United Cerebral Palsy of Greater Chicago Records and Information Management Policy and Procedures Manual, December 12, 2008

Transcription

1 United Cerebral Palsy of Greater Chicago Records and Information Management Policy and Procedures Manual, December 12, 2008

2 I. Introduction United Cerebral Palsy of Greater Chicago ( UCP ) recognizes that it is good business practice to retain records in a consistent, systematic and reliable manner so that they can be retrieved promptly when required for legal, regulatory, or operational reasons. This Records and Information Management Policy (the Records Management Policy ) has been developed to provide guidance to the employees of UCP to manage UCP s records throughout their life cycles according to sound business, operational and legal practices. II. Purpose UCP creates and retains records to meet its operational needs and to comply with legal and regulatory requirements ( Business Records, defined herein). The purpose of the Records Management Policy, including Appendix B, the Records Retention Schedule (the Retention Schedule ), includes: Identifying, maintaining, and safeguarding Business Records necessary to conduct the UCP s business; Observing consistent records retention and disposal practices; Retaining Business Records for at least the minimum periods required by applicable federal or state laws and regulations, in accordance with an established retention schedule; Disposing of Business Records in a timely and consistent manner, pursuant to an established retention schedule, after there is no longer a legal or operational need to retain such records; Identifying and preserving appropriate Business Records for pending or reasonably foreseeable litigation, audit, or compliance purposes; Enhancing productivity by maintaining current information; and Managing the overhead costs associated with storing and maintaining Business Records that have no enduring business or legal value. III. Organization and Leadership The UCP s Executive Vice President (the Administrator ), in conjunction with the UCP s Department Heads, shall be responsible for ensuring consistent application and implementation of the Records Management Policy and Retention Schedule throughout UCP. In addition, other representatives from the various departments within the UCP may from time to time provide input concerning the development and implementation of this Records Management Policy and contribute to the optimization of UCP s record-keeping practices. The Administrator, in conjunction with the UCP s Department Heads, shall be responsible for overseeing compliance with this Records Management Policy, and therefore they shall: Page 1

3 Take reasonable steps to ensure that UCP complies with applicable regulations and security requirements for retaining and disposing of Business Records; Work with outside counsel to determine defensible and appropriate retention periods for Business Records; and In the event of pending, potential or foreseeable claims, investigations, or litigation, determine and implement appropriate procedures to ensure that any planned or routine disposal of Business Records is suspended so that relevant Business Records are preserved. Each department or functional area within the UCP shall designate a records coordinator, who shall perform the following functions: Identifying categories or sources of Business Records that shall be retained, stored, or disposed of pursuant to the Records Management Policy s objectives; Ensuring that all employees within their department are familiar with and follow the Records Management Policy and Retention Schedule; Implementing procedures to ensure that all Business Records required to be retained pursuant to the Records Management Policy and Retention Schedule are stored and protected for the requisite retention period; Compiling and forwarding to the UCP s records coordinators information and statistics regarding Business Records that are retained pursuant to the Records Management Policy and Retention Schedule. IV. Scope This Records Management Policy requires that all UCP personnel who create, store, retrieve, manage, or dispose of the UCP s Business Records will conduct those activities in accordance with this Records Management Policy and the current Retention Schedule. This Records Management Policy applies to all Business Records created or received by UCP in the course of its operations. V. Records Management Policy A. UCP Business Records A Business Record is defined as any document or object that: (a) documents a specific business-related event or activity; (b) demonstrates a specific business transaction; (c) identifies individuals who participated in a business activity; (d) supports facts of a particular businessrelated event, activity, or transaction; or (e) is needed for other specific legal, accounting, business, or compliance reasons. Page 2

4 All Business Records created or received in the course or conduct of UCP s business by any individual governed by this Records Management Policy are the exclusive property of UCP and are not the property of the record s author, creator, or custodian. No employee has any personal or property right to any UCP Business Record(s), including those records that he or she helped create. Therefore, all UCP Business Records are subject to and must be managed in compliance with this Records Management Policy. Intellectual property rights in all records belonging to UCP are owned by UCP in perpetuity. Intellectual property includes registered trademarks, patents, registered designs, applications for and the right to apply for any such rights, inventions, unregistered trademarks, trade and business names, copyrights, unregistered design rights, databases and rights in databases, and all other similar proprietary rights that may exist in any part of the world. Intellectual property rights also extend to all renewals, extensions, revivals, consents, and applications related to the above property types. B. Business Records Creation UCP is committed to creating and maintaining complete, accurate, and trustworthy records of its business activities. Deliberately creating false or misleading Business Records regarding the UCP s activities is strictly prohibited. All records, documents, and communications pertaining to the UCP s business should be appropriately and accurately worded to reflect the UCP s concern for safe and ethical business practices. Business Records should not contain language that is misleading, incomplete, inaccurate, fraudulent, harassing, embarrassing, sexually explicit, profane, obscene, intimidating, abusive, libelous, or defamatory, or that violates any laws or regulations. All Business Records should be created with the specific purpose of communicating or documenting business matters. The UCP expects all individuals creating Business Records to act responsibly, lawfully, and professionally in connection with their creation of Business Records. C. The Retention Schedule The UCP will manage the retention, storage, and disposal of its Business Records, whether they are in paper or other formats or media, in a manner consistent with applicable laws and regulations. Business Records will be maintained as long as they are needed for legal or business purposes. The Retention Schedule has been created to ensure that Business Records are kept as long as legally and operationally required and that obsolete records are disposed of in a systematic and controlled manner. The Retention Schedule is intended to ensure that personnel adhere to approved record-keeping requirements and that they do so consistently. Categories or Record Classes are listed on the Retention Schedule along with the retention period for each Record Class. The Retention Schedule identifies most of the Business Records the UCP creates or receives in the regular course of its business. Because not every Business Record can be explicitly listed, the Retention Schedule should be used as a tool to assist UCP personnel in determining the appropriate retention period. Where Page 3

