Electronic Records at U of L: Guidelines for Access, Retention, Destruction
- Introduction
- Employee Responsibility
- Word Processing Files
- Administrative Databases
- Electronic Spreadsheets
- Schedules of Daily Activities
- Tracking and Control Records
- WWW Materials
- Optical Imaging
- Migration
- Records Destruction
- Security
- Changes to These Guidelines
- For More Information
INTRODUCTION
Most employees at the University of Louisville create and use electronic records every day. If you send or receive email, exchange notices of meetings, or create word processing documents, then you are using electronic records. The informational content of electronic record systems constitutes an important part of the university's corporate memory and must be managed as a valuable university asset documenting functions and accountability.
Kentucky law defines public records as "all books, papers, maps, photographs, cards, tapes, disks, diskettes, recordings, and other documentary materials, regardless of physical form or characteristics, which are prepared, owned, used, in the possession of or retained by a public agency" (KRS 171.410, Section 1). The Kentucky Open Records Act mandates that "public records shall be open for inspection by any person, except as otherwise provided by KRS 61.870-61.884" (KRS 61.872).
Electronic records are subject to retention, destruction, and inspection under these laws just as if the record were stored on paper. Records management standards and principles apply to all forms of recorded information, from creation to final disposition. Guidance on records management issues, including electronic records matters, may be obtained from the University Archives and Records Center, which administers state and university policy concerning the management of university records. Feel free to call us at 6674, email us, or visit our web site at http://library.louisville.edu/uarc/.
Return to topEMPLOYEE RESPONSIBILITY
As noted above, university policy for management of university records is administered by the University Archives and Records Center. UARC's Chad Owen serves as U of L's records manager. He works with departments to help them deal with records problems. However, the departments themselves -- their administrators, staff, and faculty -- are accountable for the day-to-day administration, control, preservation, access, and security of records within their custody in accordance with state and federal laws. It is ultimately the responsibility of the creators and users of electronic records to ensure that they are properly cared for.
In other words:
University employees are responsible for maintaining the integrity of records whether stored electronically or in hard copy. Information in records systems must be maintained until the legal, fiscal, and administrative retention periods have been met.
All employees must ensure that electronic records are maintained so that they are readily available for appropriate use, and so that established records management procedures, including disposition and/or destruction, can be carried out.
Under no circumstances will employees permit the destruction or loss of records, in electronic or hard copy, if the employee has any reason to believe that the records are related to any current open records request, subpoena, litigation, investigation, audit, or other governmental proceeding.
In Kentucky, the Public Records Division's State University Model Schedule (available from the University Archives and Records Center's web site at http://www.louisville.edu/library/uarc/recmgmt/scheds.htm) lists the retention and disposition instructions for university records. These schedules are applicable to all records, both traditional (paper) and electronic. Office personnel should use the schedule for determining the minimum time that records must be kept to satisfy the administrative, fiscal and legal needs of the university.
Offices should use electronic information systems that maintain appropriate controls when creating records and which will support them in the context of their business purpose or the activity performed. Records that are vital in supporting the core activities of the university must be identified and scheduled for routine backup. However, while simply backing up a record is crucial, it is not the same as archiving a file. Hard copies, microfilm copies, or magnetic tapes of information systems or records systems, as appropriate, will provide preservation for documents requiring long term or permanent retention.
Consistent with the State University Model Schedule, most university records have a limited retention period. If an office retains records for the required length of time, on whatever medium it chooses, it is meeting legal requirements. Records required for audit purposes must be made available in hard copy or on a current computer system according to Internal Revenue procedures.
Return to topWORD PROCESSING FILES
Offices should take measures to protect permanent records produced by word processing software, either by printing the documents or preserving them in electronic form separately from materials of a non-permanent nature. This is to prevent accidental deletion or destruction with non-permanent records when the retention period for non-permanent records has expired. Non-permanent word processing files may be stored with other non-permanent electronic records and deleted with them at the end of their retention period.
Once a printed record copy is distributed, the electronic version may be deleted. If the official record copy is kept electronically, however, it must be retained for the retention period listed in the State University Model Schedule.
Documents such as letters, messages, memoranda, reports, handbooks, policies and procedures, and manuals written on hard drives or diskettes are considered works in progress or drafts until the final draft is accepted as the official version. Creators may delete drafts and revisions once the record copy has been produced. The working copies should be retained only if they are used to document how decisions were reached in developing programs and policies of the office or unit, or aid in the interpretation or purpose of the final document (e.g. to explain why certain changes were made or to clarify intent.)
Some records are now created only in electronic form, whereas in years past they might have been hard copies. In these cases, the State Model University Schedule that applied to the hard copy is still applicable to the current electronic version. If the retention period has been met and a hard copy would be destroyed, the electronic version may be deleted.
