Student Use of Technology

Last Updated by Information Technology October 2026

The Acceptable Usage Policy (AUP) establishes the standards for the responsible, ethical, and secure use of Union University’s information technology resources. It provides guidance to ensure that technology is used to support the University’s mission of Christ-centered education, reflect the institution’s Christian values, and demonstrate good stewardship of shared resources. The policy also ensures compliance with applicable legal and regulatory requirements, including Family Educational Rights and Privacy Act (FERPA), Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR), and other frameworks that safeguard personal and institutional data. By setting clear expectations, the AUP protects the confidentiality, integrity, and availability of University systems while promoting a safe, respectful, and productive environment for all members of the Union community.

I. Policy Objective

Reason for Policy

Union University’s information technology resources are critical to its academic, administrative, and operational functions. Authorized Users may have access to sensitive data, including personally identifiable information (PII), student records protected by FERPA, financial data regulated by GLBA, and proprietary institutional information. Additionally, Users share access to University systems, networks, and services that must remain secure and reliable. To protect the confidentiality, integrity, and availability of these resources, all use must comply with the standards and responsibilities outlined in this policy.

Scope of Policy and Entities Affected

This policy applies to all individuals who use Union University’s technology resources, regardless of physical location or the device used. This includes students, faculty, staff, contractors, volunteers, alumni, retirees, and guests. Any use of University systems, whether on campus or remote, is subject to this policy. Violations may result in disciplinary action, loss of access privileges, or other consequences in accordance with applicable University policies and legal requirements.

II. Definitions

Authorized User – An “Authorized User” or “User” refers to any individual who uses Union University’s information technology resources. This includes prospective and enrolled students, current and former employees, alumni, retirees, volunteers, contractors, and authorized guests. Authorized Users are responsible for ensuring that the use of University technology aligns with this policy, and are accountable for safeguarding access granted to them.

Information Technology Resources – These include all systems, services, infrastructure, and data that are owned, leased, licensed, or otherwise provided by Union University. Examples include software applications (such as learning management systems, enterprise resource systems, and email), hardware (computers, servers, printers, and mobile devices), networking services (wired and wireless networks, firewalls, and Virtual Private Networks (VPNs), audio/visual equipment, storage systems (local and cloud-based), and institutional data in any form.

User Resources – These are personally owned or non-University devices and services used by Authorized Users to access Union University technology. Examples include laptops, tablets, smartphones, external drives, gaming systems, and cloud-based services tied to personal accounts. When connected to University networks or systems, these resources are subject to University security requirements, and may be restricted if they pose risks to institutional security.

Information Technology (IT) – Refers to the University’s professional staff who are charged with the management, maintenance, and protection of Union’s information technology resources. This group is responsible for ensuring secure access, protecting institutional data, maintaining system availability, and supporting the University community in the appropriate use of technology. IT does not maintain or support personal (User-owned) devices except as explicitly allowed.

Institutional Data – Refers to all data created, collected, maintained, transmitted, or recorded by the University that is used for the conduct of University business. It includes information related to students, employees, finances, research, operations, and administration, regardless of the medium in which it resides (e.g., digital, paper, audio). Institutional data are owned by the University and are subject to institutional policies for access, security, and use.

