Chapter 3349-9 | Information Technology

Rule 3349-9-05 | Acceptable use of computing resources.

• Effective: June 11, 2017
• Promulgated Under: 111.15

(A) Purpose

The purpose of this rule is to outline the acceptable use of computer equipment at university without inhibiting the use of the information technology environment that is intended for the greater benefit of university community. Inappropriate use exposes university to risks including virus attacks, compromise of network systems and services, and legal issues.

(B) Scope

The scope of this rule includes all authorized users who have access to the university network, are responsible for an account on any system that resides at any university facility, and/or store any university information on university equipment or systems.

This rule applies to all equipment and systems that are owned or leased by university, including, but not limited to: computers, laboratories, lecture theaters, and video conferencing rooms across the university together with the use of all associated networks, internet access, e-mail, hardware, virtual private network, data storage, computer accounts, software, telephony services, and voicemail.

(C) Definitions

(1) "Information Technology Facilities" includes but is not limited to university computers, servers, networks, phones, printers and software.

(2) "Users/Community" refers to all university employees, students, alumni, and authorized external users for legitimate university purposes (including contractors and vendors with access to university systems).

(D) Body of the rule

(1) General use and ownership

(a) Users should be aware that the data they create on university systems remains the property of university.

(b) Each user is responsible for using the information technology facilities in an ethical and lawful way, in accordance with university policies and relevant laws.

(c) Each user is responsible for cooperating with other users of the information technology facilities to ensure fair and equitable access to the facilities.

(d) Each user is responsible for exercising good judgment regarding the reasonableness of personal use. The university accepts no responsibility for the integrity or confidentiality of personal files stored on university's information technology facilities.

(e) University reserves the right to audit networks, systems, and equipment on a periodic basis.

(2) Security and proprietary information

(a) Users should take all necessary steps to prevent unauthorized access to any information stored on university's systems.

(b) Each user is responsible for the unique computer accounts which the university has authorized for the user's benefit. Authorized users are responsible for the security of their passwords and accounts.

(c) All devices that are connected to the university network, whether owned by the user or university, shall execute a real time virus scanning software with a current virus definition file.

(d) University recommends that any information that users consider sensitive or vulnerable be encrypted before sending it outbound electronically or on magnetic media.

(3) Confidentiality and privacy information

Use of the university network and systems is restricted to authorized users only. All users accessing this system:

(a) Must maintain high levels of security & confidentiality;

(b) Must preserve the privacy required for these data;

(c) Will access records only as required to perform assigned duties;

(d) Will not access or release private information without proper authorization; and

(e) Will not publicly discuss data in a way that might identify a person.

Unauthorized use is a violation of applicable university policies and state/federal laws and regulations (such as Gramm-Leach-Bliley Act of 1999, Pub. L. No. 106-102, 113 Stat. 1338, Family Educational Rights and Privacy Act, 20 U.S.C Section 1232g; 34 C.F.R Part 99 and Health Insurance Portability and Accountability Act of 1996 Pub. L. No. 104-191, 110 Stat. 1936) and will be subject to criminal, civil and/or administrative action.

(4) Prohibited activities constituting unacceptable use

(a) The following activities are strictly prohibited on university information technology facilities:

(i) Unauthorized access to accounts, data, or files

(ii) Using of the university's name, seal, and/or logo on personal web pages, e-mail, or other messaging facilities unless expressly authorized by the university

(iii) Procuring or transmitting material that is in violation of sexual harassment or hostile workplace laws in the user's local jurisdiction

(iv) Accessing, creating or distributing pornographic material

(v) Running a personal business on university equipment

(vi) Making fraudulent offers of products, items, or services originating from any university account

(vii) Making statements about warranty, expressly or implied, unless it is a part of normal job duties

(viii) Effecting security attacks or disruptions of network service. Security attacks include, but are not limited to:

(a) Disruptive activities, such as denial of service attacks, packet spoofing, and forging information for malicious purposes

(b) Introduction of malicious programs into the network or server (example, viruses, worms, trojan horses, phishing attacks, etc.)

