RSCC Policy GA-18-03; Electronic Information Systems (Email)

Roane State Community College

Policy Number: GA-18-03

Subject: Electronic Information Systems (Email)

Introduction

Roane State Community College (RSCC) recognizes that principles of academic freedom and shared governance, freedom of speech, and privacy of information hold important implications for electronic mail and electronic mail services. The college affords electronic mail privacy protections comparable to that which it traditionally affords paper mail and telephone communications. This policy reflects these firmly held principles within the context of RSCC's legal and other obligations.
The college encourages the use of electronic mail and respects the privacy of users. It does not routinely inspect, monitor, or disclose electronic mail without the holder's consent. Nonetheless, subject to the requirements for authorization, notification, and other conditions specified in this policy, RSCC may deny access to its electronic mail services and may inspect, monitor, or disclose electronic mail:
1. Under time-dependent, critical operational circumstances
2. When there are compelling circumstances
3. When there is substantiated reason to believe that violations of law or of college policies have taken place
4. When required by and consistent with law
Scope
1. This policy applies to:
  1. All electronic mail systems and services provided or owned by the college
  2. All users, holders, and uses of RSCC email services
  3. All college email records in the possession of RSCC employees or other email users of electronic mail services provided by the college
2. This policy applies only to electronic mail in its electronic form. The policy does not apply to printed copies of electronic mail. Other college record management policies, however, do not distinguish among the media in which records are generated or stored. Electronic mail messages, therefore, in either their electronic or printed forms, are subject to those other policies, including provisions of those policies regarding retention and disclosure.
3. This policy applies equally to transactional information (such as email headers, summaries, addresses, and addressees) associated with email records as it does to the contents of those records.
4. This policy is effective immediately.
Statement of policy
1. Privacy, Confidentiality, and Public Records Considerations
  1. The college will make reasonable efforts to maintain the integrity and effective operation of its electronic mail systems, but users are advised that those systems should in no way be regarded as a secure medium for the communication of sensitive or confidential information. Because of the nature and technology of electronic communication, the college can assure neither the privacy of an individual user's use of the college’s electronic mail resources nor the confidentiality of particular messages that may be created, transmitted, received, or stored thereby. In addition, Tennessee law provides that communications of RCSS personnel that are sent by electronic mail may constitute "correspondence" and therefore, may be considered public records subject to public inspection under Tennessee’s Public Records Act.
  2. Legal requirements on privacy of and access to personal information, prohibits college employees and others from seeking out, using, or disclosing without authorization, personal or confidential information and requires employees to take necessary precautions to protect the confidentiality of personal or confidential information encountered in the performance of their duties or otherwise. This prohibition applies to email records.
  3. Notwithstanding the previous paragraph, users should be aware that, during the performance of their duties, network and computer operations personnel and system administrators need from time to time to observe certain transactional addressing information to ensure proper functioning of college email services, and on these and other occasions may inadvertently see the contents of email messages. Except as provided elsewhere in this policy, they are not permitted to see or read the contents intentionally; to read transactional information where not germane to the foregoing purpose; or disclose or otherwise use what they have seen. One exception, however, is that of systems personnel (such as “postmasters”) who may need to inspect email when re-routing or disposing of otherwise undeliverable email. This exception is limited to the least invasive level of inspection required to perform such duties. Furthermore, this exception does not exempt postmasters from the prohibition against disclosure of personal and confidential information of the previous paragraph, except insofar as such disclosure equates with good faith attempts to route the otherwise undeliverable email to the intended recipient. Re-routed mail normally should be accompanied by notification to the recipient that the email has been inspected for such purposes.
  4. The college attempts to provide secure and reliable email services. Operators of college electronic mail services are expected to follow sound professional practices in providing for the security of electronic mail records, data, application programs, and system programs under their jurisdiction. Since such professional practices and protections are not foolproof, however, the security and confidentiality of electronic mail cannot be guaranteed. Furthermore, operators of email services have no control over the security of email that has been downloaded to a user's computer. As a deterrent to potential intruders and to misuse of email, email users should employ whatever protections (such as passwords) are available to them. Users are prohibited from sharing email passwords with others.
  5. Users of electronic mail services should be aware that even though the sender and recipient have discarded their copies of an electronic mail record, there might be back-up copies that can be retrieved. Systems may be “backed-up” on a routine or occasional basis to protect system reliability and integrity, and to prevent potential loss of data. The back-up process results in the copying of data onto storage media that may be retained for periods and in locations unknown to the originator or recipient of electronic mail. The practice and frequency of back-ups and the retention of back-up copies of email vary from system to system. Electronic mail users are encouraged to request information on the back-up practices followed by the operators of college electronic mail services, and such operators are required to provide such information upon request.
2. Permissible Uses of Electronic Mail
  1. Authorized Users: Only college faculty, staff, and students and other persons who have received permission under the appropriate institutional authority are authorized users of RSCC's electronic mail systems and resources.
  2. Purpose of Use: The use of any college resources for electronic mail must be related to RSCC business, including academic pursuits. Incidental and occasional personal use of electronic mail may occur when such use does not generate a direct cost for the college. Any such incidental and occasional use of college electronic mail resources for personal purposes is subject to the provisions of this policy.
3. Prohibited Uses of Electronic Mail
  1. Prohibited Purposes
    1. Personal use that creates a direct cost for the college
    2. College electronic mail resources shall not be used for personal monetary gain or for commercial purposes that are not directly related to college business.
  2. Other Prohibited Uses (included but not limited to);
    1. Sending copies of documents in violation of copyright laws
    2. Inclusion of the work of others into electronic mail communications in violation of copyright laws
    3. Capture and opening of electronic mail except as required in order for authorized employees to diagnose and correct
    4. Use of electronic mail to harass or intimidate others or to interfere with the ability of others to conduct institutional business
    5. Use of electronic mail systems for any purpose restricted or prohibited by law or regulation
    6. Spoofing, or constructing an electronic mail communication so it appears to be from someone else
    7. Snooping, or obtaining access to the files or electronic mail of others for the purpose of satisfying idle curiosity, with no authorization or college business purpose
Purpose

The purpose of this policy is to assure that:
1. The college community is informed about the applicability of policies and laws to electronic mail
2. Electronic mail services are used in compliance with those policies and laws
3. Users of electronic mail services are informed about how concepts of privacy and security apply to electronic mail
4. Disruptions to college electronic mail and other services and activities are minimized
College Access and Disclosure
1. General Provisions
  1. To the extent permitted by law, RSCC reserves the right to access and disclose the contents of faculty, staff, students', and other users' electronic mail without the consent of the user. The college will do so when it believes it has a legitimate business need including, but not limited to, those listed in paragraph 3 (below), and only after explicit authorization is obtained from the appropriate college authority.
  2. Faculty, staff, and other non-student users are advised that the college's electronic mail systems should be treated like a shared filing system, i.e., with the expectation that communications sent or received on college business or with the use of RSCC resources may be made available for review by any authorized college official for purposes related to RSCC business.
  3. Electronic mail of students may constitute "education records" subject to the provisions of the federal statute known as the Family Educational Rights and Privacy Act of 1974 (FERPA). The college may access, inspect, and disclose such records under conditions that are set forth in the statute.
  4. Any user of RSCC's electronic mail resources who makes use of an encryption device to restrict or inhibit access to his or her electronic mail must provide access to such encrypted communications when requested to do so under appropriate college authority.
2. Monitoring of Communications
  
  The college will not monitor electronic mail as a routine matter but it may do so to the extent permitted by law, as the college deems necessary for purposes of maintaining the integrity and effective operation of the RSCC's electronic mail systems.
3. Inspection and Disclosure of Communications
  1. RSCC reserves the right to inspect and disclose the contents of electronic mail:
    1. In the course of an investigation triggered by indications of misconduct or misuse
    2. As needed to protect health and safety
    3. As needed to prevent interference with the academic mission or
    4. As needed to locate substantive information required for college business that is not more readily available by some other means.
  2. RSCC will inspect and disclose the contents of electronic mail when such action is necessary to respond to legal processes and to fulfill the college's legal obligations to third parties.
4. Limitations on Disclosure and Use of Information Obtained by Means of Access or Monitoring
  
  The contents of electronic mail communications, properly obtained for official purposes, may be disclosed without permission of the user. RSCC will attempt to refrain from disclosure of particular communications if disclosure appears likely to create personal embarrassment, unless such disclosure is required to serve a business purpose or satisfy a legal obligation.
5. Special Procedures to Approve Access to, Disclosure of, or Use of Electronic Mail Communications
  
  Individuals needing to access the electronic mail communications of others, to use information gained from such access, and/or to disclose information from such access and who do not have the prior consent of the user must obtain in writing, approval in advance of such activity from the president. A list of guiding concepts and a template for such a procedure is provided as an attachment.
Public Inspection, Retention, and Archiving of Electronic Mail
1. Public Inspection of Electronic Mail
  