Return to topADMINISTRATIVE DATABASES
Many offices use databases containing information fields arranged and secured so that the information can be maintained or removed for use for various purposes. Much of the utility of a database lies in its flexibility and dynamic character. They change often as information is added, deleted, or modified. Ultimately, from this body of raw information, many different distinct queries can produce different results.
Documents generated from selected information in databases are often produced in hard copy and distributed; however, the databases themselves are retained primarily in electronic format. Few records generated from databases are to be retained permanently. Record copies of reports and other documents generated from databases that document official policies should be printed for permanent retention. Records that are non-policy in nature and are used for informational purposes, or do not set official guidelines or procedures, may be deleted in accordance with the State Model University Schedule.
If hard copy records produced from a database are maintained in the office files, and these hard copies have a limited retention period, the electronic files may be deleted when the information is superseded or no longer useful.
Return to topELECTRONIC SPREADSHEETS
Spreadsheets in electronic format such as hard disks or diskettes and used to produce a hard copy that is maintained in established files may be deleted when no longer useful. If the spreadsheet is kept electronically, it can be deleted when the authorized retention period is reached. If the electronic system contains several spreadsheets with different retention periods, and if the software does not easily allow deletion of individual records, delete the records after the longest retention period has been met.
Return to topSCHEDULES OF DAILY ACTIVITIES
Calendars, appointment books, and schedules documenting meetings, appointments, telephone calls, and other activities by university personnel are increasingly kept in electronic format. Calendars relating to the official activities of the president, provost, vice presidents, and deans must be retained permanently. These should be printed periodically and filed in the official records. Otherwise, calendars may be deleted at the discretion of the employee.
TRACKING AND CONTROL RECORDS
Logs, registers, and other records in electronic format used to track and document the status of correspondence, reports, or other records that are approved for destruction under the guidelines of the State Model University Schedule may be deleted when no longer needed.
Return to topWWW MATERIALS
University departments and schools are increasingly using the World Wide Web instead of or in conjunction with paper documents to publish information about their programs. Materials provided on U of L WWW sites must be managed as other university records are. Documents that in hard copy format would qualify as official university records with permanent or long term value should be printed and retained. WWW documents that do not set or document official policies or procedures and are of a transitory nature may be deleted once their usefulness has ended.
Return to topElectronic mail is a major factor in university offices since correspondence, memos, and reports are increasingly sent and stored electronically. Email does fall under the statutory definition of public records, and as such, the email issued by and received by university employees is subject to open records requests and can be discoverable under legal actions brought against the university.
Senders and recipients of email must be aware that the legal standards for the retention and disposition of university records also apply to email. Email categories include official and general, the same as that of hard copy office correspondence.
Official is defined as documenting the major functions, activities and programs of the university and important events in its history. Electronic mail that falls under this definition must be retained under the guidelines in the State University Model Schedule. Employees should print and retain in department files or store in an accepted, retrievable electronic format email that reflects the official position of the university or that documents the administrative, legal, and fiscal requirements of the institution. UARC recommends printing these emails as the most reliable form of long-term preservation.
General email correspondence which is non-policy in nature and not critical to administrative, fiscal, or legal requirements can be deleted in accordance with guidelines in the State University Model Records Retention Schedule. Form letters, notices of meetings, duplicates and forwarded messages from other offices, spam, and other email messages of a transient nature can be considered reference or information-only material and can be deleted at the discretion of the user. Disposition of electronic mail should take place on a regular and systematic basis in accordance with approved records retention guidelines.
Information Technology has developed default settings for the archiving capabilities of U of L's GroupWise email applications. However, it is important to understand that the GroupWise client cannot determine the relative significance of individual pieces of email. Responsible management of email, including determining which emails constitute important university records and which do not, must be the responsibility of the account user. The University Records Manager will provide advice and support on how to make these decisions, but it is the department and its employees that will be held responsible in the event of a record being inappropriately retained or prematurely destroyed.
As employees leave the university, email accounts remain active for one month after the termination date before being deleted. Before a staff member leaves the unit, a supervisor should confer with the account owner to determine what email must be retained, who within the unit should keep it, and to ensure that the email is forwarded to the proper recipient(s) for appropriate retention. Likewise, any other electronic files maintained on a departing staff member's hard drive should be given a similar assessment. If that person also manages an email service account, arrangements should be made to transfer control of the account to another person within the unit. If there are questions about what records should be retained and what may be deleted, please contact the University Archives. If there are other questions concerning the management of email accounts or other electronic resources, please contact Information Technology.
