Computing Services at Morehouse School of Medicine

PURPOSE
To set policy regarding the selection and acquisition of all computer information systems, including equipment and software, at the Morehouse School of Medicine (MSM) and Morehouse Medical Associates (MMA), and the management and use of all computing resources, including local area networks, remote access and wide area network, library information systems, E-mail, the Internet, (outside the boundaries of our control), and Intranet, (all network equipment we contract or control), voice mail, off site departmental and public computing facilities, and related services owned or managed by Morehouse School of Medicine.

RESPONSIBILITY:
The Senior Vice President for Management and Policy will ensure compliance with this policy. The Director of Information Technology Services, will implement this policy.

APPLICABILITY:
This policy and all guidelines will apply to all users of computing resources owned or managed by MSM and MMA. Users include, but may not be limited to MSM faculty, staff, students and guests.

POLICY:
1. It is the policy of MSM that the Director of Information Technology will have the responsibility and authority for the selection and acquisition of all computer information systems for MSM and MMA.
2. The Director of Information Technology will have responsibility and authority for the integration and management of all computer information systems.
3. All users of MSM and MMA computing services and facilities will act in a responsible and ethical manner in accordance with established guidelines.

GUIDELINES:
1. Use only the computers, computer accounts and computer files for which you have authorization.

2. Obey established guidelines for any computers or networks used both inside or outside the Institution. For example, individuals using MSM’s remote access servers must adhere to the policies established for those servers; individuals accessing off-campus computers via external networks must abide by the policies established by the owners of those computers as well as policies governing use of those networks. (See Appendix B for a summary of MSM’s contractual agreement with BBN Planet).

3. Do not attempt to access restricted portions of the operating system, security software, or accounting software unless authorized by the appropriate Institution administrator. Breaking into computers is explicitly a violation of Internet rules of conduct, no matter how weak the protection is on these computers.

4. Abide by all state and federal laws. (See Appendix C, provides an extract of some relevant Georgia and Federal laws).

5. Respect the privacy and personal rights of others. Do not access or copy another user’s electronic mail, data, programs, or other files without permission. MSM endorses the following statement on software and intellectual rights distributed by EDUCOM, the non- profit consortium of colleges and universities committed to the use and management of information technology in higher education, and ADAPSO, the computer software and services industry association:

"Respect for intellectual labor and creativity is vital to academic discourse and enterprise. This principle applies to work of all authors and publishers in all media. It encompasses respect for the right to acknowledgment, right to privacy and right to determine the form, manner and terms of publication and distribution. Because electronic information is volatile and easily reproduced, respect for the work and personal expression of others is especially critical in computer environments. Violations of authorship, integrity, including plagiarism, invasion of privacy, unauthorized access and trade secret and copyright violations may be grounds for sanctions against members of the academic community." Guidelines in the Tenets of Community Behavior and Academic Code regarding plagiarism or collusion on assignments apply to course work completed with computers just as they do to other types of course work.

6. Abide by all applicable copyright laws and licenses. Institutional policies and the law expressly forbid the copying of software that has not been placed in the public domain and distributed as "freeware." Users of "Shareware" are expected to abide by the requirements of the Shareware Agreement.

7. Use appropriate standards of civility when using computing systems to communicate with other individuals. When sending personal messages to other users or posting on electronic bulletin boards, identify yourself as the sender. Using MSM’s computing resources to harass other individuals deliberately is explicitly prohibited.

8. Be sensitive to the needs of others, and use only your fair share of computing resources, such as the remote access servers. You should use these facilities for only the most essential tasks during periods of peak demand. Broadcasting non-critical messages to large numbers of individuals and sending chain letters are examples of activities that cause network congestion and interfere with the works of others, and thus are not allowed.

9. Treat computing resources and electronic information as a valuable Institutional resource. Protect your data and the systems you use. Back up files regularly, set an appropriate password and change it regularly, and understand the access privileges you have set for your files. Do not destroy or damage any computing equipment, networks or software. The willful introduction of computer code that compromises the integrity of a system, such as viruses and worms, into the Morehouse School of Medicine computing environment or into other computing environments via MSM’s network violates Institution standards and regulations and is strictly prohibited.

10. Use MSM’s computing facilities and services for Institution related work only. Activities that would jeopardize the Institution’s tax exempt status are prohibited. Personal Financial Gain: Use of Institution computing resources for personal financial gain requires prior approval. The Director of Information Technology or the Director of Risk Management should be contacted for detailed information.

