Skip to main content
About Us » Information Technology » Employee Acceptable Use Policy

Employee Acceptable Use Policy

Ukiah Unified School District

Acceptable Use Policy (AUP) for District Technology Resources

Employee Use Policy

 

The purpose of the Ukiah Unified School District’s (“District”) Acceptable Use Policy (“AUP”) is to prevent unauthorized access and other unlawful activities by users online, prevent unauthorized disclosure of or access to sensitive information, and to comply with the Children’s Internet Protection Act (“CIPA”), the Family Educational Rights and Privacy Act (“FERPA”), the Student Online Personal Information Protection Act (“SOPIPA”; Business and Professions Code § 22584 et seq.), and Education Code section 49073.1.  As used in this policy, “user” includes anyone using the District’s technology resources (collectively, the “network”), which include: District-owned or District-issued computers and devices, wherever located; District networks, Internet access, telephone, and email systems; District cloud services and accounts (such as Google Workspace and the student information system); District-approved applications and online services; and any personal device while it is connected to District systems or used to access, create, or store District data.  District employee accounts and credentials are provided only to current employees.  Other users — including students, volunteers, contractors, and guests — may access the network only as authorized by the District (for example, through designated guest wireless access) and are subject to this policy and any applicable access terms.

The District will use technology protection measures to block or filter, to the extent practicable, access of visual depictions that are obscene, pornographic, and harmful to minors over the network.  The District reserves the right to monitor users’ online activities and to access, review, copy, and store or delete any electronic communication or files and disclose them to others as it deems necessary.  Users have no expectation of privacy regarding their use of District property, network and/or Internet access or files, including email.  This applies regardless of whether use occurs on District premises, remotely, or through a personal device used to access District systems or data.

Acceptable Uses of the UUSD Computer Network and/or the Internet

Employees, volunteers, and other users are required to follow this Acceptable Use Policy.  Even without a signature, all users must follow this policy and report any misuse of the network or Internet to a supervisor or other appropriate District personnel.  Access is provided primarily for education and District business.  Staff may use the Internet, including the email system, for incidental personal use during duty-free time.  By using the network, users have agreed to this policy.  If a user is uncertain about whether a particular use is acceptable or appropriate, he or she should consult a supervisor or other appropriate District personnel.

Unacceptable Uses of the Computer Network or Internet

The following examples are considered inappropriate activity on the District network; however, the District reserves the right to take immediate disciplinary action regarding any activities (1) that create security and/or safety issues for the District, students, employees, schools, network or computer resources, or (2) that expend District resources on content the District, in its sole discretion, determines to lack legitimate educational content/purpose, or (3) other activities as determined by District as inappropriate.

  • Violating any state or federal law or municipal ordinance, such as: Accessing or transmitting pornography of any kind, obscene depictions, harmful materials, materials that encourage others to violate the law, confidential information or copyrighted materials;
  • Criminal activities that can be punished under law;
  • Selling or purchasing illegal items or substances;
  • Sending unsolicited bulk messages (“spam”); using anonymous or disguised accounts to conduct District business; knowingly transmitting malware, ransomware, or other harmful code;
  • Disabling, bypassing, or attempting to bypass District security measures, content filters, endpoint protection, or monitoring tools, including through the use of proxy services or unauthorized VPNs;
  • Entering personally identifiable student information, confidential personnel information, or other confidential District data into any application or online service — including artificial intelligence tools — that has not been approved by the District;
  • Developing work-related web sites, blogs, forums, emails, or similar online communications representing the District or using District equipment or resources without the permission of the Superintendent or designee. All such forums shall include a disclaimer that the District is not responsible for the content of the messages;
  • Promoting unethical practices or any activity prohibited by law, Board policy, or administrative regulations;
  • Causing harm to others or damage to their property, such as:
    • Using profane, abusive, or impolite language; threatening, harassing, or making damaging or false statements, in print or any electronic medium, about others or accessing, transmitting, or downloading offensive, harassing, or disparaging materials; including photos, movies, and text;
    • Deleting, copying, modifying, or forging other users’ names, emails, files, or data; disguising one’s identity, impersonating other users, or sending anonymous email;
    • Damaging computer equipment, files, data or the network in any way, including intentionally accessing, transmitting or downloading computer viruses or other harmful files or programs, or disrupting any computer system performance;
    • Using any District computer to pursue “hacking” internal or external to the District, or attempting to access information protected by privacy laws; or
  • Engaging in uses that jeopardize access or lead to unauthorized access into others’ accounts or other computer networks, such as:
    • Using another’s account password(s) or identifier(s);
    • Interfering with other users’ ability to access their account(s); or
    • Disclosing anyone’s password to others or allowing them to use another’s account(s);
  • Using the network or Internet for Commercial purposes:
    • Using the Internet to buy or sell anything for personal financial gain;
    • Using the Internet for personal advertising, promotion, or financial gain; or
    • Conducting for-profit business activities and/or engaging in non-government related fundraising or public relations activities such as solicitation for religious purposes, lobbying for personal political purposes.

