Purpose

To establish the protection of using approved applications for official communications for UTHSC. This standard is also designed to meet compliance requirements for data regulated by federal or state law. This includes, but is not limited to, security requirements and safeguards for the Family Educational Rights and Privacy Act (FERPA), Health Insurance Portability and Accountability Act (HIPAA), or Gramm-Leach-Bliley Act (GLBA).

Scope

This practice applies to UTHSC information, communications, and the official recourses used to transmit, store, and process that information.

Definitions

Official Communications – UTHSC communications passed through channels throughout the organization and externally, following specific rules and regulations, to maintain a professional workplace environment.

UTHSC Workforce – employees, volunteers, trainees, student employees, paid contractors, or anyone acting in an official capacity for UTHSC, and other persons whose conduct, in the performance of work for a covered entity or business associate, is under the direct control of such covered entity or business associate, whether or not they are paid by the covered entity or business associate.

Responsibilities

Office of Communications and Marketing is responsible for approving applications to be used in official communications.

Information Technology Services (ITS) is responsible for aiding in the implementation and support of the approved applications.

Office of Cybersecurity is responsible to review any communications publicly posted to ensure it does not contain regulatory information, i.e. HIPAA or the communications presents a risk to UTHSC, i.e. posting a Zoom meeting with the passcode on social media.

UTHSC Workforce is responsible for adhering to the practice and the security controls set forth in it.

Practice

Only approved applications should be used for official UTHSC communications.
Approved applications are those that have been vetted by ITS and procurement processes and purchased by UTHSC such as:
1. Microsoft 365 applications, such as Outlook and MS Teams
2. UTHSC’s HIPAA Zoom Conferencing application
Use of non-approved applications, whether paid or free, is prohibited.
Requests for communication applications must be handled through the appropriate procedures directed by Procurement Services.
The Office of Communications and Marketing has final approval for all communications used in official UTHSC press releases, printed materials, digital/web materials, and social media posts.
Exceptions to this practice should be requested using the process outlined in GP-001.02 Security Exceptions and Exemptions to ITS Standards and Practices.