Standard Technology Review Practices Apply
Regardless of the technology and intent, the procurement and security review processes are fairly similar, explains Zach Rossmiller, associate vice president and CIO at the University of Montana. Rossmiller describes the University of Montana’s technology review process as rigorous and demanding, ensuring compliance with federal and state laws, accessibility standards, and cybersecurity checks. The university also asks for a SOC 2 report and uses the Higher Education Community Vendor Assessment Toolkit.
The HECVAT template is the product of combined efforts of EDUCAUSE, Internet2 and REN-ISAC. It’s used by higher education to get a “detailed picture” of a prospective vendor’s “cybersecurity, privacy, IT accessibility and compliance standards in one place,” according to EDUCAUSE.
Lipscomb University relies on HECVAT as well, says Brett Hinson, vice president of IT and CIO. “The report allows us to thoroughly evaluate a vendor’s security posture, data encryption and access controls tailored specifically to our campus environment,” he says.
In addition to this process for any proposed technology, mental health platforms introduce access or integration with protected health information and personally identifiable information, which means more laws — such as HIPAA — are in play.
WATCH: In this webinar, CDW experts discuss how to manage third-party risk.
“Every university looking at these tools should have a vendor risk management program,” Rossmiller says. “They should have strong data governance and a HIPAA compliance officer, CISO and CIO who are a pyramid of experts, actively reviewing and pushing back on the vendors to ensure that they’re protecting their student data.”
Collaborating Across the University for the Protection of Students
When it comes to a mental health platform, Rossmiller encourages IT leadership to also consider the expertise of their faculty and staff. While IT handles the integration requirements, data access controls and cybersecurity, these mental health experts — whether faculty or counselors — can assess how the platform interacts with students and vice versa to ensure a safe environment, especially during critical moments.
Lipscomb University’s partnership with TimelyCare, a virtual health provider, began during the COVID-19 pandemic when the university was searching for an alternative to on-campus resources, explains Kevin Eidson, director of health and wellness at Lipscomb.
“What began as a response to an immediate crisis has become an important part of our ongoing commitment to supporting the emotional and physical well-being of every student in the Lipscomb community,” he says.
DISCOVER: Artificial intelligence is supporting mental health initiatives.
Eidson also says that cross-departmental collaboration at the university is imperative for the success of a mental health platform and for the safety and benefit of students.
“While IT professionals provide critical expertise related to technology, cybersecurity, privacy and system integration, faculty, counselors, healthcare providers and student life professionals bring an important understanding of students’ needs and how the service will function within the broader campus support system,” he says.
Hinson says it’s this very group, the folks outside of IT, who are the day-to-day overseers of the platform. Once IT has reviewed and approved the vendor — barring any unexpected changes to terms and conditions or offerings— and enabled the necessary integration requirements, the ownership transitions.
“Faculty and staff must understand its value and support the partnership,” says Eidson. “They are often the people students trust and turn to first, so their willingness to promote the service, explain how it can help, and refer students to it is a vital part of increasing awareness and utilization.”
READ MORE: Higher ed IT leaders are rethinking vendor risk.
Considerations for Implementation and Deployment
As with any other platform or tool, the same steps and conversations should be had with a mental health vendor with regard to access and retention of student data, says Rossmiller.
He advises:
- Data retention is a major concern. If a vendor uses a chatbot feature, for example, universities must understand how the student interactions and student data are being used to train their artificial intelligence (AI) — and put a stop to it as needed.
- Ask for references that reflect the region and size of your institution. Rossmiller also asks for references of former clients — though he rarely receives them. He wants a clear picture of the positives and negatives with a comparable institution, and information about how they handled the deployment.
- Gone are the days when contracts were reviewed once per fiscal year. With new features and AI enablement, IT teams are left constantly scrambling to pause tech and reassess the risk and legal concerns. Look for a vendor who is willing to be a partner and not adjust terms and conditions without warning. These kinds of vendors can also help tell the story of how your university is using the tool for the betterment and benefit of students.
Rossmiller says that he cannot have a conversation without AI being brought up, and the discussion about mental health tech deployment is no different. His concern stems from students potentially turning to AI chatbots as a substitute for a human professional in a vulnerable moment. It’s scenarios like this that highlight the value and importance of relying on university mental health faculty and staff to assess every aspect of a potential new mental health tool before it’s shared with students.
“Broad institutional involvement helps ensure that the service is safe, clinically appropriate, responsive to students’ needs and effectively integrated into the university’s overall approach to student well-being,” says Eidson.
