The USF Health and USF Health IS procedures are meant as a supplement to the State and University regulations and procedures. They are designed to further define and clarify those resources and systems under the control of USF Health, and, in some cases, go beyond the University's standards. USF Health procedures are to comply fully with those regulations and policies set down by the State and University.
There are several basic reoccurring principals that can be summed up as follows:
Every user and device utilizing the USF Health computing facilities must do so in a manner that maintains the integrity and well being of the entire USF Health networking environment. This includes using proper authentication and secure connectivity, properly secured workstations and servers, using proper virus protection, and restrictions on the use of programs and services in a manner that may adversely affect the network and other users.
USF Health networking and computer facilities are to be utilized for the purpose of university academic, research, and business functions. Any utilization of the USF Health computing environment not meeting this criteria is in violation of the procedures defined in this document.
USF Health Computer resources and infrastructure are maintained to support USF Health academic, research and business functions. Any use of these resources for any other purpose, or any activity that directly or indirectly inhibits this purpose, is prohibited. Anyone using USF/USF Health equipment or systems must comply with applicable USF, USF Health, state and federal regulation. Failure to will subject the violator to possible administrative, civil and criminal penalties.
Computer accounts are provided to the faculty, staff, students and designees of USF Health. Such USF Health computer accounts provide access to Email and other information resources provided by USF Health. These accounts are for use only in relevant academic research, educational pursuits, and for USF business. They are not to be used for the pursuit of personal interests or gain. They are not to be used in any attempt to gain access to information or resources other than those for which the holder is specifically designated. Only the person to whom the account is assigned may use the account for any purpose. It is the responsibility of the account holder to keep his or her account secure and access information (password, etc.) secret. It is the responsibility of the account holder to safeguard information and resources entrusted to them, and to guard against the introduction of computer viruses to the USF Health network systems by ensuring that anti-virus software is installed and up-to-date on all computers used to access the USF Health network. The USF Health Information Systems Department (USF Health IS) will, upon receipt of an account request, authorized by an official designee of one of the USF Health Colleges and/or Departmental units, create one or more computer access accounts. The individual named in the request will be granted specifically designated access privileges (so long as that individual has not had their account terminated in the past without reinstatement under the terms of this procedure.) It is the responsibility of the authorizing agent to determine the appropriateness of granting these access rights. Once granted, the account holder is expected to abide by all laws of the United States, and the State of Florida that may pertain to the use of this account. In addition, they are expected to abide by all University of South Florida policies that may pertain to the use of this account. These may be found in full at the USF General Counsel web site: http://regulationspolicies.usf.edu/
Below are several links of particular interest that should be reviewed by all USF Health computer account users:
Although not all-inclusive, following is a list of some of the most prevalent misuse issues that we have seen:
Upon detection of a breach of these regulations, policies, and procedures, one or more of the following actions will be taken, depending upon the nature of the breach:
Reinstatement of accounts and reconnection of any disconnected data lines will require specific approval from the offender's department head and the Chief Information Officer. In some cases additional review and approval may be required.
As the USF Health computer network provides services to the designated covered component (under the Health Insurance Portability and Accountability Act (HIPAA)) it is the responsibility of all USF Health computer account holders to comply with USF Health procedures and guidelines in order to comply with federal laws governing the confidentiality of Electronic Protected Health Information. Workstations and other devices attached to the USF Health network must also comply with HIPAA requirements for identification and authentication procedures. This includes "workstation security" that ensures basic levels of software patching, virus protection and restriction of known security vulnerabilities. Workstation attaching to the USF Health network may be automatically updated as necessary to insure compliance to these mandates.
USF Health IS will create one generic account per department, or authorized Center upon the Chair’s, or Center head’s request. The account must follow a format of the department’s name (i.e. Internal Medicine@health.usf.edu or Surgery@health.usf.edu, or Ctr_InnovationandTransformation@health.usf.edu.
