Computer Use/Electronic Information: Difference between revisions

no edit summary
(Created page with "POLICY NO : 6051<br /> EFFECTIVE DATE: 04/25/07<br /> Revised Date: 11/16/04<br /> Reviewed Date: 11/16/04<br /> <big>'''Computer Use and Electronic Information Security ...")
 
No edit summary
Line 44: Line 44:


   
   
 
==== Acceptance and Adherence to Policy ====
'''Acceptance and Adherence to Policy'''
<br />


Using UNMC’s information systems by anyone shall constitute agreement to abide by and be bound by the following:
Using UNMC’s information systems by anyone shall constitute agreement to abide by and be bound by the following:
Line 58: Line 58:
*    Executive Memorandum No. 27, HIPAA Compliance Policy
*    Executive Memorandum No. 27, HIPAA Compliance Policy
<br />
<br />
B. Access
   
==== Access ====
<br />


Physical and electronic access to proprietary information and computing resources is controlled.  The level of control will depend on user need and the level of risk and exposure to loss or compromise.  Access will be assigned based upon the information needed to perform assigned duties.  Electronic access is controlled through user id and password.  
Physical and electronic access to proprietary information and computing resources is controlled.  The level of control will depend on user need and the level of risk and exposure to loss or compromise.  Access will be assigned based upon the information needed to perform assigned duties.  Electronic access is controlled through user id and password.  


    UNMC Net ID accounts will only be issued to the following individuals:  
'''UNMC Net ID accounts will only be issued to the following individuals:'''
         Faculty, staff and students of UNMC
          
         Individuals who have a relationship with UNMC and need access to electronic resources in order to perform their duties.
* Faculty, staff and students of UNMC
            Individuals must have a department chair or section chief sponsor their need for this account.
*         Individuals who have a relationship with UNMC and need access to electronic resources in order to perform their duties.
             The department chair or section chief is responsible for ensuring that the individual is aware of all UNMC policies and procedures relating to the use of the electronic resources.
# Individuals must have a department chair or section chief sponsor their need for this account.
             The department chair or section chief is responsible for coordinating with ITS to ensure that all software license regulations are honored by granting this account.
#             The department chair or section chief is responsible for ensuring that the individual is aware of all UNMC policies and procedures relating to the use of the electronic resources.
             ITS is responsible for maintaining a log of:
#             The department chair or section chief is responsible for coordinating with ITS to ensure that all software license regulations are honored by granting this account.
            Individual name, contact information
#             ITS is responsible for maintaining a log of: Individual name, contact information, Sponsoring Department Chair or Section Chief, Resources accessed, Reason for account/relationship to UNMC
            Sponsoring Department Chair or Section Chief
#             The Assistant Vice Chancellor or designee will approve requests for these types of accounts.
            Resources accessed
'''UNMC email accounts will only be issued to the following individuals:'''
            Reason for account/relationship to UNMC
          
             The Assistant Vice Chancellor or designee will approve requests for these types of accounts.
* Faculty (excluding volunteer appointments) staff and students of UNMC
    UNMC email accounts will only be issued to the following individuals:  
*         Retired faculty who have an emeritus appointment
         Faculty (excluding volunteer appointments) staff and students of UNMC
*         If a department identifies the need for an individual who does not meet the criteria to have an email account, a request for a policy exception can be made:
         Retired faculty who have an emeritus appointment
              
         If a department identifies the need for an individual who does not meet the criteria to have an email account, a request for a policy exception can be made:
# Individuals must have a department chair or section chief sponsor their need for this account.
             Individuals must have a department chair or section chief sponsor their need for this account.
#             The department chair or section chief is responsible for ensuring that the individual is aware of all UNMC policies and procedures relating to the use of the electronic resources.
             The department chair or section chief is responsible for ensuring that the individual is aware of all UNMC policies and procedures relating to the use of the electronic resources.
#             The department chair or section chief is responsible for coordinating with ITS to ensure that all software license regulations are honored by granting this account.
             The department chair or section chief is responsible for coordinating with ITS to ensure that all software license regulations are honored by granting this account.
           
