email

Report as inappropriate Your report has been received

Shared by: NiceTime

Tags

free email, Outlook Express, mobile phone, Electronic Mail, instant messaging, how to, virus protection, e-mail address, e-mail system, email services

Stats

views:: 1511
posted:: 5/22/2010
language:: English
pages:: 12

Public Domain

Document Sample

University Health Network
Policy & Procedure Manual
Administrative – E-mail Usage

Policy
E-mail is a critical administrative and clinical communications tool for use within the
University Health Network (UHN) environment, and between UHN users and the
external community, subject to specific conditions outlined in this policy.

UHN ensures that the e-mail system is used securely and appropriately in compliance
with the Personal Health Information Protection Act (PHIPA), 2004 and UHN policy.

As the owner of the e-mail system, UHN reserves the right to audit and monitor e-mail
usage and content, subject to specific conditions outlined in this policy.

E-mail messages are not encrypted on the UHN e-mail system, therefore, UHN cannot
guarantee the confidentiality and security of messages users send to or receive from
others, except where a secure link has been created (see Secure E-mail Use).

A violation of this policy may result in the suspension or permanent disabling of an e-
mail user’s account. More serious breaches may result in disciplinary action up to and
including termination of employment and/or affiliation with UHN.

Definitions
Internal Use –Use of UHN e-mail services to send or receive messages to other users
using the organization’s e-mail systems. Typically, if the user is using such a system he
or she is listed in the Global Address List (GAL). The GAL includes UHN employees,
medical staff, students, residents, researchers, volunteers, contract personnel,
temporary or part-time workers, or authorized agents who have been given access to
UHN e-mail services. Internal e-mail users are contained within the UHN firewall,
although users should know that the contents of their e-mail messages are not
encrypted.

Secure E-mail Use – Use of UHN e-mail services to send or receive messages to users
where a secure link (as designated by UHN) has been established. These users are
identified in the White Pages directory.

External Use – Use of UHN e-mail services to send or receive messages to users
outside of the organization’s internal and secure e-mail systems (e.g., hospitals and
organizations not listed in the UHN GAL).

This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material
by any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.20.010 Original Date 12/99
Section General Administration Revision Date(s) 04/02; 02/03; 09/03; 01/05
Issued By Shared Information Management Services; Review Date
Public Affairs & Communications
Approved By Senior Operations Committee Page 1 of 12
Personal Health Information – Information about an individual whether living or
deceased and whether in oral or recorded form. It is information that can identify an
individual and that relates to matters such as the individuals physical or mental health,
the provision of health care to the individual, payments or eligibility for health care in
respect of the individual, the donation by the individual of a body part or bodily
substance, and the individuals health number. (Personal Health Information Protection
Act, 2004)

• Personal health information can be information about a physician or other care
provider, a hospital staff person, a patient, or a patient’s family member.
Examples of personal health information include a name, medical record
number, health insurance number, address, telephone number, and personal
health information related to a patient’s care such as blood type, X-rays,
consultation notes, etc.

Scope of Application

1. This policy applies to all users of UHN’s e-mail systems.

2. This policy contains rules that apply to both the internal and external use of e-mail.

3. This policy applies to the use of e-mail services within the UHN environment, as
well as the use of UHN e-mail services through remote access and Outlook Web
Access (OWA). For policies guiding the appropriate use of other forms of
correspondence or technology see Faxing Confidential Information policy 1.40.008
and/or Appropriate Use of Technology policy 1.20.014.

General Rules and Procedures for Appropriate Usage of E-mail
Personal Health Information in E-mail Messages

Internal and Secure E-mail Use

1. Highly sensitive or personal health information can only be sent internally and to
secure e-mail users where the recipient has a need to know the information and
only to support the purposes for which it was collected.

2. Information should be retained in an e-mail user’s account for as long as is
necessary to fulfill those purposes.

3. Users should appropriately safeguard their e-mail boxes where possible by logging
out of it or locking their screen with a password protected screen saver.

4. Internal users are contained within the UHN firewall; however, the contents of their
e-mail messages are not encrypted.

6. Double-check all "To" fields prior to sending messages to avoid sending e-mail to
the wrong recipient.

7. Limit and, where possible, avoid including personal health information in the subject
line of e-mail and in e-mail sent to group distribution lists.

