Cloud Services – Appropriate Use

Get Started

Using external (cloud-based) email or other services doesn't change anything about the University appropriate use policies. In all cases – whether you use internal UW-servers, or external cloud-based services – you are responsible for complying with official UW polices, standards and guidelines. See: "Knowing the Rules".

In addition, there are some things that you may not use cloud-based services for, even if the UW has a contract with the service provider. Read on...

Important Details

What is NOT Allowed in the Cloud

In addition to the standard appropriate use rules, there are some additional restrictions for use of ANY cloud services, including UW-contracted and sanctioned services:

HIPAA – The Health Insurance Portability and Accountability Act includes strict provisions to protect the privacy of individual's health information. If you deal with HIPAA data (highly unusual for CSE members), you may not use an external provider for email, or documents that contain protected health-related data.
Export Controlled Information – If you deal with "export controlled" information, or any federally "classified information", you may not utilize any external provider for any such email or data. Check with the UW Office of Sponsored Research if you are unsure if this applies to you.

"Personal" Email

What if I forward my CSE or UW email to my personal Yahoo or Gmail.com account?

If you are an employee, don't do this. When your UW email is handled by an "approved" cloud provider they are contractually obligated to handle security, privacy, and thorny legal issues such as search warrants, litigation holds, and public disclosure requests in appropriate fashion, and in coordination with UW personnel. If you forward your UW email to your personal email account, then YOU are legally responsible for ensuring that all applicable state and federal laws, regulations and procedures are followed – and it's almost certain that they won't be, because the "End User Agreement" that you make with those providers will not have the necessary provisions. Furthermore, you would be responsible for acting on legal "eDiscovery" obligations. (Don't know what that means? Another good reason to avoid this situation!) Forwarding your email to a non-contract provider does not change the laws regarding your email, it simply places all of the the responsibility for privacy, security, and appropriate disclosure and protection, squarely on your shoulders. You surely don't want that responsibility, because you won't want to take the time to understand all the issues and requirements, and understand and mitigate all the related risks in the contract with your pesonal email provider.

Furthermore, if you are a faculty member, staff member or a TA, you must never use a private email account for sending or storing student educational records (where UW does not have an appropriate contract). This is a FERPA requirement. If you use an approved cloud provider with whom the UW has a contract that includes appropriate FERPA compliance language (currently, only Google and Microsoft), it is acceptable to use that service for FERPA-protected educational records.

Also see: "Separate Work and Personal Email and Files"

Best plan: use a "branded" and sanctioned cloud service for UW-related work, and a personal account provider for personal use.^†

Confused?

Yeah... there is plenty of room for confusion here! Cloud services are still in their relative infancy, and are continuing to evolve at a rapid pace. Many are still labeled as "beta". There are interoperability challenges. And legal compliance complications. Please bear with us as we work hard to clear up confusion. And we invite your help! Please share with us anything that seems confusing, and we will attempt to clarify our documentation and systems to make things better (you can send comments, questions and suggestions using the link at the bottom of this page). We do believe that things will get better as the products evolve and mature, and as we gain experience with them – and we appreciate your patience.

Terms of Use

You must abide by the Terms of Use for CSE Cloud Services, in order to use these services. Please understand that cloud services represent a rapidly changing landscape, and while we do not expect the Terms of Use to change frequently, they may occassionally need to be updated to reflect new information or conditions that arise. It is your responsibility to keep up (yeah, we know...). Significant changes will be announced to affected users, or broadly to the department.

^&daggerCurrently, Google and Microsoft are the only cloud service providers that meet the criteria for employee use for UW-related work, using CSE (or UW) credentials.


	Computer Science & Engineering University of Washington Box 352350 Seattle, WA 98195-2350 (206) 543-1695 voice, (206) 543-2969 FAX [comments to support]