Electronic Recordkeeping Key Terms

Term Definition Introduced in:

Classifying recordsThe process of categorizing records to ensure that the records are properly handled based on the importance and sensitivity of the information Module 2

Degaussing A way to erase information from a magnetic storage device by de-magnetizing it Module 4

Disaster Recovery PlanAn outlined procedure that specifies the resources required to protect and reinstate healthcare information in the event of a sudden loss of such information Module 5

EEO-1 form

A form used to collect company employment data for categorization by race/ethnicity, gender, and job category; used to support civil rights enforcement and to analyze employment patterns Module 2

HITECH Act

A law promoting the adoption and meaningful use of health information technology, while addressing the privacy and security concerns associated with electronic transmission of health information; includes provisions that strengthen the civil and criminal enforcement of HIPAA rules; part of the American Recovery and Reinvestment Act (ARRA) Module 1

HIPAA

Health Insurance Portability and Accountability Act; the first comprehensive federal protection for the privacy of personal health information requires medical records to be maintained in a separate, locked filing cabinet with extremely limited access Module 1

HygrothermographA device that records humidity and temperature over time in order to properly maintain and preserve document storage Module 3

I-9

A legal document that verifies an employee's right to work within the United States; must be maintained three years after employment begins, or one year after termination – whichever is later Module 1

PHI

Protected Health Information; protects all "individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral Module 1

Record Collected data that provides evidence of a fact or past event Module 1

Record's life cycleA process that depicts what happens to a record from the time of creation to the time it is either archived or destroyed Module 3

Sarbanes-Oxley Act

A law that defines the responsibility of organization executives to implement and monitor processes to report financial information and document management practices Module 1

 Glossary Page 1

Electronic Recordkeeping Key Terms

Term Definition Introduced in:

Spoliation of EvidenceA deliberate act that results in the alteration, loss, destruction, or negligence of relevant evidence prior to the initiation of legal action Module 1

 Glossary Page 2

Page 1

ELECTRONIC RECORD KEEPING FOR HR PROFESSIONALS MODULE ONE – UNDERSTANDING THE LAW AND DEFINING TERMINOLOGY Female: Module One – Understanding the Law and Defining Terminology. Do you

know when the duty to preserve records is triggered? Is every person who is a records

custodian covered in your current policies and procedures? Under current case law

regarding spoliation of evidence, is your organization at risk for sanctions? In five

webinar modules, we will explore the basics of electronic records retention. You will

learn the basics of the law and terminology in this module one. Then we will discuss the

Rule Maker’s Guide to Retention. In module three, we will discuss physical storage

considerations; In module four, document imaging pros and cons, and finally we will

conclude our time with action steps you can take to make the most of this one hour.

Now in just these five modules, we can’t possibly cover the depth of records retention.

Employment records retention is covered by various statutes and regulatory agencies

and federal law as well as state law. But today you will get tips, techniques and best

practice tools to use after this webinar to find the solutions that you are expected to

know as the HR professional. People have preconceived notions about records. But

records are much more than documents in a file cabinet. You must understand the

nature of the record and know how to define it before you understand what actions to

take with respect to that record – whether you should maintain it or destroy it. What are

you using in your organization right now to define records and appropriate actions to

take with respect to each type of record? As an HR professional, one hot tip is you can

create an internal cheat sheet, if you will – a one-pager that defines the types of records

about which you want every employee to have some knowledge. When you think of

records retention, have you been putting it all on yourself as the HR professional? Are

Page 2

you waiting for the organization to give you the money you really need and the

resources you need to be able to engage additional help? Well, if that day is not

coming, you’ve got to create the team approach to records retention to manage risk

because others are creating and even destroying documents without knowledge of the

laws. You want everyone to be a stakeholder in records retention, and you can do that

by creating some general awareness of what the hot documents are, what they’re

called, and what action steps you want employees to take with respect to each of those

types of documents. We’ll talk about best practices in our policies and procedures

section. Records are simply defined as data, which are elements of information that’s

recorded. It’s evidence of data. There’s information about facts or events within that

record. The preservation of records is absolutely critical to avoiding potential sanctions

for what we call “spoliation of evidence.” Some updates that you need to know in terms

of records preservation deal with this concept of the pre-litigation duty to preserve and

the sanctions for spoliation. Here’s what that means. Although the duty to preserve

evidence in the form of various records can arise from specific regulatory, statutory, or

court ordered provisions to preserve documents and information, courts have inherent

authority to sanction – that means to punish – parties who culpably permit the loss or

destruction of relevant evidence prior to the initiation of legal action. culpable for the

pre-litigation duty to preserve. I will give you some rules of thumb today during this

webinar. But the caveat is that even though there are rules of thumb that are guided by

regulatory and government agencies that tell you exactly how long to keep a document,

if there’s potential litigation on the horizon, you nevertheless have a duty to preserve

that information, or you will subject your organization and possibly yourself to sanctions.

