Rider 114 – Supply Chain User Acknowledgement

The University of Texas MD Anderson Cancer Center INFORMATION RESOURCES USER RIGHTS AND RESPONSIBILITIES ACKNOWLEDGEMENT

Supply Chain Management

The University of Texas MD Anderson Cancer Center (“MDACC”) relies on information resources and the data contained within those systems (Data) to achieve its missions. This User Rights and Responsibilities Acknowledgement protects these resources in accordance with state law, The University of Texas System Regents’ Rules, and MDACC policies and practices and ensures that MDACC can access Data to fulfill its duties and mission. All individuals granted access to MDACC information resources must be familiar with and follow the rights and responsibilities below:

General • MDACC information resources are provided for the express purpose of conducting the business and mission of MDACC

Information stored on MDACC information resources other than information resulting from permitted incidental personal use of such resources may only be shared with others who have a business need to know such information, and such information may only be shared in compliance with applicable laws, regulations, and policies.

MDACC information resources must not be used to: engage in acts against the mission and purposes of the Institution, intimidate or harass, degrade performance, deprive access to an institution resource, obtain extra resources beyond those allocated, or to circumvent security measures.

Information resources must not be used to conduct a personal business or used for the exclusive benefit of individuals or organizations that are not part of The University of Texas System. Any exceptions must be in support of MDACC missions and require the prior written approval of an Executive Officer of MDACC. Incidental personal use of certain systems is permitted (refer to Section F below).

Inappropriate sexual or obscene materials must not be intentionally accessed, created, stored or transmitted.

Users must not copy or reproduce any licensed software except as expressly permitted by the software license, use unauthorized copies on MDACC-owned computers or use software known to cause problems on MDACC-owned computers.

Use of camera phone or other devices to inappropriately capture data or images of MDACC Internal Use, Confidential, or Restricted Confidential information is prohibited.

Any exception to the acceptable use of information resources must be approved by the Information Security Department.

Information Services (IS) Privacy

Users have no expectation of privacy regarding any Data residing on MDACC computers, servers, or other information resources owned or held on behalf of MDACC regardless of whether the Data was generated as the result of acceptable (including incidental use as described below) or unacceptable use of MDACC information resources.

All files, documents, messages in any format, and other Data residing on MDACC computing resources or held on behalf of MDACC are owned by the institution in accordance with the Regents’ Rules and Regulations and are subject to access by the institution without notice to comply with public information requests, court orders, subpoenas, or litigation holds; or for any other purpose consistent with the duties of the institution. Users, including students, staff and faculty members, have no expectations of privacy in any such Data.

MD Anderson workforce members are never compelled to use Personally-Owned Mobile Devices for institutional business.

MDACC acknowledges the privacy of users with respect to personal information on personally-owned mobile devices to the extent possible, consistent with the business needs of the institution and obligations imposed by law. The expectation of privacy on personally-owned mobile devices differs in this respect from institutionally-owned devices, on which MDACC users have no expectation of privacy.

Data Protection • Any information concerning any person, system, or asset of MDACC that is obtained in the performance of one’s duties is of value to MDACC, may be Confidential or Restricted Confidential, and shall not be disclosed to any individual, unless such release of information is directly related to the performance of one’s responsibilities.

Users may not further disclose Confidential or Restricted Confidential information without proper authorization or as required by law.

Confidential and Restricted Confidential Data will be accessed and used only as necessary. Users of MDACC information resources must not attempt to access data or programs contained on resources for which they do not have authorization or consent.

All critical data (electronic files) will be saved on network resources to ensure backup of the data. All data, including research data, shall be backed up to secure storage locations within MDACC network (network drives) for disaster recovery purposes.

All records (electronic or paper) will be maintained in accordance with the MDACC Records Retention Policy.

For systems that contain Social Security Numbers (SSN), the system must use the SSN only as a Data element or alternate key to a database and not as a primary key to a database. The system must not display SSNs visually (such as on monitors, printed forms, system outputs) unless required or permitted by law or by The University of Texas Systemwide Policy UTS165 Information Resources Use and Security Policy. Name and directory systems must be capable of being indexed or keyed on a unique identifier, once it is assigned, and not on the SSN. For those databases that require SSNs, the databases may automatically cross-reference between the SSN and other information through the use of conversion tables within the system or other technical mechanisms.

All Confidential and Restricted Confidential information (e.g., protected health information, sensitive research Data, student Data, Social Security Numbers) transmitted through open networks (e.g., the Internet and wireless) must be encrypted in accordance with MDACC encryption guidelines. Refer to Information Security website for Data Classification Guidelines & Ratings.

Confidential and Restricted Confidential Data shall not be stored on unmanaged personal devices (see Electronic Confidential and Restricted Confidential Information Use and Storage Policy (UTMDACC Institutional Policy # ADM1187).

MD Anderson’s Electronic Health Record (EHR) consists of proprietary software that is owned exclusively by a commercial vendor and which is restricted from disclosure and dissemination to third parties. Accordingly, users must keep confidential this software’s object and source codes and protect them from disclosure to any unauthorized third party. This includes ensuring that credentials used to access the EHR are kept confidential and preventing the unauthorized copying or dissemination of EHR software (including screen displays)

Virus Protection

All computers connecting to the MDACC network must run current and authorized virus prevention software. Virus protection software must not be disabled or bypassed except as required by the temporary installation of software or for other special circumstance. Computers found to be infected with a virus or other malicious code may be disconnected from the MDACC network until deemed safe by the Information Security Department.

