University compliance: reminder about paper and electronic records

Management and retention policies

Now that spring has arrived, there is no better time to revisit your office or department’s document “spring cleaning” protocols.

Ohio University, like all public institutions, has mandated by policy that colleges and administrative offices create and follow a records retention schedule that takes into account the types of records maintained by the unit. Your college or office records retention schedule provides guidance to help you and your unit to manage the deluge of paper and electronic records that we all generate, receive, and maintain at an ever-increasing rate. Improper retention and unsecured storage create risk of disclosure of private or protected information. Storing records for an indefinite period or keeping information that isn’t being used can quickly contribute to stress, clutter, and other unnecessary problems – all of which can be prevented. 

So how do we know what to keep and what to purge?

Policy 93.002 “Records Management and Archiving” requires departments to plan for retention, purge, and destruction of records created in the course of university operations – whether related to academics, administration, or both. The timeframe varies depending on the type of record and the purpose for which it was created or maintained.

To ensure each unit develops a plan that fits the needs of its business operations, the policy requires identification of at least one person “who oversees custody of university records is, therefore, responsible for consulting the university archivist and records manager to establish and maintain compliance with current records retention guidelines specific to records that are created or received by their office.” [https://www.ohio.edu/policy/93-002 Section B)

A helpful resource is the Inter-University Council of Ohio model Records Retention for Public Colleges and Universities in Ohio schedule.

What is a “record?”   

We find that answer in a related policy. Policy 40.007 defines a record as “A document in any format- paper, electronic (including university e-mail), created, received by, or coming under the jurisdiction of the university that documents the organization, functions, policies, decisions, procedures, operations, or other activities of the university. Electronic records include emails, texts, voicemails, social media and other forms of communication technology.”

Why is a record retention plan important?

By developing and implementing a record retention plan, an office or department can:

• Improve the use of physical and electronic record space
• Control the growth of records volume
• Ensure comprehensive and consistent implementation of record-keeping policies
• Demonstrate compliance with regulatory recordkeeping requirements
• Reduce litigation risks
• Maintain privacy of student, employee, and university records where required by law
• Improve ability to respond to public records requests on a timely basis

Because Ohio University is a public institution, we are subject to the state of Ohio Public Records and Open Meetings laws, collectively known as the “Sunshine Laws” which require our university to maintain and produce public records upon request and in a reasonable timeframe. There is a potential for significant fines, increased scrutiny from regulators, and loss of public trust if records are not accessible and complete.  In addition, retaining records beyond the appropriate retention period creates risk and additional administrative burden because if these records are requested, we must produce them, even if they are outside the retention schedule. Lack of adherence to an established retention schedule may have a negative impact in the event of a security breach or litigation. 

What about email?

For more information about managing email records, please refer to the resource from OHIO’s Office of Information Technology:  Guidelines for Electronic Mail Retention, Back-up, and Archiving.

How do we safely dispose of digital and paper records?

Ohio University provides shredding services and document destruction bins for secure disposal of paper records including documents that contain private, protected or sensitive information. Limited, temporary storage of university records awaiting their final disposition is available from the Office of the University Records Manager at the Library Annex facility. For more information, please review information about Records Storage and Destruction Services.

The Office of Information Security publishes guidance and resources for secure destruction of data. Please review Securely Destroying Data for more information about options for disposition of digital records.

Where can I get more information or report a concern about record management?

Questions or concerns regarding paper or electronic records may be directed to the following offices:

• University Archivist and Records Manager
• Office of Information Security
• Office of Legal Affairs 
• To report compliance issues and concerns about records management/retention you may make an anonymous report to the Ethics Hotline

If you have questions about institutional compliance at Ohio University, please contact: 

Laura L. Myers, J.D., M.A.
Director of University Compliance
myersl@ohio.edu 
Office of Audit, Risk, and Compliance