Ohio Administrative Code
Title 3364 - University of Toledo
Chapter 3364-65 - Technology Security and Safeguarding
Section 3364-65-07 - Electronic communication policy
Current through all regulations passed and filed through September 16, 2024
(A) Policy statement
The university of Toledo provides electronic mail "e-mail," communication, and collaboration services to support academic, research, medical, and administrative functions of the institution. University electronic communication services are to be used responsibly within the normal standards of professional and personal courtesy and conduct. The use of electronic communication services is a privilege, not a right, and it should be treated as such by all users.
(B) Purpose
This policy establishes guidelines for the responsible and efficient use of university of Toledo "university" electronic communication services, and to clearly set forth the rights and responsibilities of the university's authorized users regarding these services, including e-mail.
(C) Scope
Electronic communications and associated attachments transmitted or received over the university network are subject to the provisions of this policy. According to Ohio law, electronic communications such as e-mail are generally considered to be public records to an equal degree of an equivalent communication in physical form. E-mail communications written and sent during university business are subject to applicable provisions of this policy, regardless of whether the communication was sent or received on a public or privately owned personal computer or messaging system.
(D) Definitions
(E) Policy
Electronic communications must comply with these general principles and rules:
Authorized users of the campus electronic communications or electronic mail systems may include the following based upon need and available resources:
Access to university e-mail, when provided, is a privilege that may be wholly or partially restricted by the university without prior notice and without the consent of the user. Individual e-mail privileges may be suspended or revoked as conditions warrant to ensure the overall health and security of the university's messaging system.
The university reserves the right to monitor, inspect, and disclose usage of electronic communications without prior notice in accordance with state and federal law. The university information security office may institute scanning, sandboxing, and/or blocking technologies for the protection of the university and university owned information technology assets.
E-mail and other documents needed by a departing employee's department may be identified and archived by the department on request to the departing employee. Access to a terminated employee's e-mail after the terminated employee's departure may be granted to another individual upon approval of the vice president, human resources, or designee.
Appropriate use - "appropriate use" means respecting the rights of other computer users, accessing data that is relevant to their role within the university, the integrity of the physical facilities and all pertinent license and contractual agreements.
The confidentiality and privacy of e-mail messages cannot be guaranteed. Disclosure of electronic messages may be made at any time due to legal discovery, public record request, or other legal request. Authorized users should review the content and attachments of e-mail to ensure that the message would not be a source of embarrassment to the sender, to the recipient, or to the university.
Authorized users should exercise extreme caution when using email services to communicate confidential or sensitive matters. Users should employ protections including password protecting files, encrypting messages, or hand delivery of electronic files. Users that are unsure how to protect content should contact the information technology help desk for guidance.
E-mail and other electronic messages are subject to the same legal requirements as most other forms of communication. The Ohio
Public Records Act, and section 149.43 of the Revised Code governs availability of public records. The Ohio Public Records Act treats electronic records in the same manner as an equivalent paper record.
Email and other electronic messages that document the functions, policies, and procedures of the university are public records that must be retained in either paper or electronic format. Disposition decisions regarding individual documents should be made in accordance with the definition of public records and in accordance with university record retention policy.
University records in electronic form including documents, email, and backup copies should be retained in accordance with the university's record retention schedules that apply to non-electronic records of similar subject and content. If necessary, specific departmental retention schedules for unique records in electronic form can be established. The university archivist is responsible for establishing records retention schedules. Further guidance on the university's public records responsibilities may be found at:
Electronic communications may contain sensitive data, including health information PHI, PII, payment card information "PCI," and student educational records. In the event that sensitive data is sent in an e-mail message, it should be protected appropriately and sent to only those individuals with a need to know. Sensitive information shall not be transmitted to any external, e-mail addresses unless it has been encrypted through the university's encrypted e-mail gateway. Authorized users can contact the information technology help desk for further guidance on the university's encrypted e-mail gateway.
Communications by e-mail to the entire university address book or to large portions of the address book must be approved and distributed by the office of marketing and communications. The office of marketing and communications will work with the departments to select and utilize the most appropriate means to disseminate information to the entire university community. The information should be sent in a manner that prevents identification of individual's protected information including e-mail addresses and does not allow replies to the entire group.
This requirement does not apply to critical communications sent by pre-approved senders, such as electronic infrastructure outage notices, health, security, and safety alerts and messages from the university president.
University equipment and e-mail service may be used by employees for incidental personal purposes so long as the personal use does not harm:
In order to ensure responsible use of email, authorized users should ensure that:
Note: This can be accomplished by placing these addresses in the blind carbon copy "BCC" line of the e-mail being sent.
The following practices are prohibited on university electronic communication systems:
Violations of this policy will be subject to the university's disciplinary process and may result in disciplinary action up to and including termination. Minor violations will result in removal of the offending device from the university network at the discretion of information technology or administration. Criminal activity subject to applicable state and federal criminal penalties may be referred to law enforcement as appropriate.