8. Senior leaders, directors or assigned representatives can only send All-Users e-
mail messages. Staff without access to the all-users function will receive an
undeliverable message. At no time should personal health information be
contained in a mass communication. (See All-Users E-mail.)

External Use

It is strictly prohibited to send e-mail messages containing personal health information
that identifies a patient to an external e-mail account (e.g., a user not on the Global
Address List) unless one of the following two conditions are met:

1. A patient has consented to communicating with the user by e-mail. (See Sending
and Receiving E-mail from Patients.)

2. The e-mail is required for a one-time, emergency health purpose between care
providers. In such cases, the sender must follow-up using alternative
communication methods, such as phone or fax, to ensure the information reached
the intended recipient and is being handled with appropriate care.

3. Users may send e-mail messages to external users containing anonymous
patient information – e.g., aggregate data or data with no personal identifiers –
without patient consent to support the purposes for which it was collected.

• All messages to external users must contain the following disclaimer, which is
attached automatically to all e-mail messages sent from UHN to external e-
mail addresses:

“This e-mail may contain confidential and/or privileged information for the sole
use of the intended recipient. Any review or distribution by anyone other than
the person for whom it was originally intended is strictly prohibited. If you
have received this e-mail in error, please contact the sender and delete all
copies. Opinions, conclusions or other information contained in this e-mail
may not be that of the organization.”

• Double-check all "To" fields prior to sending messages to avoid sending an e-
mail to the wrong recipient.

Forwarding

Forwarding e-mail is subject to the same internal and external use guidelines.

1. E-mail can be forwarded internally to those who need to know the information and
only to support the purposes for which it was collected.

2. Check the content of the e-mail you are forwarding to be sure it is appropriate to
send internally.

3. E-mail can be auto-forwarded to an internal e-mail account during short leaves or
employee absences in order to support hospital business activities when the user
can reasonably expect that the recipient will not receive any personal health
information they should not be privy to.

4. It is strictly prohibited to auto-forward from an internal e-mail account to an
external e-mail account since users cannot control whether highly sensitive or
personal health information is being sent to the external e-mail account.

5. Users must remove all personal health information that identifies a patient when
forwarding e-mail externally.

Delegate User of an E-mail Account

Users may share their e-mail account in order to conduct Hospital business when no
other practical alternative exists. They may do this by appointing a delegate when the
delegate is privilege to the same information as the e-mail account owner.

1. Delegates must be set up through the Customer Care Centre or Research
Information Systems.

2. Delegates must identify themselves in all e-mails sent from the shared account.
They can do this by using the “Sent on Behalf of” option of their e-mail program or
electronically signing the e-mail with their name and contact information.

3. Care providers must include the delegate’s name in the Patient Consent for E-mail
Communications (form D-2019M) to communicate with a patient using a shared e-
mail account.

4. If the delegate(s) change, it is the responsibility of the e-mail owner to inform the
Patient immediately.

Sending and Receiving E-mail from Patients

Authorized UHN care providers or their designate may communicate with patients
through e-mail to support that patient’s care at UHN if the following conditions are met:

1. Care providers wishing to use e-mail to communicate with patients should identify
in writing the types of transactions (e.g., prescription refill, appointment scheduling)
and sensitivity of subject matter (e.g., HIV, mental health) permitted over e-mail.
[See UHN E-mail Guidelines for Patients (form D-3223).]

2. Care providers must obtain Patient Consent for E-mail Communications (form D-
2019M) from individual patients to communicate with a patient by e-mail. Care
providers must identify all designates and/or custodians who will be able to access
patient e-mails. Consent can be obtained either in person at the time of a patient’s
appointment, or consent can be obtained through e-mail if the patient expresses his
or her consent in a return e-mail from his or her care provider that includes the
disclaimer below. Where consent is obtained by e-mail, a signed copy of the
Patient Consent for E-mail Communications (form D-2019M) should be obtained at
the next reasonable opportunity.

“Dear Patient: I [insert care provider’s name and/or designate and designation] am
pleased to communicate with you through e-mail. However, you should know that
e-mail messages are not encrypted on the hospital e-mail system, and, therefore,
the hospital cannot guarantee the security of messages that you send to or receive
from your care provider. For this reason, e-mail should not be used to
communicate certain sensitive types of information, such as mental health
information, HIV/AIDS information or pregnancy test results. You may also have
other types of information that you would prefer not to discuss in your e-mail
messages, which you should inform your care provider about.