            ITS is responsible for maintaining a log of:
# ITS is responsible for maintaining a log of: Individual name, contact information, Sponsoring Department Chair or Section Chief, Resources accessed, Reason for account/relationship to UNMC
            Individual name, contact information
#             The Assistant Vice Chancellor or designee will approve requests for these types of accounts.
            Sponsoring Department Chair or Section Chief
<br />
            Resources accessed
            Reason for account/relationship to UNMC
             The Assistant Vice Chancellor or designee will approve requests for these types of accounts.


     NOTE:  If an individual is a volunteer, please refer to Reporting of Non-faculty Volunteer Policy.
      
:NOTE:  If an individual is a volunteer, please refer to Reporting of Non-faculty Volunteer Policy.


Shared accounts are discouraged.  Shared accounts should be used only to access the network and shared resources.  Shared resources would include printers, shared file store which does not contain confidential information, Internet access, etc.  Personal accounts will always be utilized to access confidential information.
Shared accounts are discouraged.  Shared accounts should be used only to access the network and shared resources.  Shared resources would include printers, shared file store which does not contain confidential information, Internet access, etc.  Personal accounts will always be utilized to access confidential information.
Line 111: Line 111:


Information Technology Services (ITS) and/or system administrators will inactivate or delete IDs/password, as appropriate, of individuals who no longer have a relationship with UNMC.
Information Technology Services (ITS) and/or system administrators will inactivate or delete IDs/password, as appropriate, of individuals who no longer have a relationship with UNMC.
<br />
<br />


   
   


C.  Misuse of UNMC information resources
==== Misuse of UNMC information resources ====
<br />
 
It is the responsibility of the workforce to utilize the information technology resources in an appropriate manner.  Individuals with access to information systems are expected to safeguard resources and maintain appropriate levels of confidentiality in order to protect the integrity of all data and of the interests of the entity.
It is the responsibility of the workforce to utilize the information technology resources in an appropriate manner.  Individuals with access to information systems are expected to safeguard resources and maintain appropriate levels of confidentiality in order to protect the integrity of all data and of the interests of the entity.


Line 123: Line 127:
   
   


UNMC’s information technology resources are to be used predominately for completing UNMC work related business.  Misuse of University information systems is prohibited.  Misuse includes the following (see Executive Memorandum No. 16, Policy for Responsible Use of Information Resources, Technology and Networks):
UNMC’s information technology resources are to be used predominately for completing UNMC work related business.  Misuse of University information systems is prohibited.  Misuse includes the following (see Executive Memorandum No. 16, Policy for Responsible Use of Information Resources, Technology and Networks):<br />
<br />


    Attempting to modify or remove computer equipment, software, or peripherals without proper authorization.


     Accessing without proper authorization computers, software, information or networks which the University belongs, regardless of whether the resource accessed is owned by the University or the abuse takes place from a non-University site.
   
# Attempting to modify or remove computer equipment, software, or peripherals without proper authorization.
#     Accessing without proper authorization computers, software, information or networks which the University belongs, regardless of whether the resource accessed is owned by the University or the abuse takes place from a non-University site.
#    Taking actions, without authorization, which interfere with the access of others to information systems.
#    Circumventing logon or other security measures.
#    Using information systems for any illegal or unauthorized purpose.
#    Personal use of information systems or electronic communications for non-University consulting, business or employment, except as expressly authorized pursuant to Section 3.4.5 of the Bylaws of the Board of Regents.
#    Sending any fraudulent electronic communication.
#    Violating any software license or copyright, including copying or redistributing copyrighted software, without the written authorization of the software owner.
#    Using electronic communications to violate the property rights of authors and copyright owners. (Be especially aware of potential copyright infringement through the use of e-mail.)
#    Using electronic communications to harass or threaten users in such a way as to create an atmosphere which unreasonably interferes with the education or the employment experience.  Similarly, electronic communications shall not be used to harass or threaten other information recipients, in addition to University users.
#    Using electronic communications to disclose proprietary information without the explicit permission of the owner.
#    Reading other user’s information or files without permission.
#    Academic dishonesty.
#    Forging, fraudulently altering or falsifying, or otherwise misusing University or non-University records (including computerized records, permits, identification cards, or other documents or property).
#    Using electronic communications to hoard, damage, interfere with academic resources available electronically.
#    Using electronic communications to steal another individual’s works, or otherwise misrepresent one’s own work.
#    Using electronic communications to fabricate research data.
#    Launching a computer worm, computer virus or other rogue program.
#    Downloading or posting illegal, proprietary or damaging material to a University computer.
#    Transporting illegal, proprietary or damaging material across a University network.
#    Personal use of any University information system to access, download, print, store, forward, transmit or distribute obscene material.
#    Violating any state or federal law or regulations in connection with use of any information system.
<br />
<br />


