Mobile Communication Devices Policy

The University at Buffalo (UB, university) recognizes that the performance of certain job responsibilities may be facilitated by the use of various mobile communication devices. The university will accommodate employees with a valid business need for mobile communication devices and related services by issuing a department-owned mobile communication device or providing an allowance to offset the cost of a personally-owned mobile communication device (device acquisition and monthly service). This technology must be used for the benefit of the university in the performance of university business.

To be eligible for consideration of a department-owned mobile communication device or an allowance, the employee must have a valid business need for required or essential business communication resulting from:

• The need to be readily accessible
  
• The need to receive or initiate communication in emergency or time sensitive situations
• Safety requirements while traveling on the road or to off-campus locations
• Frequent and regular travel, with a travel plan as part of job responsibilities
• Work locations in the field where access to electronic and telecommunication devices is not readily available.

With approval of the appropriate dean, vice president, or their designee, employees may receive a department-owned mobile communication device or allowance to offset the cost of a personally-owned mobile communication device and related services. This determination must be reviewed annually and revised when necessary.

Departments determine the appropriate communication device and service plan for each employee based on business need. Departments retain ownership, maintain inventory controls over the device, and administer the service plan. Approval for a mobile communication device and related services is subject to valid business need and budget considerations.

Employees are expected to conduct university business on devices purchased and maintained by departments. Minimal personal use of a department-owned device is permitted. These devices are the property of the department and must be returned to the university if changes in responsibility no longer require the employee to have a device or upon the employee’s departure or termination from the unit.

An employee who has been issued a department-owned mobile communication device is not eligible for an allowance for a personally-owned mobile communication device.

Departments may provide an allowance to offset the cost of a personally-owned mobile communication device and related services to an employee with a valid business need. The allowance is an amount toward a portion of the mobile communication device needed for business and will be paid through the University at Buffalo Foundation (UBF) payroll process. This method of payment eliminates the administrative burden of retaining monthly statements to distinguish business from personal use.

The allowance for each employee should be established by the department based on the portion of mobile communication device service needed for business and department budget considerations.

Departmental or unit policy for an allowance to offset the cost of a personally-owned mobile communication device and related services used for university business may be more, but not less, restrictive than university policy. A department or unit may provide an allowance or terminate an allowance based on business requirements or budget considerations. 

Employees may request reimbursement for the occasional business use of personally-owned mobile technology and related services if they do not receive an allowance. Occasional business use may be a single event (e.g., international business trip) or occur over a limited time period (e.g., semester project) and includes voice and/or data that results in additional costs that are above and beyond the employee’s usual calling plan (i.e., excess minutes, roaming charges, international calling plan).

Generally, reimbursement for mobile communication devices and related services may not be charged to sponsored accounts. In instances where a Principal Investigator (PI) or project has obtained budgetary and sponsor approval to charge mobile communication devices and related services to a grant, the PI or other research personnel should submit an eRequisition to establish a separate contract with the service provider.

There may be additional restrictions on the use of sponsored funds to pay for mobile communication devices and related services. Contact your grant administrator for information.

The university does not provide reimbursement for internet connectivity from home; the employee is responsible for all costs related to this service.

The university standard for securing devices and information includes both university and personally-owned mobile communication devices. This is especially important for employees who receive or use Category 1 - Restricted Data or Category 2 - Private Data as defined in the Data Risk Classification Policy. Employees must safeguard mobile communication devices and protect the data stored on the devices. Category 1 - Restricted Data or Category 2 - Private Data may not be copied to or stored on mobile devices. While these devices can be used to view university business data, including Category 1 - Restricted Data and Category 2- Private Data, employees must not download this data to the device. Mobile communication devices that are used to access Category 1- Restricted Data and Category 2 - Private Data must use encryption to protect the data.

Pursuant to law and State University of New York (SUNY) policy, whenever the university reasonably anticipates that litigation legal proceeding (e.g., lawsuit, audit, investigation, Freedom of Information Law (FOIL) request) has been or will be commenced, it must take actions to preserve all electronically stored information that may be relevant. This requires the university to suspend the deletion, overriding, or other destruction or alteration of electronic information relevant to the proceeding. This preservation obligation includes all forms of electronic communications (e.g., email, word processing, calendars, text messages, voice messages, videos, photographs) wherever stored, including on a mobile communication device. This electronic information must be preserved so that it can be retrieved at a later time in connection with the legal proceeding. Mobile communication devices used to conduct university business, whether owned by the university or the individual, are subject to these preservation requirements and employees using such devices to conduct university business must comply with preservation and production notices.

Under New York State law, an individual cannot use a hand-held mobile telephone or portable electronic device to talk, text, or email while driving. If a portable electronic device is used while driving (except to call 911 or to contact medical, fire, or police personnel about an emergency), the driver can receive a traffic ticket and be subject to a fine, surcharge, and point assessment. Fines are the responsibility of the employee and will not be reimbursed by the university.

Use of a mobile communication device while operating a motor vehicle is strongly discouraged, even when a hands-free accessory is available. If it is absolutely necessary to use the device, university employees driving a motorized vehicle should:

• Be familiar with the mobile device and its features
• Position the mobile device so that it is within reach
• Let the person with whom the driver is speaking know that a vehicle is being driven
• Suspend the call in heavy traffic or hazardous conditions
• Refrain from taking notes or searching for information while driving
• Drive sensibly and periodically assess the traffic
• Place calls only when not moving or before pulling into traffic.

