Memorandum #313 Records Management and Retention Policy

November 15, 2010

Purpose

• To establish accountability for records management and retention.
• To define certain terms relevant to records management and retention.
• To strengthen safeguards against the unauthorized or accidental disclosure of confidential records.
• To establish the length of time certain categories of records are required to be maintained and stored.
• To establish the time at which certain categories of records should be destroyed, absent exceptional circumstances, in order to allow for the preservation of records maintenance space.
• To establish appropriate records destruction practices and processes.

The program shall, as appropriate, incorporate existing policies and procedures that control reasonably foreseeable risks.

Policy

It is the policy of the Community College of Philadelphia to comply with applicable laws and best practices with regard to the records it maintains, and to apply those laws and practices consistently across College Offices.

Definitions

“Confidential Record” – The following types of Records are considered confidential:

• “Education records” as defined by the Family Educational Rights and Privacy Act of 1974, as amended;
• Individual employment records, including records which concern hiring, appointment, promotion, tenure, compensation, performance, termination or other circumstances of employment;
• Records that include "protected health information" as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA);
• Records the use of which has been restricted by contract;
• All administrative records of the College, with exceptions as specifically defined by the General Counsel including those records which must be open in conformance with Pennsylvania’s Right-to-Know Law, as amended; and
• Records which might expose the College to legal liability if treated as non-confidential.

Duplicate Record
A copy of a Record maintained by a College Office other than the Responsible Office.

Electronic Record
Any Record that is created, received, maintained and/or stored on College local workstations or central servers, regardless of the application used to create that Record.  Examples of Electronic Records include, but are not limited to, electronic mail, word processing documents, scanned documents, spreadsheets and databases.

Originating Office
The College Office where a Record is first created or received from a sender external to the College.

Paper Record
Any Record maintained in a hard copy paper format, regardless of whether the Record was originally created on paper or as an Electronic Record.

Required Retention Period
The retention period set forth in the College’s Records Retention Schedule.

Responsible Office
The College Office responsible for ensuring that a particular Record is maintained for the Required Retention Period.

Electronic Records

Unless otherwise specifically set forth in this Policy, maintenance and disposition of Electronic Records shall proceed on the same basis as Paper Records.

Safeguards Against Unauthorized or Accidental Disclosure

Until Records are properly disposed in accordance with the Records Retention Schedule, each Office of the College is accountable for securing and maintaining its Records, regardless of format or location.  Each Office is accountable for ensuring that employees, and others, are only granted access to Confidential Records essential to the performance of their duties.  Further, each Office must ensure that those granted access are trained and employ reasonable safeguards to protect the Confidential Records.

Records Retention Schedule

The Records Retention Schedule sets forth the length of time Records should be retained by the Responsible Office. 
See Attachment A.

The General Counsel should be notified of any Records not encompassed within the Records Retention Schedule. The General Counsel will determine, in consultation with appropriate Department personnel, whether to destroy the Records in question or add those Records to the Records Retention Schedule.

Recognizing that the Responsible Office must maintain Records in accordance with the Records Retention Schedule, Duplicate Records should be destroyed and disposed of as early as practical once no longer necessary to the operation of the Office maintaining the Duplicate Record.

Certain categories of Records are subject to a “review annually” Retention Period.  Personnel in the Originating Office will review those files annually, disposing of Records that are no longer necessary for or relevant to the operation of the Originating Office.

Extended Retention Period

Records which are retained beyond the Required Retention Period should be destroyed and disposed of, in accordance with this Policy, as early as practical.

Destruction Authorization

Destruction of Electronic Records will be a coordinated effort between the Responsible Office and the Office of Information Technology Services.  When the Required Retention Period for Electronic Records expires, the Responsible Office will initiate the process for the Records’ destruction and disposal.  The destruction of those Electronic Records will be authorized jointly by the senior officer in the Responsible Office and the Chief Information Officer.  If those individuals are unable to agree, destruction will be stayed pending review and final determination by the General Counsel.

Paper Records which are no longer needed by the Responsible Office for the day-to-day operation of that office may be identified by Department staff within the Responsible Office and transferred to the College’s records storage areas. When the Required Retention Period for those Records expires, the Responsible Office shall initiate the process for the Records’ destruction and disposal.  The destruction of those Records shall be authorized jointly by the Vice President for Planning and Finance and the senior officer of the Responsible Office.

If those individuals are unable to agree, destruction will be stayed pending review and final determination by the General Counsel. If Paper Records are still located within the Responsible Office as of the expiration of the Required Retention Period applicable to them, the senior officer of the Responsible Office will initiate the process for the Records’ destruction and disposal.

Safe and Secure Disposal

All Paper Records constituting Confidential Records covered by the Records Retention Schedule shall be destroyed by shredding.  All Electronic Records covered by the Records Retention Schedule shall be destroyed by or under the supervision of the Chief Information Officer.

Destruction Record [Certificate of Destruction]

The Certificate of Destruction contains an inventory describing and documenting every Record, in any format, that has been authorized for destruction, as well as the date and method of destruction. See Attachment B.

The Certificate of Destruction will also identify the individual who was responsible for the Record’s destruction.  The Certificate itself shall not contain confidential information.  Two copies of the Certificate of Destruction will be retained permanently:  one in the Responsible Office and one stored electronically by the Office of Information Technology.  The Responsible Office’s Certificates of Destruction record may be retained in paper, digital, or other format.

Suspension of Records Retention Schedule and Litigation Hold Directives

When litigation involving the College or its employees is filed or threatened, the law imposes a duty upon the College to preserve all Records that pertain to the issues involved.  Once aware that litigation exists or is likely to be commenced, the College’s General Counsel will issue a litigation hold directive to appropriate personnel.  The litigation hold directive overrides the Records Retention Schedule that may have otherwise called for the destruction of the relevant Records until the hold has been lifted by the General Counsel.  The suspension applies equally to Paper and Electronic Records, including Duplicate Records.  No College employee who has been notified by the General Counsel of a litigation hold may alter or destroy a Record that falls within the scope of that directive.

Any College employee who becomes aware of litigation or threatened litigation prior to receiving a litigation hold directive shall inform the General Counsel immediately and shall suspend the Records Retention Schedule until either (a) a litigation hold directive, defining the scope of the suspension, is issued by the General Counsel; or (b) the employee receives confirmation from the General Counsel that no litigation hold directive will be issued.

Depending on the Records involved, the College’s records storage area may be located off-site, in the “Vault,” or another location on campus.  Supervision of the College’s records storage area lies with the Vice President for Planning and Finance.