You should also not use e-mail to communicate emergency or urgent health
matters since e-mail messages can be delayed for technical reasons beyond the
control of your care provider. By replying to this message, you acknowledge that
you have read and agree with these terms. If you have questions about e-mail
communications with care providers at the University Health Network, please
contact your care provider for a copy of the UHN E-mail Guidelines for Patients.”

3. Once patient consent has been obtained for e-mail communications, care providers
or their designate must respect the following UHN e-mail processes:

• Document clinical content of e-mail message as clinical notes within the
patient’s chart.

This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material
by any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.20.010 Original Date 12/99
Section General Administration Revision Date(s) 04/02; 02/03; 09/03; 01/05
Issued By Shared Information Management Services; Review Date
Public Affairs & Communications
Approved By Senior Operations Committee Page 5 of 12
• Periodically remind patients that e-mail messages are considered personal
health information, and that decision about their treatment or care may be
made on the basis of information contained in e-mail messages. (This is
similar to how decisions about a patient’s treatment or care are made on the
basis of other personal health information about the patient such as his or her
lab results or x-rays.)

• Maintain a mailing list of patients, but never send group mailings (e.g. when
communicating information about an educational seminar) where recipients
are visible to each other. Use the blind copy feature in e-mail software to
avoid displaying recipients’ addresses.

• Instruct patients to put the category of transaction in the subject line of their e-
mail message, e.g., prescription, appointment, medical advice or billing
question.

Personal Use of E-mail

Users may use the UHN e-mail system for incidental or occasional personal use
provided the following conditions are met:

1. Personal communications must be carried out on the user’s own time and must not
interfere with his or her job responsibilities.

2. Personal communications must not interfere with the operation of the UHN e-mail
system.

3. Personal use of the e-mail system is subject to all other rules set out in this policy.
For example, personal e-mail messages must not contain material that may create
a hostile work environment. (See Prohibited Content in E-mail Messages.)

4. E-mail users are advised to keep their personal messages in a separate folder
apart from work-related e-mails, and to clearly mark the folder as “Personal”. This
will help distinguish work-related e-mails from personal e-mails in the event that a
user’s manager or supervisor needs to access a user’s e-mail account. (See
Manager/Supervisor Access to an Employee’s E-mail.)

User Access to E-mail Messages Related to a Change in Job Status

1. When a user changes job status (i.e., leaves UHN or changes positions at UHN):

• A user will have the right to access e-mail messages, including messages in
his or her personal folder, upon the discretion of the user’s manager or
supervisor.

This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material
by any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.20.010 Original Date 12/99
Section General Administration Revision Date(s) 04/02; 02/03; 09/03; 01/05
Issued By Shared Information Management Services; Review Date
Public Affairs & Communications
Approved By Senior Operations Committee Page 6 of 12
• It is the responsibility of the user to reasonably notify his/her colleagues that
his/her e-mail will be deactivated or his/her job responsibilities have changed.
A user may provide notification personally, through e-mail, or by adding
his/her job change information to his/her electronic signature. For help setting
up this feature, contact the Customer Care Center (ext. 4357).

2. When a user changes job status, a manager or supervisor may choose:

• To provide the user with online access to his or her personal folder and other
e-mail messages (e.g., the user would have the capability to send, receive,
save and print e-mail messages).

• To provide the user with offline access to his or her personal folder and other
e-mail messages (e.g., the user would have the capability to save and print e-
mail messages but not to send and receive messages).

• To not provide the user with access to his or her e-mail messages, including
the contents of the user’s personal folder.

Prohibited Content in E-mail Messages

UHN is committed to creating a positive working environment that is respectful of the
diversity of its workforce. As such, e-mail is not to be used for the creation or distribution
of the following:

1. Messages that contain offensive comments about age, race, religion, creed,
gender, sexual orientation, political beliefs, national origin, language, or disability.

2. Messages of solicitation or for commercial purposes that have not been sanctioned
by UHN, i.e., the e-mail system is not to be used for the running of a personal
business.

3. Messages that promote or criticize religious or political causes, i.e., it is not
permitted to recruit individuals for a religious or political cause using e-mail.

