Legal Issues in Records Management


Published on

Legal issues to consider when managing records at UWM. Originally presented at UWM July 16, 2009

Published in: Education, Technology, Business
  • Be the first to comment

Legal Issues in Records Management

  1. 1. Brad Houston, University Records Officer July 7. 2009
  2. 2. <ul><li>RM programs in public institutions (like UWM!) driven by legal mandate </li></ul><ul><li>Provides legal protection in case of public records request, subpoena, etc. </li></ul><ul><li>Privacy laws and concerns: dictates disclosure </li></ul>
  3. 3. <ul><li>Introduce participants to relevant laws, court decisions, and policies </li></ul><ul><li>Explain steps you can take to ensure compliance and limit liability </li></ul><ul><li>Focus on electronic records and requirements for storing and producing digital files </li></ul><ul><li>Describe basic procedures for dealing with records requests </li></ul>
  4. 4. <ul><li>Do NOT rely on this presentation for legal advice! </li></ul><ul><ul><li>Guidelines for compliance, preparation for discovery/disclosure </li></ul></ul><ul><ul><li>Not intended to provide SPECIFIC instruction for individual litigation cases </li></ul></ul><ul><li>If your office is subject to litigation/discovery: </li></ul><ul><ul><li>Contact Legal Affairs (x4278) </li></ul></ul>
  5. 5. <ul><li>Laws and what they mean for you as a UWM Employee </li></ul>
  6. 6. <ul><li>Definition of a public record </li></ul><ul><ul><li>Materials “made or received… in connection with the transaction of public business” </li></ul></ul><ul><li>Public records are property of the State of Wisconsin </li></ul><ul><li>Public records may not be destroyed without approved records retention schedule </li></ul><ul><li>Electronic/Microfilm copies may be considered official records </li></ul>
  7. 7. <ul><li>Defined regardless of format </li></ul><ul><ul><li>“ books, papers, maps, photographs, films, recordings, optical disks, electronically formatted documents or other documentary materials” </li></ul></ul><ul><li>Major Exceptions: </li></ul><ul><ul><li>Convenience/Reference copies </li></ul></ul><ul><ul><li>Notices/Invitations </li></ul></ul><ul><ul><li>Drafts/Notes (not shared with colleagues) </li></ul></ul><ul><ul><li>Routing Slips/Envelopes </li></ul></ul>
  8. 8. <ul><li>An accountability measure! </li></ul><ul><ul><li>Provision for internal audit of department activities </li></ul></ul><ul><li>No destruction without records schedules (RRDAs) </li></ul><ul><ul><li>General Records Schedules: Fiscal, Personnel, etc. </li></ul></ul><ul><ul><li>Specific Records Schedules: Dept. series </li></ul></ul><ul><li>Records Schedules must be renewed every 10 years </li></ul>
  9. 9. <ul><li>Make sure all records in office have applicable record schedules </li></ul><ul><ul><li>Most offices are mostly covered by general records schedules </li></ul></ul><ul><li>Separate records from non-records </li></ul><ul><li>Maintain filing by record series and disposition date </li></ul>
  10. 10. <ul><li>All public records potentially available to any public requestor </li></ul><ul><ul><li>“ The denial of public access generally is contrary to the public interest…” </li></ul></ul><ul><li>Public records requests coordinated by UWM Records custodian </li></ul><ul><li>Exceptions to required disclosure </li></ul><ul><li>Limitation of scope of disclosure </li></ul>
  11. 11. <ul><li>ANY requestor may request viewing of public records except as otherwise provided by law! </li></ul><ul><ul><li>Confidential Records: subject or his/her designee may view (but see exceptions) </li></ul></ul><ul><li>Requestors NOT required to provide reason </li></ul><ul><li>If requested records are internal use (i.e. not intended for public), refer requestor to Public Records Custodian </li></ul>
  12. 12. <ul><li>Information gathered in connection with a complaint/grievance/arbitration </li></ul><ul><li>Information which may endanger an individual’s life/safety </li></ul><ul><li>Information which identifies informants </li></ul>
  13. 13. <ul><li>You are not required to disclose: </li></ul><ul><ul><li>Trade Secrets, including research data </li></ul></ul><ul><ul><li>Identities of applicants for public positions (until finalists) </li></ul></ul><ul><ul><li>Plans/Specifications of State Buildings </li></ul></ul><ul><ul><li>Personnel Records (including some supp. materials) </li></ul></ul><ul><ul><li>Financial Identifying Information </li></ul></ul><ul><li>If you suspect requested records to include these materials, inform the records custodian! </li></ul>
  14. 14. <ul><li>Defer ALL public records requests to UWM Public Records Custodian </li></ul><ul><li>Maintain appropriate security levels for all records </li></ul><ul><li>Suspend records destruction once a public records request is received </li></ul><ul><li>Be prepared to make ANY eligible record in your office available </li></ul><ul><ul><li>Requestors may sue for “unnecessary delay”, so be timely in responding to the Records Custodian! </li></ul></ul>
  15. 15. <ul><li>Define rules and regulations re: discovery of records for subpoenas/litigation in federal court </li></ul><ul><li>Describe scenarios under which records disposition can/cannot occur </li></ul><ul><li>Provide for potentially severe penalties for non-compliance or premature destruction </li></ul><ul><li>In all cases, FRCP-relevant cases will be handled through Legal Affairs </li></ul>
  16. 16. <ul><li>Contact Legal Affairs IMMEDIATELY </li></ul><ul><ul><li>If electronic records are involved, also contact UITS to preserve backup tapes </li></ul></ul><ul><li>Cease all records management activities (especially records destruction) </li></ul><ul><li>Assess your ability to produce records, and how quickly </li></ul>
  17. 17. <ul><li>ANYTHING in subpoenaed files may be subject to discovery and use! </li></ul><ul><li>Protect yourself: </li></ul><ul><ul><li>Keep files on different cases/projects discrete </li></ul></ul><ul><ul><li>Destroy files scheduled for destruction in a timely manner unless litigation has started </li></ul></ul><ul><ul><li>Do not use your personal email for work purposes, or vice-versa </li></ul></ul><ul><ul><ul><li>Why? You may need to produce in connection with litigation </li></ul></ul></ul>
  18. 18. <ul><li>FRCP “Safe Harbor” clause! Applies if: </li></ul><ul><ul><li>Records schedule for that series exists </li></ul></ul><ul><ul><li>Disposition of that series is performed on regular basis </li></ul></ul><ul><ul><li>Records were destroyed before Legal Affairs became aware of litigation possibility </li></ul></ul><ul><li>Strongest argument for practicing good records management </li></ul>
  19. 19. <ul><li>FERPA, HIPAA, and UWM’s Personnel File Policy </li></ul>
  20. 20. <ul><li>Students have right to view educational records </li></ul><ul><li>Educational records are only accessible to student </li></ul><ul><ul><li>Student may authorize disclosure </li></ul></ul><ul><li>Directory Information may be made available </li></ul><ul><ul><li>Exception: if a student has opted-out </li></ul></ul><ul><li>Certain other exceptions exist </li></ul>
  21. 21. <ul><li>All records pertaining to students maintained at UWM </li></ul><ul><li>Presumption of confidentiality </li></ul><ul><li>Major exceptions: </li></ul><ul><ul><li>Instructor personal/sole possession notes </li></ul></ul><ul><ul><li>Employment Records </li></ul></ul><ul><ul><li>Campus Security Records </li></ul></ul><ul><ul><li>Alumni records </li></ul></ul>
  22. 22. <ul><li>Defined as information publicly available: </li></ul><ul><ul><li>Name, Address, Contact Info </li></ul></ul><ul><ul><li>Year in school, major, enrollment status </li></ul></ul><ul><ul><li>Participation in activities </li></ul></ul><ul><ul><li>Degrees, graduation date, awards received </li></ul></ul><ul><li>Students may choose to opt out of directory information release </li></ul><ul><ul><li>Contact Enrollment Services </li></ul></ul><ul><ul><li>Campus Directory? </li></ul></ul>
  23. 23. <ul><li>Individual Students </li></ul><ul><li>UWM Employees with “Genuine Educational Interest” </li></ul><ul><li>Exempted classes </li></ul><ul><ul><li>Financial Aid Providers </li></ul></ul><ul><ul><li>Other educational institutions (for transfers, etc.) </li></ul></ul><ul><ul><li>Specifically exempted officials (FERPA Manual) </li></ul></ul><ul><li>Accrediting groups/student study groups </li></ul>
  24. 24. <ul><li>Students must provide WRITTEN consent (with signature), including: </li></ul><ul><ul><li>Specification of records to be released </li></ul></ul><ul><ul><li>Identify to whom records may be released </li></ul></ul><ul><ul><li>Indication of purpose of release </li></ul></ul><ul><li>Provide requested records within 45 days </li></ul><ul><li>No consent needed if records are subpoenaed or requested via public records request </li></ul><ul><ul><li>But contact Records Custodian first to determine validity of subpoena </li></ul></ul>
