Re: Email Forwarding

[Theresa Rowe <rowe () OAKLAND EDU>]

We do allow forwarding and actually promote forwarding email to students if
they do not want to use the university accounts.  Like Wayne State, were
were blocked frequently by spam reports, but that ceased when we moved to
Google and we've not been blocked since.  We do not anticipate turning off
forwarding.

* *
> *1.       **Records Retention - *Emails are University business records
> and ought to be treated as such. When an employee forwards email from his or
> her bu.edu account to a personal account, the University loses control of
> those record and must rely on the employee to provide records. If the
> employee leaves the University, passes away, or loses access to his or her
> own personal account, these records will most likely be lost to the
> University.

We've never had a policy that prohibited using email or any communications
services (personal cell phone, personal home phone, text, etc.) for
university communications.  We do not centrally archive or store
communications.  Our campus procedure is to rely on individuals to provide
communications when required to do so.  We do not include communications in
our record retention.


> *2.       **eDiscovery - *The University is frequently asked to or needs
> to collect emails for litigation. If an employee is forwarding, evidence to
> support the University’s claims or defenses may be lost.

We've had a few notices for preservation due to litigation. In all cases, we
preserve what we have in our possession at the moment the notice is
received, as directed by our General Counsel.  So far, no issue.


> * *
>
> *3.       **Contractual Obligations - *The University is party to many
> agreements that require the University to keep a third party’s information
> confidential. When an employee forwards email, that confidence is undermined
> and the University may be in breach of the agreement.

Our employees are instructed to follow contractual obligations locally.  We
do not centrally police.



> *4.       **FERPA - *Forwarding (non-directory) personally identifiable
> information (“PII”) from student education records to an account
> administered by a third party email provider could be a violation of FERPA
> unless (i) the University had the student’s consent, (ii) the University
> designated the provider a ”school official,” or (iii) one of the other FERPA
> exceptions applies.
> First, student consent, which must be particular to the disclosure and in
> writing, is impractical and unlikely. Second, the ...


We tell our employees not to send ANY FERPA protected information in any
email at any time.  We do not believe email is secure and that it always may
be forwarded.




> <#12e3486d062d7e6f__ftn1>
>
>
>
> *5.       **State Privacy Laws - *If email contains “personal information”
> (name + driver’s license number, social security number or financial account
> number) and the University is the owner of, or charged with maintaining or
> storing, the personal information, then unauthorized access to, acquisition
> of, or use of the email will violate state law in most states....


We've identified such data and the FERPA data above as "Confidential" in a
university policy and all Confidential data are not to be included in email
(or any electronic communication).



> *6.       **HIPAA - *Protected health ...

Included in #5 above...



> *7.       **Confusion - *An @xxxxxxxx.edu address is a reasonably reliable
> indication to a recipient that the sender is a member of the given
> University community. When an email comes from a Gmail or Yahoo account, it
> may be confusing to the recipient or lead the recipient to mistrust the
> source of the email.
>
>
>
> We agree but don't see how this affects forwarding.  This is why we tell
our employees to send communications to university email addresses, as these
can be verified and linked to a single university-community individual.  We
don't want communications to go to godzilla () hotmail com because we cannot
verify.  If the individual makes the decision to forward to
godzilla () hotmail com, that is their choice.

Theresa Rowe





-- 
Theresa Rowe
Chief Information Officer
Oakland University