Page 3

What’s new? I’ve given you a few of the laws, and we won’t go over every single one of

them today. But you need to be able to speak the terminology. By identifying a few of

these laws, you can be well on your way to appropriately classifying documents, and

then understanding what to do next. HIPAA is very important, particularly in terms of

the changes to the Family Medical Leave Act. As many of you know, HIPAA stands for

the Health Insurance Portability and Accountability Act of 1996. It was the first

comprehensive federal protection for the privacy of personal health information, which is

called PHI. Contrary to popular belief, not all medical information is covered under

HIPAA. The privacy rule, which took effect April 14, 2003, governs the use and

disclosure of protected health information, or PHI. There are stricter requirements now

under the new Family Medical Leave Act changes since our current President’s

administration. And under FMLA, one of the most important things to know is there are

some strict guidelines now regarding direct supervisors having any contact with the

employee’s physician to follow up on an FMLA leave notice form. Direct supervisors

should not have any contact with PHI of employees. You may come in contact with

protected healthcare information at all different points in your position. So be aware of

the guidelines regarding management of medical records. Typically, as many of you

know, the medical records have to be maintained in a separate, locked filing cabinet

with extremely limited access. For the organization’s own protection, PHI should only

be accessed by the privacy officer who’s designated for the organization. One of your

resources is www.dol.gov. That’s the Department of Labor site. If you’ve ever tried to

engage in any research, the toughest part of research strategies is developing key

terms. And this page in your handout gives you some of those key terms. The HITECH

Page 4

Act was signed into law February 19th, 2009, as part of the American Recovery and

Reinvestment Act – the ARRA – and it significantly expands the HIPAA privacy rule and

security standards. So it’s one to review. Sarbanes-Oxley addresses public company

accounting reform and investor protection. Often referred to as Sox or Sarb-Ox, it’s

considered by some to be one of the most significant changes to United States

securities laws since the New Deal in the 1930s. Where you have to watch for

Sarbanes-Oxley potential violations is even in the exchange of email information.

Where we’re talking about electronic record keeping, employees often create records

that we know nothing about. We’ll talk about those unmanaged records in a moment.

But postings on those pesky social networking sites such as Twitter and Facebook

where employees are in real time sort of creating a diary of their work day can pose a

real problem in terms of potential insider trading violations and violations of Sarbanes-

Oxley. For example, a simple Facebook post in real time that says, “Something big is

about to come soon,” and that post is geo-tracked, and everyone in the public can see

that that’s coming from that employee during work while on the premises. And a

reasonable person can then connect that whatever news this employee is speaking

about has something to do with something big at that company. Inadvertently, the

employee may have just exposed the company to violations. What do you have in

place right now in your handbook policies and procedures regarding the use of

Facebook over and above what your expectations are regarding using social networks

on company time? E-discovery is all about electronic data discovery. And as of

December, 2006, electronic records are now considered a separate type of evidence

apart from documents and things. Emails, instant messages, computer files and the like

Page 5

may all fall into the category of now discoverable. And that’s covered in Rule 26 of the

Federal Rules of Evidence. That’s the most common discovery rule. When we’re

talking about electronic data, there are all kinds of quick conversations during the day

that actually can create records. Treat instant messages, text messages, as you would

a written email. That information is discoverable. verify the information on the I-9, that is

all you are doing. When you sign the bottom of the I-9 to verify someone’s status for

employment, that attestation clause says that you have verified the information. Who

makes the rules? There are a number of rule makers, and we can’t possibly go over

every single one today. Here are a few of the organizations for your follow-up after

today. NARA is the National Archives and Records Administration. Their purpose is to

create records management programs for federal agencies. Their website is

www.archives.gov. We’ve talked about HIPAA and the resource hot tip for HIPAA is

www.hhs.gov. We’ve spoken a little bit in module one about unmanaged records.

These are records that are out there – records that often are inadvertently created, and

records about which we have to make some decisions regarding storage and certain

types of protection. Blogs or web log is what that is short for, are those websites where

entries are written in chronological order and displayed in reverse chronological order.

Employees often blog, and that creates some problems because those records are all

certainly discoverable. Are you defining these terms for employees so that they can

help you manage the risk? Cookies is a message given to a web browser by a web

server. The browser stores the message in a text file and the message is then sent

back to the server each time the browser requests a page from the server. The main

purpose of cookies is to identify users and possibly prepare customized web pages for

Page 6

them. Think of cookies as one of the ways in which we leave certain footprints, and all

of that is discoverable. Think very carefully about what you are researching from the

workplace. So please be very careful about your use of access of unmanaged records

to make important employment decisions. You won’t know what to do with records until

you’ve properly classified them. We’ll explore in the next module, how the way you

classify records affects your actions with regard to record retention.

Page 1

ELECTRONIC RECORD KEEPING FOR HR PROFESSIONALS MODULE TWO – THE RULE MAKER’S GUIDE TO RETENTION Female: Module Two – The Rule Maker’s Guide to Retention. The classification of

records is very critical. Do you have a chart or something that you use to classify

records before making decisions? First, name the record. Determine what kind of

information is on it. What form does it take? And how would you classify it? Company

confidential is a need-to-know basis kind of a document. It’s restricted to employees

and officers of the company. Is it private, such as medical information or formulas for

products? Is it sensitive information which can be misused to the detriment of the

information owner, such as Social Security numbers? Is it confidential – information

that could cause damage, or be prejudicial to individuals? Think beyond just the

records retention schedules that are provided by the rule makers that we will discuss

today. Determine record importance and sensitivity, what could happen if it was lost or

destroyed or ended up in the wrong hands. And create a chart that you use that lists

the name of the record, the kind of information, its origin, and then classify it. Here’s

one example of how you could do just that. This is an action step that you could take

after today. If you don’t have something like this in place, I would submit that you may

be negligent in your records retention policies and practices. Decide who on your team

could assist with compiling this information. Perhaps you’ll disseminate something like

this to different departments if you’re a larger organization. Maybe you have something

like this in place, but you’ve not been effectively using it. If people don’t know why

they’re completing charts, are they likely to do it? Some people have to understand

where the task fits into the overall picture. What information do you know already about

the risk of exposure to sanctions that you didn’t know before today, and how could you

Page 2

communicate it effectively to get the buy-in of people on your team? There are a few

critical HR retention rules of thumb, and we can’t possibly go over every single one of

them, but I want to give you a few of those. HIPAA has several administrative

requirements when it comes to retention. HIPAA privacy policies and procedures and

privacy practices notices the disposition of complaints and other actions, activities, and

designations that the privacy rule of HIPAA requires to be documented should be

retained generally for six years. There are various other types of documents that you’re

required to retain, and about which you should have basic information. IRS tax records

are generally required to be maintained for four years if you’re dealing with churches

and religious organizations. But if you’re dealing with other organizations, most of the

records guidelines suggest that you should keep those indefinitely when you’re dealing

with tax records. Certainly consult with your accountant regarding what can be retained

and what should be destroyed. But with IRS records, you have a much longer retention

period. Let’s talk about OSHA. OSHA is the occupational injuries and illness records,

including an annual summary and record in detail on OSHA. Those are required to be

maintained for five years. If you are dealing with the I-9 form, there are some important

things that you need to know. There have been some changes over the last three years

to the I-9 itself. There’s a new form that is available. You can get to it on www.dol.gov.

There are also some great posters that are available on the poster page of the

Department of Labor’s website. If you have not seen that when it comes to a lot of

these laws, and I do think of posters as records, sort of, that you have to keep and you

have to post, go to dol.gov. Do a search on “poster page” and if you’ve been paying for

posters, you will see that you can get free posters right there on the Department of

Page 3

Labor’s website. I-9 forms must be maintained three years after employment begins, or

one year after termination – whichever is later. So think about that carefully. If you

have an employee who has been with you for ten years, should you still have an I-9 on

file for that employee? The answer is yes. If you have to terminate that employee, or

the employee terminates the position by quitting the job, then you would be disposing of

that I-9 one year after the employee’s termination. Now, what are the exceptions to that

rule? You’ve learned one already. This is where spoliation of evidence is an issue.

Let’s say that employee’s been with you for ten years. The employee quits under

circumstances that involve the employee being placed on a performance improvement

plan after a counseling session with the employee’s manager. That is a circumstance

where you might reasonably anticipate this employee might file an EEOC complaint,

might pursue litigation for wrongful termination, because there is something called

constructive termination. Or the employee might argue, “I was effectively pushed out of

my job by this performance improvement plan, and I was put on it because of disparate

treatment in the workplace. I was placed on this performance improvement plan

because of the illegal considerations of my age, the illegal considerations of my race,

the illegal consideration of my gender. Or because I was pregnant, suddenly I was

placed on a performance improvement plan.” These are the kinds of fact sensitive

inquiries that a court would engage in. You as an HR professional now have enough

information to put some pieces of information together from these modules to

understand how just knowing that three years after employment begins or one year after

termination isn’t enough. There are a number of payroll records and records related to

the employment of an individual that must be maintained. The EEO-1 form that you

Page 4

might be required to maintain as an organization must be kept indefinitely. Pre-

employment records for temporary positions must be maintained for 90 days. Do you

know which law regulates that requirement? It’s the ADEA – the Age Discrimination

and Employment. Wage rate tables for piece rates or other rates, and work schedules

such as the established hours and days of employment, or records of wage additions or

deductions, must generally be maintained for two years. A lot of employee records that

relate to payroll generally have a three-year retention schedule. It all depends on the

classification or type of record. We could do hours in this seminar just on the number of

years for each kind of record. Why? It’s because there is no one law where you can go

to see it at a glance. They’re governed by different federal laws. Most of your laws that

apply to payroll practices are found in the Fair Labor Standards Act. Become very

familiar with that. And if you are personally in charge of payroll, you absolutely should

take continued training just on the payroll laws. It can become difficult to have separate

schedules for every single kind of document. As you see, we’ve gone through a few,

and there are so many more. For that reason, some organizations work with their

attorneys or have meetings to regularly discuss records retention policies and

procedures. Do you have a risk management team? Who is on it? Who is charged

with this specific role? You might want to employ general practices that require your

organization to blanketly maintain everything for a period of seven years – seven to

eight years on the outside edge. Ten years tends to cover most of the kinds of records

that you will encounter. But whatever policy you implement, you have to vet it in light of

all the different federal laws. This is where you may want to create your policies and

procedures and save time in a cost effective way, and then have the attorney review

Page 5

what you’ve already created instead of having the attorney draft from point one. And

there are a lot of tools, such as the Ultimate Employer, and other electronic tools such

as that which is software that organizations use to write these policies and procedures

for them. And they’re updated with the law. Here are some more acronyms for you –

places to go for additional assistance in addition to your attorney, accountant, or tax

preparer. There are some organizations such as ARMA, the Association of Records,

Managers, and Administrators. And they’re at www.arma.org. And the Institute for

Certified Records Managers where you can obtain a CRM credential. They’re at

www.ICRM.org. Another quick hot tip for information are two resources that I go to

routinely. And I’m sure many of you do as well. This may be a reminder, or it could be

a revelation – www.hrhero.com. It’s another great place for help and guidance. They

have lots of free tools, and I love free tools and free tips. And it’s a great place to go

where you do not necessarily have to be a member to get access to very good

information, and great articles on records retention. The only way to stay current is by

continuing your training and updating to be proactive. I also like SHRM, the Society for

Human Resources Management, which is www.shrm.com. SHRM has a lot of great

free articles and resources, often written by attorneys and experts in the field of HR, and

even more articles if you join as a member.

[End of recording.]

Page 1

ELECTRONIC RECORD KEEPING FOR HR PROFESSIONALS MODULE THREE – PHYSICAL STORAGE CONSIDERATIONS Female: Module Three – Physical Storage Considerations. It’s not where you’ll put

it, but where you’ll find it when you need it. That’s what Ab Jackson says in How to

Organize Your Life and Get Rid of Clutter. And a big part of records management is the

physical storage issue. I moved to New Orleans, Louisiana two years ago. My

husband was born and raised here in New Orleans. I’m originally from Indianapolis,

Indiana. And we moved, obviously, in the wake of one of the biggest environmental

natural disasters in U.S. history, and that is Hurricane Katrina. And as you can imagine,

Hurricane Katrina has changed so much here in New Orleans for the lives of the people.

And in terms of the issue that we’re talking about today, records retention was

absolutely devastating. Many records were permanently lost or destroyed. And out of

that catastrophe came this opportunity to really think more critically about storage needs

in the future, because as in this environment in New Orleans, we deal with things such

as humidity and climate control needs in addition the obvious risk of another hurricane.

So as we talk about records retention, there are a number of choices that you have to

make, even with respect to electronic data, because no two forms of storage are the

same, and there are particular temperature and environmental considerations to give to

your storage decisions. This is a record’s life cycle – the creation of the record, and this

point of access by various people all of whom may be filing records in different places

and separately making decisions. What’s guiding that filing decision? And then there’s

this important point where you as the HR professional or other employees have to

decide what is the retention period? When can it be destroyed? And how should it be

Page 2

destroyed? And when it comes to electronic records, has it even been destroyed?

Because pushing delete does not destroy an electronic record. Pretty easily through

some computer forensics, others can retrieve the information that should have been

destroyed to protect confidentiality concerns. And the failure to adequately destroy the

information and prevent it from being accessed by others could result in liability to the

organization. Will you image documents? Does it make sense to take some of your

paper records and image those documents? As you can imagine in a courthouse in a

city that’s very known for its architecture and holding on to the old, in New Orleans the

city’s got a way to go in being able to image documents. But it’s very much an issue of

concern to us here in New Orleans, given the climate concerns and the loss of data that

occurred during Hurricane Katrina. Document imaging can become very expensive to

do, and there have to be critical decisions about what really should be imaged. So let’s

talk about some of those storage decisions. Here are the questions you really have to

ask yourself, just as we’ve had to do here in New Orleans, and you should in thinking

about document retention. How vulnerable is the media to fire, flood, and breakage?

Where are the appropriate containers, cases, and/or envelopes to use with a specific

type of media? What are other environmental conditions that could affect the longevity

of the media, such as the ideal temperatures for storing electronic media? For example,

paper is inexpensive and accessible. But it is very space intensive and easily

destroyed. The ideal temperature for storing paper is at 60 to 70 degrees Fahrenheit

with 40 to 50 percent as the humidity factor. If you’re dealing with microfilm or

microfiche, which I hate to say, we’re still dealing with in the courthouse in New Orleans

because we’re dealing with very old records, it’s long-lasting and it preserves space, but

Page 3

it’s expensive to create, expensive to access, and requires less than or equal to 40

percent in terms of humidity. You can imagine, then, what a challenge microfilm can be

in this environment. CD and DVDs actually don’t have an indefinite shelf life, and

neither do flash drives. Flash drives are actually called that because they are

somewhat temporary. A flash drive is not a place to store records that you need for any

long-term period of time. CD-ROMs are getting less expensive. They are very

accessible. But they’re often mistreated and sort of easily damaged, and can be a little

bit finicky when it comes to particular humidity concerns. So the art of being well

preserved in terms of your records is really asking these questions. And these are

questions that you can take after today and even submit in a brief survey to people

around the office or your place of employment, whatever environment you work in, to try

to get some input and answers to these types of questions. There’s some important

storage speak. I can’t say enough about speaking the right vocabulary. In

understanding records retention, there’s some must-know terminology. As the resident

expert in HR, your job is to speak the language that attorneys speak so that you are

showing your organization who to value. And if you do need to retain the assistance of

counsel or of outside vendors who provide various records services, you understand

what to ask for, and you can communicate intelligently with that outside vendor to make

critical decisions for the organization to add value and minimize risk. Archives is a

place containing a collection of records, documents, or other materials of historical

interest. We have certain records if they’re past 1999 that are in archives. When I

came to New Orleans, I am barred in the state of Indiana. Louisiana is the only state in

the United States that follows the Napoleonic Code, so I felt like a fish out of water. I

Page 4

didn’t understand the terminology. And it was uncomfortable. Have you ever had

people throw out acronyms or words and you know you don’t know the meaning? But

what are you willing to do about it? I had to learn how to speak the language of the

community in which I was living and working, and had to learn a whole different type of

legal language to understand the laws here. And you’ve got to do the same. Barcode –

we all know what that is. But it’s also how it can be used. It’s a printed symbol or series

of parallel bars that can be easily read by an optical scanner. In the courthouse where I

work, we often use a charge-out system for records, which I was very surprised and

thought it seemed very old. But it’s less expensive than implementing a barcode

system. So you might be having a conversations where you’re trying to keep track of

who has checked out records. When you’re dealing with medical files in an office where

various people are checking records out, if you’re dealing with a law firm or legal

documents, you might wish to have a system of barcodes implemented so you can see

who checked out a record, when they checked it out, and where it is. It can be a great

way to track certain records. A charge-out card is similar, but lower cost to implement.

It’s just a card that’s inserted in place of documents that are removed from a file that

identifies what was removed, who removed them, and when. How much time have you

spent chasing down particular files or documents to see who’s got it? And then you go

to that person. “Well, I don’t have it anymore. I gave it to so and so.” You might want

to think about a charge-out card system because it can easily save your time, and your

time is worth money. These are other commonly used terms. One of them that you

might not know is hygrothermograph, which is difficult to say, obviously. And it’s a

device that records humidity and temperature over time. Records preservation not only

Page 5

involves the obligation to keep the record, but also to preserve it and to take reasonable

steps to preserve the record in its original condition. Remember when we talked about

sanctions for spoliation of evidence? Typically you’ll see attorneys make arguments

that another side has deprived them of the evidence because they have intentionally

destroyed it. However, spoliation has held to a negligent standard. So if you fail to take

the reasonable steps that you knew you should have taken, then that may constitute

negligence that could also result in some sanctions. In our environment here in New

Orleans, it would be absolutely unreasonable to not account for the factors of humidity

and temperature. It is part of the environment in which we live, and part of the duty to

preserve those records. Here are a few resource hot tips for records management.

These are all great websites that I’ve referenced today that will help you stay up to date

on records retention issues. How often do you do research just on the issue of records

retention? How proactive are you really in this area? Don’t wait until the auditors are

there, the litigation has started. Get out and start touching these different websites.

Sign up for some of the free newsletters. And create a folder right in your email, just for

records retention, where you can drag the articles and come back to them and peruse a

few every single month.

[End of recording.]

Page 1

ELECTRONIC RECORD KEEPING FOR HR PROFESSIONALS MODULE FOUR – DOCUMENT IMAGING PRO’S AND CON’S Female: Module Four – Document Imaging Pros and Cons. Going electronic by

imaging documents is a big decision for an organization, often so daunting that it never

makes it past the planning phase. We’re going to talk now about a few of the pros and

cons of document imaging and some of the tips that you should know. A few document

imaging dos and don’ts: Do your research; do a cost benefit analysis; and do meet with

salespeople; be open to the team approach; don’t follow the leader. Just because

someone else is doing it and you’ve seen something work for another organization

doesn’t mean it’s the right fit for your organization. One great tip, though, that costs

very little money is to think about establishing a partnership or coaching relationship

with another organization. You might network with other HR professionals. A great

place to do that is on LinkedIn. There’s a great group of HR professionals on that

professional networking site, which is called LinkedIn, and many of you are probably

already on there. But one way you can do that is develop a partnership. If you’re in a

small organization especially, and even in a larger one, as an HR professional, you can

feel like you’re the lone wolf. You’re the only one who knows the information you know.

You are often entrusted with confidential information. It’s a lot of responsibility. You

don’t have to make decisions in a vacuum. If you know another HR professional in

another organization who is willing to share information with you, have some

masterminding meets with a few of those professionals. If you join SHRM, they have

meetings where they discuss this kind of information. You can chat on some of the

sites of those organizations about frequently asked questions and discuss the document

Page 2

imaging dos and don’ts decision. But if you have someone with whom you can find that

partnership, you can maybe even make a trip to their organization and look at their best

practices. For example, in New Orleans, the leadership of our court took a trip to

Chicago to take a look at some of their best practices because you want to look at

another urban environment in which there is a courthouse who’s managing similar

issues in a similar environment serving a similar public to see what their best practices

had been in records management and the management of the courthouse. It’s a great

idea, because you can take at least a couple of tips back. While you might not be able

to follow the leader and do everything that someone else can do, there might be a few

best practice tips that you will learn if you’re able to broaden your horizons by using

some of those networking relationships for the betterment of your own organization.

Don’t operate in a silo and make decisions on your own. Don’t write a check until you

know what you’re getting. When you talk with vendors, check the references.

Understand how to speak the language. Remember how we discussed storage speak

earlier? Now you’re better armed when you go to talk to the outside vendor about

document imaging to talk specifically about how you’d like to be able to store

information, what it is you need to do with it, how accessible it needs to be. If you can’t

speak that language, you’re not likely to get the service that you want. Sometimes

when there’s a breakdown between a vendor and the organization for which it’s

providing services, the breakdown simply was in communication. One side thought it

was giving the other exactly what it asked for. But sometimes it’s the sender who’s not

communicated the right message. As the sender, you’re always responsible for the

message, and that’s why we went over the storage speak before you go and have these

Page 3

conversations. Don’t ignore hidden costs, such as training, equipment, and supplies.

Look very carefully as you make these decisions. There are some pros and cons that

I’ve listed for you here. You can write these down or just use this to think about it.

Document imaging can be great for fast retrieval. It gives multiple people access to

information and is easy to implement. It’s easy to distribute information when you

image documents, and digital images don’t lose quality from generation to generation.

Some of the obvious drawbacks of imaging your documents and going electronic

include the potential for higher equipment costs, including hardware and software.

Access is sometimes time intensive, depending on how many documents you’ve

imaged, and costly unless the records are very well indexed. I worked for a large law

firm that had an exceptional document management system. And it can be difficult to

access documents if you don’t know the correct terms. But the documents were often

indexed well so that it was relatively easy for attorneys to go and access documents

that other attorneys had created. So we effectively were not reinventing the wheel

every time we had to draft important pleadings for clients. One con, though, can be that

these electronic documents that have been imaged now from paper to electronic can be

difficult to control in terms of the unauthorized proliferation. In other words, you’ve got

something that’s supposed to be very confidential and you’ve imaged and you’re trying

to retain it in that way. But because of the ease of access, which is a pro in some

circumstances, it can be a con because it’s easily accessed, and now it can be spun out

into the public. Think about what we talked about in the beginning regarding HIPAA.

And remember why I said you had to keep those medical records that are subject to the

PHI, their protected health information? If you have to keep them in a separate locked

Page 4

filing cabinet with limited access when you’re dealing with the hard copies, you’re under

the same requirements when it comes to electronic records. Once you image those

records, you’ve got to keep those electronic documents in a separate locked database

that’s different from a file. Be very careful that you are involved with anyone who is

doing the document imaging, and think about how you can create the equivalent of

those separate locked file cabinets, because you do not want to inadvertently expose

information to others to access. Another con is the potential hire labor cost for in-house

imaging. And here’s what I mean by that. When you try to begin imaging documents,

even just in a small environment, there’s someone who’s got to stand at that machine

and constantly feed the paper into a scanner when we think about the most simple way

to image a document. Think about what that employee is paid per hour. You can go

with their annual salary and calculate the hourly wage, or the employee might already

be an employee on hourly wage. Look at how much time it cost that employee to scan

the documents you needed. Then weigh that against the benefit. Determine how much

it really cost you per hour. That may help you determine if it’s more effective for you to

have an outside service scan your documents. We like to scan a lot of courtesy copies

of pleadings that people file in preparation for certain days in court. It makes it easier to

access and review those documents on an iPad, as an example. However, for that to

occur, someone has to take those big hard copies of those pleadings, stand at the

scanner, and scan the information. In our environment, it’s been a value and it’s made

sense to do it that way. But what we’ve done to respond to that labor cost, though, is

we’ve implemented a new policy in our specific court that requires attorneys to submit

their courtesy copies in electronic form now instead of hard copy so that it reduces the

Page 5

paper that we have to touch and scan. It’s just a creative way around some of the

constraints of the environment. How many of you have said, “I’m not getting the money

and resources that I need in order to do what I need to do. I wish I had more help to be

able to do this. This makes sense, but no one will help me, and we’re a small office.

We’re a small organization. We don’t have the ability to image documents. Well, think

about how you can control the way information comes to you in the first place. That’s a

way that you can add value, minimize risk, and reduce the labor cost, yet still have the

information in the electronic form that you really prefer. Be careful about just putting

information out in that dumpster. As most of you probably know, this is just a reminder

that stealing trash is not illegal. We have no expectation of privacy in information we

place out into a dumpster. Once the item is left there for trash pickup, we’ve given up

that expectation and it’s fair game. That’s not the way to dispose properly of records.

The question of destruction is really about reconstruction. In other words, I’m taking it

from one form and putting it into another. When it comes to electronic media, deleting is

not erasing, as I mentioned. And you’ve got to know how to properly destroy that

information. Here are the decisions you’ve got to make with respect to any kind of

record. Save this acronym TRASH. Write it down. Toss it; Refer it; Act on it; Store it;

Halt it. Teach the employees in your organization this acronym. Maybe next to each

one of these letters, define the list of documents that can be tossed. Which ones do

you really need for people to refer to HR? Do you have individuals who are trying to be

proactive, but really they’re taking action on information without proper training, and it

really needs to be referred to you whenever they encounter this type of document. If

you do nothing else after today, come up with your referent list. Distribute it to other

Page 6

employees, even if there’s only one other person, so that they know what information

you really need to have passed on to you so that you can be the most effective in your

position. Write this down: Ftc.gov. This is where fact or provisions law is covered.