5 multiple record types may apply to the same record, UCP personnel should choose the record type with the longest retention period unless otherwise directed by the Administrator. Any and all new record types must be approved by the Administrator and/or the UCP s Legal Counsel. As an employee of UCP, it is your duty to periodically review UCP updates for information or direction concerning the Records Management Policy. D. Retention Periods The retention period is the length of time that records in each Record Class must be retained. A retention period is stated in terms of years and may be expressed as contingent upon the occurrence of an event, such as the termination of a contract or conclusion of a project. The UCP is committed to retaining and disposing of its Business Records in compliance with the retention periods set forth in the Retention Schedule. The Retention Schedule is the official authority for the retention and destruction of UCP records. Records should neither be kept longer than the period set forth in the Retention Schedule nor be disposed of or discarded before the stated retention period expires. For convenience and consistency, all record retention periods should start on the last day of the year in which the Business Records were completed, finalized, or made inactive, although this section may be modified in the future. E. Business Record Security UCP s departments and personnel must comply with applicable security policies and take all reasonable measures to ensure the integrity, confidentiality, and availability of the Business Records they create and retain. All employees shall comply with UCP s Code of Ethics, employee handbook, written supervisory procedures and confidentiality policy and procedures regarding the Business Records. UCP s departments and personnel must ensure that medical records and other health-related information is maintained in accordance with the rules and regulations promulgated under HIPAA. This means that all UCP departments and personnel must ensure that all protected health information ( PHI ) is disclosed only as permitted by HIPAA and that UCP complies with all HIPAA privacy practices. F. Business Records Storage Business Records must remain on the UCP s premises or at other UCP-approved secure storage locations. Employees should not remove Business Records from the UCP s premises, unless such Business Records are being used for legitimate UCP business purposes, and those records must be returned to a proper and secure storage repository within two weeks following completion of authorized use. While most records are retained in work areas for part or all of their required retention period, hard-copy records should be reviewed at least annually to determine whether they are active or inactive and whether they are originals or duplicates. Inactive records are those that use or for Page 4

6 which the need for reference has diminished sufficiently to permit removal from the immediate area of responsibility without impairing normal operations. Inactive original records should be reviewed for possible storage in a designated facility for the remainder of the required retention period. UCP personnel should ensure that records sent to storage are classified, packed and labeled in a way that will facilitate their identification, retrieval and eventual destruction. Bills of lading should be executed by the UCP and its off-site storage vendors whenever the UCP transfers and/or recalls records to effectuate a chain of custody relative to records transfer. G. Business Records Disposal Business Records are to be disposed of in the normal course of business and in accordance with this Records Management Policy and the Retention Schedule. Annually, records coordinators shall conduct a survey of all UCP Business Records within their respective departments to determine whether the various business departments retain Business Records whose retention periods have expired and are otherwise appropriate for disposal. Upon completion of this annual records survey, the results shall be forwarded to the Administrator. The Administrator, in conjunction with the UCP s Legal Counsel, shall certify whether the records are eligible for disposal. When expired Business Records are approved for disposal, they must be disposed of using appropriate procedures and methods. For example, Business Records classified as public information may be discarded, but sensitive or confidential Business Records must be eliminated by shredding or other methods that prevent reconstruction of the record contents. H. Suspension of Records Disposal UCP has adopted this Records Management Policy to ensure that it is taking all reasonable steps to preserve and safeguard potentially relevant evidence relating to a pending or reasonably foreseeable litigation, claim, audit, or investigation. In the event that either: (a) a litigation, claim, audit, or investigation exists or has been asserted against UCP; or (b) a litigation, claim, audit, or investigation is reasonably foreseeable, all regularly scheduled disposal of certain UCP Business Records must immediately be suspended. At any time that a UCP employee learns that: (a) a litigation, claim, audit, or investigation exists or has been asserted against UCP; or (b) a litigation, claim, audit, or investigation is reasonably foreseeable, as determined by the Administrator, that employee shall report that fact directly to the Administrator. VI. Drafts, Duplicates and Convenience Copies Draft versions of documents should not be retained once they are superseded by later drafts or final documents. Duplicate records or convenience copies may be maintained by UCP personnel in their own offices or on UCP-owned computers, subject to appropriate security controls, but only while needed for valid business reasons. No duplicate record or convenience copy may be Page 5

