ROWAN UNIVERSITY POLICY

Title: IT Acquisition Policy
Subject: Information Resources and Technology
Policy No: IRT:2013:02
Applies: University-Wide
Issuing Authority: Senior Vice President for Information Resources and Technology and Chief Information Officer
Responsible Officer:
Date Adopted: 07-01-2013
Last Revision: 05-01-2024
Last Review: 05-01-2024

I.  PURPOSE

This policy sets forth the process for the approval and acquisition of all Information Technology (IT) including, but not limited to software, hardware, IT consulting, and IT services.

II.  ACCOUNTABILITY

Under the direction of the Chief Information Officer, Rowan University management shall implement and ensure compliance with this policy.

III.  APPLICABILITY

This policy applies to all members of the Rowan community who seek to acquire IT Resources for Academic, Administrative, Clinical, or Research purposes. This includes all sources of University funding including, but not limited to department budgets, grant funds from contracts and/or transmittal forms between the University, and external funding sources (public and private), are covered by this policy.

IV.  DEFINITIONS

Refer to the Rowan University Technology Terms and Definitions for terms and definitions that are used in this policy.

1. Academic IT Resources – any software, hardware, IT consulting or IT services that is used to support users (faculty and students) in their teaching, learning, and research activities. Academic IT Resources can be distributed and accessed locally or through the cloud.
2. Administrative IT Resources – any software, hardware, IT consulting or IT services that is used as an ancillary system in support of Rowan University's Enterprise Relationship Management system (Ellucian's Banner System), whether to augment or replace specific functions with best-of-breed niche products.
3. Clinical IT Resources – any software, hardware, IT consulting or IT services that allows the user to enter patient specific information, and using formulae or other forms of analysis based on clinical information, glean from that information a patient-specific diagnosis or treatment recommendation that is used to assist in making a clinical decision.
4. FERPA - The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects students' privacy by prohibiting disclosure of education records without adult consent.
5. GLBA - The Gramm-Leach-Bliley Act (GLB Act or GLBA), also known as the Financial Modernization Act of 1999, is a federal law enacted in the United States to control the ways that institutions deal with the private information of individuals.
6. Hardware – computer devices that use, process, store, or transmit electronic information.
7. HIPAA – The Health Insurance Portability and Accountability Act (HIPAA) is the federal law passed by Congress in 1996 that requires the protection and confidential handling of protected health information
8. Information Resources and Technology (IRT) – the Rowan University department responsible for the governance of all information and technology.
9. IT Consulting – a third party used to provide IT consulting services including system design, planning, auditing, and/or advisory services.
10. IT Services – a third party used to provide any other IT services, not classified as IT consulting, including IT management, hosting, repair, installation, maintenance, etc.
11. Rowan University IT Purchasers – faculty, staff, non-employees, students, attending physicians, contractors, covered entities, agents, and any other third parties of Rowan.
12. Software – computer programs that direct the operation of a computer or processing electronic data.

VI.  POLICY

1. Rowan University wants to ensure that we are meeting our responsibilities as IT users by guaranteeing that all IT Resources purchased within Rowan University are compatible with Rowan's information technology (IT) and in compliance with security requirements and regulations. IT purchasing can be an intricate process involving obscure terminology and possible legal or financial obligations for you and the University. Accordingly, prospective purchasers will obtain consultation and approval from Information Resources and Technology personnel who are familiar with these details, and who routinely implement and manage these IT Resources.
2. All IT acquisitions including, but not limited to, software, hardware, IT consulting, and IT services by academic, administrative, and clinical & research departments will require approval for purchase from the Division of Information Resources & Technology (IRT) following these procedures since IT Resources:

   1. May be used by more than a single individual and/or have the likely potential for the same or

   2. May need to interface with other University IT Resources or

   3. May be used to process, store, or transmit University data.
3. The IT purchaser is responsible for obtaining all funds needed to purchase, install, and maintain the IT Resource for current and future costs. These funds will be transferred into the IRT budget via yearly DCA transfers (or other means as needed). The transfers will cover all cost, including:

   1. The internal cost to install the IT Resource(s).

   2. Any consulting required configuring or maintaining the IT Resource(s).

   3. Any additional cost for bandwidth and storage.

   4. Ongoing annual maintenance, licensing, and fees.

   5. Any additional cost to properly protect University data.
4. Non-Compliance and Sanctions
1. Violations of this policy are strictly prohibited and may require the removal of any unapproved IT Resources at the purchaser's expense and possible disciplinary action.

By Direction of the CIO: 

Mira Lalovic-Hand, 
SVP and Chief Information Officer