    Taking actions, without authorization, which interfere with the access of others to information systems.
Persons using UNMC's information technology facilities and services bear the primary responsibility for the material they choose to access, send or display. It is a violation to access and view materials which would create the existence of a sexually hostile working, patient care, or educational environment.


    Circumventing logon or other security measures.


    Using information systems for any illegal or unauthorized purpose.
It is the workforce‘s responsibility to notify ITS when an information security incident appears to have happened.  (See UNMC ITS Security Procedure: Information Security Incident Reporting and Response).  A security incident includes, but is not limited to the following events, regardless of platform or computer environment:<br />
<br />


    Personal use of information systems or electronic communications for non-University consulting, business or employment, except as expressly authorized pursuant to Section 3.4.5 of the Bylaws of the Board of Regents.


     Sending any fraudulent electronic communication.
      
* Evidence of tampering with data
*    System is overloaded to the point that no activity can be performed ( Denial of service attack on the network)
*    Web site defacement
*    Unauthorized access or repeated attempts at unauthorized access (from either internal or external sources)
*    Social engineering incidents
*    Virus attacks which adversely affect servers or multiple workstations
*    E-mail which includes obscene material, threats or material that could be considered  harassment
*    Discovery of unauthorized or missing hardware in your area
*    Other incidents that could undermine confidence and trust in the UNMC’s information technology systems
<br />


    Violating any software license or copyright, including copying or redistributing copyrighted software, without the written authorization of the software owner.
ITS or other personnel must take immediate action to mitigate any threats that have the potential to pose a serious risk to campus information system resources.  If the threat is deemed serious enough, the system(s) or individual posing the threat will be blocked from network accessCommunication with department leadership regarding such action will take place as soon as possible. The block will be removed as soon as the threat has been repaired. (See UNMC ITS Security Procedure: Information Security Incident Reporting and Response)<br />
 
<br />
    Using electronic communications to violate the property rights of authors and copyright owners. (Be especially aware of potential copyright infringement through the use of e-mail.)
 
    Using electronic communications to harass or threaten users in such a way as to create an atmosphere which unreasonably interferes with the education or the employment experienceSimilarly, electronic communications shall not be used to harass or threaten other information recipients, in addition to University users.
 
    Using electronic communications to disclose proprietary information without the explicit permission of the owner.


    Reading other user’s information or files without permission.
    Academic dishonesty.
    Forging, fraudulently altering or falsifying, or otherwise misusing University or non-University records (including computerized records, permits, identification cards, or other documents or property).
    Using electronic communications to hoard, damage, interfere with academic resources available electronically.
    Using electronic communications to steal another individual’s works, or otherwise misrepresent one’s own work.
    Using electronic communications to fabricate research data.
    Launching a computer worm, computer virus or other rogue program.
    Downloading or posting illegal, proprietary or damaging material to a University computer.
    Transporting illegal, proprietary or damaging material across a University network.
    Personal use of any University information system to access, download, print, store, forward, transmit or distribute obscene material.
    Violating any state or federal law or regulations in connection with use of any information system.
Persons using UNMC's information technology facilities and services bear the primary responsibility for the material they choose to access, send or display. It is a violation to access and view materials which would create the existence of a sexually hostile working, patient care, or educational environment.