For more information, see the Kentucky Department for Libraries and Archives web page at http://www.kdla.ky.gov/recmanagement/tutorial/email.htm
Return to topOPTICAL IMAGING
Many offices now use scanners to render paper documents into computer-readable form, usually utilizing optical storage media such as CD-ROMs or DVDs. However, as of this writing, there are no nationally recognized records management standards concerning the longevity of any digital storage media. Considering that such formats as CD-ROMs have existed less than twenty-five years, it is difficult to make definite claims on their longevity over the many decades during which some university records must be preserved.
The Policy Memorandum on Optical Storage of Public Records issued by the Kentucky Department for Libraries and Archives (PM 96-1, Updated September 25, 1998) contains the following guideline on records which are to be converted from hard copy to electronic formats and stored on optical systems. "Public records which are either, (1) scheduled as permanent or, (2) whose vital retention status is ten years or greater, must have manual, eye-readable counterparts." This means that for records with a long retention period, a copy of the records must be maintained on a human readable format such as paper or microfilm. This is because the archival standards for permanence have not yet been met by electronic systems and optical disk media. For further information refer to the Policy Memorandum on Optical Storage (http://www.kdla.ky.gov/recmanagement/tutorial/PM96-1.htm) or contact the University Archives (call 6674, or email us).
Return to topMIGRATION
Migration is a name for the conversion of files in obsolete formats and/or upon obsolete media into forms that may be more easily read by contemporary computers and software. (An example would be migrating old files from WordPerfect format on 5 ¼" 'floppy' disks to Microsoft Word format on CD-ROM's.)
If records are migrated to new versions of software and/or new hardware or are otherwise altered when new hardware and/or software are implemented, an audit trail of any migrations and changes must be maintained. The new system must be able to read the records that the State University Model Schedule requires the university to maintain.
University offices must develop procedures for system and data migration that identify which records will be migrated and the schedule for data backups and recopying, maintaining an audit trail of any migrations that are actually completed. The full migration plan should include backward compatibility in the new electronic records system or software. This means that change to a new system or software should include the conversion of records from the previous system for access in the new one, or it should provide a mechanism such that the records from the previous system can still be accessed. If not, it will be necessary to print the inactive electronic records to paper if the records have not reached the legal destruction period.
Return to topRECORDS DESTRUCTION
Although many of the same practices apply in the application of records schedules for both hard copy and electronic copies, the destruction of these records is different. Hard copy records are destroyed in labor intensive methods such as shredding or by sending them to the landfill. Although electronic records may be erased or written over, records containing confidential information can sometimes be recovered even if they have been erased or the media reformatted. Software that deletes records from a drive is available and destruction of confidential records using these programs is recommended. In some cases the hard drive should also be reformatted to protect the confidentiality of the records. This precaution should be taken if a computer is sent to the Inventory Control Warehouse as surplus property. It is also important that personnel responsible for electronic records maintain a record of destruction of records that are deleted from office systems. The audit trail will include information on disposition status of records and whether the records were destroyed or transferred to hard copy.
The Commonwealth Office of Technology has published a set of best practices for the destruction of electronic records and sanitization of electronic media. This set of best practices can be found at: http://gotsource.ky.gov/dsweb/Get/Document-17661/CIO-077%2B--%2BSanitization%2Bof%2BIT%2BEquipment.doc
For advice on how U of L offices can best comply with these best practices, please contact the U of L Information Technology HelpDesk at http://www.louisville.edu/it/helpdesk/ or by email.
Return to topSECURITY
Many university records contain confidential data. Unauthorized access to or disclosure of these records by university employees is prohibited. For further information on policies and procedures for computer security and computer accounts, contact Information Technology. If you have questions about privacy or confidentially, please contact the University Archives. University Archives will consult with University Counsel and/or the appropriate university office that executed the agreement regarding confidentiality restrictions as needed. If you have questions about the matter of open records requests, contact Dr. William Morison, U of L's open records officer, by email.
CHANGES TO THESE GUIDELINES
Because electronic technology changes quickly, the University Archives anticipates that these electronic records guidelines will require revision. We welcome any suggestions on the subject of the management and preservation of electronic records from university personnel. Contact Chad Owen, University Records Manager.
FOR MORE INFORMATION
To learn more about the state's policies and best practices for electronic systems and records, see the Commonwealth Office of Technology's web page at http://gotsource.ky.gov/dsweb/View/Collection-1450.
For U of L-specific inquiries, contact the University Archives by phone at 6674, or by email, or visit our web site at http://library.louisville.edu/uarc/.
The Kentucky Department for Libraries and Archives has an excellent set of web pages concerning electronic records management, including how to deal with email and web pages. See http://www.kdla.ky.gov/recmanagement/tutorial/electronicrecords.htm.
Return to topReturn to Records Management page