The accounts need follow the below parameters:
Like most IT shops, USF Health IS maintains finite lists of supported software, hardware, services and platforms. We use our limited staffing and training resources to support certain “standards”, for example Dell computers, but not Sony, Gateway or Hewlett Packard’s; Microsoft Office (but not Open Office) and Microsoft Exchange (but not Lotus Notes or Novell’s Groupwise). Fortunately some technology fields have a solitary choice or only a few choices to select as standards. In these cases IS tries to support all of them.
However in some technology areas, like data cell phones, there are hundreds of choices. Here we cannot fully support all product offerings in a field, and instead use a “best effort” approach if it meets other relevant standards. For example we will attempt to network support any printer that maintains an IP address and is ethernet compatible, even though there are many hundreds of printers on the market. We offer the same support for data/cell phones:
(Personal Digital Assistants or “PDA’s” are also considered cell phones for this procedure, however most PDA manufacturers have discontinued making such a product in 2007.)
In accepting this agreement for use of USF Health computer accounts, the account holder agrees to use these accounts only for USF related academic, research, and business purposes, and to abide by all laws of the United States and the State of Florida and the procedures of the University of South Florida and USF Health as they may relate to the use of USF computer accounts.
These procedures state in general that:
USF regulations and policies may be reviewed via the USF General Council's Web page at:
Specifically, the account holder should review these USF regulations and policies:
USF Health computing procedures are published on the Information Systems web site at:
All web pages published on behalf of official USF Health and University entities fall under the control and copyrights of the University of South Florida. All official USF Health pages must comply with University and USF Health standards for "look-and-feel", operation, and content. All web pages located on state or University equipment are subject to University regulations and policies and USF Health procedures and standards.
All web pages published by and/or for USF Health and USF are subject to such rules and guidelines provided here. These rules cover the various aspects of "look-and-feel", operations, ADA compliance, content and subject guidelines, legal requirements for copyright and trademark issues, privacy and security of information, and standards of decency and subject matter.
USF Graphic Standards: http://www.usf.edu/brand
USF General Counsel Link: http://regulationspolicies.usf.edu/
The University of South Florida and USF Health are committed to the protection of Patient Information and compliance with HIPAA Security Rule regulations. The document below provides the USF & USF Health HIPAA Security Rule Standards. These standards represent the compliance directives for meeting HIPAA regulations.
This section describes the rules and procedures for attaching to and utilizing the USF Health computer network. It recognized the necessity to both manage and control the network infrastructure in order to provide a secure and reliable computing environment within USF Health.
INTRODUCTION (Purpose and Intent)
The purpose of this procedure is to define a basic set of rules that USF Health and its related departments shall establish and maintain for the management, use, and protection of the USF Health network and its devices, including workstation-clients and servers. The procedure applies to any and all network devices that are part of the USF Health computing environment.
This procedure is written as an extension of existing University Policy, specifically the following policies: policy number 0-501 "Using and Protecting Micro-computing Resources"; policy number 0-502 "Appropriate Use of Information Technology Resources"; policy number 0-508 "Information and Communications Security Program"; and 0-511 "Securing Computer Accounts for Terminating Employees". This procedure is meant solely to augment these existing campus-wide policies and not meant to replace them or be used in lieu of them.
Further, Florida Statutes, Section 282.318-1984 "Security of Data and Information Resources Technology Act" requires each head of a department to be responsible for ensuring an adequate level of security for all data information technology resources. This "Network Procedure" addresses security levels that must be implemented to meet the State Statute and to meet the Federal "Health Insurance Portability and Accountability Act" (HIPAA) on a system-wide basis, but is not intended to supplant the responsibilities of the department heads.
Finally, this procedure is to be used as an enforcement tool to meet the campus-wide "Best Practices" document that will be appended to 0-510, and 0-508, and may be amended when that final document is published. This "Best Practices" document will detail specific and technical information regarding proper usage of each Network Operating System (NOS) the University operates.
STATEMENT OF PROCEDURES
It is the Standard Procedure of the USF Health that all network devices, including both multi-user systems, classically referred to as "servers", and single-user systems, classically referred to as "clients" or "workstations" be considered assets to be protected, and as such all administration, faculty, staff and students are responsible and accountable for the systems viability and survivability. This responsibility extends to USF Health Information Systems, as in-place administrators of systems, and includes protection from internal misuse (whether intentional or unintentional) and external abuse. It is Information Technology's responsibility to be aware of known network security defects and to take actions to publicize, correct and eliminate the defects in conjunction with University Policy 0-508 and Policy 0-501. Further it is Information Systems' responsibility through administration of NOS Servers and NOS Clients to take appropriate legal, auditable control steps to protect USF Health assets and information from unauthorized, intentional or accidental disclosure, modification, destruction, denial of service or denial, or misappropriation of said assets.
Information and communication security, being the operational responsibility of the Information Security Manager and Information Security Officers, is to be ensured by following NOS-specific and email application-specific Best Practices. The Best Practices carry the weight and full authority of Policy.
The following details Network Best Practices as of 1/02:
1. Network BEST PRACTICES
E-Mail Forwarding Procedures
1) Third parties
2) Former employees
Since the creation of the USF Health Data Center in 2005, USF Health I.S. typically prohibits servers in outlying buildings, colleges, and departments. Specifically prohibited are web servers, database servers, or servers that provide outside access. In all cases, remote servers are prohibited solely for security reasons to protect the USF Health I.S. network. Specifically, HIPAA, ARRA, and other federal statutes require this prohibition.
Health IS will happily work with any college, department, center, or grant recipient on server needs. In many cases, servers are provided with financial help from USF Health I.S. In other cases, the full cost of the servers will be borne by the customer.
If a customer needs a server for new projects or services, we recommend they contact the USF Health I.S. CIO to meet and discuss.
All software on USF Health IS servers shall be installed and maintained by the USF Health IS staff in compliance with the software licensing agreements. All software changes and modifications shall be made in accordance with professional standards of testing and implementation. Software upgrades and changes occur at two levels; base system software (i.e. operating systems, database systems, programming development tools), and end user software (i.e. WordPerfect, Lotus, E-mail software, developed end user programs).
Some software may not be suitable or appropriate for the USF Health Server environment, and its purchase should be discussed in advance with USF Health IS.
Operating system software shall be upgraded and changed at the discretion of the USF Health IS staff in order to maintain current levels of compatibility and functionality.
For user provided software, a copy of the software must be supplied to USF Health IS along with proof of license. Upgrades to such software must, be scheduled by the requestor along with a copy of the upgrade files.
USF Health Information Systems will maintain the network to meet this procedure or others that are applicable. As with all procedures, exceptions may need to be made for business reasons, including temporary and permanent exceptions. The monitoring of these exceptions, and prevention of exception abuse shall further be the responsibility of the direct end-user, their department head and the USF Health IS department.
Procedure – Only content directly related to University events, promotions, activities. USF Health Computer Resources and infrastructure are maintained to support USF Health academic, research and business functions may be placed on the EVENTS system.
Guideline – Content should be appropriate to the audience that sees it as well as appropriate use of time and will be regulated by local administrator of location2.
Accounts – will be created using current account request and approval procedure using online form and authorized signer.
User agreement –
These procedures state in general that:
Ongoing Admin role – There is a formal grouping of local administrators who will meet monthly to discuss content and procedures.
Time distribution – default
1 hour total loop
Time distribution – emergency
The Scope of HSC Health IS Support
Who is considered a USF Health IS Customer?
Faculty, staff and students that have a valid USF Health network account are considered customers of USF Health IST. Having this account gives access to many services and resources within USF Health IST. Some of these services include:
• Access to phone technical support through the USF Health Help Desk.
• Access to participate in free technical training classes.
• Access to the wireless and wired network.
• Access to software downloads from the USF Health IST website.
What equipment is supported?
USF Health IS primarily supports Windows-based PC’s with Dell being the preferred vendor for purchasing computers. Support is also offered on Macintosh operating system 10.0 or greater. To read specific information on the equipment and operating systems that are supported, please refer to the hardware standards web page found here: Health Computer Standards .