   
   


It is the workforce‘s responsibility to notify ITS when an information security incident appears to have happened.  (See UNMC ITS Security Procedure: Information Security Incident Reporting and Response).  A security incident includes, but is not limited to the following events, regardless of platform or computer environment:
==== Copyright ====
 
<br />
    Evidence of tampering with data
<br />
    System is overloaded to the point that no activity can be performed ( Denial of service attack on the network)
    Web site defacement
    Unauthorized access or repeated attempts at unauthorized access (from either internal or external sources)
    Social engineering incidents
    Virus attacks which adversely affect servers or multiple workstations
    E-mail which includes obscene material, threats or material that could be considered  harassment
    Discovery of unauthorized or missing hardware in your area
    Other incidents that could undermine confidence and trust in the UNMC’s information technology systems
 
ITS or other personnel must take immediate action to mitigate any threats that have the potential to pose a serious risk to campus information system resources.  If the threat is deemed serious enough, the system(s) or individual posing the threat will be blocked from network access.  Communication with department leadership regarding such action will take place as soon as possible. The block will be removed as soon as the threat has been repaired. (See UNMC ITS Security Procedure: Information Security Incident Reporting and Response)


UNMC maintains strict compliance with the Digital Millennium Copyright Act of 1998 and applicable amendments. It should be noted that traditionally a user purchases a software “license,” which is a right to use.  Many times the licenses can only be loaded on one machine.  Violating any software license or copyright is in violation of university policy.  <br />
<br />
   
   


D.   Copyright
   
UNMC maintains strict compliance with the Digital Millennium Copyright Act of 1998 and applicable amendments. It should be noted that traditionally a user purchases a software “license,” which is a right to use. Many times the licenses can only be loaded on one machine.   Violating any software license or copyright is in violation of university policy.  
* [http://www.nebraska.edu/about/exec_memo16.pdf Executive Memorandum No. 16, Policy for Responsible Use of Information Resources, Technology and Networks]
*    [http://lcweb.loc.gov/copyright/legislation/dmca.pdf The Digital Millennium Copyright Act of 1998]
*    [http://lcweb.loc.gov/copyright/ U.S. Copyright Office - General Guidelines About Copyright Law]
*    [http://www.unmc.edu/policy/index.cfm?CONREF=78 UNMC Policy, Reproduction of Copyrighted Materials]
*    [http://www.nebraska.edu/site-information.html Public Affairs Copyright and Disclaimer]
<br />
<br />


    Executive Memorandum No. 16, Policy for Responsible Use of Information Resources, Technology and Networks
==== Privacy ====
    The Digital Millennium Copyright Act of 1998
<br />
    U.S. Copyright Office - General Guidelines About Copyright Law
    UNMC Policy, Reproduction of Copyrighted Materials
    Public Affairs Copyright and Disclaimer


E. Privacy
Users should be aware that privacy cannot be guaranteed. UNMC ITS staff do not regularly audit e-mail, voice mail or other information systems for content except under the direction of UNMC internal investigations. However, users should be aware that UNMC information technology technical personnel have authority to access individual user files, data and voice mail in the process of performing repair, maintenance of information systems or supporting UNMC internal or external investigations (See Fraud Policy and Executive Memorandum 16 ). In the event violations to this policy are discovered as a result of the maintenance activity, ITS will bring the issue to the attention of the appropriate dean, director or department head and the Assistant Vice Chancellor for Human Resources.


Users should be aware that privacy cannot be guaranteed. UNMC ITS staff do not regularly audit e-mail, voice mail or other information systems for content except under the direction of UNMC internal investigations. However, users should be aware that UNMC information technology technical personnel have authority to access individual user files, data and voice mail in the process of performing repair, maintenance of information systems or supporting UNMC internal or external investigations (See Fraud Policy and Executive Memorandum 16 ). In the event violations to this policy are discovered as a result of the maintenance activity, ITS will bring the issue to the attention of the appropriate dean, director or department head and the Assistant Vice Chancellor for Human Resources.
UNMC Information Technology Services will not release IDs/passwords for voice mail or information systems to anyone other than the user without explicit review by and permission from the Assistant Vice Chancellor for Human Resources or Vice President General Counsel.<br />
<br />


UNMC Information Technology Services will not release IDs/passwords for voice mail or information systems to anyone other than the user without explicit review by and permission from the Assistant Vice Chancellor for Human Resources or Vice President General Counsel.