11. Users are responsible for staying informed about changes in the computing environment and are expected to adapt to changes in the Institution computing environment. MSM publishes information in a variety of ways, including log on messages, general news items that users are prompted to read, news items associated with particular compilers or software packages, on-line documents about software, policy, and procedures, WEB pages, newsletters, and in some cases, letters mailed to individuals.

PRIVACY ISSUES:
1. Users must respect others users’ computer files, as these are their own property. This includes any Institutional files such as grades, budgets, and research data. Actions such as destroying, altering, copying or prying through data of other users is a serious breach of ethics and will be investigated and recommendations for disciplinary action will be made. Access by DITS Staff on behalf of the Institution

2. DITS respects the privacy of all users. Members of the DITS staff are forbidden to log on to a user account or to access a user’s files unless the user gives explicit permission. Exceptions to this privacy policy may be made under specific conditions as defined below:

a) A program suspected of causing disruption to the network or other shared services.

b) Suspected violation of the Tenets of Community Behavior and Academic Code or of state or federal law. In these instances, the Director of Information Technology Services and one other senior officer of the Institution must be convinced that there is sufficient cause to review a file(s) before those files(s) can be scanned or searched without the user’s permission.

3. Before logging on to a user’s account or accessing a user’s private files, a reasonable attempt will be made to contact the user to inform him or her that DITS will access the files. If that is not possible, the Director for DITS or an authorized representative will view the files for the suspected violation and will inform the user afterwards that the files have been reviewed. Information obtained in this manner is admissible in legal proceedings or in a Institutional hearing. In accepting a user account, the user agrees to this policy.

Access by project owners to accounts on campus computing facilities

4. Project owners or their delegated representatives can access and modify data associated with campus computing facility user accounts for which they are responsible. MSM project owners are expected to respect the privacy of users for whom they are responsible. Data should be accessed only as required for the purposes of research, instruction, administration or other purposes for which the user account exists.

SYSTEM SECURITY AND CRACKING
1. Attempting to obtain access to computer files that are restricted, obtain passwords for other accounts, remove or change restrictions on a computer account, or to affect system performance are serious breaches of ethics. Activities of this nature will be treated seriously by the Division.

USER’S RIGHTS
ACCESS TO COMPUTING RESOURCES
1. Faculty, students, and staff may obtain an ID for use with the campus computing facilities for activities related to research, instruction or Institution administration.

2. Recognized student organizations at MSM may obtain User ID’s when authorized by the Dean. Individuals not at MSM or affiliated with MSM may, under some circumstances, also obtain a user account. Persons in this category should contact the Office of the Dean or Office of Admissions regarding obtaining and using campus computing facility accounts.

DATA SECURITY AND INTEGRITY
1. DITS provides reasonable security against intrusion and damage to files stored on the campus computing facilities. It also provides some facilities for archiving and retrieving files specified by users, and for recovering files after accidental loss of data.

2. Neither the Institution nor any DITS staff can be held accountable for unauthorized access by other users, nor can they guarantee protection against media failure, fire, floods, etc.

3. Users should use all available methods to protect their files, including the frequent changing of their passwords, encryption of data, and storing back-up copies of information off site.

4. In the event that data has been corrupted as a result of intrusion, DITS should be notified immediately. Every reasonable attempt will be made to restore files to their status prior to intrusion, however, DITS cannot guarantee full restoration. Upon request, the DITS staff will assist in implementing procedures to maximize security. It is especially important that users back up their files and use all available means to protect their data on workstations.

Electronic Mail
1. Users should not expect total privacy of electronic mail (E-mail). Computing systems administrators may see the contents of E-mail due to serious addressing errors or as a result

of maintaining the E-mail system. In those cases where administrators do see the contents of private E-mail, they are required to keep the contents confidential.

2. Users should also be aware that the current design of the Internet is such that the privacy of and security of E-mail transmitted from MSM cannot be guaranteed.

3. When a user’s affiliation with MSM ends, E-mail subsequently received at MSM that is addressed to the former user will either be returned to the sender or, if appropriate, forwarded to an address specified by the former user. After a reasonable length of time and appropriate notice to the affiliated department, the former users’ mailbox will be removed from the system.