(c) Port scanning or vulnerability scanning

(d) Executing any form of network monitoring which will intercept data not intended for the user's host, unless this activity is a part of the user's normal job/duty

(ix) Providing information about, or lists of, university employees directly to parties outside university without proper authorization.

(b) The following email and communications activities are strictly prohibited:

(i) Sending unsolicited email messages, including the sending of "junk mail" or other advertising material to individuals who did not specifically request such material (commonly known as 'spam')

(ii) Sending defamatory, aggressive or rude e-mail messages

(iii) Sending threatening, harassing, or hate-related communications to another person via email or telephone, whether through language, frequency, or size of messages

(iv) Sending sexually explicit material

(v) Propagating chain mail (e-mail sent to a number of people asking the recipient to send copies of the e-mail with the same request to a number of recipients)

(vi) Impersonating another person by sending a message which appears to have come from another person's computer or represent themselves as being of a different gender, race, age, etc. (e.g., in a chat session or electronic conference)

Users are entitled to use the university's e-mail and messaging facilities for private purposes, provided such use is lawful. Messaging facilities may include chat sessions, newsgroups, and electronic conferences. University reserves the right to withdraw this permission in the event that such use places the information technology facilities at risk or poses a security or other threat. Users must respect the privacy and personal rights of others.

(5) Copyright violations

(a) Violations of the rights of any person or institution protected by copyright, trade secret, patent, or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of "pirated" or other software products that are not appropriately licensed for use by university is strictly prohibited.

(b) Unauthorized copying of copyrighted material including, but not limited to, digitization and distribution of text and/or photographs from magazines, books or other copyrighted sources, copyrighted music, and the installation of any copyrighted software for which university or the end user does not have an active license is strictly prohibited.

(c) Original multimedia works are protected by copyright. The copyright act's exclusive rights provision gives developers and publishers the right to control unauthorized exploitation of their work. Multimedia works are created by combining content, music, text, graphics, illustrations, photographs, and software.

(d) Authorized users are expressly forbidden to make digital files of any commercially available multimedia works including, but not limited to, recordings, music albums, album covers, and videos, without permission of the copyright owner. Investigative bodies are able to detect infringing activities of a student, faculty, or staff member. Individual members of the university community may be held liable for damages and costs if a copyright owner takes action for infringement of copyright.

(e) Distribution of music/film files for the purpose of trade or any other purpose which affects the copyright owner prejudicially, making music files available for downloading free of charge on an internet website, is a criminal offense.

(6) Enforcement

(a) Login access to the information technology facilities is a privilege that is granted by the department of information technology. An individual's access may be restricted on the grounds that the user is in breach of this rule. Any user found to have violated this rule may be subject to disciplinary action, up to and including termination of employment.

(b) For security and network maintenance purposes, authorized individuals within university may monitor equipment, systems and network traffic at any time. The university does not generally monitor e-mail, personal web sites, files, and data stored on the university's computers or traversing the university's network. However, the university reserves the right to access and monitor e-mail, web sites, server logs and electronic files and any computer or electronic device connected to the university network, should it determine that there is reason to do so. Such reason would include, but not be limited to, suspected or reported breaches of this rule, or breach of any statutes, regulations or policies of the university, or suspected illegal activity.

(c) Unlawful use will breach this rule and will be dealt with as a discipline offense. Unlawful use of the information technology facilities may also lead to criminal or civil legal action being taken against the individual. This could result in serious consequences such as a fine, damages and/or costs being awarded against the individual or even imprisonment. The university will not defend or support any client of the network who uses the information technology facilities for an unlawful purpose.

Supplemental Information

Authorized By: 111.15
Amplifies: 111.15

Rule 3349-9-15 | Information security.

• Effective: May 27, 2019
• Promulgated Under: 111.15

(A) Purpose

Northeast Ohio medical university ("NEOMED") has instituted the following information security rule to establish the overarching, university-wide approach to information security and as a measure to protect the confidentiality, integrity and availability of university data and systems.

(B) Scope

This rule applies to university data and systems; university students, faculty, staff, and alumni; and authorized external users for legitimate university purposes (e.g., volunteers, tenants, vendors, contractors, consultants, guests and/or visitors).

