Acceptable Use of Personal Devices Policy

HIC, Inc
Publish Date: September 15, 2016

Scope
This policy applies to the officers and employees (collectively Employees) of HIC, Inc., and covers all data and
information related or belonging to HIC, Inc. and all of its affiliates (HIC).

Purpose
This policy sets forth guidelines and procedures for employees who choose to use their own personal electronic
device(s) for work purposes and the associated acceptable use. HIC employees must agree to the terms and
conditions set forth in this policy in order to be able to connect their devices to HICs network.

Personal electronic devices include personally owned cellphones, smartphones and tablets. Personal use of
laptops and computers in lieu of company provided equipment is forbidden.

The use of personal devices is limited to certain employees and may be limited based on compatibility of
technology. Contact the Human Resource (HR) department for more details.

We recognize this is a change from the prior acceptable use in place at HIC. Careful consideration was given to the
additional restrictions placed on all Employees and was balanced against the increased vigilance needed in todays
information security environment. While these new limitations can and will impact your ability to work remotely,
the recent issues in the industry related to information security necessitate this change.

Objective
This policy is intended to protect the security and integrity of HICs data and technology infrastructure. Limited
exceptions to the policy may occur due to variations in devices and platforms.

HIC grants its Employees the privilege of purchasing and using smartphones and tablets of their choosing for use
while working for HIC. HIC reserves the right to revoke this privilege if users do not abide by the policies and
procedures outlined below or if HIC, in its sole and absolute discretion, determines that continued access poses a
threat to the security of HICs systems. HIC will not purchase or support personal electronic devices or accessories.

Due to the sensitive and confidential nature of our business, we must be extraordinarily cautious in what we do. If
our information is compromised, it can have a devastating impact on our customers, our company, and our
Employees. As such, this Acceptable Use Policy of Personal Devices Policy has been developed. Please see the
other corporate policies for reimbursement, access control, etc.

Acceptable Use
HIC defines acceptable business use as activities that directly or indirectly support the business of HIC.
HIC defines acceptable personal use on company time as reasonable and limited personal communication.
Devices may not be used at any time to:
Store or transmit illicit materials
Store or transmit proprietary information
Harass others
Violate in Local, State or Federal law or regulation
Engage in outside business activities that compete with HIC or violate the code of ethics

Acceptable Use of Personal Devices Version 1 Page 1 of 3

Restrictions on Authorized Use
While at work, Employees are expected to exercise the same discretion in using their personal devices as is
expected for the use of company provided devices. HIC policies pertaining to harassment, discrimination,
retaliation, trade secrets, confidential information and ethics apply to Employee use of personal devices for work-
related activities.

Nonexempt (i.e., hourly wage) Employees may not use their personal devices for work purposes outside of their
normal work schedule without prior written authorization from management. This includes reviewing, sending
and responding to e-mails or text messages, responding to phone calls, or making phone calls for HIC business
purposes. If management approves the use of a personal device outside of work hours, the nonexempt Employee
must report the amount of time spent on work outside of their normal work hours. Non-exempt Employees who
fail to obtain prior written authorization to use personal devices for work purposes, or who fail to report the
amount of time spent after normal work hours on authorized work purposes, are subject to discipline up to and
including termination of employment.

Employees may not use their personal devices for work purposes during periods of unpaid leave without
authorization from management. HIC reserves the right to deactivate the companys application and access on the
Employees personal device during periods of unpaid leave.

Access of Information
No sensitive, proprietary or confidential information is to be stored on cellular telephones and PDAs at any time. In
the event an organization-provided cellular telephone or PDA is lost, stolen or misplaced, the Information
Technology department manager should be notified immediately (regardless of time of day) so that appropriate
steps can be taken to remotely trigger the timely deletion of all contact and calendar information contained on the
cellular telephone/PDA.

Sensitive data will not be sent to / from the mobile device. HIC has enacted several different technical and process
based solutions to block the transmission of Personal Health Information (PHI) and Personally Identifiable
Information (PII). At no times shall you deliberately send / receive, attempt to circumvent or take any other
action to obtain PHI or PII on your personal electronic device.

Management reserves the right to review or retain personal and HIC-related data on personal devices or to release
the data to government agencies or third parties during an investigation or litigation. Management reserves the
right to retain personal electronic devises for a reasonable period of time during an investigation or litigation.
Management may review the activity and analyze use patterns and may choose to publicize these data to ensure
that HICs resources in these areas are being used according to this policy. Furthermore, no Employee may
knowingly disable any network software or system identified as a monitoring tool.

HIC will endeavor to respect the privacy of your personal device and will only request access to the device by
technicians to implement security controls, to remove company information at the termination of your
employment or to respond to legitimate discovery requests arising out of administrative, civil, or criminal
proceedings, investigations or litigation. This differs from the policy for HIC-provided equipment and/or services,
where Employees do not have the right, nor should they have the expectation, of privacy while using that
equipment and/or those services.

Termination of employment
Upon resignation or termination of employment, or at any time on request (e.g. spot check), the Employee may be
asked to produce the personal device for inspection. All HIC data on personal devices will be removed by IT upon
termination of employment. If, after resignation or termination of employment, a former Employee discovers HIC
information on the device, they will promptly delete it.

Acceptable Use of Personal Devices Version 1 Page 2 of 3

Posting of Policy and Policy Updates
This Policy and updates to this Policy will be posted to the Public Folders section of Sharepoint.

User Acknowledgment and Agreement

I acknowledge, understand and agree to comply with the above referenced policy and rules of behavior, as
applicable to my usage of personal electronic devices to access HICs network and services. I understand that
business use may result in increases to my personal monthly service plan costs. I further understand that
reimbursement of any business related data/voice plan usage of my personal device is not provided.

Device user understands and accepts the Company data on the device will be removed remotely under the
following circumstances:
Device is lost, stolen or believed to be compromised
Device is found to be non-compliant with this policy
Device inspection is not granted in accordance with this policy
Device belongs to a user that no longer has a working relationship with the Company.
User decides to un-enroll from the Mobile Device Policy and Management solution

Any violation of the Cell Phone & PDA Policy must be immediately reported to the Information Technology
department manager.

Violating the Cell Phone & PDA Policy, or any of its tenets, could result in disciplinary action leading up to and
including termination of employment and civil and/or criminal prosecution under local, state and federal laws.

Employee Name:

Personal Electronic Device(s):

Employee Signature: Date:

Employee ID No.

Acceptable Use of Personal Devices Version 1 Page 3 of 3