Cloud services, such as those offered by Apple, Microsoft and Google, have proliferated in recent years, and personal use is increasing among the general population. But storage of UAB data requires a higher standard of security.
UAB has developed interim guidelines for using public cloud applications and services — such as file storage, Web conferencing and content hosting — to store information related to university business. Review them online to ensure that your handling of information complies with all relevant UAB policies and best practices.
“We want people to know that it is risky to use such sites for sensitive data,” said David Yother, director of enterprise technology services for UAB IT. “The safest method is to store it on UAB-owned systems, unless a specific business reason exists and appropriate management approvals have been received.”
Yother noted that UAB IT offers researchers 1TB of free storage space that permits sharing of files among individuals with appropriate access. Contact AskIT for access and information.
If you are thinking about using cloud-based services, three things bear special consideration:
- Employees and students may not enter cloud-services contracts on behalf of UAB, including click-through agreements for free services.
- Under no circumstances should restricted, protected or sensitive information be stored without explicit UAB approval because its compromise could lead to institutional or individual liability, including criminal charges.
- Reimbursement for paid subscription services requires the user to sign a statement affirming the data is not sensitive or protected, and an audit may be required to confirm that.
UAB IT specialists are available to counsel employees on the use of these services, and additional policies and guidance will be available in 2015. Direct questions to Yother, dyother@uab.edu.
UAB Hospital employees should refer to HSIS for guidance.
