Records Management

Responsible Office: Technology Services, Division of Administration
Current Approved Version: 12/09/2020
Policy Type: Board of Visitors

Policy Statement and Purpose

This policy establishes the general responsibilities for management, retention, and disposition of Virginia Commonwealth University records as mandated by the Virginia Public Records Act (VPRA), Code of Virginia § 42.1-76–§ 42.1-91.

This policy supports the following objectives:

Compliance with the VPRA, Code of Virginia § 42.1-76–§ 42.1-91, which governs the creation, maintenance, and disposition of public records
Development and implementation of procedures, guidelines, systems, and business practices that facilitate the creation, backup, preservation, filing, storage, and disposal of records of all formats
Reduction of risks associated with unintended disclosure of sensitive or confidential information
Retention and protection of essential and historical information about the university

All records, regardless of format, must be retained and destroyed according to the state-mandated record retention schedule unless subject to a longer retention period by other superseding authority; a record hold; or deemed a permanent record. University records may not be destroyed because of lack of space or funding for storage.

Noncompliance with this policy may result in disciplinary action up to and including termination. VCU supports an environment free from retaliation. Retaliation against any employee who brings forth a good faith concern, asks a clarifying question, or participates in an investigation is prohibited.

Who Should Know This Policy

All employees are responsible for knowing this policy and familiarizing themselves with its contents and provisions.

Definitions

Archival Record

"Archival record" means a public record of continuing and enduring value useful to the citizens of the Commonwealth and necessary to the administrative functions of public agencies in the conduct of services and activities mandated by law that is identified on a Library of Virginia approved records retention and disposition schedule as having sufficient informational value to be permanently maintained by the Commonwealth. (Code of Virginia § 42.1-77)

Confidential Records

Public records that are restricted from disclosure by statute, court order, or legally adopted rules and regulations are considered confidential. University records that are deemed confidential by the Library of Virginia are still considered to be public records even though they are not publicly available.

Official Record

The “official record” shall be construed to mean the “official” copy of a particular public record, with no regard as to whether it is an original, copy, or reformatted version.

Department Records Coordinator

Employee who serves as a liaison between the department and the designated records officer.

Designated Records Officer

The designated records officer(s) serves on behalf of VCU as a liaison(s) to the Library of Virginia implementing and overseeing the records management program.

Non-records

As set forth in the Code of Virginia § 42.1-77, “nonrecord materials,” means materials made or acquired and preserved solely for reference use or exhibition purposes, extra copies of documents preserved only for convenience or reference, and stocks of publications.

Non-permanent Records

A university record that has not been deemed permanent. The records retention and disposition schedules identify when a set of records has reached the end of its usefulness

Permanent Records

A public record is considered permanent when it has been determined to have “continuing and enduring value useful to the citizens of the Commonwealth and necessary to the administrative functions of public agencies in the conduct of services and activities mandated by law.” (Code of Virginia § 42.1-77)

Public Record

A public record is any recorded information that documents a transaction or activity by or with any public officer, agency or employee of an agency. Regardless of physical form or characteristic, the recorded information is a public record if it is produced, collected, received or retained in pursuance of law or in connection with the transaction of public business. The medium upon which such information is recorded, whether electronic or otherwise, has no bearing on the determination of whether the recording is a public record.

Personal Information

"Personal information" means all information that (i) describes, locates or indexes anything about an individual including, but not limited to, his social security number, driver's license number, agency-issued identification number, student identification number, real or personal property holdings derived from tax returns, and his education, financial transactions, medical history, ancestry, religion, political ideology, criminal or employment record, or (ii) affords a basis for inferring personal characteristics, such as finger and voice prints, photographs, or things done by or to such individual; and the record of his presence, registration, or membership in an organization or activity, or admission to an institution. "Personal information" shall not include routine information maintained for the purpose of internal office administration whose use could not be such as to affect adversely any data subject nor does the term include real estate assessment information.(Code of Virginia §2.2-3800)

Record Hold

A temporary suspension of destroying records in accordance with the record retention schedule when the records are subject to a pending or active audit, litigation, investigation or request for records.

Record Retention Schedule

The documents that authorize the period of time that records are kept before they are destroyed or kept permanently. The Library of Virginia sets the record retention schedule referred to as General Schedules for State Agencies.

Superseding Authority

Governing body with recordkeeping requirements that conflict with the record retention schedule. Records governed by a superseding authority must be retained to the most lengthy retention period.

Contacts

Technology Services officially interprets this policy. Technology Services is responsible for obtaining approval for any revisions as required by the policy Creating and Maintaining Policies and Procedures through the appropriate governance structures. Please direct policy questions to Technology Services and the designated records officer.

Policy Specifics and Procedures

The following procedures describe the required actions and processes to comply with this policy and applicable laws and regulations.

Roles and Responsibilities

Designated Records Officer

1. Coordinate Records Management Program: The designated records officer develops and coordinates the university’s records management program. This includes:

Administering the university’s records management program in coordination with the Library of Virginia.
Providing self-paced and live development opportunities covering records management procedures and practices, including the use of appropriate forms.
Implementing systems and identifying resources to meet program requirements for completeness, legibility, reproducibility, retrievability, distribution, control, security, storage, and disposition of records, regardless of format or media type.
Advising employees on where to access and how to use the record retention schedule.
Assisting employees in the surveying of records.
Ensuring that essential, archival, non-permanent and permanent records are identified, properly maintained, protected, and accessible for the length of time cited in the record retention schedule.
Collaborating with department record coordinators.
Submitting the Records Officer Designation and Responsibilities Form (RM-25) to the Library of Virginia.

