Responsible Official: Enterprise CIO and Sr. Vice Provost for Library Services and Digital Scholarship
Administering Division/Department: LITS: Library & IT Services
Effective Date: April 03, 2017
Last Revision: April 03, 2017
This policy supports the consistent, efficient, and comprehensive management, retention, and disposition of records created, received, and retained by Emory University and Emory Healthcare, hereafter referred to as Emory.
The records management program assists departments and offices by providing training and education, procedures and associated forms to standardize practices across campus, and one-on-one consultation around management of active records, reformatting and preservation actions, records disposition, and emergency response planning.
This policy applies to all employees of Emory University and Emory Healthcare, as well as contractors who conduct business for or on behalf of Emory, who create, receive, or retain University records. Any recorded information, regardless of media, characteristics, physical form, storage location, or means of transmission, is considered a University record when it is relevant to Emory’s legal obligations or business.
A. Records Management Program: Emory will support a sound records management program intended to ensure efficiency in the creation, use, handling, control, maintenance, and disposition of its records, regardless of format. The goals of the program are to comply with state and federal statutory requirements, reduce risk associated with unintended disclosure of sensitive information, increase efficiency of business operations through thoughtful storage and retrieval systems, and protect vital and historical information about Emory.B. Roles and Responsibilities:Records Manager: The Records Manager is a position within Library and Information Technology (LITS) responsible for the development, implementation, and ongoing coordination of the records management program at Emory.Information Technology: Information Technology will collaborate with the Records Manager and departments or offices to preserve and dispose of electronic records by setting restrictions on access, maintaining storage, implementing a disaster recovery plan, and ensuring timely disposition of electronic records on Emory-controlled systems.Department or Office Heads: The heads of departments or offices are responsible for ensuring that procedures within their area of responsibility meet the requirements of Emory’s records management program relative to record identification, control, maintenance, storage, and disposition. The department or office head should designate a Records Liaison in support of this work.Records Liaison: Records Liaisons are responsible for assisting in the design, implementation, and management of their department or office records management program by serving as contacts to the Records Manager. The Records Liaison will assist staff within their unit in understanding and complying with Emory’s records management program. Information on establishing a program is available at http://records.emory.edu/procedures/setup-program.html.All Faculty, Staff, and Contractors: All employees are responsible for managing the records in their possession in compliance with this policy. When leaving a position, employees must ensure that records are left in the custody of personnel of the originating department or office.C. Retention Schedule: Each department or office will maintain and dispose of records in compliance with Emory’s retention schedule. The schedule identifies and describes Emory’s records, provides direction for the length of time they must be kept, and identifies their method of disposition. Emory records include, but are not limited to, information pertaining to athletics, financial transactions, personnel actions, research activities, and student and course documentation. The retention schedule applies to all records, regardless of format. Formats include paper, electronic documents such as those created by Microsoft products, Adobe PDF, photographs, digital photographs, email, maps, posters, audio and visual recordings, databases, and web pages. The retention schedule is available at http://records.emory.edu/retention-schedules/.D. Disposition of Records:Permanent Records: Departments and offices will routinely transfer records with continuing and enduring value, as identified on the retention schedule, to the University Archives. Systems containing permanent records should be implemented in consultation with the University Archivist.Non-permanent Records: Departments and offices will destroy records that have not been deemed permanent in the manner identified by the retention schedule. Confidential paper must be shredded; electronic records must be made unreadable by being overwritten or the storage media being physically destroyed. Recordkeeping systems must be capable of the complete deletion of records; it is not sufficient to take information off-line. Departments and offices will establish a plan for the final disposition of electronic records within recordkeeping systems at the time they procure each system. Records should not be maintained past the end of their stated retention unless involved in current litigation, investigation, or audit. Records may not be destroyed because of lack of space or funding for storage. Destruction should occur at the record series-level, not at the item level, and destruction must be documented to ensure compliance.E. Records Capture and Storage: Records must be maintained in such a way that they are identifiable and accessible for the entirety of their assigned retention period. Paper should be stored in areas with consistent temperatures and humidity levels and be protected from fire, free of vermin and insects, and far from water pipes. Confidential records should be stored in a secure area that is locked and has controlled access. Electronic records must be stored, managed, and retained in Emory-approved recordkeeping systems to prevent unauthorized addition, alteration, use, suppression, or deletion. Electronic records should not be kept on devices or in locations where they cannot be centrally managed, such as desktops, personal devices, or unapproved systems. Information Technology staff will develop migration or conversion strategies to update hardware, software, and storage media for record systems to ensure future usability of records. Any device that does not meet Emory security requirements is prohibited from accessing or storing confidential electronic records.F. Compliance: Departments and offices are encouraged to assess current compliance by completing a compliance review with assistance from the Records Manager.Department or office heads are responsible for investigating and resolving any alleged violations of this policy. Violations of the records management practices laid out in this policy may expose Emory to liability, including penalties, fines, and imprisonment. Sanctions for non-compliance may include reprimand or other appropriate measures.
Confidential Records: Any information that is required by contract, law, ethical guidelines, or data owner mandate to be limited to controlled access or any information that if used inappropriately or disclosed could cause significant harm to individuals or Emory.
Permanent Records: Materials created or received in the conduct of business that are preserved because of the enduring historical value or as evidence of the roles and responsibilities of the creator.
Record: Any recorded information, regardless of media, characteristics, physical form, storage location, or means of transmission, made or received and maintained by Emory pursuant of its legal obligations or in the transaction of its business.
Recordkeeping System: Any software or computer program where records are created, captured, or maintained by Emory faculty and staff.Record Series: Group of similar or related records that are arranged according to a file system and that are related as the result of being created, received, or used in the same activity.
Retention Schedule: Document that identifies and describes Emory’s records at the series level and provides instructions for the length of time a series must be kept and their required disposition. Emory’s retention schedule is available at http://records.emory.edu/retention-schedules/.
Non-records: Materials made or acquired and kept solely for reference or exhibition purposes, copies of records kept only for convenience or reference, and stocks of publications.
- Current Version of This Policy: http://policies.emory.edu/5.21
- Records Management at Emory University (http://records.emory.edu/ )
- Information Technology Conditions of Use Policy 5.1 (http://policies.emory.edu/5.1)
- Disk Encryption Policy 5.12 (http://policies.emory.edu/5.12)
- Smart Device Security Policy 5.14 (http://policies.emory.edu/5.14)
Subject Contact Phone Clarification of Policy Anita Vannucci (404) 727-6900 firstname.lastname@example.org