The University of Texas Health Science Center at Houston (UTHSC-H) aspires to be the model health sciences university for the 21st century. The UTHSC-H supports innovative information technology in achieving this goal. Toward this effort, faculty, students and staff must realize that regardless of the funding source, information resources are owned by UTHSC-H and are governed by university rules, which arise from local, state, and federal regulations.
Under the provisions of the Information Resources Management Act, Section 2054.001 et. seq., Government Code, university information resources are strategic assets of the State of Texas that must be managed as valuable state resources. The UTHSC-H protects its information resources in accordance with the State of Texas Department of Information Resources' (DIR) Information Security and Risk Management Policy Standards and Guideline, published in the Texas Administrative Code (TAC) Title 1, part 10, Chapter 201, Rule 201.13(b). 1 TAC Section 201.13(b)(3)(c) states that access to state information resources must be strictly controlled.
This policy establishes the fundamental rules for all UTHSC-H information resources and their use. These policies apply to employees, students, vendors, contractors, visiting faculty, business partners, affiliate hospitals, clinics and guests. All information resources attached to the UTHSC-H network and all information resources that process UTHSC-H information fall under the authority and responsibility of the IRMs and must meet the minimum security requirements of UTHSC-H and appropriate federal and state regulations and policies. The security requirements and practices at UTHSC-H are outlined in HOOP Chapter 17.
For purposes of this policy, information and data subject to the Public Information Act 17.07 Handling Records Requests are referred to as "public information". Public information pertains to open records identified in the official UTHSC-H Records Retention Schedule approved by the Texas State Library and the State Auditor's Office.
Information Classifications:
Confidential information is information that is exempted from disclosure requirements under the provisions of the Texas Public Information Act or other applicable state or federal laws published in the Texas Administrative Code (TAC) Title 1, part 10, Chapter 201, Rule 201.13(b). 1 TAC Section 201.13(b)(3)(c). Confidential information includes, but is not limited to: some employee information (e.g., social security numbers, family members, criminal history checks, medical information, benefit elections, performance evaluations). Student information, such as test items as well as student, employee and patient medical records are confidential. Roles and responsibilities for the protection of confidential information are outlined in this policy.
Sensitive information is information maintained by state agencies that require special precautions, as determined by agency standards and risk management decisions, to assure its accuracy and integrity by utilizing integrity, verification and access controls to protect it from unauthorized modification or deletions. Roles and responsibilities for the protection of sensitive information are outlined in this policy.
Vital information is any information necessary to the resumption or continuation of state agency operations in an emergency or disaster. It is information necessary to the re-creation of the legal and financial status of the agency; or necessary to the protection and fulfillment of obligations to the people of the State as published in the State Records Management Laws, State Agency Bulletin Number Four, Current through the 75th Legislature, Regular Session, 1997. Vital records are protected in accordance with record management guidelines and can also be protected using the same guidelines as those protecting confidential and sensitive information. Roles and responsibilities for the protection of vital information are outlined in this policy.
Permanent information is identified in the record retention schedule. A permanent record possesses enduring legal, fiscal, or administrative value and must be preserved permanently by the agency. Permanent records are protected in accordance with record management guidelines and can also be protected using the same guidelines as those protecting confidential and sensitive information. Roles and responsibilities for the protection of permanent information are outlined in this policy.
Roles and Responsibilities:
Any individual or department may have multiple roles and responsibilities. For example, information technology service providers may be IT Infrastructure Owners, Stewards and Security Administrators.
The UTHSC-H president has delegated the responsibility to oversee the UTHSC-H information security and risk management program to information resource managers (IRMs).
There are two distinct Information Resource Managers at UTHSC-H who work collaboratively.
IRM Responsibilities:
IT Security Team Responsibilities:
To contact the IT Security Team contact its@uth.tmc.edu
IT Infrastructure Owners:
IT Infrastructure Owner Responsibilities:
Examples of IT Infrastructure Owners:
The office of Academic Computing and Information Services and Medical School Network Operations.
Information Owners:
Owner Responsibilities:
Examples of Owners:
The Chief Operating Officer delegates the responsibility for ensuring that the UTHSC-H is in compliance with all relevant legislation to department heads. These positions are typically one organizational level below the positions of president, executive vice president, vice president, dean, or executive director of Harris County Psychiatric Center, and rarely more than two levels below.
"Department head" applies to UTHSC-H associate and assistant deans, department chairs, module conveners, and others who serve in positions that function in the same manner as department heads, such as division chiefs and program directors, anyone with financial and administrative responsibility and accountability for their departments, such as process owners, principal investigators and directors.
Stewards of information resources:
Steward Responsibilities:
Examples of Stewards:
Stewards include such individuals as school and departmental Local Area Network managers and webmasters, the office of academic computing, information services, and system administrators network analysts, and IT support personnel for departmental systems.
Users of information resources are individuals who use the information that is processed by an automated information system.
User Responsibilities:
Examples of Users:
Employees, students, vendors, contractors, visiting faculty, business partners, affiliate hospitals, clinics, and guest users of UTHSC-H information resources and patients.
a UTSystem Policy 165 Information Resources Use and Security Policy.
Created 06/00; Updated 11/04
| HOOP Home Page | Chapter 17 Table of Contents |