Electronic Mail	•	The following electronic mail (email) activities are prohibited:

Using email for purposes of political lobbying or campaigning except as permitted by the Regents' Rules and Regulations.

Posing as anyone other than oneself when sending email.

Incidental Personal Use of Information Resources

Reading another user's email unless authorized to do so by the owner of the email account, or as authorized by policy for investigation, or as necessary to maintain services.

Use of email software that poses a significant security risk to other users on the MDACC network.

Sending or forwarding “chain” letters.

Sending unsolicited messages to large groups except as required to conduct MDACC business.

Sending excessively large messages or attachments unless in performance of official MDACC business.

Knowingly sending or forwarding email that is likely to contain computer viruses.

Exchanging unencrypted email containing Confidential or Restricted Confidential information, (e.g., protected health information with patients, external physicians, or other parties).

Exchanging credit card information (other than your own) via email.

Incidental personal use of electronic mail and internet access is permitted by MDACC policy but is restricted solely to authorized users (authorization does not extend to family members or other acquaintances). Incidental personal use must not interfere with normal performance of an employee’s duties, must not result in direct costs to MDACC, and must not expose MDACC to unnecessary risks.

Storage of any non-work related email messages, files and documents within the MDACC email system must be nominal (less than 5% of a user's allocated mailbox space).

Non-work related information may not be stored on network file servers.

Internet Use	•	Software for browsing the Internet is provided to authorize users for business, education, research, and patient care purposes.

Due to network maintenance and performance monitoring and to ensure compliance with applicable laws and policies, all user activity may be subject to logging and review.

Email or postings by users of MDACC network resources to news groups, “chat rooms” or “listservs” must not give the impression that they are representing, giving opinions, or making statements on behalf of MDACC, unless authorized. Faculty and staff members shall use a disclaimer stating that the opinions expressed are their own and not necessarily those of MDACC.

Personal commercial advertising must not be posted on MDACC web sites.

Portable and Remote Computing

All computers and portable-computing devices accessing MDACC information resources must be secured in a manner consistent with MDACC policy.

Users accessing the MDACC network from a remote computer must adhere to all policies that apply to access from within the local campus network. Remote computers are subject to the same rules and security related requirements that apply to MDACC- owned computers.

Unattended portable computing devices must be physically secured.

If it is determined that required security related software is not installed on a remote computer or that a remote computer has a virus, is party to a cyber-attack, or in some way endangers the security of MDACC, the account and/or network connection will be disabled. Access will be re-established once the computer or device is determined to be safe by MDACC.

Users must not divulge MDACC remote access information to unauthorized individuals.

If Confidential or Restricted Confidential MDACC Data is stored on portable computing devices or removable media, it must be encrypted and backed up to a network server for recovery in the event of a disaster or loss of information.

Removable media devices should not be used for long-term storage of Confidential and/or Restricted Confidential information.

Passwords • In order to preserve the security of MDACC information resources and Data, every MDACC computer/network account, password, any personal identification number (PIN), digital certificate, security token (i.e., Smartcard), or any other similar information or device used for identification and authorization purposes, must not be shared. Each user of MDACC resources is responsible for all activities conducted using his or her account(s).

Digital certificate passwords used for digital signatures must never be divulged to anyone.

Users must not circumvent password entry through use of auto logon, application “remember password” features, embedded scripts or hard-coded passwords in client software. Exceptions may be made for specific applications (such as automated backup and single sign-on solutions) with the approval of the Information Security Department. Any exception must include a procedure to change the passwords and must adhere to security policies for password construction. (For more information, see the password guidelines in the Information Resources Security Operations Manual.)

Computer System Security

Incident Reporting

Security programs or utilities that reveal or exploit weaknesses in the security of a system or that reveal data by circumventing established authorization procedures and systems shall not be downloaded and/or used, except as authorized by the Information Security Department. For example, password cracking programs, packet sniffers, or port scanners on MDACC information resources shall not be used. Users must report any identified weaknesses in MDACC computer security and any incidents of possible misuse or violation of this agreement to an immediate supervisor, manager, department head, or the Information Security Department.

Where technically possible, all PC’s, laptops, mobile devices and workstations shall be secured with a feature that requires re- authentication after 15 minutes or less of inactivity to prevent unauthorized access to the device.

Media containing Confidential or Restricted Confidential information must be used, reallocated and disposed of in such a manner as to prevent unauthorized access to the Data.

System shall be configured to display the MDACC warning banner.

Users must report Security Incidents, or suspected Security Incidents, to the Department of Information Security at csirt@mdanderson.org or by calling 713-745-9000.

Users must report missing or stolen devices to UTPD and 4-INFO.

Users must report privacy concerns, or suspected privacy concerns, to the Institutional Compliance Office at 713-745-6636 or by calling the Privacy Hotline at 1-888-337-7497.

User Acknowledgement - Vendor

I acknowledge that I have received and read the M. D. Anderson INFORMATION RESOURCES USER RIGHTS AND RESPONSIBILITIES ACKNOWLEDGEMENT stated above. I understand that any employee of [insert vendor name] who accesses M. D. Anderson information resources must comply with this agreement, and I will inform all such employees of these requirements. I acknowledge that failure to comply may result in termination of my contract with M. D. Anderson and/or action by law enforcement authorities.

Signature of Authorized Representative:	____________________________________________ Date:	________________________________

Printed Name and Title of Authorized Representative:	Vendor ID #	Return this form to: