New guidance on using Zoom to record meetings

This Compliance and Privacy Services advisory addresses the non-clinical care use of the Zoom recording functionality at UC Davis Health.

As operationally appropriate, the Zoom audio, web, and video conferencing service(s) may be used by the UC Davis Health workforce to support various UC Davis Health work purposes. However, Zoom is not currently approved at UC Davis Health to record meetings for clinical care purposes or meetings where patient information will be discussed.

Zoom may be used to record non-clinical meetings, but the creation of recordings can increase risk to UC Davis Health, and potentially to involved workforce members. As such, recording with Zoom should be done only when necessary and with prior management approval.

The following items should be considered prior to recording a meeting with Zoom and any other UC Davis Health-approved technology.

Necessity of Zoom recordings

UC Davis generally recommends not recording meetings unless necessary. This standard also applies to the UC Davis Health environment. The necessity is not defined beyond “exceptional circumstances,” so this is a unit-based decision to be made with prior approval from the unit head/leader. This is because, as listed in the UC Davis guidance, any recording must be maintained with appropriate access, use, and deletion protocols, and may be compelled for disclosure under applicable law.

Consent prior to recording

In alignment with state law, consent must be obtained from meeting participants prior to recording. Zoom meets this requirement with the following:

• The Zoom service includes the technical capability to obtain consent by presenting a pop-up message to meeting participants notifying them that a recording is or will be activated and offers the participant to “accept,” or “leave the meeting” if they do not consent to the recording.
• Zoom hosts are encouraged to make a verbal announcement prior to starting a recording, although the visual prompt appears.
• Zoom Chat: this service also presents a pop-up message to meeting participants when recording is activated. This means that messages sent using Zoom Chat are posted in the group chat and can be seen by others and could possibly be used, saved, and shared by others. See Cal. Penal Code § 632.

Storage of Zoom recordings

In alignment with UC Information Security policies and best practices, and as listed in the UC Data Security Appendix (DSA), the storage location of Zoom recordings must be secure and only accessed by authorized persons as determined by data protection and availability level. At present, for UC Davis Health users, Zoom Cloud storage is not enabled. Instead, recordings may be stored in the UC Davis Health-approved versions of Microsoft OneDrive and Microsoft SharePoint, and Cisco’s VBrick Rev. Prior to storing, please consult with Innovation Technology (IT) if you have any questions about security and access to recordings maintained in the storage location selected by your department.

Destruction of Zoom recordings

In alignment with UC Davis Health policy, any recordings that are made should be promptly destroyed when no longer needed. The exception would be if there is a specific retention period that exists under law or UC standards depending on how a recording is classified and its intended use. For more information, please review the UC Records Retention Schedule.

Please contact Compliance and Privacy Services at hs-privacyprogram@ucdavis.edu or 916-734-8808, or the IT Help Desk at 916-734-4357 if you have any questions.