   
   


F.  E-mail, Instant Messaging and Voice Mail
==== E-mail, Instant Messaging and Voice Mail ====
<br />


All policies stated herein are also applicable to all communication systems including e‑mail, instant messaging and voice mail. Persons using UNMC’s e‑mail or voice mail resources are expected to demonstrate good taste and sensitivity to others in their communications.
All policies stated herein are also applicable to all communication systems including e‑mail, instant messaging and voice mail. Persons using UNMC’s e‑mail or voice mail resources are expected to demonstrate good taste and sensitivity to others in their communications.
Line 217: Line 223:


E-mail attachments and files transfer utilizing instant messaging capabilities represent a significant risk to the organization.  Many computer viruses are distributed through e-mail attachments or files received via instant messaging.  Users should be careful about opening e-mail attachments or accepting file transfers via instant messaging.  
E-mail attachments and files transfer utilizing instant messaging capabilities represent a significant risk to the organization.  Many computer viruses are distributed through e-mail attachments or files received via instant messaging.  Users should be careful about opening e-mail attachments or accepting file transfers via instant messaging.  
<br />
<br />


   
   


G.  Controlling the Distribution of Non-Solicited Marketing E-mail
==== Controlling the Distribution of Non-Solicited Marketing E-mail ====
<br />


Electronic mail sent externally by UNMC personnel for the primary purpose of promoting UNMC’s “commercial” products or services must comply with the ITS Security Procedure: Controlling the Distribution of Non-Solicited Marketing Email.  Examples of such products or services include publications and membership solicitations.  
Electronic mail sent externally by UNMC personnel for the primary purpose of promoting UNMC’s “commercial” products or services must comply with the ITS Security Procedure: Controlling the Distribution of Non-Solicited Marketing Email.  Examples of such products or services include publications and membership solicitations.  
Line 230: Line 239:
   
   


Exemptions:
''Exemptions:


The Act exempts “transactional or relationships messages” from the procedural requirements when the primary purpose of the message is to achieve on of the following:
The Act exempts “transactional or relationships messages” from the procedural requirements when the primary purpose of the message is to achieve on of the following:''


     Facilitate, complete or confirm a commercial transaction that the recipient has previously agreed to, such as messages confirming registration, purchase or reservations.
      
     Provide warranty information or product recall or safety/security information with respect to a product or service used or purchased by the recipient
* ''Facilitate, complete or confirm a commercial transaction that the recipient has previously agreed to, such as messages confirming registration, purchase or reservations.
     Notify the recipient about substantive changes in an existing subscription or related benefit plan in which the recipient is currently participating.
*     Provide warranty information or product recall or safety/security information with respect to a product or service used or purchased by the recipient
     Deliver good or services, including upgrades or updates, which the recipient has previously requested or ordered from the sender.
*     Notify the recipient about substantive changes in an existing subscription or related benefit plan in which the recipient is currently participating.
*     Deliver good or services, including upgrades or updates, which the recipient has previously requested or ordered from the sender.''
<br />


For more information, see Controlling the Distribution of Non-Solicited Marketing E-mail Procedures.
For more information, see Controlling the Distribution of Non-Solicited Marketing E-mail Procedures.
<br />
<br />


   
   


H.  Campus-wide e-mail announcements
==== Campus-wide e-mail announcements ====
<br />
<br />


Sending out mass distribution e-mails containing event and/or general announcement type information is discouraged.  If you have an event to publicize or an announcement to deliver to a large group of people, the best way to do this is through UNMC Today, the campus electronic newsletter.  Contact Public Affairs for additional information.
Sending out mass distribution e-mails containing event and/or general announcement type information is discouraged.  If you have an event to publicize or an announcement to deliver to a large group of people, the best way to do this is through UNMC Today, the campus electronic newsletter.  Contact Public Affairs for additional information.
Line 249: Line 264:
   
   


However, if e-mailing to a large group is warranted, the content and size of the message must be approved by the Public Affairs Department.  Delivery of the message must then be scheduled by the ITS department to minimize the demand on campus computer systems.  Contact Public Affairs (x9-4696) to obtain approval.
However, if e-mailing to a large group is warranted, the content and size of the message must be approved by the Public Affairs Department.  Delivery of the message must then be scheduled by the ITS department to minimize the demand on campus computer systems.  Contact Public Affairs (x9-4696) to obtain approval.<br />
<br />
 


   
   