4. Chain messages that encourage the receiver to forward the message on to others.
Chain messages can have a negative impact on system resources and create a
disruptive work environment, e.g., messages that involve lost children or messages
that claim to offer monetary rewards for the continued distribution of the message.

5. Messages of a malicious or threatening nature.

6. Messages that violate provincial or federal laws, professional codes of ethics or
standards.

This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material
by any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.20.010 Original Date 12/99
Section General Administration Revision Date(s) 04/02; 02/03; 09/03; 01/05
Issued By Shared Information Management Services; Review Date
Public Affairs & Communications
Approved By Senior Operations Committee Page 7 of 12
7. Messages involving the impersonation of another e-mail user. It is not permissible
to misrepresent yourself as the author of an e-mail. When sending a message that
is authored by someone else, be sure to clearly indicate that the message is “Sent
on behalf of the author’s name”.

8. Messages in which the original content has been altered without the original
author’s approval. Content can only be modified with the knowledge and approval
of the original author.

Manager/Supervisor Access to an Employee’s E-mail

1. A manager or supervisor may be given short-term access to an employee’s e-mail
account in order to support hospital business activities in an employee’s absence,
to investigate suspected misconduct or to support a legal investigation.

2. A manager or supervisor will not access an employee’s personal folder unless it is
required to support hospital business, he or she is required to do so by law, or if he
or she has reasonable cause to suspect that the employee has violated any UHN
policies or codes of conduct.

3. Where possible, a manager or supervisor will obtain consent to access an
employee’s e-mail account.

4. A manager or supervisor can request access by sending a Network Access
Request form to the Customer Care Centre. Researchers must contact Research
Information Systems.

5. All requests for access to an employee’s e-mail account must be approved by the
Privacy Manager at 14-6937 or privacy@uhn.on.ca.

6. A manager or supervisor is strictly prohibited from requesting credential identifiers
such as logins or passwords to access employee e-mail accounts.

Outlook Web Access (OWA) and Remote Access

1. Users who need to access their mailbox can do so from any location by using
OWA. To access your e-mail account from anywhere via the Internet, enter the
address https://webmail.uhn.on.ca into your web browser. You will then be
prompted for your ID and password before being able to access your mailbox.

2. Attachments viewed from OWA are downloaded to the computer you are using to
access your OWA e-mail. For this reason, attachments containing personal health
or confidential corporate information should where possible not be accessed
remotely or be deleted from the computer when you have finished using them.

4. The use of OWA and remote dial-in or Virtual Private Network (VPN) access to e-
mail services is subject to the same rules as the use of e-mail services within the
UHN environment.

5. For further information about appropriate use of Remote Access resources consult
the UHN Remote Access policy 1.20.016).

Distribution List Messages

The UHN GAL has a number of distribution lists that allow users to send e-mails to a
group of people by entering a single e-mail address, e.g., “All Users”. Distribution-list
messages must be of significant importance and clearly relevant to all the users in
the list.

All-Users E-mail

Access to the All Users e-mail list on the GAL is limited to senior leaders, directors and
assigned representatives. All other staff and physicians attempting to send All Users-
UHN, All-Users-TGH & UHN Corporate, All Users-TWH, and All Users-PMH will
receive”message undeliverable” e-mail in their inboxes.

In addition, users attempting to “Reply All” to All-Users e-mail will receive”message
undeliverable” e-mail in their inboxes. Only the sender of the original All Users message
will receive the response.

1. The All-Users address lists cannot be used for individual announcements such as
vacation alerts or office relocations.

2. The following list of criteria outlines the appropriate uses of “All Users” distribution
lists to communicate corporate and site-specific initiatives which reflect legitimate
business purposes:

• To announce new and/or revised policies.

• To announce significant changes in staffing, services or processes.

3. To support the appropriate use of “All Users” communications:

• Staff who would like to distribute All Users e-mail must forward it for approval
to Public Affairs, a senior leader, or a director who has access to the function.
If the message does not meet the criteria, the respective Public Affairs
corporate/site specialist should be contacted for advice concerning other
effective modes of communication.
This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material
by any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.20.010 Original Date 12/99
Section General Administration Revision Date(s) 04/02; 02/03; 09/03; 01/05
Issued By Shared Information Management Services; Review Date
Public Affairs & Communications
Approved By Senior Operations Committee Page 9 of 12
• Choose a meaningful Subject Header to inform users of the nature of the
communication.