And it spells out what reasonable measures you must take in connection with the

disposal of records that apply to organizations that use consumer reports. If you do any

credit checks or come in contact with credit reports, if you have salary report

information, other types of consumer reports in your possession, these may all be

subject to the reasonable measures requirements connected with disposal. Ftc.gov is

where you will find the fact or provisions that tell you what those reasonable measures

are. When you think about information that’s on tape, just know that you have to take

some particular steps to destroy information on tape. Erasure or degaussing, which is

sort of de-magnetizing that storage information, or overwriting the information. If it’s a

reusable disc and you want to reuse it, you can overwrite it by reusing. You must erase

it. You can shred it, or you can crush it. Think about the different ways that you can

physically destroy records. Some organizations have a very good shredder that you

can actually feed discs into when you’re talking about electronic media. You might want

to demagnetize a video tape to completely erase data. You might wish to employ the

services of an organization in order to help you with your document destruction. The

three major steps to success are sound policies, understandable procedures, and

relentless but digestible awareness campaigns. The hot tip for your creation of

awareness is to plan campaigns for each group responsible for enforcement.

Everything we’ve done all day today in this webinar has really been about the

development of sound policies and procedures – how you can take all the information

Page 7

you’ve learned so far today and revise your policies, or even develop new ones.

Policies and procedures plus awareness, which is through clear, consistent

communication, equals implementation success. You might want to have a new

employee summary sheet. It’s a great way to catch people on the front end and have

them become part of your records retention team by creating that understanding and

the expectations up front. Over 55 percent of employees fail because they simply do

not know what’s expected of them. The sender is always responsible for the message.

[End of recording.]

Page 1

ELECTRONIC RECORD KEEPING FOR HR PROFESSIONALS MODULE FIVE – PUTTING IT ALL TOGETHER Female: Module Five – Putting It All Together. We’ve covered so much ground in

just four modules. So now it’s time to quickly give you some final hot tips for putting it

all together. If you have a records management policy, here are a few things that it

must include: The purpose of the policies; responsibility for enforcement – name who’s

responsible; information classification – have you clearly classified information in your

policies and procedures? Remember, I gave you a few classifications today; records

origination standards – did you include email and IM addresses; records retention

standards; records destruction standards; development and implementation of

procedures; development and implementation of awareness campaign; and an

acknowledgement page that each employee signs. Do you have a separate policy for

electronic use? Those are just a few things that your records management policies

should include. In terms of managing your records, create a checklist; assign a

classification of the records; determine who will access certain records; develop a

retention schedule and procedures by department; have on-site and off-site storage

procedures and forms; create records destruction procedures and forms; determine

supervisory responsibility for staff awareness, and do this as a team; and create a self-

test and a self-audit reporting so you are constantly checking your own records and

maybe conducting reviews of things such as I-9s before the EEOC or Department of

Labor is auditing you. We’ve talked a little bit today already about disaster recovery and

the important questions that your organization must ask in order to be protected.

You’ve got a number of decisions to make based on the information that you’ve gained

today. Could my organization continue to do business without these records? Is my

Page 2

company vulnerable to legal ramifications if I cannot produce this information in this

form upon request? If I’m asked for that EEO-1 form during an EEOC audit, I know now

that I have to keep those indefinitely. Could I produce it? If I’m asked for an I-9 for that

employee of mine who’s been there for those ten years, do I still have that? Is it

maintained properly? Can I go to a binder and pull that I-9 immediately? You must

produce documents in the form in which they are maintained. So in other words, if I

keep the I-9 in a particular binder with all the other I-9s, I’ve got to hand over the entire

binder. Now that auditor has access to more than just the information that’s on the one

employee’s I-9. Is this how you wish to maintain your records? You might wish to do

something different, but understand that that auditor does not have the time –

sometimes not the patience – and is also following the rules regarding reviewing

documentation. Think about how you’re currently retaining those records and if

someone walked into your organization today, what would it take for you to pull them

together? You can actually inadvertently expand the scope of the audit because of how

you retain your records. So how far off should off-site be in light of that question? Are

your systems for accessing these records also backed up?

[End of recording.]