Policy and Action for CASE Study #2: ETSU

1. Access to Student Information (Policy4455) KAGL University 2012-2013
Policy 4455: Access to Student Information
At KAGL University, it is our mission to keep student information private while facilitating
communication between students and organizations that may benefit them. In addition to
adhering to all federal, state, and local laws governing information privacy, we plan to keep
students safe by:
1. Allowing students to choose which organizations they receive information from. The
students will have a two-week window at the beginning of each semester during which
they may opt out of communications from groups they do not wish to be affiliated with.
The only exception will be that students may not opt out of receiving communication
from areas of the university that will directly affect their enrollment status or academic
standing (i.e. - bursar, registrar, etc.)
2. Those wishing to be included on the list of possible organizations allowed to
communicate with students via university technology systems must go through a
screening process to ensure that they will not sell student information to third parties,
engage in identity theft, fraud, or negatively impact students in any other way.
3. All computers used by the university will have anti-virus software to ensure the safety of
current students.
4. Any computer used by the university will have their hard drive removed before being
discarded to ensure that information of current/former students cannot be accessed in the
future. Two informational technology technicians will be assigned to each computer
being discarded or donated to ensure that they have been fully re-imaged before going off
campus.
5. Individuals or Organizations wishing to receive donated computers from the university
will go through a screening process similar to that of other organizations wishing to gain
access to student information.
Individuals or Organizations who do not adhere to this policy will be subject to disciplinary
actions by the Informational Technology Review Board. These include but are not limited to:
1. For the first offense, disciplinary action may include a fine and probationary period
during which the individuals will be monitored. If the breach of policy is illegal in nature
or compromises the safety of the students, the organization will be reported directly to
authorities and will be denied access to student information and communication.
2. For the second offense, termination of employment for university employees is possible.
Organizations and individuals breaking this policy for the second time will instantly be
excluded from electronic access to communication with students and will be taken off the
computer donation list.