cloud storage services cannot be used to store University information classified as Confidential or Private or otherwise considered privileged or sensitive by Rowan. Cloud storage tools include, but are not limited to:

...

1. 1. 1. 1. iCloud

...

1. Data Sharing Tools

...

1. 1. 1. 1. , Carbonite, Box, Dropbox, Evernote, OpenDrive and SugarSync.

      2. Third Party Email Services

         1. Third party email services cannot be used to

...

1. 1. 1. 1. communicate or store University information classified as Confidential or Private or otherwise considered privileged or sensitive

...

• Box.net
• Catch
• Dropbox
• Evernote
• Google Docs
• Google Drive
• OpenDrive
• SugarSync

1. Third Party Email Services

...

1. 1. 1. 1. .

      2. Email Auto-Forwarding

         1. With the exception of current undergraduate and other non-medical students, members of the Rowan Community are not permitted to automatically forward or redirect messages from a Rowan email address to a non-Rowan email address

      3. Texting

         1. Texting cannot be used to communicate or store University information classified as Confidential

...

1. 1. 1. 1. .

      2. Video Conferencing 

         1. Video conferencing services are limited to Rowan business-use only and must be conducted using Rowan equipment. They are to be used strictly for business collaboration between members of the Rowan Community or outside entities, or for educational purposes. Users must ensure that video communications are done in a setting or configured to restrict the possibility of non-authorized individuals from viewing or listening to sensitive information.

      3. Chat

         1. The use of non-approved chat services cannot be used to communicate or store University information classified as Confidential or Private or otherwise considered privileged or sensitive by Rowan. Chat tools include, but are not limited to: Slack and HipChat.

         2. Webex is approved for Confidential, Private, Internal and Public data.

      4. BitTorrent Software  

         1. BitTorrent software (or other file sharing software) used to download and share movies, music, and other copyrighted media is strictly forbidden unless it is used for Rowan business or academic purposes. The use of this software must be approved by the Dean or Department Head/Chair, and the Information Security Office.

VI. POLICY COMPLIANCE 

1. Violations of this policy may subject the violator to disciplinary actions up to or including termination of employment or dismissal from school, subject to applicable collective bargaining agreements and may subject the violator to penalties stipulated in applicable state and federal statutes. Students who fail to adhere to this Policy or the Procedures and Standards will be referred to the Office of Student Affairs and may be expelled. Affiliates, contractors and vendors who fail to adhere to this Policy and the Procedures and Standards may face termination of their business relationships with the University. Sanctions shall be applied consistently to all violators regardless of job titles or level in the organization.

2. University sanctions, penalties, fines and discipline for employees will be based on the severity of the incident per below

1. Email Auto-Forwarding
2. Full time faculty and staff are not permitted to automatically forward or redirect messages from their primary email address to a non-Rowan email address.

1. Individuals associated with the School of Osteopathic Medicine (Faculty/Staff/Students) are not permitted to forward or redirect messages from their primary Rowan email address to a non-Rowan email address.

Alumni and Retired Faculty
Alumni and retired faculty may use email auto-forwarding provided they hold no other position at the University, including as a volunteer.

1. Texting
2. Health Care Information

As per the Joint Commission, "It is not acceptable for physicians or licensed independent practitioners to text orders for patients to the hospital or other health care setting. This method provides no ability to verify the identity of the person sending the text and there is no way to keep the original message as validation of what is entered into the medical record."

1. General Use

Users should take care texting other sensitive information, particularly when confirmation of receipt or the identity of the recipient is required for business or legal purposes.

1. Internet-based Video Conferencing
   1. Faculty and Staff

Internet-based video conferencing services, such as Skype, are limited to Rowan business-use only and must be conducted using Rowan equipment. They are to be used strictly for business collaboration between members of the Rowan community or outside entities, or for educational purposes. Users must ensure that video communications are done in a setting that limits or restricts the possibility of non-authorized individuals from viewing or listening to sensitive information.

1. Bit Torrent Software
2. Faculty and Staff

Bit Torrent software (or other file sharing software) used to download and share movies, music, and other copyrighted media is strictly forbidden unless it is used for Rowan business or academic purposes. The use of this software must be approved by the Dean or Department Head/Chair, and the Information Security Office.

1. NON-COMPLIANCE AND SANCTIONS

...

1. :

   1. Low – retraining and to be reviewed with the employee during annual appraisal. Also, any cost shall be borne by the Department. The Department Chair or VP will determine how these funds will be assigned.

   2. Medium – retraining and to be reviewed with the employee during annual appraisal. Discipline will be considered up to and including dismissal from the University. Also, all costs will be borne by the Department. The Department Chair or VP will determine how these funds will be assigned.

   3. High – retraining and to be reviewed

...

1. 1. with employee during annual appraisal. Discipline will

...

1. 1. be unpaid suspension for a minimum of three (3) days with a consideration of up to and including dismissal from the University. Civil and criminal penalties may apply. Also, all costs will be borne by the Department. The Department Chair or VP will determine how these funds will be assigned. The Deans of each College, Vice Presidents, and University President, with the assistance of the Department of Human Resources, will enforce the sanctions appropriately and consistently to all violators regardless of job titles or level within the

...

1. 1. University and in accordance with bargaining agreements for represented employees.

VII.  ADDITIONAL INFORMATION

1. Rowan University Statement of Principles

2. Breach Notification Policy

3. HIPAA Policy

4. IT Acquisition Process (ITAP)

5. Information Classification Policy

6. Data Governance Policy

By Direction of the CIO:
__________________________________

Mira Lalovic-Hand,
VP SVP and Chief Information Officer