Approved Software, Applications, and Online Services

Employees may use only District-approved applications, websites, and online services with students or with student data.  California law (SOPIPA and Education Code section 49073.1) requires a written agreement containing specific privacy protections before a third-party service may collect or maintain pupil records.  Employees shall submit any new software, application, website, or online service — including free tools — through the District’s educational software approval process and receive approval before classroom or business use.  Creating accounts for students, or directing students to create accounts, on unapproved services is prohibited.  A current list of approved services is maintained by the Technology Department.

Artificial Intelligence (AI) Tools

Generative AI and other AI-powered tools are subject to the District’s software approval process before use for District business or instruction.  Users of AI tools shall observe the following:

  • Never enter personally identifiable student information, confidential personnel or health information, or other confidential District data into an AI tool that has not been approved by the District for that purpose;
  • Employees remain responsible for the accuracy, appropriateness, and legal compliance of any work product created with AI assistance and shall review AI-generated content before use or distribution;
  • AI tools shall not be used as the sole basis for decisions materially affecting students or employees (such as grading, discipline, or employment decisions) without meaningful human review; and
  • Employees shall follow any additional District or California Department of Education guidance on the instructional use of AI.

Account Security and Incident Reporting

  • Users shall enable and comply with multi-factor authentication (MFA) where provided, use strong and unique passwords, and safeguard their credentials at all times;
  • Users shall lock or log out of devices when unattended and shall not store District data on personal or unencrypted storage media except as authorized by the Technology Department;
  • Users shall immediately report suspected phishing messages, compromised accounts, lost or stolen devices, or any suspected breach of District data to the Technology Department.  Good-faith reporting of a security concern, including an employee’s own error (such as clicking a phishing link), will not by itself result in disciplinary action; and
  • Users shall not attempt to investigate or remediate a suspected security incident on their own beyond disconnecting an affected device, and shall preserve related evidence.

Remote Access and Off-Site Use

This policy applies to the use of District technology resources and District data wherever such use occurs.  When working remotely, employees shall access District systems only through District-approved methods, shall not permit family members or others to use District accounts or devices, and shall not access or download student or confidential data on public or shared computers.

Use of Personal Devices

Employees may use personal devices to access District systems or data only as authorized under standards established by the Technology Department.  The Technology Department shall establish and maintain standards specifying which categories of personal devices are approved, the District services each category may access, and the security requirements (such as screen locks, encryption, and endpoint management enrollment) that apply to each category.  Personal devices that do not meet these standards shall not be used to access, create, or store District data.  District data may not be downloaded to or stored on any personal computer.  Employees have no expectation of privacy in District data or accounts accessed from a personal device, and the District may revoke personal device access at any time.

District Email and Communications Accounts

Employees shall use their District-issued email account for all District business communications, including communications with students, parents/guardians, colleagues, other agencies, and vendors.  Personal email accounts shall not be used to conduct District business.  Employees shall not automatically forward District email to a personal account, and shall not store District communications or records in personal accounts.  An employee who receives a District-related communication in a personal account shall forward it to his or her District account for retention and continue the exchange from the District account.

Mass Emails

Employees shall not use the district’s network to transmit general or “mass” emails to other district employees without the prior consent of the Superintendent or designee. Emails sent to employees’ mailboxes in this way will be considered “spam” and an abuse or disruption of the email service.

Student Internet Safety and Employee, Volunteer, and Other User Responsibility

It is the responsibility of all District employees, volunteers and other users to:

  • Follow this District Acceptable Use Policy to protect student identity;
  • Follow this District Acceptable Use Policy regarding electronic communications they require, initiate, host or sponsor on District and/or other networks used for school purposes, including educational, sports, and extra-curricular activities.

Use of Student Information

Because of the wide accessibility of the District network and potential risk to students, absent parent permission for the particular purpose, District employees may not send, share, or post pictures, text messages, e-mails or other material that personally-identifies District students in electronic or any other form of personal technology. District employees may not use images of students, e-mails, or other personally identifiable student information for personal gain or profit.  Student records and personally identifiable student information shall be created, stored, and shared only through District-approved systems and services.