Web Page Authoring
1. Authors of WEB pages on the Campus internet or intranet WEB site must receive prior written approval from the appropriate Department chairs or heads regarding content before such material will be electronically published for internal or external viewing. For external internet publication, the style and format must be reviewed by the Director of Public Affairs and/or the Director of Risk Management.

OWNERSHIP OF COPYRIGHT FOR MATERIALS DEVELOPED WITH MSM RESOURCES
1. Morehouse School of Medicine has established guidelines related to ownership of copy- rightable property. The exact policies and procedures relating to copyrights may be obtained from the office of the appropriate Associate Dean at the School.

RESPONSIBILITY FOR ERRORS IN SOFTWARE, HARDWARE, AND CONSULTING
1. MSM presents no warranty, either expressly stated or implied, for the services provided. Damages resulting directly and indirectly from the use of these resources are the responsibility of the user.

2. At the request of the user, when hardware, software, or consulting errors are determined to have occurred on computing facilities, computing staff will make a reasonable attempt to restore files to their state prior to the failure, at no cost to the user.

3. As part of maintaining the software environment, computing staff applies vendor-supplied or locally developed fixes as appropriate when problems are identified. Given that vendors may be involved and staff resources are finite, no guarantee can be made as to how long it may take to fix an error once it has been identified.

4. When software errors are considered major problems or could produce inaccurate results, users will be notified as soon as possible using appropriate electronic and/or other media.

CHANGES IN THE COMPUTING ENVIRONMENT
1. When significant changes in hardware, software or procedures are planned, computing system administrators will notify their user community through electronic and other media to ensure that all users have enough time to prepare for the changes and to voice any concerns that they might have.

By Direction of the President

________________________________
Ronny B. Lancaster, M.B.A., J.D.
Senior Vice President for Management and Policy

Using Computer Resources at Morehouse School of Medicine

APPENDIX B

MSM’s Contractual Agreement with BBN Planet
Document Updated: September 30, 1996

Description: This statement represents a guide to the contractual agreement between Morehouse School of Medicine and BBN Planet for data communication services. It is only intended to address the issue of BBN Internet Access Service use. In those cases where data communications are carried across other networks, BBN Internet Access Service users are advised that policies of those other networks apply and may limit use.
1. Internet access using BBN Internet Access Service is restricted to employees and students in support of the educational mission of the School.

2. BBN Internet Access Service can only be used to transmit technical data abroad if it is in compliance with U.S. law.

3. BBN Internet Access Service cannot be used for illegal purposes.

4. BBN Internet Services cannot be used to interfere with or disrupt network users, services or equipment. Disruptions include, but are not limited to, distribution of unsolicited advertising or chain letters, propagation of computer worms and viruses, and using the network to make unauthorized entry to any other machine accessible via the network.

Violations of this contractual agreement can result in termination of Internet services by BBN Planet.

Using Computer Resources at Morehouse School of Medicine

APPENDIX C

GEORGIA COMPUTER SYSTEMS PROTECTION ACT

H.B. No. 822 (AS PASSED HOUSE AND SENATE)
By: Representatives Walker of the 115th, Coleman of the 118th, Murphy of the 18th and Buck of the 95th

SECTION 1.
16-9-93.

(a) Computer Theft

Any person who uses a computer or computer network with knowledge that such use is without authority and with the intention of:

(1) Taking or appropriating any property of another, whether or not with the intention of depriving the owner of possession;

(2) Obtaining property by any deceitful means or artful practice; or

(3) Converting property to such person’s use in violation of an agreement or other known legal obligation to make a specified application or disposition of such property shall be guilty of the crime of computer theft.

Computer Trespass
Any person who uses a computer or computer network with knowledge that such use is without authority and with the intention of:

(1) Deleting or in any way removing, either temporarily or permanently, any computer program or data from a computer or computer network;

(2) Obstructing, interrupting, or in any way interfering with the use of a computer program or data or;

(3) Altering, damaging, or in any way causing the malfunction of a computer, computer network, or computer program, regardless of how long the alteration, damage, or malfunction persists shall be guilty of the crime of computer trespass.

Computer Invasion of Privacy
Any person who uses a computer or computer network with the intention of examining any employment, medical, salary, credit, or any other financial or personal data relating to any other person with knowledge that such examination is without authority shall be guilty of the crime of computer invasion of privacy.

(b) Computer Forgery
Any person who creates, alters, or deletes any data contained in any computer or computer network.