Skip to main content

Part of UT Health San Antonio

Information Security - UT Health Science Center San Antonio - UT Health San AntonioInformation Security - UT Health Science Center San Antonio - UT Health Science Center San Antonio

Part of UT Health San Antonio

Quicklinks

Services & Solutions

  • Request E-mail Account
  • Request Voicemail delivery to your email
  • Password Reset
  • VPN (Secure Remote Access)
  • Wireless Support
  • Guest WiFi
  • Telephone Support
  • Forms
  • Policies & Procedures

Information Management Services (IMS)

  • IMS Home
  • Other IMS Services
  • About IMS

 Close Quicklinks

Menu
  • Information Security
  • Policy and Procedure
  • Hardware Security
  • Software Security
  • E-mail and Passwords

Policies, practices and additional security information

These links and documents include the university’s security goals and objectives. Specific requirements or rules are outlined, along with common and proprietary IT security practices that are in general use today. Additional documents, containing security related information, are available here.

Policies

These are high-level statements of the university’s goals and objectives with the intent to be long-lasting.  They outline specific requirements or rules that must be met.

Standards

These are mandatory rules of measure; collections of system-specific or process-specific requirements that must be met.  Standards are designed to provide policies with the support structure and specific direction they require to be meaningful and effective.

Guidelines

These are recommended models or general statements designed to achieve policy objectives by providing a framework for developing or implementing procedures, processes, or practices; guidelines may utilize or refer to standards.

Security References and Information Technology-related policies from the Handbook of Operating Procedures:

  • Chapter 1
  • Chapter 2
  • Chapter 4
  • Chapter 5
  • Chapter 6
  • Chapter 8
  • Chapter 10
  • Chapter 11
  • Chapter 12

Chapter 1


1.3 EXECUTIVE OFFICERS
  • 1.3.6 Vice President and Chief Information Officer

1.7 STANDING COMMITTEES

  • 1.7.4 Computing Resources Committee

Chapter 2


2.2. INFORMATION MANAGEMENT
  • 2.2.1 Records and Information Management and Retention
    • (Records Retention Schedule)
  • 2.2.2 Information Security
  • 2.2.3 Family Educational Rights and Privacy
  • 2.2.6 Release of Records and Requests for Personal Information
2.3 LEGAL AFFAIRS
  • 2.3.2 Use of Copyrighted Material
2.4 ADMINISTRATIVE AND SUPPORT DEPARTMENTS
  • 2.4.2 Internal Audit & Consulting Services
  • 2.4.4 Library
  • 2.4.5 Student Services
2.5 INSTITUTIONAL COMPLIANCE PROGRAM
  • 2.5.1 Office of Regulatory Affairs and Compliance
2.6 MISCELLANEOUS
  • 2.6.1 Safes
  • 2.6.3 Fraud, Abuse, and False Claims Act

Chapter 4


4.4 BACKGROUND INFORMATION CHECKS

  • 4.4.1 Criminal Background Checks for Security Sensitive Positions

4.5 EMPLOYMENT ADMINISTRATION

  • 4.5.6 Ending Employment
    • (Exit/Clearance Form)
  • 4.5.16 Personnel Records

4.7 WORK AND LEAVE ADMINISTRATION

  • 4.7.6 Telecommuting

4.10 EMPLOYEE DEVELOPMENT AND TRAINING

  • 4.10.1 Compliance Training
  • 4.10.4 Disciplinary Actions for Failing to Attend Compliance Training Sessions

Chapter 5


5.2 SYSTEMS AND NETWORK OPERATIONS

  • 5.2.4 Communications Infrastructure and Equipment
  • 5.2.5 Protection of Information Resources
  • 5.2.6 Electronic Mail Use and Retention
  • 5.2.7 Using Electronic Communications for Broadcast E-Mail Notifications and Distribution of Information
  • 5.2.8 Internet Use

