Records Management

Responsible Office: Technology Services, Division of Administration
Current Approved Version: 01/08/2016
Policy Type: Administrative

Policy Statement and Purpose

This policy establishes the general responsibilities for management, retention, and disposition of Virginia Commonwealth University records as mandated by the Virginia Public Records Act (VPRA), Code of Virginia § 42.1-76–§ 42.1-91.

This policy supports the following objectives:

Compliance with the VPRA, Code of Virginia § 42.1-76–§ 42.1-91, which governs the creation, maintenance, and disposition of public records
Development and implementation of procedures, guidelines, systems, and business practices that facilitate the creation, backup, preservation, filing, storage, and disposal of records of all formats
Reduction of risks associated with unintended disclosure of sensitive or confidential information
Retention and protection of essential and historical information about the university

Noncompliance with this policy may result in disciplinary action up to and including termination. VCU supports an environment free from retaliation. Retaliation against any employee who brings forth a good faith concern, asks a clarifying question, or participates in an investigation is prohibited.

Who Should Know This Policy

This policy applies to all employees and authorized agents of the university.

Definitions

Confidential Records - Public records that are restricted from disclosure by statute, court order, or legally adopted rules and regulations are considered confidential. University records that are deemed confidential are still considered to be public records even though they are not publicly available.
University records management procedures will contain references to all applicable regulations and statutes affecting university records.

Copy of Record - The “copy of record” shall be construed to mean the “official” copy of a particular public record, with no regard as to whether it is an original, copy, or reformatted version. All work units within the university shall work with a designated records officer to establish in writing the ownership of and responsibility for copies of record.

Designated Records Officer – The designated records officer(s) will serve as a liaison(s) to the Library of Virginia for the purposes of implementing and overseeing a records management program and coordinating legal disposition, including destruction of obsolete records.

Non-records - Public records shall not include materials made or acquired and kept solely for reference or exhibition purposes, copies of records kept only for convenience or reference, and stocks of publications. These are considered “non-record materials.” (Code of Virginia § 42.1-77)

Non-permanent Records - A university record that has not been deemed permanent. The records retention and disposition schedules identify when a set of records has reached the end of its usefulness.

Permanent Records - A public record is considered permanent when it has been determined to have “continuing and enduring value useful to the citizens of the Commonwealth and necessary to the administrative functions of public agencies in the conduct of services and activities mandated by law.” (Code of Virginia § 42.1-77)

Public Record - A public record is any recorded information that documents a transaction or activity by or with any public officer, agency or employee of an agency. Regardless of physical form or characteristic, the recorded information is a public record if it is produced, collected, received or retained in pursuance of law or in connection with the transaction of public business. The medium upon which such information is recorded, whether electronic or otherwise, has no bearing on the determination of whether the recording is a public record.

Contacts

Technology Services officially interprets this policy. Technology Services is responsible for obtaining approval for any revisions as required by the policy Creating and Maintaining Policies and Procedures through the appropriate governance structures. Please direct policy questions to the VCU records officer within Technology Services.

Policy Specifics and Procedures

The following procedures describe the required actions and processes to comply with this policy and applicable laws and regulations.

The university records officer will develop and coordinate the records management program, which includes:

Developing guidelines to implement the university records management program in coordination with the Library of Virginia;
Providing training in records management procedures and practices, including the use of appropriate forms;
Implementing systems to meet program requirements for completeness, legibility, reproducibility, retrievability, distribution, control, security, storage, and disposition of records, regardless of format or media type;
Advising staff members on where to access and how to use Library of Virginia–approved retention schedules;
Coordinating and/or assisting staff in the surveying of records;
Ensuring that essential, archival, and permanent records are identified, properly maintained, protected, and accessible for the length of time cited in an applicable retention schedule; and
Maintaining contact and connections with university records coordinators.
Submitting the Records Officer Designation and Responsibilities Form (RM-25) to the Library of Virginia.

Each department, division or section head will implement the records management program for each department in accordance with the applicable Library of Virginia Retention Schedule
(referred to herein as “retention schedule”) and the guidelines developed by the university records officer. All departments must have procedures in place for the retrieval, use, and re- filing of records.
Each department will train its employees in records management.
Each department will have a records coordinator, who serves as a liaison between the department and the university records officer. Responsibilities of a records coordinator include:

Familiarity with the university records management policy;
Developing the unit’s records management procedures and practices, consistent with this policy;
Educating staff within the department in understanding proper record management practices;
Restricting access to confidential records and information; and
Coordinating the destruction of records under the guidance of the university records officer.

