Standards of Conduct
| EWU Policy 203-08 | Authority: EWU Board of Trustees |
| Effective: February 23, 2024 | Proponent: Vice President for Business and Finance |
Purpose: This policy prescribes university standards and related procedures for the use of mobile devices by employees to conduct university business.
History: This policy is new. It was approved by the Board of Trustees on February 23, 2024. It supersedes and replaces in its entirety EWU Policy 203-03 (Cellular Telephones and Services) (last updated January 29, 2010).
Applicability: This policy applies to the use of any mobile device by an EWU employee to conduct university business.
1 – Purpose and Scope
This policy governs the use of mobile devices (such as smart phones and tablets) to conduct university business. Use may include, but is not limited to, telephone calls, texts, emails, internet searches, messages, recordings, and social media posts. This policy addresses an employee’s use of a personal mobile device to conduct university business due to the security, retention, and data privacy issues involved in accessing confidential information or institutional data[1] and creating university records. The policy also addresses situations when the university provides a mobile device or a stipend to an employee because the employee must be regularly available to respond to university-related communications.
2 – Use of a Personal Device to Conduct University Business
Employees may use personal mobile devices to conduct university business. The employee is responsible for ensuring the use of a personal device continues to meet all university security, data privacy, retention, and production requirements. Communications for university business must comply with all university policies regardless of the type or ownership of device used. This includes, but is not limited to:
(a) The device must be protected by an active form of access protection such as a pin, password, facial recognition, fingerprint, etc. and have a time out setting after a period of inactivity; and, access to the device may not be shared with any other individual while logged in to a university system;
(b) The device and use of the device must comply with EWU Policy 203-01 (Information Security);
(c) Emails relating to university business must be sent or received through the university’s email service provider;
(d) Emails and texts must meet the requirements of EWU Policy 203-06 (Contact Information, Email, & Texting);
(e) Records must be retained in accordance with EWU’s records retention schedule consistent with EWU Policy 201-02 (Records Retention, Preservation & Management);
(f) The device, or copies of all university-related communications and other records, must be provided to EWU’s public records manager or risk management in the event of a public records request, subpoena, investigation, discovery request, or other legal process consistent with EWU Policy 201-06 (Subpoenas, Public Records, Service of Process). If the employee does not provide the personal device and access information, the employee must conduct a reasonable search for university-related records or communications on their personal device(s) in a timely manner and provide copies of such records, along with information detailing their search efforts, to the public records manager or risk management;
(g) Employees must immediately notify IT if their device is lost, misplaced, or compromised. IT may disable remote access to university systems in those circumstances; and,
(h) If the employee is receiving an allowance under chapter 4, the university may require the personal device to be enrolled in mobile device management and/or have university applications and policies pushed to the device.
3 – University-Owned Mobile Devices
3-1. Necessary for Legitimate Business Need
University-owned mobile devices may be assigned to a permanent employee when such assignment is approved by an appointing authority and there is a legitimate business need for the employee to have a university-owned mobile device.
A legitimate business need exists when an employee must be readily accessible for contact with the public or with university employees or students for essential business communication due to:
(a) Frequent travel or work at a remote location;
(b) The need to receive or initiate communications in an emergency situation; and/or,
(c) The need to be accessible and available during working hours when the employee is away from a desk or during non-business hours.
The university will not issue a mobile device to an employee for the employee’s convenience. Any use of a university-owned mobile device must comply with all applicable university policies, including, but not limited to, EWU Policy 901-02 (Appropriate Use of University Resources).
3-2. Acquisition & Billing
University-owned mobile devices and services must be acquired through the Information Technology department (IT). All repairs and replacements must also be coordinated through IT. All charges associated with a university-owned mobile device will be billed through the IT department in accordance with university and IT guidelines and procedures. Such devices remain the property of the university and must be immediately surrendered to the department upon request of the supervisor or appointing authority. Service will be terminated immediately if the department notifies IT the device is no longer needed or must be transferred to another employee.
3-3. Loss
Employees must immediately notify IT if a university-owned device is lost or misplaced. IT may disable or remotely wipe the device to address potential security issues.
3-4. No Expectation of Privacy
University-owned mobile devices are subject to search or inspection at any time and without notice, including, but not limited to, voicemails, text messages, emails, social media use, call history, photographs, application use, and any other data or information stored on the device. Employees have no expectation of privacy with respect to the use of university-owned mobile devices.
3-5. Return
All university-owned mobile devices must be returned to IT when they are obsolete, replaced, an employee leaves the university, or when an employee no longer qualifies for a university-owned device.