Department Head

1. Maintain Departmental Procedures: Each department head is responsible for the department’s compliance with the records management program and procedures developed by the designated records officer in accordance with the record retention schedule:

Documenting record types managed by the department, where they are located and where to find retention periods and destruction requirements.
Documenting the record type, retention period and recordkeeping requirement of records governed by a superseding authority.

2. Train Employees: All employees must adhere to the records management requirements:

Directing employees to participate in records management development opportunities.

3. Honor Record Holds: Any record that is subject to a record hold must be retained until final resolution of the matter. In this circumstance, the department(s) involved must:

Notify all other relevant organizational units.
Work with employees to identify and retain any records relevant to the matter.
Reinstitute appropriate retention and disposition after the matter is closed.

4. Designate Department Records Coordinator: Each major budget unit must have at least one records coordinator:

Appointing or affirming one or more employees to serve as the department records coordinator.
Informing department employees of who is their department records coordinator.

Department Record Coordinator

1. Advocate Records Management Program: Each major budget unit must have at least one records coordinator designated to assist with records management compliance.

Gaining knowledge of and comfort to support the records management program within their department.
Assisting development of the department’s records management procedures consistent with this policy and for recordkeeping requirements of superseding authorities.
Educating employees within the department in understanding proper record management practices.
Assisting with communications and coordination of the records destruction under the guidance of the designated records officer(s).

Employee

1. Know Your Department Records Coordinator: Leverage the designated department records coordinator for assistance complying with department procedures and the records management program.

2. Manage Records Appropriately: Manage records with care throughout their lifecycle:

Aiding development of procedures that will help identify department record types and where they are located.
Storing records in a protected, identifiable and accessible manner throughout their retention period.
Reformatting paper records to electronic records is allowed unless explicitly restricted by a superseding authority.
Protecting records from unauthorized disclosure.
Securing records following the university’s Information Technology Policies, Standards, Baselines and Guidelines:

For physical records, see the Physical Security Standard.
For electronic records, see the Data Handling and Storage Standard.

Transferring records in your possession to your supervisor or their designee prior to separation from the university or moving to a new department. Formal approval must be granted to retain a copy of records upon separation.

3. Timely Record Destruction: A Certificate of Records Destruction (RM-3 Form), signed by the designated records officer, is required for official records prior to destruction:

Identifying retention schedule for the official record.

Confirming there are no pending or active record holds;
Confirming there are no lengthier recordkeeping requirements dictated by a superseding authority.
Electronically submitting a destruction approval request for official records via RM-3 Form. Do not report the destruction of non-records, including convenience copies, on a RM-3 form.
Receiving signed, approval from the designated records officer.
Destroying the official records and all copies.
Affirming records destruction on the RM-3 Form.

4. Disposition Methods: Acceptable methods of record destruction. Confidentiality is deemed by the Library of Virginia and denoted in the record retention schedule:

Non-confidential records - trash, recycling, or deletion of electronic records.
Destroy within one (1) year after retention period expiration.
Confidential records - shred bins, cross-cut shredding, pulping, incinerating, physical destruction of electronic storage media, “wiping” of electronic records with appropriate software, and degaussing of magnetic material are acceptable.
Destroy within six (6) months after retention period expiration.

Forms

The following forms are associated with this policy and procedures:

Revision History

This policy supersedes the following archived policies:

Approval/Revision Date	Title
Initial Approval: 07/31/2009	Records Standards
Revised and Approved: 03/10/2010	Standard for Records Management
Revised and Approved: 12/03/2015	Records Management

FAQ

1. What are reasons to enact a record hold?
There are several reasons to enact a record hold. Some examples are pending or active:

Audit
Investigation
Litigation (e.g. discovery request, subpoena)
Request for records, as required by law including but not limited to:

Family Educational Rights and Privacy Act (FERPA)
Freedom of Information Act (FOIA)

2. Where should I store my data?
The Information Security Office in Technology Services provides guidance on the secure handling, transmission and storage of data and information; IT resources and services offered by the University that can assist; and specific precautions one should take. For more information, contact Technology Services at (804) 828-2227 or visit the Data Management System webpage: https://ts.vcu.edu/askit/essential-computing/information-security/data-management-system/

3. Who owns the record?

Records created, collected or required by law while doing university business belong to the university. Formal approval must be granted to retain a copy of records. To see exceptions or to make formal request, please visit:

Employees, Faculty and Students - VCU Policy: Intellectual Property Policy
Researchers - See VCU Policy: Research Data Ownership, Retention, Access, and Security

4. Whom should I contact about recycling or document destruction?
VCU Facilities Management (FMD) provides guidance on recycling and destruction services for documents and other types of media storage. For more information about available services, contact the FMD Customer Service Center at (804) 828-9444 or submit a service request at fmd.vcu.edu.

Policy Program

Integrity & Compliance Office