Student Email Policy

1. Purpose: University email services are provided to support the academic, business and research missions of the university. All emails processed by the university information technology systems and networks are considered to be the property of the university.
2. Responsibility: Email users are responsible for avoiding practices that could compromise information security. This includes (but is not be limited to) preventing unauthorized access to email accounts by properly protecting login credentials, not storing passwords on public-access systems and proper use of encryption services for sending private data.
3. Email as Official Communication: Email is an official means of communication within the university. Therefore, the university has the right to send communications to students, faculty and staff via email, and the right to expect that those communications will be received and read in a timely fashion.
4. Expectations: Students, faculty, and staff are expected to check their official email address on a frequent and consistent basis in order to stay current with university communications. Students, faculty, and staff have the responsibility to recognize that certain communications may be time critical. University e-mail is provided to support University activities and excessive personal use should be avoided.
5. Encryption: Data that is classified as Private (as defined in the CU System Policy Glossary, see references, below) must be encrypted when being sent to recipients outside of the university and its affiliates’ networks (i.e. when sent across the Internet or other public networks.). Such emails must be encrypted through an IT Services-managed encryption system.
6. Out of Office Messages: Do not unnecessarily disclose potentially sensitive information in “out of office” or “automated reply” messages (reference Email Security Guidelines, below).
7. Privacy: IT Services reserves the right to scan email traffic for malicious software, spam and unencrypted private or restricted information. While the university encourages the use of electronic mail and respects the privacy of users, all emails traversing university computing systems and networks are subject to automated scanning and monitoring. Emails may also be quarantined and/or reviewed by authorized university employees.
8. Interception/Modification: Except when specifically authorized by university management or where necessary for IT system administration purposes, employees must not intercept, divert, modify, or destroy another person’s email communications or messages.
9. Personal Use of University Email Accounts: University email services may be used for incidental personal purposes provided that such use does not: (i) directly or indirectly interfere with the operation of computing facilities or electronic mail services; (ii) burden the university email system with noticeable incremental cost; or (iii) interfere with the email user’s employment or other obligations to the university. Email messages arising from such personal use are also considered to be the property of the university with no expectation of privacy. Email users should assess the implications of this presumption in their decision to use university electronic mail services for personal purposes.
10. Personal Email Accounts: Use appropriate discretion when using Gmail, Hotmail, Yahoo or any similar external/third-party email services for university business or academic purposes. Do not forward or auto-forward university email that may contain private or restricted data (e.g. PHI, SSNs, or FERPA-protected data) to external/third party email systems or store such email data on insecure mobile devices.
11. Distribution lists and Listservs: Exchange/Outlook email distribution lists should ONLY be used for email communications being sent to less than 150 recipients. Larger volumes of messages should be processed through IT Services managed listservs or other IT Services- approved email tools. IT Services provides free listserv services for faculty & staff.
12. Campus-wide Distribution: Only the Chancellor, the President, or their designee may send email communications to the entirety of the university. This includes faculty and/or staff and/or student populations.
13. Restrictions: Do NOT use email:
    1. To create, send, forward or store emails with messages or attachments that are illegal or violate any other campus or University policy.
    2. To commit the university to a third party, for example through purchase or sales contracts, job offers or price quotations, unless you are explicitly authorized by management to do so (principally applies to staff within the Procurement Service Center and Human Resources).
    3. In ways that could be interpreted as representing or being statements on behalf of the university, unless you are a spokesperson explicitly authorized by university management to make such statements.
    4. To send a message from anyone else’s email account or in their name (including the use of false or spoofed ‘From:’ addresses). If authorized by their manager, administrative assistant or other office personnel may send email on the manager’s behalf but should sign such email in their own name per procuration (‘for and on behalf of’) the manager. 

Campus Administrative Policy 5011: Email