Records Management Procedures

I. Procedures

Consistent with the university Records Management Policy, schools and divisions that maintain university records (“Data Custodians”) are responsible for establishing an appropriate records management plan. The university has established a record retention and disposition schedule (Records Retention Schedule), which sets limits on how long different categories of university records are to be retained by schools and divisions before disposal or transfer to the university Archives.

The Retention Periods specified in the Records Retention Schedule are derived from applicable legal, regulatory, accreditation, and other standards, including recommended best practices.

Each school and division should also identify an individual responsible for implementing the respective records management plan (“Records Manager”). This should be an individual in a position with sufficient knowledge and understanding of the operations and business needs of the school or division.
 

A. Conduct a Records Survey

The Records Manager should conduct a Records Survey.

Important considerations include:

• Distinguishing university records that the school or division is required to retain under a Litigation Hold required by the Office of the Senior Vice President and General Counsel (“OGC”) and note any records that may otherwise be the subject of a claim, audit, agency charge, investigation, or enforcement action that has been identified; and

• Distinguishing university records that the school or division should offer to the University Archives before disposal, because they have historical or administrative value. For assistance determining whether university records have long-term historical or administrative value to the university, schools and divisions should contact the University Archives.

For assistance with the Records Survey, Records Managers may contact the Privacy Office. Records Managers should review their Records Survey on a periodic basis to ensure all records managed are captured.
 

B. Establishing Records Management Plan

Based on the results of the Records Survey, Records Managers should establish an appropriate records management plan in accordance with the Records Retention Schedule.

Consider factors such as:

• Determine appropriate storage method for university records (e.g. whether paper documents will be retained, sent to storage, or scanned).

• For electronic storage, GW IT should be consulted to determine appropriate storage applications.

• Determine appropriate disposal method of university records based on their classification (e.g. Regulated Information in paper form should shredded; for disposal of Regulated electronic records, contact GW IT for assistance).

The records management plan for each school and division should be reviewed by the Privacy Office. To make any substantive changes to their records management plan, records managers should contact the Privacy Office.
 

C. Implementing the Records Retention Schedule

GW Schools and Divisions are responsible for retaining only those records to which they are the official custodian of as noted in the Records Retention Schedule.

Records listed in the Records Retention Schedule

Records maintained by schools and divisions falling within the Records Retention Schedule must be retained for not less than the minimum Retention Period specified for that category of record. At the conclusion of the Retention Period, the University Records should be destroyed, unless the applicable records are subject to a Litigation Hold, or the applicable records are transferred to the University Archives due to their historical or administrative value to the university. In the event of a Litigation Hold, the applicable University Records shall be maintained through the final resolution of the Litigation Hold as determined by OGC. After the Litigation Hold is released, the appropriate Retention Period for the University Records will apply.

Records not listed on the Records Retention Schedule

If there is a category of University Records maintained by a school or division that is not listed on the Records Retention Schedule, the appropriate official from that school or division should contact the Privacy Office, with a description of the category of University Records and a recommended Retention Period. The Privacy Office will work with OGC to review and modify the Records Retention Schedule as appropriate.

Modifications to the Records Retention Schedule

The Privacy Office may make additions, deletions, and modifications to the Records Retention Schedule based on applicable legal, regulatory, accreditation, and other standards, including recommended best practices. Faculty and staff should contact the Privacy Office promptly if they believe that applicable standards require a Retention Period that differs from the period established in the Records Retention Schedule.

Disposal of University Records

In absence of a Litigation Hold or an authorized exception, schools and divisions are responsible for the proper disposal of University Records upon expiration of the Retention Period established in the Records Retention Schedule. The appropriate method for disposal depends on the physical form or medium (e.g., paper or electronic) and the subject matter of the University Records.

University Records containing Regulated or Restricted Information, as defined in the Data Classification and Protection Guide, must be destroyed in accordance with the level of confidentiality or sensitivity of the records.

Schools and divisions may contact GW IT for assistance with the destruction of electronic University Records stored in university systems in accordance with the established Retention Periods.
 

D. Managing Electronic Records

Records are not determined by physical form, media, or format, but by their content. Therefore, electronic messages (email or instant message) sent / received while conducting university business are also university records, yet their format (email, IM) is considered transitory (temporary) in nature. When such messages contain information with administrative or business value, that should be preserved as a University Record, they should be memorialized by transferring the information to a more permanent form and repository, as needed.

Emails

Email messages and attachments involving University business are administrative records and are owned by the University, even though they may be in one individual’s mailbox.

Email record retention requirements depend on their content. Where the Records Retention Schedule requires that information included in GW email should be retained for a certain period of time, the respective email should be saved in a format and repository appropriate for the classification of the information therein, in accordance with the university’s Data classification and Protection Guide.

Instant Messages

Like email, text and chat/instant messages are designed to permit communication between computers, phones, and other networked devices. However, they differ in ways that significantly impact records management.

By comparison, an email contains a header made up of fields including, date, time, recipients and sender, while individual chat and text messages often mask or fail to include the address, username, or phone number of the account holder (information which may be critical to the authenticity of a university record).

Therefore, as a best practice, information with administrative or business value to the University should not be transmitted via instant message (chat, txt).

In situations where information with administrative or business value to the University has been transmitted via instant message, the recipient should request the information (record) to be re-transmitted via email, attachment or link to a document stored in an university repository, thus having the record saved in an appropriate form and repository.
 

E. Convenience Copies

To meet business and operational needs, schools and divisions may create and maintain unofficial copies of University Records for various purposes (i.e., convenience copies). Data Custodians should make such convenience copies only when there is a compelling business or operational need.

Data Custodians should avoid making convenience copies of electronic University Records stored in enterprise or university-wide data management systems of record (e.g., Banner, Enterprise Account System) to protect the security and integrity of those records.

If a school or division has convenience copies of University Records, that school or division is responsible for the proper disposal of such copies. Convenience copies should be disposed of upon the earlier of (i) the conclusion of the business need for which the copy was created, or (ii) the expiration of the Retention Period for the copied University Records established in the Records Retention Schedule. Convenience copies should not be maintained after the expiration of the applicable Retention Period.
 

II. Contacts

Questions about these procedures should be directed to the following offices based on the subject:

III. Definitions

University Records means all official materials created in the course of the university’s operations. This includes information created or received in any form, such as emails, paper documents, electronic files, database or application information, photographic media, and other electronic information.

Records Survey refers to the creation of an inventory of all types of University Records maintained by a school or division, including information regarding their quantity, physical form, type, location, value, and format (such as paper or electronic).

Retention Period refers to the established period of time that University Records should be maintained for the university’s business operations or archival purposes, or to satisfy specific requirements, including, but not limited to, accounting, audit, legal, and tax requirements, after which period of time the records are subject to Disposal.

Disposal refers to the process of permanently destroying or deleting University Records after the Retention Period has expired, including, but not limited to, recycling records containing Public Information, shredding records containing Regulated or Restricted Information, in accordance with the level of confidentiality or sensitivity of the records, and erasing electronically stored records.

Litigation Hold refers to the process used to preserve all forms of relevant information when litigation is anticipated or pending. OGC will notify relevant departments and work with staff to identify and preserve any records (including electronic records) and other information that could be relevant to the matter. This will include a directive that the department’s normal record retention and disposition protocols must be suspended pending resolution of the matter.

Regulated Information refers to information that is protected by local, national, or international statute or regulation mandating certain restriction.

Restricted Information refers to information that must be limited to appropriate university faculty, staff, students, or other authorized users with a valid business need.

Public Information refers to information with no restrictions on access, use, or disclosure, as defined in the Data Management and Protection Standard.