E-Mail Use and Procedures
Information Management Memorandum No. 94-1/97
- OFFICIAL USE
- AUTHORIZED USE
- PREPARATION OF E-MAILS
- CONFIDENTIALITY/PRIVACY
- RECORDS MANAGEMENT
- PRIVACY ACT
- FREEDOM OF INFORMATION ACT
- CONTINGENCY PLANNING FOR E-MAIL SYSTEM AND MESSAGES
- COMPLIANCE
The following policies and procedures apply to the use of E-mail at CDC* and supplement PHS policy on E-mail established in Circular 93.01 of the IRM Manual.
I. OFFICIAL USE
Government-provided electronic mail (E-mail) is primarily intended for official and authorized purposes. When using E-mail for official business, the same limitations as for written correspondence apply. For formal internal communications, the same routing and copying conventions in the CDC Communications Style Guidelines for a memorandum also apply to E-mail.
II. AUTHORIZED USE
A. Personal
While E-mail is intended for official purposes, incidental and occasional personal use of E-mail is authorized. Short personal messages to individuals or to small groups are acceptable, but E-mail users must exercise common sense, good judgment, and propriety in the use of this Government resource. E-mails sent to large groups of users are not authorized for personal reasons, such as selling or giving away tickets, pets, or other items, asking for a ride, advertising a nonwork-related event, etc.
Government ethics regulations prohibit employees from using Government E-mail systems for unauthorized purposes. (5 C.F.R. 2635.704). Some examples of unauthorized uses are chain letters, charitable events, fund raisers, or personal businesses. Employees who abuse E-mail, as with other Government resources, are subject to disciplinary action.
B. Group Messages/Announcements
The E-mail system provides opportunities for
communicating with large numbers of staff in an efficient way; however, when
the content of such messages is not of interest or is unnecessary for the
majority of recipients, then a significant loss in productivity results from
staff reading and purging such messages.
Therefore, originators should exercise care in
determining whom the recipients should be for a group E-mail. Extend to
everyone the E-mail courtesy you wish extended to you.
For E-mail messages to large numbers or to all CDC E-mail users, the following guidelines apply:
1. Recipients of Message
Determine the appropriate group of employees to receive the message. If the event is of interest to only a restricted number of staff, send the E-mail to those staff only. Contact your LAN Administrator for questions about suitable group code use.
If you have a question about the appropriateness of an E-mail message going to "all-hands," ask your supervisor, administrative officer, principal management official, etc. For example, for an event or topic for staff in Atlanta or at your location, do not send the message to ALL CDC staff.
2. Meeting or Activity Announcements
Announce a meeting or activity in a succinct manner and include the following information for the event:
- Name/Title
- Scheduled date and time
- Location
- Sponsor(s)
- Availability on Envision
Send a reminder notice for a meeting or activity only if there is a change in the original message.
3. New Appointment Announcements
New appointment announcements may be appropriate for group E-mail messages for certain positions upon approval of the personnel action, security clearances, and any related organizational approvals. The announcements should be sent only within the respective Center/Institute/Office (CIO) except for Division Director positions and above and for positions providing CDC-wide service. Inclusion of biographical data is appropriate for CDC-wide announcements for CIO Directors and for Associate Director and above positions in the Office of the Director, CDC.
Proposed announcement for CDC-wide distribution should accompany the related request for personnel action when submitted to the Human Resources Management Office (HRMO).* Upon completion of the appropriate approvals, HRMO will standardize and distribute the announcement on E-mail to CIO administrative officials for further redistribution as appropriate.
4. Leave Donation Announcements
When a request for donation of leave goes to the Human Resources Management Office a draft announcement, with the following information, should be given.
WHO: Name
Job Title
Section (if applicable)
Division (if applicable)
CIOWHY: Brief description of reason they need leave
Example: Recuperative period following an illnessELIGIBILITY PERIOD::........... Month, Day, Year through Month, Day, Year
HOW: Submit a signed SF-71, Application For Leave, to your timekeeper. Indicate name of recipient and number of annual leave hours you wish to donate. FOR QUESTIONS,
CONTACT:Contact person's name and phone number. In the event that another employee or a family member submits the application for the employee, he or she must make reasonable assurance that the potential leave recipient agrees with the draft announcement. HRMO will edit and distribute the announcement on E-mail. 5. Retirement Announcements
Retirement announcements should be sent to the Office of Program Support (OPS) for standardization and distribution. E-mail address: OPS ANNOUNCEMENTS. Please include the following information:
WHO: Name
Job Title
CIOYEARS OF
SERVICE:x Years RECEPTION
INFORMATION:When
WhereQUESTIONS/GIFT
DONATIONS:Contact person's name, mailstop, extension, and deadline date for donations 6. Death Announcements
Death announcements should be sent to OPS for standardization and distribution. E-mail address: OPS ANNOUNCEMENTS. Please include the following information:
WHO: Name
Job Title
Section (if applicable)
Division (if applicable)
CIO
(Optional: Brief information about the circumstances of the death)
DATE OF DEATH:
NEXT OF KIN:
FUNERAL/MEMORIAL
SERVICE:
FLOWERS/IN
LIEU OF FLOWERS:
QUESTIONS/GIFT DONATIONS:Month, Day, Year
Name
Address (if relative gives approval)
When
Where
Where flowers may be sent
or
Name and address of organization to which donations may be sent
Contact person's name, mailstop, extension, and deadline date for donations7. SHARE Announcements
At this time the SHARE News will not be sent over E-mail; therefore, SHARE, Inc., may send a limited number of time-sensitive announcements to ALL CDC/ATSDR-ATLANTA employees.
If you have a message about a SHARE-sponsored event, forward the message to the President of SHARE, or his/her designee, for dissemination. Only one message for each event will be sent.
8. Work-Related Personal Information Announcements
Some examples of personal issues relating to work which may be appropriate for E-mail include informing staff about a sickness, death, or birth to a CDC employee, family, or colleague. When sending these types of E-mails, the sender must determine who should receive the message and should not indiscriminately send messages to all employees.
9. Nonwork-Related External Activities
Announcements for nonwork-related external activities shall not be broadcast to large groups except for sponsored employee associations and groups as defined in the Manual Guide--Printing Management No. CDC-8, Printing and Delivery of Materials for Employee Associations and Similar Groups.
A copy of this issuance can be obtained from the Management Analysis and Services Office (MASO).
III. PREPARATION OF E-MAILS
A. Subject Line
Describe messages clearly in the SUBJECT line to allow recipients to handle the message in the most expeditious manner.
B. Attachments
Whenever possible, include all necessary information in the E-mail itself and avoid sending attachments. If an attachment is necessary, use one of the following options in order of preference:
1. ASCII textfile that can be viewed on the screen, e.g., filename.TXT(filename can be up to 8 characters)
2. WordPerfect document in WordPerfect format:
filename.WPF(filename can be up to 8 characters long; WPF stands for WordPerfect format)
3. Attachment in its native format (e.g., Lotus 1-2-3 spreadsheet, graphics file, or WordPerfect document not adhering to the naming convention in number 2 above that will be used by the recipient(s) within WordPerfect)
NOTE: Because of large data requirements, do not attach or include graphics, images, pictures that don't convey unique and necessary information.
C. Format
For DOS E-mail users: Do not send messages with poorly contrasting colors or flashing items so that persons with visual or other sensory-activated impairments experience difficulty reading their messages.
NOTE: If you receive an E-mail message that is difficult to read because of flashing items or color problems, selecting F4 while you are in the message will revert the message to monochrome.
D. Group Announcements
Have someone other than the originator review the proposed message content before it is sent to ensure it is clear, correct, and contains all the necessary information to avoid later corrections, second transmissions, and replies asking for more information.
Originators of messages to large groups should evaluate whether it is necessary to send the message "registered."
When a reply is requested, be careful not to "reply to all," but instead reply just to the originator.
Employees who send broadcast messages which are inappropriate or unauthorized will be advised and retrained through normal supervisory channels.
IV. CONFIDENTIALITY/PRIVACY
While the CDC E-mail system is designed secure, i.e., it employs encryption technology on all message traffic, users are not guaranteed absolute privacy of their E-mail. The CDC E-mail system shall not be used to create, transmit, or store classified (national security) information.
E-mail systems are Government property and Department policy strictly limits employees' authority to access other employees' E-mail communications. While all employees, including system administrators, are expressly prohibited from violating the security of the E-mail system, as well as other information system security protections, by breaching security and/or reading E-mail traffic arbitrarily, there may be occasions due to technical, administrative, or legal reasons for system administrators to access messages upon authorization by the IRM Coordinator and the IRM Coordinator's supervisor of the involved center.
System administrators shall obtain a written authorization (format attached) before taking actions that would allow anyone other than the intended recipient to read the contents of an E-mail message or messages or obtain access to any other password-protected electronic system or file. Improper and unauthorized access of another person's E-mail messages or other secure information systems is a violation of Federal regulation and policy and may also violate Federal security and privacy laws. Such actions will result in appropriate legal or disciplinary action.
V. RECORDS MANAGEMENT
The decision whether a document transmitted via E-mail is a Federal Records Act (FRA) record that should be filed in the official CDC filing system or deleted when no longer administratively useful, is no different from the decision employees make concerning the myriad of paper documents that come across their desks every day.
According to 44 U.S.C. 3301, the term record:
"... includes all books, papers, maps, photographs,
machine-readable materials, or other documentary materials, regardless of
physical form or characteristics, made or received by an agency of the
United States Government under Federal law or in connection with the
transaction of public business and preserved or appropriate for preservation
by that agency or its legitimate successor as evidence of the organization,
function, policies, decisions, procedures, operations, or other activities
of the Government or because of the informational value of data in them..."
Some messages or attachments that do not constitute FRA records are administrative matters, such as meeting announcements, routine transmittal notes, announcements of employees' absences or schedules, and changes in telephone numbers or office locations. However, many messages or attachments that contain substantive information about work matters do not constitute FRA records because they do not need to be retained in order to preserve evidence of agency activities or in order to preserve the information it contains.
If an E-mail message or attachment qualifies as an FRA record, it must be printed out in hardcopy and filed in CDC's official filing system in a named file. This is the equivalent of the file copy (box copy, which shows clearances) of ordinary paper correspondence. If a message (or attachment) that you send or receive qualifies as an FRA record, you should print it out as soon as possible after you create or receive it. Should the hard copy of the message not provide the complete computer-generated information, including the date, the sender, the addressee(s) and the recipient(s) of copies, this information must be affixed to the document. If, for program reasons, you need to know that the addressee (or cc:) received a message, then you must retain a copy of the return receipt (certification of receipt). (Hardcopy files will be used pending development of a suitable electronic system for records storage at CDC.)
Personally Created Group Codes
For messages sent to personally created group codes that are considered FRA records, please see the guidelines below to ensure that all recipients are documented.
You may handwrite the group code members on a printed E-mail document, or you may do the following:
For DOS E-mail:
(1) Either include the sender's name (i.e., your name) in the group code or "cc" the sender.
(2) Once the sender has received the message, save this message to a folder.
(3) Go into COMPOSE and retrieve this message from the folder.
(4) When the message is retrieved, the group code will open and specify the individual members.
(5) At this point, print the message and clear the COMPOSE screen.
(6) File this FRA record in the appropriate named file.
For WINDOWS E-mail:
(1) Either include the sender's name in the group code or "cc" the sender.
(2) Upon receipt of the message, the personally created group code will specify the individual members.
(3) Print the message.
(4) File this FRA record in the appropriate named file.
LAN Created Group Codes
For messages sent to group codes that are created on the LAN and maintained by your LAN Administrator, IRMO will electronically copy and archive the details (members) of all such group codes at least weekly. Therefore, no further action is required by the user to identify group code members for these groups.
The message or attachment should then be deleted. These filed records are disposed of in accordance with the CDC Records Disposal Schedule.
To ensure that CDC employees are making proper determinations and taking proper actions in accordance with these requirements, CDC provides training to all staff on the proper handling of E-mail, as well as other electronic and printed files. Additional guidance is available through the Records Management Activity, MASO.
