Health Care Department Operations Manual

Cancel

Chapter 5 – Administrative

Article 3 – Information Technology

View All Sections >

5.3.15 Acceptable Use

  • Policy

    • California Correctional Health Care Services (CCHCS) shall safeguard department information assets and ensure their appropriate use in order to strengthen the protection of the department, its personnel, and business partners from illegal or potentially damaging activities.

  • Scope

    • This policy defines applies to all state employees and contractors, known hereinafter as employee workforce, all information assets owned or operated by CCHCS, as well as information assets owned or operated by third parties on behalf of CCHCS.

  • Roles and Responsibilities

    • Chief Information Officer shall:

      • Ensure all users of information assets are aware of this policy.

      • Review this policy annually and update accordingly.

      • Audit and assess compliance with this policy at least once every two years.

      • Determine the risk response for all Generative Artificial Intelligence (Gen AI) usage and purchases, whether intentional or incidental. Notwithstanding (d)(1), this responsibility shall not be designated.

    • The Chief Information Security Officer (CISO) shall ensure:

      • The Information Technology Services Division monitors the use of information assets for acceptable use.

      • Use of Gen AI and related technologies is governed and approved prior to implementation.

      • Security incidents involving information assets are properly documented and reported to California Compliance and Security Incident Reporting System as necessary.

    • Information asset owners and program management shall ensure that personnel:

      • Use only state provisioned accounts on state approved equipment for state work.

      • Receive appropriate training on the use of Gen AI consistent with their roles and responsibilities, when using Gen AI with data and information assets.

      • Document and inventory all Gen AI applications in a maintained inventory.

      • Use the “opt-out” option on data collection and model training features that Gen AI tools and systems offer.

      • Must clearly label any output produced using Gen AI tools and systems to produce output must be clearly labeled as Gen AI content.

    • Information Asset Custodians shall implement, maintain, and monitor Gen AI access and security controls.

    • Information Asset Users shall:

      • Be aware of and adhere to all department information security and privacy policies.

      • Use and protect information assets in accordance with this policy and applicable information security and privacy policies.

      • Report any security concerns pertaining to information asset security to the CISO or designee, appropriate security staff, or their immediate supervisor. Security concerns with information assets may include unexpected software or system behavior, which could result in unintentional disclosure of information or exposure to security threats.

      • Report any suspected or actual activities or events indicating misuse or violation of this policy to the CISO or designee, appropriate security staff, or their immediate supervisor.

      • Comply with the mandatory security awareness training requirements.

  • Management Commitment

    • CCHCS workforce shall adhere to CCHCS Information Security policies and procedures. CCHCS shall provide the necessary resources and training to support a secure environment.

  • Coordination Among Business Units

    • Health Care Regulations and Policy Section shall facilitate information security policy development, review and approval while ensuring cross functional participating from appropriate business units.

    • This cross-organizational engagement ensures policy alignment with operational reality, clinical needs, security and privacy obligations coupled with federal and state mandates.

  • Compliance

    • Non-compliance with this policy may result in corrective or disciplinary action, up to and including termination as set forth in CDCR Department Operations Manual, Chapter 3, Article 22 and California Code of Regulations, Title 15, Chapter 1.

    • If compliance is not feasible, or if deviation from this policy is necessary to support a business function, the respective manager shall formally request an exemption as defined by the department Information Security Officer (ISO).

  • Procedure

    • CCHCS shall ensure users:

    • Are provisioned access to state accounts, limited to use on state-approved equipment and for work-related activities.

    • Review their Gen AI content to ensure accuracy and that content is free of AI hallucinations.

    • Report the unauthorized use or disclosure of confidential, proprietary, and sensitive state data in Gen AI tools and systems to the ISO.

  • Policy Directives

    • The department shall ensure that users use and protect department information assets in accordance with this policy and applicable information security and privacy policies.

    • CCHCS shall ensure that users do not:

      • Use information assets to engage in or solicit the performance of any activity that violates laws, regulations, rules, policies, standards, and other applicable requirements issued by the federal government, the State of California, and CCHCS.

      • Use Gen AI with data and information assets unless trained regarding Gen AI use according to their roles and responsibilities.

      • Use information assets for personal enjoyment, private or personal gain or advantage, political activity, unsolicited advertising, unauthorized fundraising, or an outside endeavor not related to state business.

      • Access or transport information assets and data outside of the continental United States unless approved by the CCHCS CISO and the state CISO.

      • Send unapproved organizational, sensitive, unencrypted Personally Identifiable Information (PII) or Protected Health Information (PHI) to any personal e-mail or any non-CDCR e-mail.

      • Engage in any activity that may circumvent or alter the function of security controls (e.g., spoofing email, anonymous proxies, or unauthorized encryption), degrade the performance of information resources, or may deprive an authorized user access to department assets.

      • Share or disclose their work-related accounts, passwords, Personal Identification Numbers, security questions and answers, security tokens (e.g., smartcard, key fob), or similar information or devices used for authentication and authorization purposes.

      • Use confidential, proprietary, and sensitive state data in publicly available commercial Gen AI tools and systems.

      • Engage in the use of unauthorized AI tools for handling PHI and PII as this poses significant risks to data integrity, confidentiality, and patient or staff privacy.

      • Use information assets to send or arrange to send emails or intentionally access sites that contain pornographic, racist, extremist, or offensive material, chain letters or unauthorized mass mailings, and malicious code.

      • Connect or otherwise attach unauthorized devices or equipment to the network infrastructure. Unauthorized software downloads and installations are strictly prohibited.

      • Create any public social media account intended (or could reasonably be assumed) to represent CCHCS.

      • Content posted online should not violate any applicable security or privacy laws. Confidential and personal information and internal communication shall not be published online in any form.

  • References

    • Statewide Information Management Manual, Section 5305-A, Information Security Program Management Standard

    • State Administrative Manual, Section 5305.3, Information Security Roles and Responsibilities

    • State Administrative Manual, Section 5320.4, Personnel Security

    • California Department of Corrections and Rehabilitation, Department Operations Manual, Chapter 3, Article 22

    • California Department of Corrections and Rehabilitation, Department Operations Manual, Chapter 4, Article 41, Section 48010.5

    • California Government Code, Section 11549.3

  • Policy Control
    Executive Sponsor: Chief Information Officer, CCHCS Information Technology Services Division
    Effective: 03/28/2022
    Revised: 09/16/2026