Record Retention Policy

Attached to this policy is a Records Retention Schedule. This Schedule sets forth the recommended minimum retention period for each category of records. The categories are intended to be general and should be interpreted as including all types of records relating to that category, including correspondence, notes, reports, etc. The schedule also lists the official repositories for University records. Departments that are not official repositories and that retain duplicate or multiple copies of these records, should dispose of them when they are no longer useful.

Records not identified should not be disposed of without first consulting with the Controller.

This policy shall apply to all records regardless of whether the records are stored on paper or on computer hard drives, floppy disks or other electronic media.

Departments that maintain University records are responsible for establishing appropriate record retention management practices. Each unit’s administrative manager or a designee must

• Implement the unit’s and/or office’s record management practices;
• Ensure that these management practices are consistent with this policy;
• Educate staff within the administrative unit in understanding sound record management practices;
• Preserve records of historic value and transfer those records to the Archives;
• Ensure that access to confidential files is restricted with long-term restrictions on access to records that are archived being established at the time records are placed in permanent storage; and
• Destroy inactive records that have no archival value upon completion of the applicable retention period

The Controller is responsible for the overall administration and enforcement of this policy. Either the Controller or another responsible person will monitor general compliance with this policy and is specifically charged with overseeing periodic reviews of records in accordance with the policy. Oversight shall include creation of an index of active and inactive records as well as maintaining records of all destroyed documents.

Following the minimum retention period, a determination of whether to preserve or dispose of the documents must be made. If there is a question regarding whether a record has historic value to the University, consult the University Archivist, who has authority to designate which records shall be archived.

Records to be destroyed in accordance with the attached retention schedule should be destroyed using a method that preserves the confidentially of the information, if applicable.

If records must be moved to an off-site storage location, the following considerations should be made when determining how such records will be stored

• Access and retrieval needs, including frequency of retrieval, emergency access needs and potential costs associated with retrieving the records
• Specific environmental conditions necessary to preserve the records
• Security requirements to prevent unauthorized access to the records
• Filing system to permit rapid retrieval of records

Documents that are sent to storage should be identified by category and should indicate a planned destruction date determined in accordance with the attached schedule. The individual responsible for carrying out this policy shall use these dates to identify records ready for destruction.

The University acknowledges its responsibility to preserve information relating to litigation, audits and investigations. The Sarbanes-Oxley Act of July 30, 2002, makes it a crime to alter, cover up, falsify, or destroy any document to prevent its use in an official proceeding. Failure on the part of employees to follow this policy can result in possible civil and criminal sanctions against the University and its employees and possible disciplinary action against responsible individuals (up to and including termination of employment). Each employee has an obligation to contact the VP for Business and Finance of potential or actual litigation, external audit, investigation or similar proceeding involving the University that may have an impact as well on the approved records retention schedule.

The legally-required retention periods set forth on the attached schedule presumes the operation of the University in the “ordinary course of business.” Destruction of records relating to litigation or governmental investigations may constitute a criminal offense. The VP for Business and Finance shall be responsible for suspending destruction of any University records as soon as litigation, federal government investigation, civil action, audit by a governmental agency or enforcement proceeding is suspected, reasonably anticipated or is commenced against the University, its officers, directors or employees. The VP for Business and Finance shall be responsible for notifying individuals at the University responsible for record retention activities to ensure that destruction of records is suspended until the litigation, investigation or proceeding is complete.

Work related electronic mail (“e-mail”) messages are corporate records and must be treated as such. It is the responsibility of the sender of the e-mail message and the recipient of messages from outside the University to manage e-mail messages according to this records retention policy. An e-mail message that does not meet the definition of a record (i.e., personal e-mail or junk e-mail) should be deleted immediately from the system.

The University’s e-mail servers are NOT intended for long-term record retention. E-mail messages and any associated attachment(s) with retention periods greater than three (3) years should be kept in similar fashion to paper records or electronically stored in an appropriate file on the network drive, so that it may be maintained and stored in accordance with the records retention policy. It is important to note that the e-mail messages should be kept with any attachment(s). The printed or electronic copy of the e-mail message must contain the following header information

• Who sent the message;
• Who the message was sent to;
• Date and time the message was sent; and
• The subject of the message

When e-mail is used as a transport mechanism for other record types, it is possible, based on the content, for the retention and disposition periods of the e-mail message and the transported record(s) to differ. In this case, the longest retention period shall apply.

An e-mail message can be deleted once a paper copy has been printed or the e-mail message has been stored electronically in a file on the network drive. The paper copy or the electronic copy must be retained for the correct time period as determined by this record retention policy.

It is Information Technology Services’ policy to keep three months of daily backups of active email accounts. When employees separate from service their email accounts are archived for one year.

In accordance with the Family Education Rights and Privacy Act (FERPA), students may inspect their education records. In addition, FERPA limits disclosure to others of personally identifiable information from education records without the student’s prior written consent. Finally, FERPA provides students the opportunity to seek correction of their education records where appropriate. For more information on FERPA and the release of students’ information, please refer to the FERPA policy set forth in the University’s Student Handbook.

Some student records contain private health information and are subject to the provisions of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). For more information on HIPAA and the protection of private health information, please refer to the University’s HIPPA policy.