Privacy Considerations when using Virtual Meeting and Collaboration Platforms
To ensure the protection of personally identifiable information and to meet privacy regulations requirements, special care needs to be taken when using virtual meeting and collaboration platforms (“virtual tools and technologies”).
The following guidance is offered to you by the GW Privacy Office, in Collaboration with GW IT and it aims to assist in minimizing the risk of accidental personal information disclosure, while using virtual tools and technologies.
Faculty and Staff should only use virtual tools and technologies that have university approved contracts, as they are privacy compliant (through appropriate privacy terms and conditions) and configured with adequate security and privacy protections. To protect university non-public information, virtual tools and technologies should be integrated with GW Single-Sign On or two-factor authentication, as well as have the capability for event-specific password protection, encryption and attendance control.
In absence of a contract, virtual tools or technologies should not be used for any university activity where non-public information will be shared.
Information on available university approved virtual tools and technologies can be found on the GW IT Web Conferencing page. Additionally, virtual training and personalized guidance on tools and best practices for virtual learning can be found on the Tools for Instructional Continuity page.
Guidelines and Best Practices
To minimize risk of disclosure or breach of non-public data, these guidelines and best practices apply to virtual tools and technologies for administrative operations and virtual learning. Both the organizer (host) and participants should be aware of the privacy risks and exposures that exist when facilitating and participating in online meetings using virtual tools and technologies.
Be familiar with configurations and settings that minimize privacy risks associated with the use of virtual tools and technologies, such as the difference between public and non-public virtual meeting rooms:
- Non-Public Meeting Room: If the virtual event will contain content that is sensitive or includes any personal identifiable information (PII or PHI), a non-public meeting room should be used. A non-public meeting room is one where a one-time password or access code for entry into the meeting room is required; End to end encryption is strongly recommended. All available encryption and privacy modes should always be enabled. Do not record the virtual meeting unless it’s absolutely necessary (e.g. for purposes of records retention or asynchronous learning.) If the meeting is recorded for asynchronous learning purposes, the recording must not be shared outside of the class roster without student consent.
- Public Meeting Room: If the content will not include any personal identifiable information (deidentified PII or PHI or general administrative or academic content), a public meeting room can be used. For example, a Webex personal room is a public meeting room unless a password has been enabled.
The following guidance applies to both non-public and public meeting rooms:
- Use a 'green room' or 'waiting room' to allow the meeting to begin only after the host joins.
-
Carefully control and monitor who has the ability to invite/share the meeting invite. For example: avoid making the meeting available to anyone with the link.
- Monitor attendees through a dashboard – identify all generic attendees before meeting begins (e.g. Caller X). The host should pay attention to all new/late arriving attendees and ask them to identify themselves. An unauthorized attendee should be expelled or the meeting room may be locked once in progress to prohibit others from joining.
- Before anyone shares their screen, files or other content, remind them not to share sensitive or personally identifiable information during the meeting inadvertently.
Online Classes
Instructors should be aware of the privacy risks and exposures that exist when hosting online classes and lectures and maintain compliance with FERPA with regards to student's personal information captured via virtual tools and technologies.
Instructors should be familiar with configurations and settings that minimize privacy risks, such as controlling attendance by not making the meeting available to anyone with the link. When the online class invite includes a virtual conference link, ensure students do not forward the link to others not in the class, whether by mistake or otherwise.
Telehealth Activities
GW Clinics may seek to conduct telehealth activities. When using virtual meeting applications to provide telehealth services, all state licensing requirements and regulations for health professionals must still be met. If virtual meeting applications will be used for telehealth activities, non-public meeting rooms must be used. This requires the use of a one-time password or access code for entry into the meeting room. End to end encryption is strongly recommended. All available encryption and privacy settings should be enabled.
Recordings
As a general rule, meetings, events, classes, lectures or health sessions should not be recorded without a legitimate business purpose.
Recording class lectures and presentations is helpful for students who have a necessary, temporary absence and can also assist all students in reviewing materials and preparing for exams.
Zoom AI Companion
Zoom AI Companion is now available to all GW Staff and Faculty. Click here for instructions on how to enable Zoom AI Companion for your university Zoom account.
- Do not select Automatically start meeting summary for all meetings. Be selective when using the AI features of Zoom.
- Let meeting participants know if you plan to use Zoom AI Companion for a specific meeting. This fosters transparency and avoids privacy concerns.
- There may be situations in which a mandatory attendee elects to opt-out. In such cases, the host shall refrain from using the Zoom AI tool.
- Understand how to turn features on/off. To stop the summary, click the 'Stop summary' icon. To stop AI Companion completely, click the 'Disable' button at the upper right corner of the screen.
- Meeting summary in Zoom Ai Companion should be sent only to the host by way of an email after the meeting has concluded.
- The host should review the AI-generated summary before sharing it with participants. Correct any inaccuracies and remove any sensitive information. Please be sure not to record or store in Zoom AI Companion Summaries any information that includes sensitive Personal Identifiable Information (PII) of individuals.
View Zoom’s guidelines on how Zoom AI Companion features handle your data.
NOTE: Zoom does not use any customer audio, video, chat, screen sharing, attachments, or other communications-like content (such as poll results, whiteboard and reactions) to train Zoom’s or third-party AI models.
Resources
- Web Conferencing at GW
- Online Teaching Guidance offered by the GW Instructional Design Team
- Blackboard
Contacts
Privacy Assistance | GW Privacy Office | Email us |
Technical Assistance | GW IT Support Center |
Phone: 202-994-4948, Email: [email protected] |