5.4 EDUCATIONAL MEDIA RESOURCES

  • 5.4.4 Copyrighted University Materials

5.5 INFORMATION MANAGEMENT CLIENT SUPPORT SERVICES

  • 5.5.4 Access to Central Resources
  • 5.5.10 Software Policy

5.8 INFORMATION SECURITY

  • 5.8.1 Information Security Program
  • 5.8.4 Access Management
  • 5.8.5 Information Security Incident Management
    • 5.8.5 Incident Response Guideline
  • 5.8.8 Information Resource Security Configuration and Management
    • Device Naming Convention Standard
    • Server Security Standard
    • Workstation Security Standard
    • Web Application Security Standard
    • Login banners
  • 5.8.9 Malware Prevention Policy
  • 5.8.10 Information Resources Acceptable Use and Security Policy
  • 5.8.12 Mobile Device and Personally-Owned Computing Policy
  • 5.8.13 Security Monitoring
  • 5.8.17 Information Security Training and Awareness Policy
  • 5.8.18 Third-Party Management of Information Resources
    • 5.8.18 Third-Party Risk Assessment Security Standard
    • Information Security Third-Party Assessment Survey
  • 5.8.19 Administrative and Special Access Policy
  • 5.8.20 Information Resources Privacy Policy
  • 5.8.21 Data Classification
    • 5.8.21 Protection By Data Classification Standard
  • 5.8.22 Data Protection
    • 5.8.22 Media Control (Accountability) Security Standard
    • 5.8.22 Media Control (Data Destruction) Security Standard
    • 5.8.22 Media Control (Data Destruction) Security Guidelines
  • 5.8.23 Back-Up and Disaster Recovery Policy
    • 5.8.23 Backup Security Guideline
  • 5.8.24 Change Management Security Policy
  • 5.8.25 Systems Development Life Cycle (SDLC) Policy
  • 5.8.26 Information Security Risk Management
    • 5.8.26 Electronic Information Security Risk Assessment Security Standard
  • 5.8.27 Physical Security for Information Resources
    • 5.8.27 Physical Security for Electronic Information Resources Standards
  • 5.8.30 Information Security Exceptions
  • 5.8.31 Cloud Computing Policy

Chapter 6


6.3 PROPERTY CONTROL

  • 6.3.3 Deletion of State Property
    • Electronic Storage Device Disposal Request
    • Property Deletion Request
    • Software Deletion Request 
  • 6.3.8 Property Removal Permit
    • Property Removal Permit

Chapter 8


8.6 STUDENT RIGHT-TO-KNOW AND CAMPUS SECURITY ACT

  • 8.6.1 Student Right-to-Know and the Clery Act

8.7 UNIVERSITY POLICE

  • 8.7.2 Security
  • 8.7.5 Property Removal
    • Property Removal Permit
  • 8.7.7 Security Sensitive Positions
  • 8.7.9 Key/Card Keys
  • 8.7.10 Identification Badge Policy
  • 8.7.11 Contractors and Vendors

 


Chapter 10


10.1 ETHICS, STANDARDS OF CONDUCT, AND RELATIONSHIPS WITH EXTERNAL ENTITIES

  • 10.1.2 Code of Ethics and Standards of Conduct
  • 10.1.3 Personal Use of University Resources, Equipment, and Assets

Chapter 11


11.1 GENERAL AND OVERSIGHT POLICIES

  • 11.1.1 Notification of Privacy and Security Breaches
  • 11.1.5 Patient Health Records
  • 11.1.6 Confidentiality of Patient Health Information
    • Confidentiality/Security Acknowledgement
  • 11.1.12 E-Mailing Protected Health Information
  • 11.1.14 Securing Protected Health Information and Mobile Devices

11.4 EDUCATION

  • 11.4.1 Education and Training on Patient Privacy

Chapter 12


12.1 TECHNOLOGY DEVELOPMENT

  • 12.1.1 Intellectual Property Policy

Additional Resources

  • Guidance for Cloud Services
  • Security Configuration Management
  • International Travel Guidelines
  • General Data Protection Regulation (GDPR)
  • Access control executive (ACE)

 

Information Security Department

Contact Infosec directly at 210-567-0707 or infosec@uthscsa.edu


 

Chat with Service Desk

210-567-7777

 

Epic Support Desk

210-450-HELP or 210-450-4800

 

IMS Self-Service

IMS Self-Service information


Submit feedback - online form

 

You can also follow us on Twitter:

    Information Security Department

    7703 Floyd Curl Drive
    San Antonio, TX 78229

    210-567-0707

    • Contact us
    • Maps & directions
    • Job openings
    We make lives better ®

    The University of Texas Health Science Center at San Antonio, also called UT Health San Antonio, is a leading academic health center with a mission to make lives better through excellence in advanced academics, life-saving research and comprehensive clinical care including health, dental and cancer services.

    Web Privacy | Links from websites affiliated with The University of Texas Health Science Center at San Antonio's website (uthscsa.edu) to other websites do not constitute or imply university endorsement of those sites, their content, or products and services associated with those sites. The content on this website is intended to be used for informational purposes only. Health information on this site is not meant to be used to diagnose or treat conditions. Consult a health care provider if you are in need of treatment.