Electronic Records at U of L: Guidelines for Access, Retention, Destruction
Most of us create and use electronic records every day. If you send or receive email, exchange notices of meetings, update databases or spreadsheets, or create word processing documents, then you are using electronic records. The informational content of electronic record systems constitutes an important part of the university's corporate memory as well as a source of its accountability, and must be managed as a valuable university asset.
Kentucky law defines public records as "all books, papers, maps, photographs, cards, tapes, disks, diskettes, recordings, and other documentary materials, regardless of physical form or characteristics, which are prepared, owned, used, in the possession of or retained by a public agency" (KRS 171.410, Section 1). The Kentucky Open Records Act mandates that "public records shall be open for inspection by any person, except as otherwise provided by KRS 61.870-61.884" (KRS 61.872)
The fundamental rule of managing electronic records is: Records management standards and principles apply to all forms of recorded information, from creation to final disposition. Electronic records are subject to retention, destruction, and inspection under these laws just as if the record were stored on paper. Guidance on records management issues, including electronic records matters, may be obtained from the University Archives and Records Center, which administers state and university policy concerning the management of university records. Feel free to call us at 852-8789, email us, or visit our website at http://louisville.edu/library/archives/.
As noted above, university policy for management of university records is administered by the University Archives and Records Center. UARC's Chad Owen serves as U of L's records manager. He works with departments to help them deal with records problems. However, the departments themselves -- their administrators, staff, and faculty -- are accountable for the day-to-day administration, control, preservation, access, and security of records within their custody in accordance with state and federal laws. It is ultimately the responsibility of the creators and users of electronic records to ensure that they are properly cared for.
In other words:
University employees are responsible for maintaining the integrity of records whether stored electronically or in hard copy. Information in records systems must be maintained until the legal, fiscal, and administrative retention periods have been met.
All employees must ensure that electronic records are maintained so that they are readily available for appropriate use, and so that established records management procedures, including disposition and/or destruction, can be carried out.
University employees are responsible for maintaining the integrity of records whether stored electronically or in hard copy. All records, including electronic records, must be maintained until the legal, fiscal, and administrative retention periods have been met. All employees must ensure that electronic records are maintained so that they are readily available for appropriate use, and so that established records management procedures, including disposition and/or destruction, can be carried out.
Under no circumstances will employees permit the destruction or loss of records, in electronic or hard copy, if the employee has any reason to believe that the records are related to any current open records request, subpoena, litigation, investigation, audit, or other governmental proceeding.
In Kentucky, the Public Records Division's State University Model Schedule lists the retention and disposition instructions for university records. These schedules are applicable to all records, both traditional (paper) and electronic. Office personnel should use the schedule for determining the minimum time that records must be kept to satisfy the administrative, fiscal and legal needs of the university.
Records that are vital in supporting the core activities of the university must be identified and scheduled for routine backup. However, while simply backing up a record is crucial, it is not the same as archiving a file. Electronic files and storage media have an imperfect history of survivability: files, folders, or entire hard drives may be corrupted and lost; CDs, DVDs, or other media may be damaged or unreadable. Therefore, for documents which are to be retained longer than ten years, UARC recommends creating a hard copy for preservation purposes.
Consistent with the State University Model Schedule, most university records have a limited retention period. If an office retains records for the required length of time, on whatever medium it chooses, it is meeting legal requirements. Records required for audit purposes must be made available in hard copy or on a current computer system according to Internal Revenue procedures.
Employees should take measures to protect permanent records produced by word processing software, either by printing the documents or preserving them in electronic form separately from materials of a non-permanent nature. This is to prevent accidental deletion or destruction with non-permanent records when the retention period for non-permanent records has expired.
Non-permanent electronic records should be deleted at the end of their retention period.If a printed record copy is distributed, the electronic version may be deleted. If the official record copy is kept electronically, however, it must be retained for the retention period listed in the State University Model Schedule.
Draft documents such as letters, messages, memoranda, reports, handbooks, policies and procedures, and manuals written on hard drives or diskettes are considered works in progress until the final draft is accepted as the official version. Creators may delete drafts and revisions once the record copy has been produced. Working copies should be retained only if they are used to document how decisions were reached in developing programs and policies of the office or unit, or aid in the interpretation or purpose of the final document (e.g. to explain why certain changes were made or to clarify intent).