(C) Definitions

(1) "Access control" refers to the process of regulating specific requests to obtain and use university data and systems.

(2) "Authorization" refers to the granting of permission to an identified individual to use university data or system(s) and to explicitly accept the risk to university operations, individuals, and assets based on extending such permission. Acceptance of authorization to use university data and systems establishes an obligation on the part of the individual to use those resources responsibly.

(3) "Availability" refers to the ensuring of timely and reliable access to and use of data or systems. Additionally, it describes the importance of access when the data or system is needed, and the impact on the organization if it is not available. A loss of availability is the disruption of access to or use of data or systems (e.g., hard drive failure, destruction of a system, system unresponsiveness, denial of service attack).

(4) "Confidentiality" refers to the preservation of authorized restrictions on data access and disclosure, including means for protecting personal privacy and proprietary data. A loss of confidentiality is the unauthorized disclosure of data (e.g., compromised by hackers; released or published publicly without authorization).

(5) "Data" refers to any instance of information, regardless of form or storage medium, that is categorized by an organization or by a specific law or regulation.

(6) "Information security" refers to the protection of university data and systems from unauthorized access, use, disclosure, disruption, modification and destruction with the intent to provide confidentiality, integrity and availability to such data and systems.

(7) "Integrity" refers to the guarding against improper data or system modification or destruction and ensuring authenticity and non-repudiation in the use of data or systems. A loss of integrity is the unauthorized modification or destruction of data or systems where such resources can no longer be trusted for use, are not complete, or incorrect.

(8) "Risk," with respect to the university, refers to the effect of uncertainty, either negative or positive, on the university's strategy and its strategic objectives.

(9) "Security incident" refers to an adverse event that results in a suspected or known unauthorized disclosure, misuse, alteration, destruction, or other compromise of university data or systems. A security incident is caused by the failure of a security mechanism or an attempted or threatened breach of these mechanisms through nonelectronic means (e.g., a violation of applicable university rules, mishandled documents, the theft or loss of a system, verbal or visual disclosure of personal information) and electronic means (e.g. hacking, malware, ransomware, phishing).

(10) "System" refers to an information technology resource that can be classified, may have security controls applied, and are organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of university data. Example of systems are, but not limited to: desktop, laptop, or server computers; mobile devices (e.g., iphones; ipads; android; blackberry) to the extent that they interact with university data and systems, such as university email; university network(s); software; applications; and databases.

(11) "University data" refers to data that is created, collected, stored and/or managed in association with fulfilling the university's mission or its required business functions. University data may or may not constitute a public record (as defined within section 149.43 of the Revised Code).

(12) "University account" refers to a user's username and password combination for a university system (e.g., university email).

(13) "University email", also known as "NEOMED email", refers to the university's approved microsoft-based email system used to transmit and receive electronic messages.

(14) "User" refers to any individual or entity that has received authorization, if applicable, to access university data or systems.

(D) Rule statement

(1) Overview

(a) The ability for the university to meet the regular needs of its academic, administrative, and research communities is facilitated, in large part, by using university data and systems. While these technologies are important assets of the university and are fundamental to the carrying out of its mission, they also introduce risk, which are increasing in both number and variety (e.g., phishing, identity fraud, misuses of university data and systems). As a result, the university has established an overarching information security rule to serve as the basis for the safeguarding of its data and systems.

(b) NEOMED will ensure that users are aware of their specific information security responsibilities in the use and management of university data and systems. By being aware, NEOMED expects users to use appropriate physical, electronic, and procedural safeguards to protect the confidentiality, integrity and availability of university data and systems, as outlined herein and throughout the university's information technology rules and procedures. While the safeguards utilized by the university are expansive and thorough, the university cannot guarantee absolute security; therefore, all users share responsibility to minimize risk and to secure university data and systems within their control. Any suspected misuse or other information security incidents must be reported, in accordance with the information security incident response plan rule.

(c) This overarching rule is supplemented and supported by other information technology rules and procedures that are created to support information security elements not outlined herein. All information security rules and procedures shall ensure compliance with all applicable federal and state security-related laws and regulations. These rules and procedures shall consider risk within their design and be written to recognize the risk severity and resource constraints of university.

