Box for Restricted Data – Health: Acceptable Use Agreement

The purpose of this agreement is to ensure the application of Baylor University's responsibilities regarding the Health Insurance Portability and Accountability Act of 1996 (HIPAA) when using the Box for HIPAA (“the Service”). Baylor has privacy and confidentiality standards in place to ensure appropriate access or disclosure of protected health information. HIPAA provides safeguards for ensuring that health information is adequately protected. Students' health information is not covered by HIPAA rules and regulations, but is protected by the Family Educational Rights and Privacy Act (FERPA).

By using this Service, you agree to abide by the following Baylor University Policies:

• Baylor University Technology Usage Policy (BU-PP-025)
• Baylor University Policy on Protected Health Information Under the Health Insurance Portability and Accountability Act (BU-PP-048)

Additional guidance and resources for protected health information are available at: https://risk.web.baylor.edu/compliance/privacy-compliance/hipaa

As a Baylor University employee or student using this service, you agree to:

• Limit the download of electronic Protected Health Information (ePHI) from the Box Service to a Baylor University-managed local computer; defined as a laptop, desktop, or tablet computing device through use of the Box Drive Service. When download of ePHI from the Box Service to a local computer is necessary, you agree to download data only to a Baylor University managed local computer where encryption has been applied to the local computer. Use of the Box Drive Service on a personally managed local computer is prohibited. To determine if your Baylor University managed local computer has encryption applied, visit the main Box for Restricted Data - Health page and read FAQ #9.
• Apply Protected Health Information administrative and physical protection procedures to printed documents acquired through the Box Service. Reference BU-PP-048 for proper handling of Protected Health Information in printed form.
• Gain approval for the access of external collaborators or collaborating Institutions through the Baylor University – Institution Review Board (IRB) when human subjects data is present through identification of collaborators in the IRB application and in the research plan with associated research protocols. The IRB provides review and determination of human subjects research. It is your responsibility to identify Key Research Personnel, collaborate with the Baylor IRB to review and receive approval, and to only add those approved personnel as external collaborators in the Box Service. Visit the Baylor University IRB Resource website for more information.
• Existing Owners and Co-Owners will be reduced to Editor to ensure that the restrictions remain in place.  These could be in subfolders, so we have to run reports to ensure that there aren’t any.
• Limit the addition of external collaborators to personnel who have received approval as documented in an External Agreement, Memorandum of Understanding, or other documented form of approval asserting the relationship between Baylor University and the external collaborator. 

When granting access to a non-Baylor University employee or student collaborator, you agree to ensure and communicate to the external collaborator that they:

• Follow the above Baylor University referenced policies, comply with the requirement for strong passwords and multi-factor authentication, and do not attempt to circumvent authentication and access controls.
• Avoid the downloading or printing of files accessed from the Baylor Box service to your local computer or smartphone. All data accessed in the Baylor Box Service must remain in the Box Service.
• Avoid the use of a smartphone to take pictures, screenshots, recordings, or otherwise collect data in the Box Service to another device. 

Through use of the Box Service, you agree to the above terms, conditions, and adherence to applicable Baylor University policy. For additional information or questions related to use of the Box Service, please visit https://helpdeskplus.web.baylor.edu/box.