Some records are now created only in electronic form, without ever existing in a paper or other hard copy format. In these cases, the State Model University Schedule that applied to the hard copy is still applicable to the current electronic version. If the retention period has been met and a hard copy would be destroyed, the electronic version should be deleted.
Many offices use databases containing information fields arranged and secured so that the information can be maintained or extracted for use for various purposes. Much of the utility of a database lies in its flexibility: databases change often as information is added, deleted, or modified. Ultimately, from this body of raw information, many different distinct queries can produce different results.
Documents generated from databases are often produced in hard copy and distributed; however, the databases themselves are retained electronically. Compared to the database itself, which may have a long retention period as a whole even though its parts are fluid, few records generated from databases are to be retained permanently. Record copies of reports and other documents generated from databases that document official policies should be printed for permanent retention. Records that are non-policy in nature and are used for informational purposes, or do not set official guidelines or procedures, may be deleted (or destroyed, if in hard copy) in accordance with the State Model University Schedule.
Spreadsheets in electronic format used to produce a hard copy that is maintained in established files may be deleted when no longer useful. If the spreadsheet is kept electronically, it can be deleted when the authorized retention period is reached. If the electronic system contains several spreadsheets with different retention periods, and if the software does not easily allow deletion of individual records, delete the records after the longest retention period has been met.
Calendars, appointment books, and schedules documenting meetings, appointments, telephone calls, and other activities by university personnel are increasingly kept in electronic format. Calendars relating to the official activities of the president, provost, vice presidents, and deans must be retained permanently. These should be printed periodically and filed in the official records. Otherwise, calendars and calendar events may be deleted at the discretion of the employee.
Logs, registers, and other records in electronic format used to track and document the status of correspondence, reports, or other records that are approved for destruction under the guidelines of the State Model University Schedule may be deleted when no longer needed.
University departments and schools are increasingly using the internet instead of or in conjunction with paper documents to publish information about their programs. Materials provided on U of L web sites must be managed as other university records are. Documents that in hard copy format would qualify as official university records with permanent or long term value should be printed and retained. Web documents that do not set or document official policies or procedures and are of a transitory nature may be deleted once superseded or their usefulness has ended.
Electronic mail is a major factor in university offices since correspondence, memos, and reports are increasingly sent and stored via the university’s email system. Email does fall under the statutory definition of public records, and as such, the email issued by and received by university employees is subject to open records requests and can be discoverable under legal actions brought against the university.
Senders and recipients of email must be aware that the legal standards for the retention and disposition of university records also apply to email. Email may be categorized into “official” or “general/routine” categories similar to hard copy correspondence.
Official correspondence is defined as documenting the major functions, activities and programs of the university and important events in its history. Electronic mail that falls under this definition must be retained under the guidelines in the State University Model Schedule. Employees should print and retain in department files or store in an accepted, retrievable electronic format email that reflects the official position of the university or that documents the administrative, legal, and fiscal requirements of the institution. UARC recommends printing these emails as the most reliable form of long-term preservation for the historical record.
General email correspondence which is non-policy in nature and not critical to administrative, fiscal, or legal requirements can be deleted in accordance with guidelines in the State University Model Records Retention Schedule: usually, after two years. Form letters, notices of meetings, duplicates and forwarded messages from other offices, spam, and other email messages of a transient nature can be considered reference or information-only material and can be deleted at the discretion of the user. Disposition of electronic mail should take place on a regular and systematic basis in accordance with approved records retention guidelines.
Information Technology has developed default settings for the archiving capabilities of U of L's Outlook email applications. Specifically, Outlook will automatically archive all emails after 90 days, and delete the emails after two years unless they are placed into one of the retention-specific Archive folders for retention for five, seven, ten, or fifteen years. However, it is important to understand that the Outlook client cannot determine the relative significance of individual pieces of email. Responsible management of email, including determining which emails constitute important university records and which do not, must be the responsibility of the account user. The University Records Manager will provide advice and support on how to make these decisions, but it is the department and its employees that will be held responsible in the event of a record being inappropriately retained or prematurely destroyed.