Technical support requests for research-specific / specialized computer equipment is handled on an individual basis. If vendor installation and support services are available for specialized equipment, it is recommended that these services are negotiated and purchased with the equipment. Otherwise, USF Health IS will make a “best effort” attempt to install and troubleshoot specialized equipment and will dedicate a reasonable amount of time in working towards a resolution.
Is there support for Non-USF owned equipment?
Faculty, Staff, and non-mandated student personally owned computers
USF Health IS can assist faculty, staff and students with setting up on-campus wireless connectivity, Outlook email configuration, installation of Symantec Virus scan and installation of Connectra VPN software. All of these items are available for download and installation from the USF Health Downloads webpage found here: http://health.usf.edu/is/download/ . If faculty, staff or students should experience hardware difficulties with their personally owned computers, it is recommended that the equipment be taken to the vendor of purchase to resolve the issue. Hardware technical support can be obtained by contacting the USF Computer Store: (813) 974-1779.
College of Medicine Students with recommended model of Mandated Laptops
Students who have purchased the recommended Dell computer will receive the following services:
• Dell certified technicians that can expedite warranty replacement orders and provide a full range of hardware and software support.
• Access to technical support via the IS walkup window.
• Availability of loaner machines should your computer require on-site service.
Our in-house technicians are Dell Certified giving the advantage of familiar diagnostic tools, software updates, and the ability to order and install hardware in as little a time frame as next day service.
College of Medicine Students without the recommended model of Mandated Laptops
Equipment purchased that does not meet the mandate will be supported to the level of the Student Support Specialist’s discretion and will be referred to the place of purchase should there be hardware issues.
How to Request Assistance and Find Solutions
USF Health IS Knowledge base
Access to the USF Health IS knowledge base can be found on this website: Footprints Knowledge Base . At this site, a key word search function is available to find solution to questions encountered while printing, using various software packages, or attempting complete computing tasks.
Web Portal for Self-Submission
Access to self-enter a technical support assistance request is also available on this website: Submit a ticket through Footprints . Click the “Submit Requests” button and fill out the web form describing the question or issue that you have and click “submit”.
Email for Technical Assistance
Assistance can be requested by sending an email to email@example.com . The email will automatically be turned into a request ticket and the Footprints help desk software will send an email to confirm that the request has been received and entered.
Call the USF Health IS Help Desk Phone Line
To receive telephone technical support, please call 974-6288 (press option 2). A Help Desk technician will gather contact information and document the technical issue. If appropriate, the technician may verbally guide a person to the solution or use remote desktop technology to see the screen of the computer experiencing the problem and correct the issue without ever having to come to an office to address the issue.
How Requests are Prioritized
Order in which we receive requests
All technical support requests are entered into the USF Health IS request tracking software called “Footprints”. Tickets are auto-documented with the date and time that the request was made. All requests are resolved in the order in which they are received with some consideration for proximity of tickets request locations.
Nature of the technical difficulty
A high priority is give when technical difficulties occur during the course of instruction or when giving a presentation. Also, a higher priority is given when users’ computers are completely down and unusable.
Request or projects that are considered maintenance are given the lowest priority. These tasks are often completed at off-peak times to minimize time impact to higher priority tickets.
The preferred vendor for computer equipment is Dell. The USF Health IS support staff are all Dell certified which gives the support staff the advantage of familiar diagnostic tools, software updates, and the ability to order and install hardware in as little a time frame as next day. Faculty, staff and students purchasing Dell equipment can expect a higher quality of support, quicker resolution times, a reduced total cost of ownership for the life of the computer, and access to warranty replacement parts. To read specific information on the equipment and operating systems that are supported, please refer to the hardware standards web page: USF Health Hardware Standards
Equipment that is purchased from another vendor will receive software support as defined in the “Software Support” section. Should there be technical difficulties with the hardware of a non-preferred vendor; the equipment will need to be returned to the vendor or service center for assistance.
Specialized equipment for research
Technical support requests for research-specific / specialized computer equipment is handled on an individual basis. If vendor installation and support services are available for specialized equipment, it is recommended that these services are negotiated and purchased with the equipment. USF Health IS will make a “best effort” attempt to install and troubleshoot specialized equipment and will dedicate a reasonable amount of time in working towards a solution.