(2) Information security elements

The following is an overview of the overarching components that provide the basis for the university's information security measures and corresponding safeguarding requirements. These components are adapted from the national institute of standards and technology (NIST) risk management framework and corresponding NIST security controls which are further developed within other university information technology rules and procedures.

(a) Confidentiality, integrity and availability: the university shall ensure that its information security rules and procedures address the basic security elements of confidentiality, integrity, and availability.

(b) Management and governance: the university shall implement an institutional governance structure for the management of its information security framework.

(c) Classification of university data and systems: the university shall implement classification requirements that protect university data and systems in the most appropriate manner.

(d) Risk management: the university shall apply risk management procedures to make informed decisions on appropriate information security safeguards and to aid in designing and implementing any additional information technology rules and procedures.

(e) Access control and authorization: the university shall implement information security rules and procedures regarding access control and authorization required to protect university data and systems.

(f) Audit logging: the university shall implement an information security audit logging capability for university systems, including computers and network devices.

(g) Identify, protect, detect, respond, and recover: information security rules and procedures shall include methods to identify, protect against, detect, respond to, and recover from threats and vulnerabilities to university data and systems.

(h) Rule and procedure management: rules and procedures created to supplement and support this overarching information security rule shall be reviewed by university information security personnel before being installed. These rules and procedures will be implemented with consideration of the business impacts and resource constraints for all university areas tasked with their implementation.

(3) Enforcement

(a) The university respects the privacy of individuals and keeps university data on university systems as private as possible. The university also does not generally monitor university email, systems, and university data stored on university systems or traversing the university's network; however, the university reserves the right to monitor, access, and disclose university data created, sent, received, processed, or stored on university systems to protect the confidentiality, integrity, and availability of university data and systems or for any reason to ensure compliance with university rules and federal, state, or local laws and regulations. University personnel will have the right to review and/or confiscate any university equipment connected to or using university data and systems. University personnel also reserve the right, without notice, to limit or restrict any individual's university data and systems access and to inspect, remove, or otherwise alter any university data or system that may compromise the information security of the university. University data and systems are the property of NEOMED and not the personal property of the individual.

(b) Access to university data and systems is a privilege that is granted by the university; therefore, non-compliance or violation of related university rules may result in disciplinary action, which could include, but is not limited to: suspension or loss of the user privileges related to university data and systems; mandatory information security training; written warnings, suspension with or without pay, or termination; or any other remedy available by law.

(c) The university will not defend or indemnify any user who utilizes university data and systems for an unlawful purpose or in contravention of university rules.

Supplemental Information

Authorized By: 111.15
Amplifies: 3350.12

Rule 3349-9-18 | University data.

• Effective: September 25, 2026
• Promulgated Under: 111.15

(A) Purpose

This rule establishes northeast Ohio medical university's (NEOMED's) framework for the classification, governance, access, protection, and lifecycle management of university data. It aligns institutional practices with applicable laws and regulations and enables consistent controls that safeguard confidentiality, integrity, and availability of university data while supporting NEOMED's academic, clinical, research, and operational missions.

(B) Scope

This policy applies to all university data and data users, and establishes the roles and responsibilities to properly classify, use, protect, and manage university data.

(C) Definitions

(1) "Data custodian" is defined in paragraph (D)(3)(e)(i) of this policy.

(2) "Data governance council" is defined in paragraph (D)(3)(b)(i) of this policy.

(3) "Data manager" is defined in paragraph (D)(3)(d)(i) of this policy.

(4) "Data steward" is defined in paragraph (D)(3)(c)(i) of this policy.

(5) "Data user" is defined in paragraph (D)(3)(f)(i) of this policy.

(6) "Personally created data" refers to information created, collected, maintained, transmitted, or recorded that is not related to university business but is personal in nature.

(7) "University data", also referred to "institutional data", refers to data created, collected, stored, maintained, transmitted, or recorded by or for NEOMED to conduct university operations. It includes research data and data used for furthering the university's mission but does not include personally created data. University data may exist in any format (i.e. electronic, paper, audio, visual).