I.  Audits of Electronic Protected Health Information (PHI)
==== Audits of Electronic Protected Health Information (PHI) ====
<br />
<br />


Patient information including demographic and medical data contained in, or obtained from any UNMC information system is confidential data.  Individual access to this data may be audited in order to ensure compliance with federal and state law and UNMC Policies and Procedures.  
Patient information including demographic and medical data contained in, or obtained from any UNMC information system is confidential data.  Individual access to this data may be audited in order to ensure compliance with federal and state law and UNMC Policies and Procedures.  
<br />


   
   


Information Systems:
'''Information Systems:'''<br />
 
 
Each information custodian is responsible to:<br />
 
 
   
* Manage and approve access to the information.
*    Implement audit mechanisms.
*    Develop periodic audit process to validate that only those with a need to know are accessing ePHI (See  UNMC Policy No. 6057, Use and Disclosure of Protected Health Information).
*    Develop and implement a formal process for audit log review
*    Audit reports are confidential and should not be released without the approval of the HIPAA Privacy Officer or the Human Resources Employee Relations Manager.<br />
 
'''Shared Files:'''<br />


Each information custodian is responsible to:


    Manage and approve access to the information.
The owner of shared files is responsible to:<br />
    Implement audit mechanisms.
    Develop periodic audit process to validate that only those with a need to know are accessing ePHI (See  UNMC Policy No. 6057, Use and Disclosure of Protected Health Information).
    Develop and implement a formal process for audit log review
    Audit reports are confidential and should not be released without the approval of the HIPAA Privacy Officer or the Human Resources Employee Relations Manager.


Shared Files:


The owner of shared files is responsible to:
   
* Manage and approve access to the information
*    Implement process such that the minimum necessary information is available to the user (See UNMC Policy No. 6057, Use and Disclosure of Protected Health Information).<br />
<br />
 


    Manage and approve access to the information
==== Computer Crime ====
    Implement process such that the minimum necessary information is available to the user (See UNMC Policy No. 6057, Use and Disclosure of Protected Health Information).
<br />


J. Computer Crime
Computer crime in any form will not be tolerated. This policy applies to all UNMC employees and will be enforced without regard to past performance, position held or length of service. All persons found to have committed computer crime relevant to UNMC assets shall be subject to disciplinary action up to and including termination and investigation by external law enforcement agencies when warranted. <br />
<br />


Computer crime in any form will not be tolerated. This policy applies to all UNMC employees and will be enforced without regard to past performance, position held or length of service. All persons found to have committed computer crime relevant to UNMC assets shall be subject to disciplinary action up to and including termination and investigation by external law enforcement agencies when warranted.


   
   


K.  Security Administration
==== Security Administration ====
<br />


UNMC ITS is responsible for implementing and monitoring a consistent data security program.  System administrators are responsible for operation and maintenance of information processing services.  The system administrator and information custodians are responsible for implementing the security policy and standards within their applications.  
UNMC ITS is responsible for implementing and monitoring a consistent data security program.  System administrators are responsible for operation and maintenance of information processing services.  The system administrator and information custodians are responsible for implementing the security policy and standards within their applications.  
<br />
<br />


   
   


LTraining
==== Training ====
<br />
 
All members of the workforce will be trained in information security awarenessPeriodic reminders regarding information security awareness and current threats will be communicated to the workforce.<br />
<br />


All members of the workforce will be trained in information security awareness.  Periodic reminders regarding information security awareness and current threats will be communicated to the workforce.


   
   


M.  Web Pages
==== Web Pages ====
<br />


UNMC web pages should consistently meet the highest standards of writing, content accuracy, image and presentation, keeping in mind that these documents create an image of UNMC to the world. UNMC shall reserve the right to monitor web pages and to remove any material that is unlawful or in violation of UNMC policies. Originators will be notified in the event that their page is removed.
UNMC web pages should consistently meet the highest standards of writing, content accuracy, image and presentation, keeping in mind that these documents create an image of UNMC to the world. UNMC shall reserve the right to monitor web pages and to remove any material that is unlawful or in violation of UNMC policies. Originators will be notified in the event that their page is removed.
Line 304: Line 342:
UNMC web pages are required to show:
UNMC web pages are required to show:


     Date of the last revision
      
     Hot e-mail link to person responsible for the page
* Date of the last revision
     UNMC logo (per Executive Memorandum 16)
*     Hot e-mail link to person responsible for the page
     Link back to appropriate UNMC site (Internet or Intranet)
*     UNMC logo (per Executive Memorandum 16)
     Link to University of Nebraska Appropriate Use/Copyright Violations
*     Link back to appropriate UNMC site (Internet or Intranet)
*     Link to University of Nebraska Appropriate Use/Copyright Violations<br />
<br />


N.    Faxing
==== Faxing ====
<br />


Members of the workforce will have a need to transmit confidential information by facsimile rather than by a slower method, such as mail.  It is easy to misdirect faxes to unauthorized recipients, faxes could be intercepted or lost in transmission.  Thus, the potential for breach of confidentiality exists every time someone utilizes faxing.  Therefore, all faxing must be done in accordance with the faxing policy (See UNMC Policy No. 6065, Facsimile Transmissions).
Members of the workforce will have a need to transmit confidential information by facsimile rather than by a slower method, such as mail.  It is easy to misdirect faxes to unauthorized recipients, faxes could be intercepted or lost in transmission.  Thus, the potential for breach of confidentiality exists every time someone utilizes faxing.  Therefore, all faxing must be done in accordance with the faxing policy (See UNMC Policy No. 6065, Facsimile Transmissions).
<br />
<br />


   
   


O.    Demonstration of Electronic Systems
==== Demonstration of Electronic Systems ====
<br />


Demonstrations of electronic systems for non-workforce members should utilize only test data.  Test data in production systems is acceptable.  Production data (real patient data) should not be used.
Demonstrations of electronic systems for non-workforce members should utilize only test data.  Test data in production systems is acceptable.  Production data (real patient data) should not be used.
<br />
<br />


   
   


Definitions
=== Definitions ===
<br />


Computer crime examples would include:
'''Computer crime''' examples would include:


     Unauthorized use of a computer, which might involve stealing a username and password, or might involve accessing the victim’s computer via the Internet through a backdoor operated by a Trojan Horse program.
      
     Creating or releasing a malicious computer program (e.g., computer virus, worm, Trojan horse).
* Unauthorized use of a computer, which might involve stealing a username and password, or might involve accessing the victim’s computer via the Internet through a backdoor operated by a Trojan Horse program.
     Harassment and stalking in cyberspace.
*     Creating or releasing a malicious computer program (e.g., computer virus, worm, Trojan horse).
     Using computers to commit crimes that could be committed without a computer such as counterfeiting, stealing, committing larceny or fraud.
*     Harassment and stalking in cyberspace.
*     Using computers to commit crimes that could be committed without a computer such as counterfeiting, stealing, committing larceny or fraud.


(Source:  Computer Crime by Ronald B. Stander, Copyright 1999, 2002, www.rbs2.com)
(Source:  Computer Crime by Ronald B. Stander, Copyright 1999, 2002, www.rbs2.com)


Confidential information includes proprietary information and protected health information (PHI).
'''Confidential information''' includes proprietary information and protected health information (PHI).
 
'''Denial of service''' is an event in which a user or organization is deprived of resource services that they would normally expect to have.
 
'''Information''' is data presented in readily comprehensible form.  (Whether a specific message is informative or not depends in part on the subjective perceptions of the person who receives it.)  Information may be stored or transmitted via electronic media on paper or other tangible media, or be known by individuals or groups. Information generated in the course of University operations is a valuable asset of the University and property of the University.


Denial of service is an event in which a user or organization is deprived of resource services that they would normally expect to have.
'''Information custodians''' are people responsible for specifying the security properties associated with the information systems their organization possesses. This includes the categories of information that users are allowed to read and update.  The information custodian is also responsible for classifying data and participating in ensuring the technical and procedural mechanisms implemented are sufficient to secure the data based upon a risk analysis that considers the probability of compromise and its potential business impact.


Information is data presented in readily comprehensible form.  (Whether a specific message is informative or not depends in part on the subjective perceptions of the person who receives it.)  Information may be stored or transmitted via electronic media on paper or other tangible media, or be known by individuals or groups. Information generated in the course of University operations is a valuable asset of the University and property of the University.
'''Information security''' is defined as the ability to control access and protect information from accidental or intentional disclosure to unauthorized persons and from alteration, destruction or loss.