Smartphone / PDA
Cell phones that fully comply with “push” Exchange technology, i.e. they fully and directly support Exchange e-mail, Exchange Calendar and Exchange Contacts, without need for an intervening server or other proprietary methodology are supported. On devices that do not fully with Microsoft Exchange, like the RIM Blackberry, USF Health will provide technical advice on a “best effort” basis.
The Apple iPhone is fully supported for connecting to the USF Health Network, and conducting Microsoft Exchange Contacts, Calendar, and Email functions. The 2.0 update is required for 1st generation iPhones to connect to the USF Health IS email systems. 3rd Party software purchased for the iPhone from the Apple Store are not supported.
Standard Support Software Packages
USF Health IS primarily supports Microsoft business software with Office 2003 as the office productivity software most frequently used. Support is also offered on some Macintosh software packages. To read specific information on software that is fully supported, please refer to the software standards web page found here: USF Health Hardware Standards
Limited Support Software Packages
Technical support requests for specialized software are handled on a “best effort” basis and staff will dedicate a reasonable amount of time in working towards a solution. Often times, USF Health IS can install the software for use, but may not be able to answer specific question on operation of the software. If the software is unique to a vendor’s hardware product or is not often found on campus computers, vendor support services are recommended to be negotiated and purchased with the software.
Data stored on customer’s computers is very import to USF Health IS support staff. Formatting a computer is always done in cooperation with the customer. When a computer does need to be formatted, USF Health IS staff will:
• Work with the primary person responsible for the computer to identify the location of user data and direct the user on how to backup the data. If the customer chooses, the technician will back up the data for them.
• Provide a “Permission to Format” sheet that specifies what USF Health IS will do to the computer and what is required of the customer.
• Reinstall any appropriated licensed software. This does included department or individually purchased software as long as the media is provided and the license is legitimate.
The College of Medicine has purchased several “loaner” laptop computers with the intention of providing short-term laptop loans to College of Medicine and School of Physical Therapy students. These laptops are loaned to students when technical difficulties arise with their Dell mandate computers. Students are given a loaner computer to use when their Dell mandate computer is checked in for on-site repairs.
The purpose of this procedure is to provide guidelines to ensure the security of USF Health Web Servers. Since certain processes may be used to introduce security holes, this procedure provides some restrictions as to what functions may not be performed without permission and review of the USF Health IS department
USF Health Information Systems does not provide support for personal or departmental database access via any of the USF Health public Web Servers. This means that Web forms running on HSCPrime, HSCEducate, or other USF Health IS supported servers will not be able to connect to any personal or departmental databases.
Note: The reason for this procedure is the issues involved in regulating access to divergent databases in a Web environment. At this time there is no means to provide security for databases not under the direct control of the USF Health IS staff. USF Health IS will provide technical assistance to customers who wish to Web enable their database applications. However, the customer must provide their own Processor, Web Server, and Database software, which will remain the responsibility of the customer/department to purchase, USF Health IS will install and maintain for strategic enterprise systems.
USF Health IS performs nightly backups of the files on the servers that it administrates. These backups are for the purpose of a server recovery and can in many cases be used to restore individual files and directories. However, this does not mean that all information is backed up or can be restored, as this process is dependent on many things.
USF Health IS does not backup any user workstations. It is the users responsibility to backup any necessary files on his/her own workstation.
USF Health IS performs a nightly backup of all of the USF Health IS managed servers. The primary purpose is to maintain the ability to restore a failed server and to be able to restore user data files and directories. However, the ability to restore information to a specific time or some type of partial information will be dependent on the particular situation. Also, while permanent copies of backups are retained it may or may not comply with the states' record retention laws as there is no way for USF Health IS to determine what user information may fall into this category.