All records, unless subject to a preservation request or “legal hold” imposed by judicial rules as determined in consultation with University Counsel, must be either destroyed according to the retention schedule or retained as a permanent record. The university must destroy records within one (1) year after the expiration of the applicable retention period by completing the following steps:

Identify records to be destroyed in accordance with the retention schedule.
Document the destruction on a Certificate of Records Destruction (RM-3 Form). The RM- 3 Form is required when destroying public records, in all formats, that are deemed copies of record. Do not report the destruction of materials that are not public records, such as copies, personal items, and reference materials on an RM-3 Form.
Submit the original RM-3 Form to the Library of Virginia.
Retain a copy of the RM-3 Form for three (3) years.
Destroy the records according to the applicable retention schedule series category.
Notwithstanding the retention schedule, retain under a legal hold any records involved in current litigation, investigation, or audit.

University records may not be destroyed because of lack of space or funding for storage.
Acceptable methods of destruction.

Acceptable methods of destruction for non-confidential university records include trash, recycling, or deletion of electronic records.
Acceptable methods of destruction for confidential university records include cross-cut shredding, pulping, incinerating, physical destruction of electronic storage media, “wiping” of electronic records with appropriate software, and degaussing of magnetic material. Destruction of confidential records containing personally identifying information must be done within six (6) months of retention period expiration.

Storage.

All university records must be:

Maintained in such a way that they are identifiable and accessible for the entirety of their assigned retention period;
Stored in areas with consistent temperatures and humidity levels. Ideal conditions are a temperature between 65–70° F and humidity at 40%, +/- 5%;
Protected from fire by the installation of smoke detectors, water sprinklers, and fire extinguishers;
Free of vermin and insects; and
Far from water pipes.

If records are of a confidential nature, they should be stored in a secure area that is locked and has controlled access for select personnel only. Strict procedures must be in place for retrieval, use, and re-filing of confidential records. Access to confidential records in electronic formats will be limited by assigning appropriate log-in credentials.

The university will implement Emergency Preparedness Plans (EPP) that clearly communicate the procedures for records recovery in the event of a natural disaster, fire, or other catastrophic event affecting the university.
Any university record that is relevant to pending or anticipated action, e.g., litigation, claim, audit, university charge, investigation, or enforcement action, shall be retained until final resolution of the matter. In these circumstances, the department involved with the ongoing action will notify all other relevant organizational units and work with staff to identify and retain any records relevant to the matter. This will include a directive that the relevant Department’s normal document destruction procedures be suspended temporarily.
University employees who become aware that an action, investigation, or legal proceeding has commenced or is anticipated against their department or work unit must promptly notify the manager of the affected organizational unit, as well as the university records officer, so that all records with potential relevance to the investigation or legal proceeding can be retained as necessary. After a matter is closed, records should be maintained according to appropriate records series retention and disposition.
All records created and maintained by the university that contain personal or other confidential information must be kept in accordance with the Government Data Collection and Dissemination Practices Act, Code of Virginia § 2.2-3800 et seq.

Forms

RM-3 – Certificate of Records Destruction

Revision History

This policy supersedes the following archived policies:

Approval/Revision Date	Title
Initial Approval: 07/31/2009	Records Standards
Revised and Approved: 03/10/2010	Standard for Records Management
Revised and Approved: 12/03/2015	Records Management

FAQ

How do I get permission to destroy records once they have exceeded their retention period in the records schedules?

For official records you need to complete a Certificate of Records Destruction (RM-3 Form), have it approved by an administrator in your office and by the university records Officer. Complete instructions and downloadable forms are located on the Library of Virginia's Records Management Forms page. If you have questions while completing the form, please contact the university records officer (recman@vcu.edu) for assistance before sending, as most questions can be answered before a form is submitted. Once you receive the approved form back, you may destroy the records. Please note you need to send the original RM-3 to the Library of Virginia upon destruction of the records–including a signature and destruction date.
Where can I find an RM3 Form/Approval for Destruction of records?

The form is located on the Destruction of Records page, along with easy to follow instructions. If you have questions about the form please contact the University Records Management Office (recman@vcu.edu) before submitting your form for approval (send forms to Box 843059 for signature on line 8 of the form).
When can I destroy records?

Each records series listed in the Records Retention and Disposition Schedules is approved by the Library of Virginia and has specific instructions for how long the records need to be retained by your office. Identify the records series of the records you wish to destroy and calculate if the records have met their retention period. If you have questions on retention please contact the University Records Manager (recman@vcu.edu).
How do I destroy records?

After your office has received an approved Certificate of Records Destruction (RM-3) from the university records officer you may destroy records using any normal recycling (shredding/pulping) method. Non-confidential electronic records should be "wiped" from the storage media or by the manual destruction of the storage media (CD, DVD, Hard drive).
Who should I contact about recycling or document destruction?

VCU Environmental Conservation provides recycling and document destruction services. For more information about available services, contact the FMD Customer Services Center at (804) 828-9444. Or contact CINTAS (804-530-2603) directly to order secure purge containers.

Policy Program

Integrity & Compliance Office