  Communications of the college employees in the form of electronic mail may constitute "correspondence" and therefore may be a public record subject to public inspection under Tennessee’s Public Records Act. Requests for such public inspection will be referred to the president or designee for processing. RSCC may charge a reasonable processing fee for such information.
2. Retention and Archiving of Electronic Mail
  1. Electronic mail messages produced or stored using state-owned equipment or software generally are excluded from the definition of "records" subject to the provisions of the State Public Records Commission.
  2. If the recipient of electronic mail messages has previously segregated and stored such messages as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of RSCC or because of the value of the official college data contained therein, then such messages must be retained, archived, and destroyed in compliance with the relevant portions of the State Public Records Act and Tennessee Board of Regents policy 1.12.01.00 Records Retention and Disposal of Records.
  3. The college does not maintain central or distributed electronic mail archives of all electronic mail sent or received. Electronic mail is normally backed up only to assure system integrity and reliability, not to provide for future retrieval, although back-ups may at times serve the latter purpose incidentally. Operators of college electronic mail services are not required by this policy to retrieve email from such back-up facilities upon the holder's request, although on occasion they may do so as a courtesy.
  4. Email users should be aware that generally it is not possible to assure the longevity of electronic mail records for record-keeping purposes, in part because of the difficulty of guaranteeing that electronic mail can continue to be read in the face of changing formats and technologies and in part because of the changing nature of electronic mail systems. This becomes increasingly difficult as electronic mail encompasses more digital forms; such as compound documents composed of digital voice, music, image, and video in addition to text. Furthermore, in the absence of the use of authentication systems, it is difficult to guarantee that email documents have not been altered, intentionally or inadvertently.
  5. Email users and those in possession of RSCC records in the form of electronic mail are cautioned, therefore, to be prudent in their reliance on electronic mail for purposes of maintaining a lasting record. Sound business practice suggests that consideration be given to transferring (if possible) electronic mail to a more lasting medium format, such as a digital medium such as Roane State's "U" drive, where long-term accessibility is an issue.
    1. An example of a use that does not create a direct cost is sending an email message during an employee’s lunch hour: the college will pay no more for maintaining the email system than it would have paid had the message not been sent. An example of a use that does create a direct cost is printing an email message without reimbursing the college.
    2. Students who are also employees of RSCC should be given the opportunity to have separate accounts for their employment-related electronic mail to insulate their student communications from inadvertent disclosure.
3. Digital or Electronic Signatures and Transactions
  1. To comply with the Tennessee Uniform Electronic Transactions Act (T.C.A. 47-10-101 et. swq.), this act permits the use of electronic signatures and electronic transactions under certain circumstances. To be legally enforceable, electronic signatures must meet the following two criteria:
    1. An electronic signature must be attributable (or traceable) to a person who has the intent to sign the record or contract with the use of adequate security and authentication measures that are contained in the method of capturing the electronic transaction (e.g., use of personal identification number or personal login identification username and password) (T.C.A. 47-10-109) Public Key Infrastructure or PKI technology will not be used.
    2. The recipient of the transaction must be able to print or store the electronic record of the transaction at the time of receipt. (T.C.A. 47-10-109)
  2. Use of electronic signatures and transactions is permitted. For assistance with the creation of an electronic signature, contact the information technology Help Desk.
Granting Approval to Access Electronic Communications of Others

Only the president may grant approval to access electronic communications addressed to others.
1. The following information is needed to determine whether a request should be approved
  1. Name and title of the person whose communications will be accessed
  2. Name and title of the person who will do the accessing
  3. Why the access is needed
  4. What forms of communication will be accessed (e.g., voice mail, E-Mail, FAX)
  5. Required duration of the access
2. If possible, Tennessee Board of Regents Legal Counsel should be contacted.
3. Only those executives or administrators who have a need to know will receive notification of the request for access to electronic messages.
4. Concerns about fiscal misconduct or criminal activity should not be investigated by individuals or departments but should be referred to College Security or Internal Auditor in accordance with the college policy.
5. Contents of electronic communications obtained after appropriate authorization may be disclosed without the permission of the employee. At the same time, RSCC will attempt to refrain from disclosure of particular messages if disclosure could create personal embarrassment, unless such disclosure is required to serve a business purpose or satisfy a legal obligation.
6. Access Appendix A here Request to Access Electronic Communications form.
7. For access requests related to litigation holds, see the “Litigation Hold Procedures, Electronic Records Requirements,” 2007, on Roane State’s website.
Email Account Creation
1. Email account creation is an automated process. When new employees are added to Banner by Human Resources, a trigger collects the necessary information and creates a file that is then used to create the mailbox and network user.
2. Temporary email accounts may be created upon request. Temporary accounts may be used for training, auditors, short term or part-time workers. Temporary accounts will have an expiration date or will be disabled upon completion of the temporary task.
3. Email Accounts are terminated when an employee is terminated, retires or leaves voluntarily. Notification of termination or departure is started by Human Resources or department head initiating the Employee Checkout Workflow.
  Note: A retention exception is made if an employee retires and requests to retain his/her email account.
Disciplinary Action
1. Appropriate disciplinary action will be taken against individuals found to have engaged in prohibited use of the college's electronic mail resources.
2. Violations of this policy may result in restrictions or termination of access to RSCC information technology resources. In addition, disciplinary action, up to and including dismissal, may be applicable under other RSCC policies, guidelines, or other agreements.
Responsibility for Policy

The Assistant Vice President for Information Technology is responsible for development and maintenance of this policy for issuance by the Vice President of Business and Finance.

Revision History: 02/18/2000, 11/10/2003, 06/25/2007, 02/08/2016

TBR Policy Reference: 1.08.00.00, 1.12.01.00

Revision Date Effective: 06/26/2018

Revision Approval By: Christopher L. Whaley, President

Original Date Effective: 04/03/1995

Original Approval By: Sherry L. Hoppe, President

Office Responsible: Vice President for Business & Finance

Reviewed: 06/01/2017

Roane State Community College

RSCC Policy GA-18-03; Electronic Information Systems (Email)

Connect with us