VI. PRIVACY ACT
The E-mail system itself does not constitute a "system of records" as that term is defined by the Privacy Act, 5 U.S.C. 552a. However, if a record about an individual is maintained in a Privacy Act system of records in electronic form, and if it is transmitted as an attachment to an E-mail message, it retains all of the Privacy Act protections in the E-mail transmission. Also, if an employee retrieves information from a Privacy Act system of records and communicates that information through an E-mail message or attachment, that communication is a disclosure of a Privacy Act record, and may be made only if it falls within one of the exceptions listed in that Act.
VII. FREEDOM OF INFORMATION ACT (FOIA)
FOIA is a records access and disclosure law. Records subject to FOIA (that is, FOIA records) are the records in the possession of an agency regardless of storage medium. FOIA records may exist anywhere within the agency or be in the agency's legal custody, such as at a Federal record center. FOIA records must be made available upon request, unless one of the nine FOIA exemptions applies.
FOIA basically covers all Government records, regardless of whether they are FRA or non-FRA records. Thus an E-mail message that is not an FRA record could still fall within the scope of an FOIA request.
VIII. CONTINGENCY PLANNING FOR E-MAIL SYSTEM AND MESSAGES
To provide ready restoration of CDC's E-mail message traffic in the event of a systems failure, CDC system administrators shall back up the E-mail system on their local area network (LAN), including E-mail messages currently on the LAN post office, at the end of each business day. This copy will be kept no longer than three backup cycles, i.e., 3 business days. Copies older than 3 business days will either be deleted or written over by newer copies. This will ensure integrity of the E-mail database, restorability in the event of system failure, and minimize cost associated with backup tape retention. This policy applies to electronic mail system backups only and does not limit in any way an individual's decision to retain his or her individual E-mail traffic for longer periods.
Backup, retention, and restoration procedures for other electronic information and data resources should be determined based on the criticality and value of the information in concert with appropriate Federal records and security laws and regulations.
For reasons of space utilization, system integrity, and security, users are urged to manage their E-mail traffic by frequently deleting old unnecessary messages that do not meet the definition of FRA records noted in Section V above and saving messages needed for later access in electronic folders or on floppy disk for long-term storage. Employees should periodically review messages that they have saved, but that are not FRA records and they should delete them when it is no longer necessary to keep them.
IX. COMPLIANCE
An internal control review will be conducted every 3 years, as is routine with other internal control reviews, to assure overall compliance with the agency E-mail policy for storing and recording E-mails which meet the definition of an FRA record, to test management controls for training and knowledge of personnel, and for the development and maintenance of documentation. The review will consist of--
(1) interviews with employees to determine adequacy of training on the E-mail policy and knowledge of guidelines for effectively and efficiently carrying out operations
(2) examining areas to determine if guidelines and policies are maintained in a manner to give employees access to the information
(3) reviewing with employees E-mail messages currently on the systems to identify FRA records
(4) examining files to determine if E-mails subject to the FRA are being properly stored.
The review may also include a written survey to test employees' knowledge of E-mail policies, FRA definitions, and proper storage.
Authorization to Obtain/Grant
Access
to Secure Electronic Systems at CDC and ATSDR
This authorization permits system administrators, or others who have the ability to reset, change, alter, or otherwise breach electronic system security measures such as password controls, to take the measures necessary to permit access to such systems, accounts, files, databases, etc., as may be deemed necessary by the undersigned.
The undersigned certify that such access is deemed appropriate and necessary in the expedient conduct of official Government business due to technical, administrative, or legal reasons.
The undersigned shall be the IRM Coordinator and the IRM Coordinator's supervisor of the involved center.
Name: ___________________________
CDC Organization: _________
IRM Coordinator
Signed: __________________________
Date: ____________
Name: ____________________________
CDC Organization: _________
IRM Coordinator's Supervisor
Signed: ___________________________
Date: ____________
Type of Access Granted
(System Name, User Account, etc.):
*References to CDC also apply to ATSDR.
* Formerly Personnel Management Office (PMO)