Information custodians are people responsible for specifying the security properties associated with the information systems their organization possesses. This includes the categories of information that users are allowed to read and update.  The information custodian is also responsible for classifying data and participating in ensuring the technical and procedural mechanisms implemented are sufficient to secure the data based upon a risk analysis that considers the probability of compromise and its potential business impact.
'''Information systems''' are an interconnected set of informational resources under the same direct management control that shares common functionality.


Information security is defined as the ability to control access and protect information from accidental or intentional disclosure to unauthorized persons and from alteration, destruction or loss.
'''Information technology resources (system)''' include but are not limited to voice, video, data and network facilities and services.


Information systems are an interconnected set of informational resources under the same direct management control that shares common functionality.
'''Personal accounts''' allow an individual user to logon to specific applications or systems using personal or unique ID and password.


Information technology resources (system) include but are not limited to voice, video, data and network facilities and services.
'''Privacy''' is defined as the right of individuals to keep information about themselves from being disclosed.


Personal accounts allow an individual user to logon to specific applications or systems using personal or unique ID and password.
'''Proprietary information''' refers to information regarding business practices, including but not limited to, financial statements, contracts, business plans, research data, employee records, and student records. (See UNMC Policy No. 6045, Privacy, Confidentiality and Information Security Policy for more detailed information.)


Privacy is defined as the right of individuals to keep information about themselves from being disclosed.
'''Protected Health Information (PHI)'''is individually identifiable health information. Health information means any information, whether oral or recorded in any medium, that:<br />


Proprietary information refers to information regarding business practices, including but not limited to, financial statements, contracts, business plans, research data, employee records, and student records.  (See UNMC Policy No. 6045, Privacy, Confidentiality and Information Security Policy for more detailed information.)


Protected Health Information (PHI)is individually identifiable health information.  Health information means any information, whether oral or recorded in any medium, that:
   
* is created or received by UNMC; and
*    relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.<br />


    is created or received by UNMC; and
    relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual.


Records containing PHI, in any form, are the property of UNMC. The PHI contained in the record is the property of the individual who is the subject of the record.
Records containing PHI, in any form, are the property of UNMC. The PHI contained in the record is the property of the individual who is the subject of the record.


Shared accounts (i.e., generic or general accounts) allow multiple users to logon to the information technology resources using the same ID and password.
'''Shared accounts''' (i.e., generic or general accounts) allow multiple users to logon to the information technology resources using the same ID and password.
 
'''Shared file''' is a collection of electronic PHI maintain on personal or departmental computers.  This would include spreadsheets, databases, correspondence, quality improvement and research data files.


Shared file is a collection of electronic PHI maintain on personal or departmental computers.  This would include spreadsheets, databases, correspondence, quality improvement and research data files.
'''Social engineering''' describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures.


Social engineering describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures.
'''Strong authentication method''' is a layer of security which requires a token or biometric authentication.  This represents two factor authentication involving something you know (i.e. user id) and something you have (i.e., Secured card).


Strong authentication method is a layer of security which requires a token or biometric authentication.  This represents two factor authentication involving something you know (i.e. user id) and something you have (i.e., Secured card).
'''System administrators''' are the people responsible for configuring, administering, and maintaining hardware and operating systems.


System administrators are the people responsible for configuring, administering, and maintaining hardware and operating systems.
'''Workforce''' refers to faculty, staff, volunteers, trainees, students, independent contractors and other persons whose conduct, in the performance of work for UNMC, is under the direct control of UNMC, whether or not they are paid by UNMC.<br />
<br />


Workforce refers to faculty, staff, volunteers, trainees, students, independent contractors and other persons whose conduct, in the performance of work for UNMC, is under the direct control of UNMC, whether or not they are paid by UNMC.


   
   


Reference: University of CA Guidelines , January 28, 2004
Reference: University of CA Guidelines , January 28, 2004<br />
 
 
For additional information, contact Information Technology Services.<br />


For additional information, contact Information Technology Services.


This page maintained by dkp.
This page maintained by dkp.
440

edits