Overview

When someone separates from UCSF, we deactivate the person's Box account within 24 hours and only retain the Box account data for 90 days. Shared content that the separated user own will be no longer accessible to collaborators.

Once the Box account is deactivated, the separated user's supervisor will receive an email notification of the separation and instructions to request a transfer of ownership of shared content. If the user's supervisor is missing or not found, the emails will be sent to each collaborator instead, and the request for ownership will be on a first-come-first-server basis.

After the 90-day data-retention period, all content owned by the separated user will be deleted and the Box account will be removed. Requests for transfer of ownership of content will no longer be accepted.

For best practices, supervisors should remind their staff to transfer ownership before separation. This prevents losing access to shared content immediately upon the user's separation.

UCSF Box Deprovisioning Process

Every night, MyAccess processes separations from our HR systems. Once a user's account officially separates,

1. A deprovisioning script compares the list of separated users to the list of active UCSF Box users
2. Each separated user's Box account will be deactivated
3. The deactivated accounts can no longer be logged in and all content owned by each account are hidden from collaborators.
4. Email notifications are sent to supervisors or collaborators
5. After 90 days, the separated user's account and all owned data, including the Secure folder, will be deleted.

Notifying supervisors and collaborators

The following is an example email notification sent after the user's Box account deactivates:

To: [supervisor email], [collaborator email], [collaborator email]
From: [email protected]
Reply-to: [email protected]
Subject: Box collaboration with UCSF separated user

Dear UCSF Box User,

You are receiving this email because [inactivated user] has separated from UCSF, and you are either [inactivated user]'s manager or a collaborator in a Box folder that this user owns.

[inactivated user]'s Box account has been inactivated, which will prevent you from accessing their shared Box folders. If you are an editor or co-owner of the folder listed below, you can request to have ownership transferred to you within the next 90 days. After 90 days, all remaining content owned by [inactivated user] will be deleted.

If you urgently need access to the folder, please call the IT Service Desk at 415-514-4100. Otherwise, to request ownership of the folder, please send an email to the IT Service Desk. Only [inactivated user]’s manager or a user listed as an editor or co-owner can request ownership. Once a new owner is assigned, the folders will be visible again to all collaborators. You will also see [inactivated user] as a collaborator in the folder until 90 days have elapsed, at which point their account will be fully deleted.

[complete folder path]

• [collaborator name] - [collaborator role]
• [collaborator name] - [collaborator role]

A reminder to supervisors and managers: Please ask your staff to reassign ownership of Box folders before they leave.

Thank you,
The UCSF Box Team

Access Without Consent

Supervisors and managers can request access to any folder owned by their separated staff. Anyone else who needs access to previously inaccessible folders should follow the Access Without Consent process.

Related resources

• Records and Information Management
• UCSF Implementation of the ECP - Access Without Consent
• Consent to Access Electronic Information (PDF)