E-Mail for Retirees and Auto Forwarding of E-Mail

The prevalence of electronic communications requires us to manage and protect the data those communications contain. Increasingly, legal precedents have been established by the courts that place the responsibility equally on the IT departments that manage communications systems and the communicators. UCit takes these responsibilities seriously.

The following procedures help the E-Mail Services team balance these responsibilities with the needs of our e-mail customers.

E-Mail for Retirees  |  Automatic Forwarding of All E-Mail to an Account Outside UC  |  Legal Precedents

E-Mail for Retirees

A proposed policy may extend the privilege of having an e-mail account to each retiree of the University of Cincinnati after his or her HR status becomes 'terminated.'

Requirements:

1. Extension of the e-mail account must be formally requested for the following reasons:
1. Proper licensing must be activated for users who are no longer covered under our current campus license agreement.
2. Retired or terminated users whose accounts should not remain active are removed in a timely manner.
3. A department requesting the extension of an e-mail account are aware of the retention policies and assume sole responsibility of such actions and use of the account for legal compliance.
2. The dean, director, or department head of the department from which the employee retires must submit a GETit request for retention of e-mail account for the retiree.
   1. The $60 one time set up fee, typically required for an affiliate employee's account, will be waived for a retiree's account.
   2. For account retentions of 30 days or less, the $10 per month fee will be waived.
   3. For account retentions of more than 30 days, a $10 monthly fee will be charged to the department. 
   4. It is possible that if the e-mail account is retained, the retiree will continue to receive e-mail pertaining to university business. Other employees of the university may send e-mail messages to the retiree, not realizing that the retiree is no longer at the old job.
   5. If the department prefers that the retiree not retain his or her e-mail account, the E-Mail Services team can put an out of office message on the account stating that the employee has retired, who should be the recipient of business e-mail, and the retiree's personal e-mail address. (The retiree can request an e-mail account from any of the free e-mail providers, Yahoo, Google GMail, or Microsoft Hot Mail.) The e-mail account or the out of office message will remain active for the term specified in the GETit request.

Automatic Forwarding of All E-Mail to an Account Outside the University of Cincinnati

The Exchange system is configured with a global setting that prohibits an e-mail user from setting a rule to automatically forward all e-mail messages to an off-campus e-mail account. This is to prevent university-proprietary data such as student information, or financial or personal data, from being automatically sent off campus and out of the control of the University of Cincinnati. However, UCit recognizes that there are occasions when the temporary forwarding of all e-mail makes sense.

One of the following is required:

1. The forwarding address is a partner site, such as UC Physicians, CCHMC, or Health Alliance, that has a ZIX e-mail security appliance so we can confirm that the e-mail is encrypted and protected in transit.
2. The request must be received by the E-Mail Services team and it must be approved by a Dean, Director, or Department head to certify that:
   1. The requestor does not typically receive sensitive personal information.
   2. The department takes full responsibility for the protection of all data that is sent to or from an e-mail server outside the control of the University of Cincinnati.

Legal Precedents

Gramm Leach Bliley Act

The Gramm-Leach-Bliley Act, while it is targeted at financial institutions, can also be applicable to other types of enterprises. The Safe Guard rules establish practices that ensure that sensitive personal information, such as social security numbers and account data that identify customers and employees (and in the university's case, students), is kept safe and protected. This includes removing access to this data from employees who have left the institution or changed departments and safeguarding e-mail that might possibly contain this type of information.

Ohio University Class-Action Lawsuit

The 2006 data breach at Ohio University resulted in a loss of student personal information. It has resulted in a class action lawsuit.