The ampersand (&) shouldn't really be used outside of very specific situations, such as the term R&D or M&A. In fact, quasi-abbreviations such as those two probably make up 90% of ampersand usage.
On the flip side, if you were to write out my examples, it's more appropriate to write "research and development" and "mergers and acquisitions."
I'm not sure if there is a specific rule as to ampersand usage, but it is generally too informal for wholesale replacement of the word "and".