III. Policy Content

1. Access and Privileges
   Students are granted access to Union University’s technology resources once they have submitted a completed admissions application, while employees receive access on or before their official start date. To protect the University’s systems and data, all Users are required to create strong passphrases and, where available, enable multi-factor authentication (MFA). Account credentials are personal and must never be shared with others. If a compromise is suspected, credentials must be updated immediately.Access to technology resources is terminated 180 days after a student is no longer enrolled or when an employee’s period of employment ends, following the established timelines.
2. Prohibited Uses
   Users may not use University technology resources to engage in illegal activity, harassment, discrimination, copyright infringement, unauthorized access attempts, malware distribution, system disruption, credential sharing, impersonation, deceptive communications, unauthorized commercial activity, or circumvention of University security controls. Unauthorized peer-to-peer file sharing and the use of University resources for obscene, fraudulent, or abusive content are prohibited.
3. Use of User Resources and Cloud Services
   Personal devices, such as laptops, smartphones, or tablets, may be used to access the University’s technology resources, provided minimum security standards are met. These standards include having encryption enabled, keeping operating systems and applications updated, running approved antivirus and anti-malware protection, and using automatic screen locks. Devices that do not meet these requirements may be denied access to University networks. To protect sensitive information, University data must never be stored, forwarded, or otherwise transmitted to unapproved cloud services or personal accounts — including personal email, personal cloud storage, and personal messaging or file-sharing apps. This includes forwarding University email or email attachments to a personal account, and configuring automatic forwarding rules that route University email to a personal account. Only University-approved applications and cloud platforms may be used when handling confidential or restricted information.Users may not install unauthorized software, disable security controls, or alter University-managed device configurations without approval from Information Technology. Devices determined to pose a security risk may be blocked, quarantined, or removed from University networks until remediation occurs.
4. Security Awareness and Training
   Union University places a high priority on cultivating a culture of security awareness. All employees, including student workers, are required to complete annual training that emphasizes responsible data handling and protection, with a focus on recognizing and responding to phishing attempts. Any suspicious emails or unusual activity must be reported immediately to IT. Users must also safeguard their own accounts by keeping credentials private and never sharing them, even for troubleshooting purposes.Users must promptly report suspected violations of this policy, unauthorized access, data exposure, or security incidents to IT. Users are expected to cooperate with authorized security investigations and incident response activities. The University reserves the right to monitor, review, or restrict use of its systems to ensure compliance with this policy, protect institutional data, and meet regulatory requirements. Suspected breaches, malware, or account compromises must be reported immediately.
5. Data Classification and Handling
   University data must be managed responsibly based on its level of sensitivity. Public data is approved for open release, such as published course catalogs, press releases, and public web content. Internal data is intended for general business or academic use within the University including internal memos, non-sensitive operational data, and meeting notes. Confidential data includes information protected under FERPA, as well as financial and personnel records that are restricted due to contractual, ethical, or privacy considerations. Unauthorized disclosure could adversely impact individuals or the institution, such as student academic records, employee records, and non-public financial data. Restricted data represents the most sensitive category and includes information covered by GLBA, HIPAA, and Payment Card Industry (PCI) regulations, such as social security numbers, health records, and financial account information. Unauthorized access or disclosure could cause significant harm or legal exposure.Users must handle all data in accordance with its classification and may not alter or downgrade classification without prior authorization. Users must comply with all applicable copyright, licensing, and intellectual property laws and policies. Unauthorized copying, distribution, or use of copyrighted materials, software, or media using University resources is prohibited.
6. Privacy and Monitoring
   To protect the integrity, security, and availability of its technology resources, Union University reserves the right to monitor, review, audit, or restrict the use of University systems and networks. Such oversight may occur in support of security operations, incident response, regulatory compliance, system maintenance, or investigations involving suspected policy violations or unlawful activity.While the University does not actively monitor all user content or communications, Users should not expect absolute privacy when using University-owned or University-provided technology resources. Monitoring activities will be conducted in accordance with applicable laws, institutional policies, and legitimate operational or security needs.
7. Accessibility
   Union University is committed to ensuring that its technology resources are accessible to all members of the community. All technology use must comply with the Americans with Disabilities Act (ADA), Section 508 standards, and the Web Content Accessibility Guidelines (WCAG). Users are expected to engage with technology in ways that promote inclusivity and equitable access, ensuring that no individual is excluded from participation in University life due to accessibility barriers.
8. Use of Artificial Intelligence (AI) Technologies
   Union University recognizes both the benefits and risks of artificial intelligence (AI), including generative AI tools. To ensure these technologies are used in ways that reflect the University’s mission and Christian values, all use must be responsible, ethical, and transparent.University data may be entered into, processed by, or otherwise shared with an AI platform only when accessed through a University-issued or University-managed account (e.g., an enterprise or institutional subscription) and used in accordance with any applicable University restrictions. A current list of University-approved AI platforms is maintained by Information Technology. Personal or unapproved tools must never be used with confidential or restricted information, such as FERPA-protected records, GLBA-regulated data, or PII.In academic settings, AI use must follow the University’s academic integrity policies and instructor guidelines. Unauthorized use may be considered plagiarism or cheating. When AI contributes to academic, research, or administrative work, its use must be disclosed in accordance with any applicable academic integrity policy, course syllabus, publication or funding requirement, or supervisor instructions.AI must never be used to impersonate University officials, forge communications, or create content that is harassing, discriminatory, obscene, or fraudulent. AI-generated output must be reviewed by a human before being relied upon for academic, administrative, legal, or operational purposes. Users may not use AI tools to create deceptive synthetic media, impersonate individuals, or misrepresent institutional communications.The University reserves the right to monitor and restrict AI usage, and violations may result in disciplinary action under this policy and other applicable handbooks.
9. Enforcement and Disciplinary Action
   Violations of this policy may result in suspension of access privileges, disciplinary action under applicable University handbooks, termination of employment, expulsion, civil liability, and/or criminal prosecution.

IV. Exceptions

Exceptions must be approved in writing by the Associate VP for IT.

Reference Materials

• FERPA (Family Educational Rights and Privacy Act)
• GLBA (Gramm-Leach-Bliley Act)
• HIPAA (Health Insurance Portability and Accountability Act)
• GDPR (General Data Protection Regulation)
• Union University Copyright & Intellectual Property Policy
• Union University Security Program Policy
• Union University AI Policy (in draft)