(8) "University records" refers to documents or items, regardless of form, that document NEOMED functions, policies, decisions, procedures, operations, or other activities; university data may reside in records, be used to produce records, or itself constitute a record.

(D) Policy statement

(1) Overview

(a) University data is a valued strategic asset of NEOMED and is to be provided on an as needed basis to data users in furtherance of their university responsibilities. This policy establishes the roles and responsibilities to properly classify, use, protect, and manage university data.

(b) Permission to access, use, disclose, or generate university data will be granted to authorized data users only for legitimate university purposes and based upon their roles and compliance with university, contractual, and legal requirements.

(2) Classification of university data

(a) The university is committed to the privacy of its community and protecting the confidentiality, integrity, and availability of university data. As such, university data classifications have been created to ensure the appropriate security controls are applied for systems and applications containing such data.

(b) All university data must be assigned to a classification level. The classification level is based on compliance, legal, criticality, operational usage, and risk considerations. The four university data classification levels from least to most restrictive are:

(i) Public (L1): university data that is intended for public disclosure and use.

A breach of confidentiality, integrity, or availability would have little to no adverse impact on the university's mission, safety, finances, or reputation.

(ii) Internal (L2): university data that is used to conduct university business and is not generally available to the public. Internal data can be shared externally, where appropriate; however, access restrictions should be applied accordingly.

A breach of confidentiality, integrity, or availability could have minimal adverse impact on the university's mission, safety, finances, or reputation.

(iii) Restricted (L3): university data that due to legal, contractual or other requirements, and may not be accessed without specific authorization.

A breach of confidentiality, integrity, or availability could have moderate adverse impact on the university's mission, safety, finances, or reputation.

(iv) Highly restricted (L4): university data that requires the highest level of protection because inappropriate handling of this data could result in criminal or civil penalties, identity theft, and/or financial loss.

A breach of confidentiality, integrity, or availability could have significant adverse impact on the university's mission, safety, finances, or reputation.

(c) In absence of being formally classified, university data should be treated as internal data by default.

(d) When a set or collection of university data includes different classifications, the set or collection will be classified at the most restrictive level present.

(e) University data may be classified at a more restrictive level; if so, it must meet the minimum-security controls of that higher classification level.

(f) Requests to modify the classification of university data must be submitted to and approved by the data governance council.

(3) Roles, responsibilities and structure

(a) While the university owns and ultimately controls all university data, data governance is accomplished through collaborative efforts of a variety of university personnel, grouped according to the nature of their participation, scope of responsibility, and particular activities. The data governance structure and its primary roles, groups and associated responsibilities are described as follows:

(b) Data governance council

(i) The data governance council is a university committee that provides strategic planning, governance, and oversight for university Data to support data integrity, compliance, and accountability.

(ii) Their responsibilities include the following:

(a) Review and approve university data policies and standards;

(b) Defines and publishes data classification assignments and data governance roles;

(c) Resolve escalated or cross-domain data usage and ownership issues; and

(d) Provide compliance oversight (FERPA, GLBA, HIPAA, state laws).

(iii) Implementation and operational execution of university data policies and standards are the responsibility of designated data stewards and data managers.

(c) Data stewards

(i) Data stewards are senior university officials that are responsible for the overall governance, appropriate use, and protection of university data within their functional areas.

(ii) Their responsibilities include the following:

(a) Serve as members of the data governance council;

(b) Appoint and oversee data managers;

(c) Be accountable for appropriate use of data within their functional areas;

(d) Accept and manage institutional risk associated with the use, collection, sharing, retention, and protection of university data within their domain;

(e) Approve access criteria and sharing agreements; and

(f) Ensure compliance with law and policy.

(d) Data managers

(i) Data managers act on behalf of data stewards and are subject matter experts responsible for the operational management, quality, and consistent application of university data in accordance with approved policies and standards. This is a delegated responsibility and does not confer ownership or final decision making authority.

