August 27, 2018
Author: Phyllis Gurgevich
Organization: Access Information Management
An Overview
I. Record Management Basics
Recorded information, from the communication and sharing of information in the early cave drawings & hieroglyphics, to the deliberate historical preservation of significant events in writing, documentation has been around for hundreds of thousands of years.
In today’s business world, saving and eliminating records are both highly important, as is how you go about that saving and eliminating. Proper records management is an important function of every successful corporation.
For each individual business, it is as simple as; identifying what a business record is, defining how to manage that record, determining how long to retain it and how and when to eliminate it.
An effective records management program ensures proper management and disposition of records that are required to conduct the company’s business, meet the company’s legal obligations, and support its tax liabilities. The program also serves to preserve historical corporate information. An effective records management program can provide powerful protection by ensuring compliance with local and federal laws.
However, as simple as it sometimes sounds and as much as it can sometimes be promised, there is no simple solution or off the shelf or out of the box plan. Each business is unique in the records it creates, the flow of business processes and the requirements for retention of certain records. Basically there are no short cuts to good records management.
The digital era has arrived. Today’s business environments are seeing an exploding volume of information. The costs continue to escalate for storage, staff involvement, and response time out to customers. All of the volumes of information and requirements for managing it brings additional concern for companies grappling with their records programs. There are significant penalties for non-compliance, both monetary and criminal.
Regulations are varied by industry. Some of the common rulings are listed below and should be reviewed as applicable to your firm’s line of business.
Online Resources:
- Sarbanes Oxley: http://www.sec.gov/about/laws.shtml#sox2002 On July 30, 2002, the Sarbanes-Oxley Act of 2002 was signed into law. President Bush characterized it as \"the most far reaching reforms of American business practices since the time of Franklin Delano Roosevelt.\" The Act mandates a number of reforms to enhance corporate responsibility and financial disclosures as well as combat corporate and accounting fraud. The Act also created the PCAOB, Public Company Accounting Oversight Board, to oversee the activities of the auditing profession. You may view the full text of the Act online at: http://uscode.house.gov/download/pls/15C98.txt. There are links for updates included on the site as well.
- United States Department of Health, HIPPA Privacy and Security Rules: http://www.hhs.gov/ocr/privacy/index.html and HITECH The Health Insurance Portability and Accountability Act of 1996 (HIPAA) began the move to protecting the privacy of patients data. It limited how health records could be shared, how they were stored, and even mandated the shredding of old records. The Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009 further expanded the security requirements for medical records. One of the goals of the act was to incent medical practices for scanning medical records to electronic health records (EHRs). HITECH also introduced a requirement for organizations to disclose data breaches and introduced a tiered system for issuing fines.
- Fair and Accurate Credit Transactions Act (FACT or FACTA) www.gpo.gov/fdsys/pkg/PLAW-108publ159/content-detail.html Is an Act to amend the Fair Credit Reporting Act, to prevent identity theft, improve resolution of consumer disputes, improve the accuracy of consumer records, and to make improvement in the use of and consumer access to credit information.
- Graham Leach Bliley Act (GLB) also known as Financial Services Modernization Act http://business.ftc.gov/privacy-and-security/grammleach-bliley-act - The GLB Act makes financial institutions (any company that offers its customers loans, financial advice, investment services or advice, or insurance, explain to their customers exactly what their informationsharing practices are and makes requirements for these institutions to safeguard sensitive customer data.
These are a handful of the newest rules and regulations that might impact how your company manages its records, information and data. The impact can extend in ways not readily considered.
Discussion: 5 Quick Tips For Compliance
There are also some local associations that provide information and serve as a resource to Las Vegas business community.
Local Associations: ARMA
Silver State Chapter www.armalv.org
Local Associations: AIIM
http://www.aiim.org/chapters/chapterhome.aspx?chapterid=43
II Essential Records, Business Records: Definitions
Record Any recorded information, regardless of the medium. Business Record Any recorded information regardless of the medium:
- handwritten notes and memos
- typed information
- printed on paper
- sent via email
- posted on a website
- placed on a cd, dvd, drive
- video recordings, audio recordings
- Photos, drawings and pictures that has been:
- created by the company
- received by the company
- used in conducting the work or business of the company
- is evidence of the company’s activities
Essential Records
Essential (or Vital) Record: Records that would have value and meaningful purpose during an emergency situation. They are records that are
- required to respond/react in an emergency
- necessary to resume or continue with your business
- documents that protect health, safety and rights
- would require massive resources to reconstruct
- have sentimental or historical value
III Creating and Managing Policies
Records management and records management programs are the professional management of a company’s full inventory of recorded information. A professional records management program applies policies for each type of record that govern how the information will be treated and protected from creation or initial receipt through its final disposition. It is Important to note that the retention plans are components, key and critical components, of a records management program, but alone are not a records management program.
Benefits of records Management Programs include:
o Improve Operational Efficiencies
o Reduce Operating Costs
o Protection of the company
o Reduce litigation risk
o Compliance with Privacy Laws
o Safeguard vital information
o Compliance with tax and legal regulations
Records Management System: is Software that supports the Records Policy and Retention Schedule. This software often works along with Document Management System and accounting systems.
Implementing a Program
All team members at your organization need to be involved in managing the records in their control and in their possession. All team members need to be both responsible and accountable for adhering to the practices and policies the company establishes.
o Stewardship- it is important to have an empowered and supported person committee or department depending on company size to lead and manage the ongoing business of records management.
o Education and Awareness – continual education of all team members and orientation of new employees is required. Focus on two-way communication so that changes in workflow or documentation can be accommodated. Each department, business unit or group should have a champion assigned who is accountable.
o Inventory / Company assessment – a good program begins with a solid foundation. A complete assessment of the work flow, documents, information and data derived in the normal course of business
o All applicable laws considered – team members, managers and department leaders should assist in identifying any deviations or additional regulations and guidelines in their areas.
o Creating and Managing Policies – Your policies and guidelines should be set forth in writing and include:
o Identification of Roles, Responsibility & Accountability
o Definitions and terminology
o A Policy Statement
o Handling Copies, departing staff
o Storage Guidelines: Climate Controlled, Vault, Security
o Retention Periods & Disposition
o General business records
o Special Records: with a business, tax legal or compliance requirement
o Legal Hold, Notification, Distribution of Orders
o Annual Records Review
o Proper Disposition
Discussion: Case Scenario One Manufacturer
Discussion: Case Scenario Two Legal Firm
IV Imaging Records: From Archive To Business Process Optimization:
Document imaging has quickly become an acceptable solution in record management programs. It can be suitable for businesses that are trying to keep pace with growing storage needs. However, to properly scan and manage archived materials with a definite destruction date and low access/retrieval activity should be evaluated fully as hard copy retention and destruction may still prove more cost-effective.
More important to consider is that imaging of highly active documents can lighten many burdens in the workplace. In these scenarios, document scanning can allow for a much more efficient workplace. With proper security measures, information becomes easier to share across different locations.
Archive: As mentioned, there are some documents that require retention and not frequently accessed. They are required to be available for a set period of time and then are ultimately destroyed. We tend to refer to these are archive records or inactive records.
Business Process Optimization: active records present an opportunity for imaging early and afford the best return on investment on your imaging costs. The earlier you scan a document during the lifecycle of a workflow document, the more efficient it is for your business. The business processes that are initiated off of information contained in these records can be accelerated and workflow streamlined through imaging and data capture
Imaging Benefits
Improved Workflow: One of most important benefits of imaging is improved workflow of information throughout the entire organization. It reduces the labor required to manage and handle the documents. With a simple keyword search all needed documents are instantly available to the employee on their computer. This reduces labor costs and provides the return on investment that is required to justify the program.
As an example, consider how the information flows as an order moves from sales to operations to accounting. Each department has different information they collect and store to do their job. But not every person needs to have access to the entire record. There is no need for the operations department to have access to the customer's payment information. Imaging the order upon receipt provides an opportunity to parse relevant portions of the information and send out to the individual departments. Each department gets the information at the same time, so the lag time waiting for the information to flow can be greatly reduced.
Silos of information to manage: Over time each department builds a system to help them manage their documents. Very little effort is given to integrating the various systems. This exacerbates the problem of multiple records for singe customers and makes the retention requirement difficult to build and enforce. Physical disaster: Recovery of records that have been imaged and are stored on a remote server can expedite the speed with which your firm or company can resume business following any disaster that physically disrupts your work environment. By imaging and storing your firm’s vital records, you can quickly locate the needed files, information and resources that are needed when uncontrollable events happen.
Another significant advantage is legal compliance. Documents are aged and marked for destruction when they reach the end of their lifespan. Security procedures are put into assign a user appropriate levels of access. Each employee can get access what they need for their job and mass downloads are strictly controlled.
There are some other benefits of scanning company records. The need for inside space or outsourced records storage is eliminated or at least significantly reduced. The records are now easier to share among remote workers. The information is available to everyone in real time.
Getting Started: Capturing and Converting
ECM, a topic that will be covered in depth in a later presentation included in the day’s program. For our view here, we mean a software platform that acts as a portal for all the documents of an organization is developed. It can be purchased as software and used on a company server or used as a “software service” as a custom solution from a vendor. Scanning can be performed in-house or even outsourced to an imaging firm. Personal scanners can be useful for low volumes. For high volume processing, production speed scanners in a professional scan environment ensure the most secure and accurate conversion process. Key features and requirements that should be considered include:
o Ability to store electronic records
o Access control to a user level
o Portable document format
o A simple system for adding new documents
o Integration with other company software packages
o Version control of the documents with access logs
o Integration with the company document management policy
o A backup solution
Beyond the basic features there are many other available options that will depend on the individual company and the goals for the conversion:
o Conversion of images to text or optical character recognition (OCR)
o Conversion and integration of multiple file formats
o Website portals
o Enhanced search capabilities
o Ability to export into multiple file formats.
Image Processing
Document Types:
Structured
Semi-structured
Unstructured
Image considerations:
Color, Photos, background, contrast, highlighter Imaging Process Overview
- Prepping Documents
- Indexing
- Quality Control
V Organizing Electronic Content
Your index criteria set the framework for your documents organization. Libraries are built in the platform and records are filed. The filing system can be as basic as a dated archive or a robust database that allows users (depending on permissions) to pull complex data from a variety of sources in a few strokes of the keyboard.
Discussion: Case Scenario Three Auto Dealer
Discussion: Case Scenario Four Title Company
VI Retention and Destruction
Retention Policies need to span across and address all of your hard-copy and electronic records
Review of a Sample Retention Schedule
Applying Retention: It is equally as important to have a program as it is to consistently follow the program you have established for your firm.
Destruction
The need for shred services has never been more important. Information and security breaches are on the rise. Every business collects and maintains private information that can include information about employees, customers, research, products, programs services. There is a legal and moral obligation to protect individuals from identity theft. There is also obligation to protect private company information and research or trade secret information. These obligations to protect should be evident through the lifecycle of the document or record, and don’t end at the finish of its useful life. Shredding documents and destroying electronic media effectively removes the pool of information criminals are seeking to access. It protects the organization the its customers from both known and unknown sources of attack.
Records Requiring Destruction
-Archived Records Destruction
-Working Documents- collection of sensitive working papers that may not have a retention requirement but still should not be casually discarded
-Electronic Data and Information
Shredding is an easy, straight-forward and low-cost method for destroying information. Secure bins can be provided at workstations for the collection of daily work that may contain sensitive information. These are rotated by professional shred companies: removing and securing the inner container, securely transporting to the shred site (onsite of location-based) and providing documentation of the completed shred. Chain of custody is an important consideration when allowing a company to manage your shred materials.
Larger Destruction post- annual review can be conducted onsite, at a shred facility or at the location of stored archive.
Other potential sources of confidential data:
- Retired Computers
- Servers
- Copy Machines
- Smart Phones