  25. 25. <ul><li>Release FERPA-protected information to parents </li></ul><ul><ul><li>Exception: if student is under 18 </li></ul></ul><ul><li>Post test or course grades using social security numbers </li></ul><ul><li>Provide records to UWM staff without “legitimate educational interest” </li></ul>
  26. 26. <ul><li>Keep a log of all disclosures of FERPA-protected information </li></ul><ul><ul><li>Exceptions: access by student or student-permitted party, directory info disclosure </li></ul></ul><ul><li>Keep a log of notifications to students of disclosure </li></ul><ul><li>Maintain letters of consent for AT LEAST six years after student graduates/leaves UWM </li></ul>
  27. 27. <ul><li>Do not disclose student information if you have ANY doubt re: permissions </li></ul><ul><ul><li>Contact Legal Affairs for guidance </li></ul></ul><ul><ul><li>Advise requestor to direct request to Public Records Custodian </li></ul></ul><ul><li>Current Legal Affairs stance: presume ALL student information is private </li></ul><ul><ul><li>Why? Directory Info “Opt Outs” </li></ul></ul>
  28. 28. <ul><li>Defines Official Personnel File and contents </li></ul><ul><li>Provides provisions and restrictions for access </li></ul><ul><li>Prescribes official custodian, length of retention </li></ul><ul><ul><li>This section being revised </li></ul></ul><ul><li>Does not in itself have force of law </li></ul><ul><ul><li>Clarifies key provisions of Public Records Law </li></ul></ul>
  29. 29. <ul><li>Copy of the Personnel File held by Dean or Division Head or their designate </li></ul><ul><ul><li>Usually the PRep, but they may delegate </li></ul></ul><ul><li>Contains all information related to employment actions by a UWM employee </li></ul><ul><li>Become inactive after employee leaves: </li></ul><ul><ul><li>Classified: 7 year retention and destroy </li></ul></ul><ul><ul><li>Unclassified: 10 year retention and destroy </li></ul></ul><ul><ul><li>Faculty: 30 year retention and transfer to archives </li></ul></ul>
  30. 30. <ul><li>Employees may view their own personnel file </li></ul><ul><ul><li>May not view confidential records within P-file </li></ul></ul><ul><ul><li>Coordinate request with Public Records Custodian, especially if sent to Archives </li></ul></ul><ul><li>Employees may authorize access to their personnel file </li></ul><ul><ul><li>Requires written permission from employee </li></ul></ul><ul><ul><li>Route through public records custodian </li></ul></ul><ul><li>All subpoenas subject to review by Legal Affairs </li></ul>
  31. 31. <ul><li>Defines and protects certain classes of health information </li></ul><ul><li>Indicates which entities are required to protect information, and which are excluded </li></ul><ul><li>Provides right of patients to access health records </li></ul>
  32. 32. <ul><li>Surprisingly, not applicable to most departments on campus! </li></ul><ul><ul><li>Employer medical information not subject to HIPAA regulation </li></ul></ul><ul><li>Three main groups of covered depts/people: </li></ul><ul><ul><li>Provider units (Athletic trainers, Health Center, Health Sciences and Nursing Centers) </li></ul></ul><ul><ul><li>Administrative units (Bursar, BFS, Institutional Review Board, some members of UITS) </li></ul></ul><ul><ul><li>Researchers and students using clinical info </li></ul></ul>
  33. 33. <ul><li>UWM HIPAA resource site </li></ul><ul><ul><li> </li></ul></ul><ul><li>UWM HIPAA manual </li></ul><ul><ul><li> </li></ul></ul><ul><li>Other questions? Contact Legal Affairs directly </li></ul>
  34. 34. <ul><li>Wisconsin Administrative Rule 12, Digital Millenium Copyright Act </li></ul>
  35. 35. <ul><li>Electronic documents are records too, and subject to public records request/subpoena! </li></ul><ul><li>Latest revisions to FRCP include e-discovery provisions: </li></ul><ul><ul><li>E-records are discoverable and usable as evidence </li></ul></ul><ul><ul><li>Must be produced within 30 days, in the form in which they are used </li></ul></ul><ul><ul><li>Requestor may specify form of production </li></ul></ul><ul><ul><li>Third parties may be subpoenaed (Twitter, anyone?) </li></ul></ul>