(ii) Their responsibilities include the following:

(a) Maintain university data classifications;

(b) Define and maintain university data definitions and business rules;

(c) Monitor and improve data quality and integrity;

(d) Review and process routine data access and use requests in accordance with approved criteria;

(e) Maintain metadata, documentation, and data standards;

(f) Identify and escalate data issues, risks, or policy conflicts to the data Steward; and

(g) Coordinate with data custodians to ensure proper implementation of standards.

(e) Data custodians

(i) Data custodians are responsible for the technical management, protection, and operation of systems that store, process, or transmit university data.

(ii) Their responsibilities include the following:

(a) Implement appropriate technical security controls for university data aligned with institutional policy and data classification standards;

(b) Ensure access is limited to approved purposes;

(c) Provide incident response support;

(d) Monitor university data usage and policy compliance; and

(e) Notify data managers or stewards of changes that may affect data integrity or access.

(f) Data users

(i) Data users are those who access, use, disclose, generate, administer, or manage university data. This includes, but is not limited to, faculty, staff, students, contractors, volunteers, visitors, sponsored guests, and affiliated entities acting on behalf of NEOMED.

(ii) Their responsibilities include the following:

(A) Properly manage and protect university data as set forth in this policy;

(B) Report suspected incidents immediately; and

(C) Complete required training annually.

(4) Public records

Although university records may be subject to disclosure under Ohio's Public Records Act, the underlying university data must be protected according to its classification. Public records requests must be handled in accordance with NEOMED's public records rule.

(5) Records management and data disposition

University data may reside in university records, be used to produce university records, or itself constitute university records. Ohio law requires that university records not be disposed prior to the expiration of the authorized retention period. University records must be managed in accordance with approved records retention and disposition schedules consistent with the records management rile and records retention schedule.

(6) Reporting unauthorized or inappropriate access

All individuals to whom this policy applies must immediately report suspected unauthorized or inappropriate access, use, disclosure, or generation of university data to the IT help desk or information security team, per incident response procedures.

(7) Training

(a) Individuals with access to highly restricted (L4) data must complete annual, university-approved training. All others must complete annual university data awareness training. Additional training may be required by legal, regulatory, contractual, clinical, or research obligations.

(8) Relinquishing data

Data users must relinquish university data upon the end of employment, affiliation, or as otherwise required due to role changes, data manager requirements, provisions with executive leadership, and/or university policy.

(9) Personally created data

Information not related to university business that is personal in nature is the responsibility of the individual to back up, save, manage, and maintain; NEOMED does not assume liability for personally created data.

(10) Policy exceptions

Requests for exceptions to this policy must be submitted to the data governance council for review and approval prior to implementation. Approved exceptions must document compensating controls and an expiration date.

(11) Policy violations

Violations may result in denial of access to university computing resources and corrective or disciplinary action, up to and including termination or dismissal, in accordance with applicable university policies. The university may temporarily suspend or block access prior to completion of disciplinary procedures and may refer suspected legal violations to law enforcement.

Last updated September 28, 2026 at 8:10 AM

Supplemental Information

Authorized By: 111.15
Amplifies: 3350.12
Prior Effective Dates: 5/27/2019

Rule 3349-9-20 | Computer equipment and software support.

• Effective: February 14, 2019
• Promulgated Under: 111.15

(A) Purpose

The purpose of this rule is to define standards for hardware, software, and support at the university.

(B) Scope

The scope of this rule includes all personnel at university.

(C) Definitions

(1) "Authorized User" or "User" is a person who has been provided with a username and password, for their use only through legitimate university process after verification of identification by the university's information technology department.

(2) "Information Technology" is the administrative unit responsible for supporting university owned or leased hardware and software.

(3) A computer lab is defined as three or more computers used by faculty, staff, or students for general use, research, in a classroom setting, or as a component of a class.

(D) Rule

In order to make the best use of university resources, standard hardware and software specifications have been developed and are defined in the information technology standards and timelines. Employees are responsible for familiarizing themselves with this document. Non-standard hardware/software will not be supported by information technology, nor will computers that are not owned by university.

Hardware

New hardware

Supplemental Information

Authorized By: 111.15
Amplifies: 3350.12