District-Sponsored Social Media

The District’s presence on any social media site, including school-related accounts, such as clubs, teams, field trips, course, or other sites associated with the District or a District school must be authorized by the Superintendent or designee. Any sites, accounts, or pages existing absent prior authorization will be subject to review, editing, and removal. As appropriate, a recommendation for disciplinary action may result.

Any approved official presence on social media sites outside of those created and monitored by the District shall include the following text:

“The views expressed on this site do not reflect the views of the Ukiah Unified School District. This site contains user-created content which is not endorsed by the District. The purpose of this site is”…(then specify the purpose).

Content Owners are responsible for monitoring and maintaining official presences on social media sites as follows:

  • Content must conform to all applicable state and federal laws, as well as all District and Board policies and administrative regulations;
  • Content must not violate copyright or intellectual property laws and the content owner must secure the expressed consent of all involved parties for the right to distribute or publish recordings, photos, images, video, text, slideshow presentations, artwork or any other materials;
  • All postings and comments by users are monitored and responded to as necessary on a regular basis. Postings and comments of an inappropriate nature or containing information unrelated to official or District business should be deleted promptly. Such postings shall be reported, investigated, and authors will be disciplined as appropriate.

Employee Use of Personal Technology and Social Media

District employees are encouraged to limit their personal technology use during duty hours. Use of personal technology for non-District business shall be limited to off-duty time and designated breaks, except in emergency situations. Employees are encouraged to maintain a clear distinction between their personal social media use and any District-related social media sites. To avoid jeopardizing their professional effectiveness, employees are encouraged to familiarize themselves with the privacy policies, settings, and protections on any social networking websites to which they choose to subscribe and be aware that information posted online, despite privacy protections, is easily and often reported to administrators or exposed to District students.

Before employees create or join an online social network, they should ask themselves whether they would be comfortable if a ‘friend’ decided to send the information to their students, the students’ parents, or their supervisor.

Educators must give serious thought to the implications of joining an online social network. District employees should not have online interactions with students on social networking sites outside of those forums dedicated to academic use. District employees’ social networking profiles and personal blogs should not be linked to District students’ online profiles. Additionally, District employees should use appropriate discretion when using social networks for personal communications and should limit this activity to off-duty hours and the use of their own electronic communication devices.

Electronic Communications with Students.  All electronic communication between employees and students shall occur through District-approved platforms and accounts, such as District email or the District’s learning management system.  Employees shall not communicate with students through personal phone numbers, personal email or social media accounts, or consumer messaging applications, except (1) in an emergency, or (2) through a platform expressly authorized by a site administrator for a specific program or activity that includes parent/guardian visibility (for example, an approved team or club communication app).  Employees shall contact students only for legitimate educational purposes and must never disclose confidential information possessed by the employee by virtue of his or her District employment.

Public Records and Records Retention

Communications concerning District business are generally public records subject to the California Public Records Act, regardless of whether they are created or stored on District or personal devices or accounts (City of San José v. Superior Court (2017) 2 Cal.5th 608).  Employees shall conduct District business using District accounts and systems.  An employee who creates or receives a District-related communication on a personal device or account should promptly copy or forward it to a District system for retention, and may be required to search personal accounts and devices for records responsive to a Public Records Act request or litigation hold.

Penalties for Improper Use

The use of a District account is a privilege, not a right, and misuse will result in the restriction or suspension of the account.  Misuse of personal or district technology may also lead to disciplinary and/or legal action including, but not limited to, suspension or dismissal from District employment and/or criminal prosecution by government authorities.  The District will attempt to tailor any disciplinary action to the specific issues related to each violation.

Disclaimer

The District makes no guarantees about the quality of the services provided and is not responsible for any claims, losses, damages, costs, or other obligations arising from use of the network or accounts.   Any additional charges a user accrues due to the use of the District’s network are to be borne by the user.  The District also denies any responsibility for the accuracy or quality of the information obtained through user access.  Any statement, accessible on the computer network or the Internet, is understood to be the author’s individual point of view and not that of the District, its affiliates, or employees.

The District reserves the right to make the final decision on whether specific uses are consistent with this policy and shall be the final authority. The District reserves the right to modify this policy at any time and all users will receive prompt notification of all modifications.

I have read, understand, and agree to abide by the provisions of the Acceptable Use Policy of the Ukiah Unified School District. I understand that violation of this policy may result in restriction or loss of network access and in disciplinary action, up to and including dismissal from District employment, and/or referral to law enforcement where applicable.