3-6. Sponsored Research & Grants
Mobile devices and services may be purchased and used for a sponsored project/grant or contract activities when the sponsored project/grant or contract language stipulates the principal investigators, other research personnel, or instrumentation, need such devices to perform their work. In such cases, the need for a mobile device must be documented in the grant proposal and/or budget justification during the grant submission process, and the sponsor must approve (or not specifically disapprove) the expense as a direct charge on the grant. The principal investigator must ensure that monthly recurring charges are clearly identified as part of the initial budget request.
Principal investigators shall take appropriate measures to prevent misuse of mobile devices acquired through sponsored projects/grants and contracts and comply with all relevant laws and grant requirements. Such measures include informing project staff of the contents of this policy and periodically reviewing mobile device statements.
4 – Mobile Device Allowances
In lieu of providing a university-owned device, the appointing authority may approve issuance of an allowance if the situation otherwise meets the requirements for issuing a university-owned device. The appointing authority has the discretion to determine if an allowance is permissible or if the employee must use a university-owned device (such as situations where an employee frequently works with highly sensitive data). The procedures for allowances are contained in this chapter.
4-1. Approval Process
If an appointing authority approves the issuance of an allowance to an employee who has a legitimate business need for a device to conduct university business, the university will provide an allowance to cover the costs related to the employee’s use of a mobile device service plan for their own personally-owned device.
Prior to receiving any allowance, the employee must agree in writing to follow all of the requirements of this policy. Additionally, the employee must agree to the following:
(a) The employee is responsible for the cost of the personal mobile device;
(b) The amount of the allowance will be determined each year by IT and the allowance will be standardized for all types of employees. The allowance rates will be published on the IT website;
(c) The employee is responsible for choosing the device management plan that best fits their needs and for paying the cost of the plan;
(d) The employee is responsible for all costs associated with the replacement of lost, stolen or damaged personally owned devices;
(e) The employee assumes all costs associated with the plan selected by the employee. If the employee leaves the university, the appointing authority determines an allowance is no longer appropriate, or the employee falls within one of the special circumstances identified in 4-2, the employee is responsible for determining whether or not to cancel their personal plan and is responsible for any termination fees associated with the plan or device; and,
(f) The employee will at all times comply with the requirements of this policy. This includes, but is not limited to, maintaining appropriate security on the device, retaining all records consistent with EWU policy, and providing the device to the university when records are needed or conducting a reasonable search. See chapter 2 for more details regarding the use of a personal device to conduct university business.
The allowance will be distributed to the employee once a month. Payments will not be prorated. The department requesting payment of the allowance is responsible for timely submitting the appropriate paperwork. Allowances are not subject to payroll tax withholdings, and do not qualify as compensation for retirement contribution purposes. The allowance does not constitute an increase in base pay, nor will the allowance be included in any percentage calculations for increase to base pay or establishment of base pay related benefits. The allowance may be changed and/or withdrawn by the university at any time. The allowance will only be paid for the months an employee remains in paid status, unless an allowance is not permitted under section 4-2. The employee is responsible to immediately inform his/her supervisor of any changes in work or their availability that may impact the need for a mobile device allowance.
4-2. Special Circumstances:
(a) Leave without pay: employees are not eligible for the allowance during periods of leave without pay resulting in the employee being paid for less than 80 hours of work or compensated leave during a pay period.
(b) Paid administrative leave or sabbatical: employees on paid administrative leave or sabbatical are not eligible to receive an allowance.
(c) Cyclic assignments: employees who are employed on less than annual appointments (i.e. 10 month contracts) are not eligible to receive the allowance for months not worked/employed.
(d) Transfer or reassignment to another position: if an employee transfers or is reassigned to another position, the employee is not automatically entitled to continue receiving an allowance. Rather, the appointing authority for the new position must determine whether there is a legitimate business need for the allowance in accordance with this policy.
4-3. Transitioning from a University-Owned Device to an Allowance
With the approval of an appointing authority, employees assigned a university-owned device may change to an employee-owned device with an allowance. In doing so, the employee may acquire their own device, or may choose to transfer their university-owned device and phone number to their personal account. Transferring university-owned devices and phone numbers to personal accounts must be coordinated with IT. If the employee chooses to transfer the device to their personal account, they must reimburse the university for the cost of the device based on the following schedule:
(a) Device < 6 months old: 100% of the purchase price/tax paid by EWU;
(b) Device > 6 months old and < 12 months old: 50% of the purchase price/tax paid by EWU; and,
(c) Device > 12 months old: No reimbursement to EWU required.
Reimbursements are handled through IT.
[1] Please refer to EWU Policy 203-01 (Information Security) for the definitions for these terms.