Further definition and clarification of procedure:
The USF Health Information Systems provides free computer classes to all faculty, staff and students of the USF Health. These classes offer training in the Microsoft suite of products: Access, Excel, FrontPage, PowerPoint and Word; Netscape's package: Calendar, Composer and Messenger; various multimedia tools: scanning text and graphics, digitizing audio, video and images, creating CDs and DVDs, streaming PowerPoint and video; and other topics relevant within USF Health.
USF Health Information System Training
USF Health IS classes are open and free to all faculty, staff and students of the USF Health including USFPG.
A course catalog, describing course content, and containing a schedule of classes is located on the USF Health IS web site. The locations of the classes are stated in italics. Classes will be held in MDC 1055, USF Health Library classes will be held on the 2nd floor, College of Public Health in room 1038B. Some training classes will be held at the University Professional Center in room UPC 420, Davis Island, Children's Research Center, the Bayboro Campus and the Turley Family Health Center, upon request. If you have any questions regarding location or training, feel free to call 974-6288.
This document provides recommendations, based on existing equipment used within the USF Health, for Performing Teleconferencing. The recommendations described here are for, the equipment and methods supported by the USF Health IS department.
Recommendation - Multipoint Conferencing
All stand alone IP video conferencing units maintained by USF Health IS have the capability of calling three other unique IP locations. Conferences with more than four unique locations or use ISDN may be facilitated with our video conferencing bridge. A multipoint conference can be set up on our bridge to facilitate up to five unique locations as well as bridging IP and ISDN endpoints. Our ISDN line is capable of receiving three independent incoming ISDN calls at a rate of 384k.USF Health has no outbound ISDN capabilities. The T1 used for ISDN can also be used for phone conferencing and supports up to 18 unique locations.
Recommendation - Desktop Conferencing
The Polycom PVX is the recommended desktop conferencing package. This software requires a USB webcam and pc microphone. Appropriate network settings on PC will have to be configured and can be done so after purchase upon request.
Recommendation - Distance Learning
Both the Polycom VSX models and the Tandberg Set-Top MXP series models are good choices for Distance Learning facilities. These can be combined with various software and peripheral packages (overheads and Power Point etc.) to support the lecture. Both pieces of equipment support ISDN and IP based networks.
Recommendation - Medical Consultation
Medical related teleconferencing software and hardware are reviewed on case by case basis. Please contact the Digital Media and Communication group for further assistance.
Video Conference Considerations
When planning a videoconference the conference rooms where the equipment is located must be scheduled separately. This should be coordinated with the multipoint conference when applicable.
USF Health IS provides departments with the ability to purchase additional data storage allocation for their Group (generally the G:) or Video storage drives.
This means that a department may purchase additional disk storage to meet its needs beyond the space normally allocated. The purpose of this option is to provide an inexpensive alternative to having to go out and purchase their own server just for data storage. The agreement is that Information Systems will provide additional departmental data storage based on the cost for the additional equipment in any Storage Array Network or SAN server.
This will provide increased storage allocation in the departmental Group folder based on the number of blocks purchased. The purchase of additional storage blocks will represent a permanent increase in the storage allocation. This increase will not affect the storage allocation on other drives or servers.
As of the writing of this document (9/2007), the current blocks are set at approximately 100 GB (Giga Bytes), which represents the size of the drive to be purchased, which cost $995 per 100 gig. 300 Gigabytes may be purchased at one time at a rate of $ 2.500. This cost will be billed to the department. (Prices will vary over time as hardware costs fluctuate. )
Upon purchase and installation of the disk drive(s) the department will then have ongoing rights to the amount of space purchased. The disk drive itself, will remain the property of IS and not be returnable or the money refundable once installed in the SAN.
The actual size and cost for the additional storage will be quoted at the time or (of) purchase by USF Health Information Systems. USF Health I.S. guarantees to provide alternative storage if the drive fails and to back it up nightly, and virus check all data.
USF Health I.S. further guarantees that this data will be present at the offsite disaster recovery (DR) site in Louisville, Kentucky and loaded and available in case of local disaster at the DR site.The costs are a one time purchase, no further or ongoing charges will be incurred by the department in subsequent years. In case of drive failure, USF Health IS will replace the drive at their costs.