  36. 36. <ul><li>Puts forth criteria for maintaining electronic records </li></ul><ul><li>Mandates design and use of information systems to support e-records </li></ul><ul><li>Does NOT require departments to maintain records electronically </li></ul><ul><li>DOES apply to records already being maintained electronically exclusively </li></ul>
  37. 37. <ul><li>Electronic records must be: </li></ul><ul><ul><li>Accurate: reflects the original record </li></ul></ul><ul><ul><li>Accessible: Record can be retrieved </li></ul></ul><ul><ul><li>Authentic: can be substantiated as accurate </li></ul></ul><ul><ul><li>Reliable: produces the original record every time </li></ul></ul><ul><ul><li>Legible: letters and numbers are identifiable </li></ul></ul><ul><ul><li>Readable: Groups of letters recognized as words </li></ul></ul><ul><li>All of these properties must be maintained throughout a record’s active life </li></ul>
  38. 38. <ul><li>Legible and Readable: keep file formats up to date, migrate files </li></ul><ul><ul><li>Usually applies only to long-retention records </li></ul></ul><ul><li>Accurate and Reliable: write-protect final copies of electronic records </li></ul><ul><li>Authentic: use versioning/logging features of PantherFile </li></ul><ul><li>Accessible: Create logical filing system </li></ul><ul><ul><li>Robust search terms, tagging, metadata? </li></ul></ul>
  39. 39. <ul><li>Defines illegality of republishing copyrighted information via file-sharing </li></ul><ul><li>Prohibits circumvention of anti-piracy software or code (incl. DRM on music files) </li></ul><ul><li>Limits liability of ISP (i.e. UITS) for violations </li></ul><ul><ul><li>Does provide expectation of ISP action, however </li></ul></ul><ul><li>Provides exceptions for certain departments/circumstances (mostly Fair Use) </li></ul>
  40. 40. <ul><li>UWM takes DMCA violations VERY seriously </li></ul><ul><ul><li>Also violation of UWM Computing Policy! </li></ul></ul><ul><ul><li>UITS is required to facilitate removal of protected information </li></ul></ul><ul><li>Remember: Your work computer is NOT your personal property! </li></ul><ul><ul><li>Info Security Office will not hesitate to seize it for forensic analysis if necessary </li></ul></ul><ul><ul><li>DO NOT DELETE offending material </li></ul></ul><ul><ul><ul><li>It can still be found, AND you get in more trouble! </li></ul></ul></ul>
  41. 41. <ul><li>You will NOT be eligible for legal defense from UWM </li></ul><ul><ul><li>Limits UWM’s own liability </li></ul></ul><ul><li>Legal Affairs may facilitate contact between you and litigant </li></ul><ul><ul><li>e.g. forwarding letters of intent, pre-settlement or settlement letters, etc. </li></ul></ul><ul><li>Your UWM computing privileges may be revoked </li></ul>
  42. 42. <ul><li>Summary and resources </li></ul>
  43. 43. <ul><li>Create record schedules for all records in your office </li></ul><ul><ul><li>General Schedules cover a lot of these </li></ul></ul><ul><li>Maintain appropriate security levels for protected records (FERPA, personnel, HIPAA, etc.) </li></ul><ul><li>Destroy records as soon as retention time expires </li></ul><ul><li>Separate work-related and personal records </li></ul>
  44. 44. <ul><li>STOP destruction of records as soon as you are aware of litigation possibility </li></ul><ul><li>Inform legal affairs immediately of situation </li></ul><ul><li>Organize your records and prepare for potential format conversion </li></ul><ul><li>Don’t discuss the terms of the litigation any more than strictly necessary </li></ul>
  45. 45. <ul><li>UWM FERPA Guide </li></ul><ul><ul><li> </li></ul></ul><ul><li>UWM HIPAA Guide </li></ul><ul><ul><li> </li></ul></ul><ul><li>Digital Millennium Copyright Act– Info Security </li></ul><ul><ul><li> </li></ul></ul>
  46. 46. <ul><li>Office of Legal Affairs </li></ul><ul><ul><li>Legal Topics in Higher Education </li></ul></ul><ul><ul><ul><li> </li></ul></ul></ul><ul><ul><li>General Legal Resources </li></ul></ul><ul><ul><ul><li> </li></ul></ul></ul><ul><li>Wisconsin Statutes (16.61 and 19.31) </li></ul><ul><ul><li> </li></ul></ul>
  47. 47. <ul><li>Personnel File Policy </li></ul><ul><ul><li> </li></ul></ul><ul><li>Public Access to Records </li></ul><ul><ul><li> </li></ul></ul><ul><li>Information Security Policy </li></ul><ul><ul><li> </li></ul></ul>
  48. 48. <ul><li>This presentation available online: </li></ul><ul><ul><li> </li></ul></ul><ul><li>Or, contact UWM Records Management: </li></ul><ul><ul><li>[email_address] (Brad Houston) </li></ul></ul><ul><ul><li>414-229-6979 </li></ul></ul><ul><ul><li> </li></ul></ul>