• File attachments including urgent information may be attached in the body of
the e-mail with proper approvals. Non-urgent attachments should be delayed
for distribution until after 5:00 p.m. using Message Options. To do so:

a. click on View on the menu bar
b. select Options
c. select Delivery Options
d. select Do Not Deliver Before and select the appropriate date. The e-mail
will be sent automatically at that time.

• Staff with messages deemed unsuitable for All Users distribution can also post
their notices on the UHN Message Board.

The UHN Message Board

The UHN Message Board was launched in March 2003 and is located on the home page
of the Corporate Intranet under “UHN Community”.

The purpose of the Message Board is to provide staff with an alternative to unsuitable All
User e-mails and to provide a convenient one-stop shopping location where employees
can post broad-based messages and classified advertisements (e.g. furniture for sale,
lost jewelry).

• For assistance and more information, contact Public Affairs at (416) 340-4636.

Management of E-mail Messages

1. E-mail users are responsible for maintaining and filing current e-mail messages and
for deleting old e-mail messages from their mailboxes.

2. Delete e-mail as soon as they are no longer needed in order to help ensure the
maximum integrity and performance of the e-mail system.

3. If a mailbox approaches maximum capacity, the mailbox owner will be sent a
warning and the mailbox may be partially disabled. The user’s mailbox will become
fully functional once a sufficient number of e-mail messages have been deleted.

4. Avoid using the Inbox as a storage area for e-mail. Use the Inbox to hold
messages that require prompt action or attention. Archive all other messages.

5. Compress or zip large files before sending them through the e-mail system as
attachments.

• UHN provides a delivery service (File Portal) that allows users to transfer large
files via the Internet.

• The File Portal is located on the Corporate Intranet Homepage
(http://intranet.uhn.ca/).

6. For more information about the management of e-mail, refer to the SIMS Customer
Services Intranet site (http://uhn/departments/sims/customer_service/index.asp)
under the heading “Outlook E-mail”. Researchers can find this information on the
Research Information Systems Intranet site (http://intranet.uhnres.utoronto.ca/).

Secure E-mail Practices

Users are responsible for the security of their mailboxes and must take reasonable
measures to guard against unauthorized access.

1. Choose strong passwords. (Use a combination of letters and numbers or other
characters.)

2. Do not share passwords.

3. Do not post, display or make easily available information on passwords.

4. Log off when not using the e-mail system.

5. Double check all “To” fields before sending the e-mail.

6. Report viruses to the Customer Care Centre immediately (extension 4357).
Researchers should report viruses to Research Information Systems.

E-mail Support

1. Contact the Customer Care Centre (ext. 4357) to:

• Report suspected e-mail viruses.

• Request e-mail account setups.

• Request other administrative services.

2. Contact the Privacy Manager (ext. 14-6937) for questions on Manager/Supervisor
Access to employee e-mail or for the use of personal health information in
messages.
This material has been prepared solely for use at University Health Network (UHN). UHN accepts no responsibility for use of this material
by any person or organization not associated with UHN. No part of this document may be reproduced in any form for publication without
permission of UHN. A printed copy of this document may not reflect the current, electronic version on the UHN Intranet.
Policy Number 1.20.010 Original Date 12/99
Section General Administration Revision Date(s) 04/02; 02/03; 09/03; 01/05
Issued By Shared Information Management Services; Review Date
Public Affairs & Communications
Approved By Senior Operations Committee Page 11 of 12
3. Contact your Human Resources Advisor regarding harassment, abuse or
disciplinary issues relating to the use of e-mail.

4. Contact your Public Affairs and Communications site specialist for advice on the
appropriate use of e-mail sent to Distribution Lists.

5. Researchers should contact Research Information Systems to report suspected e-
mail viruses, request e-mail account setups or other administrative services.

E-mail Monitoring/Audits

UHN has the right to monitor and/or intercept e-mail messages without prior notice for
security reasons, to support ongoing operations, maintenance and upgrades to the e-
mail system, and to support investigative activities related to inappropriate conduct or
legal issues.

• For questions about e-mail monitoring/audits, contact the Privacy Manager at
14-6937 or mailto:privacy@uhn.on.ca.