As employees leave the university, data from their email accounts is retained in backups for one month after the termination date before being deleted. Before a staff member leaves the unit, a supervisor should confer with the account owner to determine what email must be retained, who within the unit should keep it, and to ensure that the email is forwarded to the proper recipient(s) for appropriate retention. Likewise, any other electronic files maintained on a departing staff member's hard drive and network space(s) should be given a similar assessment. If that person also manages an email service account, arrangements should be made to transfer control of the account to another person within the unit. If there are questions about what records should be retained and what may be deleted, please contact the University Archives. If there are other questions concerning the management of email accounts or other electronic resources, please contact Information Technology.
For more information on the retention of email, see the Kentucky Department for Libraries and Archives web page at http://kdla.ky.gov/records/Documents/EmailGuidelines.
Many offices now use scanners to render paper documents into computer-readable form. The Policy Memorandum on Optical Storage of Public Records issued by the Kentucky Department for Libraries and Archives (PM 2010-01) contains the following guideline on records which are to be converted from hard copy to electronic formats and stored on optical systems. "Scanned images of public records scheduled as permanent shall have manual, eye-readable counterparts, such as paper or microfilm This requirement does not apply to ‘born digital’ images or scanned images of primarily non-textual records (e.g., maps and photographs)." This is because the archival standards for permanence have not yet been met by electronic systems and optical disk media. For further information refer to the Policy Memorandum on Optical Storage or contact the University Archives (call 852-8789, or email us).
Electronic records may exist in numerous file formats or systems; they may be stored on servers, in a document management system such as SharePoint, or on optical storage media such as CD-ROMs or DVDs. However, as of this writing, there are no nationally recognized records management standards concerning the longevity of any digital storage media. Considering that such storage media as CD-ROMs or file formats such as Word’s “.doc” or Adobe’s “.pdf” have existed less than twenty-five years, it is difficult to make definite claims on their longevity over the many decades during which some university records must be preserved. Migration is the conversion of files in obsolete formats and/or upon obsolete media into forms that may be more easily read by contemporary computers and software. (An example would be migrating old files from WordPerfect format on 5 ¼" 'floppy' disks to Microsoft Word format on CD-ROM's.)
If records are migrated to new versions of software and/or new hardware or are otherwise altered when new hardware and/or software are implemented, an audit trail must be maintained. The new system must be able to read the records that the State University Model Schedule requires the university to maintain.
University offices must develop procedures for system and data migration that identify which records will be migrated and the schedule for data backups and recopying, maintaining an audit trail for any migrations that are actually completed. A change to a new system or software should include the conversion of records from the previous system for access in the new one, or it should provide a mechanism such that the records from the previous system can still be accessed. If not, it will be necessary to print the inactive electronic records to paper if the records have not reached the legal destruction period in order to maintain their legal accessibility.
Hard copy records are destroyed in labor intensive methods such as shredding or by sending them to the landfill. Although electronic records may be erased or written over, records containing confidential information can sometimes be recovered even if they have been erased or the media reformatted. Software that deletes records from a drive is available and destruction of confidential records using these programs is recommended. In some cases the hard drive should also be reformatted and/or physically rendered inoperable or destroyed (such as by drilling holes in the drive or crushing it) to protect the confidentiality of the records. This precaution should be taken if a computer is sent to the Inventory Control Warehouse as surplus property. It is also important that personnel responsible for electronic records maintain a record of destruction of records that are deleted from office systems. The audit trail will include information on disposition status of records and whether the records were destroyed or transferred to hard copy.
The Kentucky Department for Libraries and Archives has put forth a set of guidelines for proper destruction of records , including electronic records.
Many university records contain confidential data. Unauthorized access to or disclosure of these records by university employees is prohibited. For further information on policies and procedures for computer security and computer accounts, contact Information Technology. If you have questions about privacy or confidentiality of records, please contact the University Archives. University Archives will consult with University Counsel and/or the appropriate university office that executed the agreement regarding confidentiality restrictions as needed.
If you have questions about the matter of open records requests, contact U of L's open records officer by email.
Because electronic technology changes quickly, the University Archives anticipates that these electronic records guidelines will require revision. We welcome any suggestions on the subject of the management and preservation of electronic records from university personnel. Contact Chad Owen, University Records Manager.
To learn more about the state's policies and best practices for electronic systems and records, see the Commonwealth Office of Technology's web page.
The Kentucky Department for Libraries and Archives has an excellent set of web pages concerning electronic records management, including how to deal with email and web pages.