Records Retention and Management at BU
Record Retention
WHAT IS A RECORD?
A University Record is recorded information in any form, including non-tangible electronic formats, which is created, received, recorded, or legally filed in the course of University business. University Records serve as evidence of the University’s organization, functions, policies, decisions, procedures, operations, transactions, or other activities.
Boston University requires that University records, regardless of format, be retained for specific periods of time and then disposed of in accordance with retention periods established for types of records based on legal obligations, institutional requirements, and historical value. The University’s Data Protection Standards classify the types of data the University generates and specify the appropriate level of security protection for each class of data. All University Units and Departments are responsible for the retention, security, and disposal of University Records as outlined in the Record Retention Policy, the Record Retention Table and the University’s Data Protection Standards. The policy enables the effective and compliant retention of University records in any format, paper or electronic. The policy aims to ensure that critical records are available to meet business needs while preserving the document’s history, complying with legal requirements, and ensuring data privacy.
WHAT IS RECORDS MANAGEMENT?
Records management is the process by which records are identified, classified, used, and preserved, and records that have reached the end of their retention periods are disposed of or destroyed. Boston University is committed to effective records management to preserve its history, ensure that critical records are available to meet business needs, comply with legal requirements, protect sensitive information, optimize the use of space, reduce the cost of record retention, and ensure that records no longer required to be retained are destroyed. If a record is kept after its retention period has passed and its legal, operational, historical, or archival value to the University has ended, this record expands the amount of information, especially non-public information, that can be compromised after a data breach, and increases the burden on the University when a data request or legal subpoena is received. When the University receives an E-discovery request for records, the University must examine and release all relevant information that it possesses at the time that the request is made, including those records that have been retained longer than the retention period. As a result, the cost of complying with E-discovery requests becomes higher with the amount of data the University retains. Accordingly, proper records management minimizes costs to the University and allows each unit and/or office to efficiently locate and utilize information.
DEFINITIONS
Active Record: An original University Record currently used by the office, department or other area of the University that generated it. Active Records remain active for varying numbers of years, depending on the purpose for which they were created and regulatory requirements. Active Records may be retained in the originating office or at an offsite storage company. Active Records include records in all formats, including but not limited to: paper, fiche, digitized or scanned documents, electronic documents, and all other formats.
- Archival Record: An originalUniversity Record that has permanent or historic value, is inactive, and is not required to be retained in the office in which it originated or was received. Archival Records are retained and preserved indefinitely in the University Archives. The University’s Records Administrator will make all final decisions concerning whether records will be preserved in the University Archives.
- Electronic Record: A University Record kept in a non-tangible electronic format. Electronic Records include but are not limited to: word processor documents, spreadsheets, databases, HTML documents, scanned or imaged documents, and any other type of file warehoused online, on a mainframe, on a computer hard drive, or on any external storage medium (including disks and thumb drives). The same retention standards that apply to tangible University Records also apply to Electronic Records, and the retention periods outlined in the Record Retention Table apply equally to University Records in all formats.
- Fiche: A type of record format consisting of a flat sheet of microfilm, typically used for the purpose of maximizing space efficiency. University records kept on fiche are bound by the same standards and retention periods as records kept in paper or electronic formats.
- Inactive University Records: An original University Record that is not an Active Record but still must be maintained pursuant to the Record Retention Table set forth below. Inactive University Records are typically maintained at the University’s preferred Offsite Storage vendor or at other locations on campus; however, Inactive University Records of historical significance are maintained by the University Archives as directed by the Records Administrator or its designee.
- Official Repository: The office or department designated as having responsibility for retention and timely destruction of particular types of official University Records. The University’s Records Administrator, or designee, will make the final determination concerning the Official Repository for University Records. For example: The Payroll Office is the official repository for annual employee payroll records. There is no need for offices and departments that are not the Official Repository for a University Record to retain copies of those records.
- Offsite Storage: University Records that are in any format and are no longer needed may be stored with the University’s preferred vendor for Offsite Storage. The Offsite Storage vendor provides a fee based service for picking up and maintaining inactive records, and also delivering those records if they are needed again on campus. See the Procedures section of the Record Retention Policy for instructions on how to store records at Offsite Storage.
- Personal Information: Records that include an individual’s name together with that individual’s Social Security Number; drivers’ license number or Massachusetts state identification card number; financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password that would permit access to an individual’s financial account; or biometric indicator. Personal Information is highly sensitive, and must be safeguarded and secured at all times.
- Records Administrator: The University’s Records Administrator shall be determined by the President, or the President’s designated representative, and shall be initially the Vice President for Administrative Services. In consultation with the Executive Vice President and University Provost, the Records Administrator may designate certain policy implementation functions to other offices.
- Records Committee: The University’s Records Administrator shall convene a Records Committee to develop procedures for the implementation of the Record Retention Policy and to help ensure compliance. The Records Committee shall include representatives from the offices of the President, Information Systems and Technology, University Provost, Provost of the Medical Campus, Comptroller, Human Resources, Internal Audit, University Registrar, Research Compliance, General Counsel, and any other office or department as the Records Administrator, in consultation with the Executive Vice President and the University Provost, deems appropriate, including representatives from the faculty.
- University Record: The original or official copy of any record/document, including Electronic Records, in any format. Formats include but are not limited to: paper, fiche, and electronic. The University’s Records Administrator or its designee will make the final determination concerning the Official Repository for University Records and the Official Repositories for these records are identified in the table at the end of this document. There is no need for offices and departments that are not the Official Repository for a University Record to retain copies of those records.
EMPLOYEE OBLIGATIONS RELATING TO RECORDS
In consultation with and under the direction of the University Records Administrator or its designee, each unit manager or department head, or a designee, must:
- Determine the appropriate format for University Records under their area of responsibility;
- Implement the unit’s and/or office’s record management practices;
- Ensure that these management practices are consistent with University policies;
- Educate staff within the unit and/or office in understanding sound record management practices, including retention periods and security practices;
- Preserve Inactive University Records (see the “Definitions” Section of this document) of historic value, and transfer those records to the University Archives;
- Ensure that access to confidential files and documents or electronic media that contain non-public information is restricted in accordance with all University policies, including the Data Protection Standards, and that any restrictions on accesses to selected Archival Records are noted at the time of transfer to the University Archives;
- Keep accurate notes of what records are transferred to the University Archives or an Offsite Storage Vendor and the anticipated destruction date of these records;
- Destroy Inactive University Records that have reached the end of their retention period and have no remaining legal, operational, or historic/archival value; and
- At least annually, review the Record Retention Table for any changes in the regulatory environment, operational needs, or other considerations that require changes to retention periods or practices.
ELECTRONIC RECORDS
Electronic Records storage provides significant advantages to the University. The cost of electronic storage is significantly lower. Documents stored electronically, if appropriately created and organized, are easier to access, to search, and to destroy when the retention period has ended. The option of storing a document electronically should always be investigated first.
Records Owners may decide to replace official paper copy records with electronic or digital copies, so long as the images meet certain criteria for accuracy, future usability in the face of changing technology, and the prevention of tampering.