Approved June 29, 2009
Numerous non-University web systems for social networking and electronic messaging--i.e., Facebook, MySpace, Twitter, etc. --have become readily available to promote communication. Creating University policy for the appropriate use of each external system seems a futile exercise, so rapidly do the systems propagate. Nonetheless, University personnel and students engaged in official University activity (such as student organizations conducting official organizational activities) either planning to use or actually using external systems must keep in mind a few simple principles, tailor their actions accordingly, and ask related questions as they arise.
Non-negotiable constraints (and implications)
1. Federal (FERPA) and state university student records laws prohibit communication of information related to a student's educational record of any kind absent the student's; consent in a manner that exposes such information to a third party.
Communication from a faculty or staff member to a student on an external system exposes that communication to a third party (the system owner). If the communication does not include legally-protected information, no problem arises; if it includes legally protected information, the use of an unprotected external system for communication purposes violates FERPA and state law, and subjects the person initiating the communication to potentially severe sanctions including termination of employment or student expulsion.
2. Federal HIPAA law and Montana health information privacy statutes prohibit communication of information related to an individual's health record in the same way FERPA protects academic information.
The same precautions apply with regard to health information as to education records.
3. Federal and state law mandate that the University must have the capability and capacity to capture, archive, discover, and produce on demand copies of any official communications made by University personnel as part of assigned duties.
Communication done via an external system typically cannot meet these requirements because the external system does not provide archival and retrieval capabilities to users or to the University. University personnel may use an external system as a secondary communication channel (where the primary channel supports capture and such) but must not use an external system as the sole or primary communication channel for official University business.
4. State law prohibits communications about individual personnel evaluations or performance absent the employee's consent.
Guidelines
University personnel and student organizations:
-
MAY use external systems for personal enjoyment on personal time, using privately owned devices
-
MAY use an external system as a secondary channel to deliver general information related to a class, major, Department, program, or interest group
-
MAY NOT use external systems for communication and/or storage of individual student academic or other educational records; any person's health information; or any other information deemed to be "sensitive" or otherwise restricted by the University or protected by federal or state law from unconsented disclosure.
-
MAY permit, but NOT require, students or employees to create an account and/or use an external system, but only when (a) use of that system serves as an explicit part of an educational experience (e.g., studying the communication made possible by an external system); and/or (b) when the communication includes no sensitive data or information. Students who do not wish to create such an account or use an external system may not be adversely prejudiced in any way for this decision; and they must be allowed to participate in the activity through other means.
-
MAY NOT require students or employees to create an account and/or use a particular external system in order to receive general University information or participate in a class, major, Department, program, or interest group.