Record/Data Retention and Destruction Policy
Unit: Compliance, Ethics, and Regulatory Affairs
Contact: Marcy Huey
Title: Executive Director
Effective Date: 1/1/2023
Revision Date: 12/21/2022
Purpose
The purpose of this Policy is to establish guidelines for records management, retention, and destruction, and to require all University departments to institute and implement an appropriate records management program for both physical and digital records.Policy
This Policy applies to all records maintained by the University, in digital or physical form, primarily those records in the following categories:- Administrative records
- Athletic records
- Academic and student records, including records related to recruiting, advising, grades, course descriptions, etc.
- Finance records, including records related to procurement, contracts, tax, and budget information
- Enterprise Operations records
- Compliance and regulatory records, including records related to audits, investigations, litigation holds, etc.
- Employment records (faculty, staff, and student, regardless of location) – includes personnel information and information related to benefits, payroll, talent acquisition, etc.
- Public Relations/Communications records
- Public Safety records, including records related to UAPD, Security Resources, Threat Assessment, Emergency Management
- Construction, Facilities, and Grounds records
- Research and Economic Development records
- Patient and Healthcare records
- Marketing/Recruiting records
- Advancement, Donor, and Alumni records
The recommended and/or required retention period for each category of records is outlined in the Records Retention Schedule.
The management of records from creation to destruction should be accomplished in a uniform manner that promotes compliance with laws, regulations, and judicial proceedings; promotes appropriate business objectives; and allows for the management, maintenance, and replacement of associated information systems technology in an efficient and cost-effective manner. Records should be reviewed at least annually to allow for the identification and separation of inactive records; to remove inactive records from databases, records systems, or physical office spaces; and to delete or dispose of records that have met their required retention period. Records that are not in use, nor required to be retained, should be deleted or removed to minimize the data kept.
Changes in regulatory requirements will supersede any timelines identified in this Policy or in accompanying guidance. Further, records that are subject to a litigation hold shall be preserved and maintained even after the expiration of the applicable minimal retention period under this Policy and applicable rules, regulations, and procedures. No record subject to a litigation hold shall be destroyed or deleted unless and until the University’s Office of Counsel confirms in writing that the litigation hold has been removed.
Physical Records Storage
Physical records shall be stored in accordance with the University Archives and Records Management Program. Records should be kept in safe/secure locations and protected from environmental and other potential harm.Authorized personnel shall label records storage containers in sufficient detail to facilitate prompt and accurate content identification. Records shall be filed in records storage containers by year or other specified identification method to facilitate their reference, review and destruction.
Vital records shall be duplicated, and all duplicate records shall be stored at off-site locations, separate from corporate records, for reconstructive use in the event of a disaster.
Electronic Records
The procedures and record retention periods set forth in this policy shall be applicable to electronically stored records. In general, records generated and maintained in information systems or equipment are to be periodically reviewed at least annually by applicable information owners and/or data custodians to ensure that record retention requirements set forth in this Policy and related guidance are being met for electronic information systems. Some records may have more frequent review requirements. Details for expected review periods for specific records are outlined in the Record Retention Guidance.Exceptions
Requests for exceptions from this Policy shall be submitted to the leadership designated within each responsible department listed in the Records Retention Schedule. In order to obtain an exception from this Policy, there must be an alternate, documented process that will assure compliance with the basic objectives stated in this Policy and any applicable legal requirements. Requests shall be submitted via the Request for Exception to Records Management Policy.Disposal of University Records
When University records reach the end of their minimum recommended retention periods, they must be properly deleted or disposed of in accordance with the appropriate University procedures, unless there are regulatory changes, a litigation hold, or approved exceptions that justify or require deviation from the defined retention period.Implementation
The Office of Compliance, Ethics, and Regulatory Affairs (CERA) is responsible for assuring the development of the procedures necessary to implement this Policy.Violations
Improper management of records, including failure to purge records and/or inappropriate destruction or deletion of records, can result in fines and/or civil penalties assessed to the department or the University. Any school, department, or individual found to have knowingly and willfully violated this Policy may be held accountable for some or all of the financial penalties and/or remediation costs that are a direct result of this failure. Members of the University community who need assistance with these requirements should contact CERA (privacy@ua.edu, 205-348-2334).Definitions
The following defined terms are used for purposes of administering this Policy but may be defined differently elsewhere in other policies and materials:- Litigation – Any actual or reasonably anticipated litigation, audit, governmental investigation, or similar proceeding.
- Litigation hold – The identification and preservation of those records or non-records reasonably related to litigation.
- Permanent records – Records that are ineligible for destruction.
- Records – Any documentary material, regardless of physical form or characteristic, that is generated, received, or maintained by the University in connection with transacting its business and is retained for any period of time.
- Records management – The planned and systematic control of business records from their creation through final disposition. Records are only eligible for possible destruction or deletion when the applicable retention period has expired.
- Vital records – Official records that are considered essential to the continuity of the University. Without such records, University business would be significantly impaired as they are necessary for the maintenance and recovery of the business. Such records are essential to the continuation of operations, are essential to the University’s legal and financial status, denote ownership of assets which would otherwise be difficult or impossible to establish, and/or are necessary for fulfillment of obligations to employees, patients, and/or outside interests.
References and Related Resources
Rule 105, Ownership and Preservation of Records and Files, The Board of Trustees of the University of Alabama Board Manual