University employees driving during the course of duty, regardless of vehicle ownership, are required to comply with all local and state driving regulations, in any jurisdiction in which they are driving.

The university provides essential, business-related tools for faculty and staff in a manner that promotes the proper stewardship of assets and is in accordance with a framework for consistent decision-making. While recognizing that properly used mobile communication devices facilitate university business, the university must manage the costs, risks, and administrative burden associated with such use.

The policy applies to all university employees and state, Research Foundation, University at Buffalo Foundation, and Faculty Student Association funds.

Category 1 – Restricted Data

Protection of the data is required by law or regulation. The loss of confidentiality, integrity, or availability of the data or system could have a significant adverse impact on our mission, safety, finances, or reputation.

Restricted data includes the definition of private information in the New York State (NYS) Security and Breach Notification Act as a foundation: bank account, credit card, and debit card numbers; social security numbers; state-issued driver license numbers; and state-issued non-driver identification numbers. To this list, university policy adds protected health information (PHI), computer passwords, other computer access protection data, and passport numbers.

Category 1 – Restricted Data are exempt from disclosure or release under the NYS Freedom of Information Law (FOIL). The NYS Information Security Breach and Notification Act requires the university to disclose any breach of the data to New York residents. (State entities must also notify non-residents; see the NYS Information Security Policy.)

Individuals who access, process, store, or in any other way handle Category 1 – Restricted Data must implement controls and security measures as required by relevant laws, regulations, and university policy. In instances where laws and/or regulations conflict with university policy, the more restrictive policy, law, or regulation governs.

Category 2 – Private Data

Includes university data not identified as Category 1 – Restricted Data, and data protected by state and federal regulations. This includes Family Educational Rights and Privacy Act (FERPA)-protected student records and electronic records that are specifically exempt from disclosure by the NYS FOIL.

Category 2 – Private Data must be protected to ensure that they are not disclosed in a FOIL request. Private data must be protected in order to ensure that they are only disclosed as required by law, including FOIL. Decisions about disclosure must be made by the Records Management Officer.

The National Institute Standards and Technology (NIST) Special Publication 800-171 Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations maps to the Category 2 – Private Data risk classification.

Mobile Communication Device

Collective term used to describe various types of devices including, but not limited to:  cellular and satellite phones, smart phones, personal digital assistants (PDA’s), tablets, pagers, and other similar devices that facilitate voice and data communications.

Valid Business Need

The need to be readily accessible for contact with the public or with university faculty, staff, or students, coupled with the impracticality of a regular land-line telephone for required or essential business communication needs due to one of the following:

•  The need to be readily accessible

•  The need to receive or initiate communication in an emergency or time sensitive situations

•  Safety requirements while traveling on the road or in off-campus locations

•  Frequent and regular travel, with a travel plan as part of job responsibilities

•  Work locations in the field or at a job site where access to electronic and telecommunication devices is unavailable

• Authorize a university-owned mobile communication device or allowance to offset the cost of a personally-owned mobile communication device used for university business to those employees with a valid business need.
• Approve the Mobile Communication Device Agreement.
• Annually review the employees approved to receive a university-owned mobile communication device or allowance.
• Discontinue use of a university-owned mobile communication device or allowance to employees who no longer have a valid business need.

• Determine the appropriate mobile communication device and service plan for each employee based on business need.

•  Consider alternatives (e.g., pager, two-way radio) that will provide adequate but less costly service.

• Purchase mobile communication devices and service plans.

•  Consult with Procurement and consider using a university recommended supplier to take advantage of negotiated rates and discounts.

• Determine the appropriate amount of the mobile communication device allowance based on valid business need to be charged to a UBF account.
• Provide a copy of this policy and the Mobile Communication Device Agreement to the employee for review and signature.
• Maintain the Mobile Communication Device Agreements.
• Maintain an inventory of and appropriate controls over department-owned and department-reimbursed mobile communication devices.
• Manage the repair and replacement of damaged or lost mobile communication devices.
• Monitor usage for policy compliance and appropriate use.
• Conduct an annual evaluation of an employee’s need for a mobile communication device or allowance.
• Obtain department-owned mobile communication devices from employees who terminate or leave the department.

Department-Owned Mobile Communication Device

• Be available for communication during those times specified by the employee’s supervisor.
• Comply with all laws regarding the use of a mobile communication device while driving.
• Use discretion in relaying Category 1 - Restricted Data or Category 2 - Private Data via a mobile communication device and when using the device in public areas.
• Limit personal use of a department-owned mobile communication device.
• Notify the department of loss or damage to the mobile communication device.
• Review and sign the Mobile Communication Device Agreement.

Allowance for Personally-Owned Mobile Communication Device and Related Services

• Select a service provider, enroll in a service plan, and purchase equipment.

•  Ensure that the service plan complies with any requirements established by the employee’s supervisor.

•  Accept responsibility for all payments to the service provider.

•  Accept responsibility for the repair or replacement of a damaged or lost mobile communication device.

• Provide the mobile communication device number to the department within five working days of activation. 
• Be available for communication during those times specified by the employee’s supervisor.
• Comply with all laws regarding the use of a mobile communication device while driving.
• Use discretion in relaying Category 1 - Restricted Data or Category 2 - Private Data via a mobile communication device and when using the device in public areas.
• Review and sign the Mobile Communication Device Agreement.