7 maintained for a period longer than the applicable retention period set forth in the Retention Schedule, and such copies should not be sent to an off-site storage facility absent approval from a manager or a directive to do so by the Administrator. VII. Documents Having Short-Term (Transitory) Value Appendix A defines and provides examples of Transitory Documents that have short-term or transitory value. Such Transitory Documents, not covered by any of the Business Records identified in the Retention Schedule and otherwise having no enduring business or operational value, should be retained for 30 days. Transitory Documents should be disposed of periodically and should not be shipped to off-site storage. VIII. Interpretation, Policy Maintenance and Requests for Exceptions A. Interpretation of the Records Management Policy and Retention Schedule The Administrator, in conjunction with the UCP s Legal Counsel, will be responsible for interpreting any portions of this Records Management Policy and/or the Retention Schedule as they apply to any specific situation. Any questions regarding what category a particular record falls into or requests for exceptions to the Records Management Policy and/or the Retention Schedule are to be directed to the Administrator. B. Records Management Policy and Retention Schedule Maintenance It is expected that changes will be required to be made to the Records Management Policy and Retention Schedule from time to time to account for changes in legal, regulatory, or operational requirements. The Administrator shall thus review the Records Management Policy and Retention Schedule periodically. Suggested changes to the Records Management Policy and/or Retention Schedule should be submitted to the Administrator, which may cause appropriate modifications to be made to the Records Management Policy and/or Retention Schedule. IX. Violations of the Records Management Policy All employees must ensure that this Records Management Policy and the Retention Schedule are implemented and enforced. Willful or negligent destruction of UCP Business Records, in violation of the requirements in the Retention Schedule may result in disciplinary action, up to and including termination of employment. Federal and state laws require the UCP to maintain certain types of records for particular time periods. Failure to maintain such records could subject you and the UCP to penalties and fines, may constitute an obstruction of justice or destruction of legal evidence, and/or may seriously harm the UCP in litigation. Any employee who becomes aware of a violation of this Records Management Policy or the Retention Schedule should promptly report any such violations to the Administrator. Page 6

8 X. Roles and Responsibilities Department heads are responsible for ensuring that Business Records are correctly stored in a manner permitting easy access and retrieval. For those records stored in off-site storage facilities, the UCP s Administrator / records coordinators are responsible for managing: (i) the off-site transportation and storage of hardcopy records that have reached the end of their on-site retention period; and (ii) the retrieval or disposal of the Business Records in accordance with this Records Management Policy and the Retention Schedule. Only approved storage facilities may be used for off-site storage. Bills of lading should be executed by the UCP and its off-site storage vendors whenever the UCP transfers and/or recalls records to effectuate a chain of custody relative to records transfer. XI. Audits UCP may conduct periodic audits to, among other things, verify that employees are complying with this Records Management Policy. This Records Management Policy may be revised as appropriate, based on the results of those periodic audits and/or in accordance with changes in the law. XII. Plan Approval UCP s Records and Information Management Policy has been approved by the Board of Directors of UCP as of the date indicated below. Name/Title Date Page 7

9 Appendix A. Definitions Terms and Definitions Active When used to specify Retention Periods, Active or ACT refers to the end of the last year in which the matter to which the Business Record relates is active. For example, a contract is active while the contract has not yet expired by its terms, and a personnel record is active while the employee remains employed with the UCP. Typically, the Active period includes the full year in which the agreement expires, the last transaction is completed, or the existing document is replaced by a more current version. A retention period of Active + 7 specifies retention for 7 years beyond the end of the Active Period. Business Record A Business Record is defined as any document or object that: (a) documents a specific businessrelated event or activity; (b) demonstrates a specific business transaction; (c) identifies individuals who participated in a business activity; (d) supports facts of a particular businessrelated event, activity, or transaction; or (e) is needed for other specific legal, accounting, business, or compliance reasons. Business Records may exist in many forms, including writings, drawings, graphs, charts, hard-copy photographs, electronic documents including , online presentations, images, or other data or data compilations stored in any medium from which information may be obtained from an archive or electronic storage repository. Department Leader The Department Head is the person in your department who is responsible for overseeing the proper procedures for Records Retention. This individual is also available to answer your questions and will provide procedural training on complying with the Records Management Policy. Disposal To dispose of a Business Record means to shred, discard, destroy, or permanently erase the Business Record after the retention period has been met. Inactive Records A record becomes inactive when it no longer has operational value. UCP s policy is to transfer records to off-site storage, where they shall remain, unless needed for a legal or unexpected operational need, for the remainder of the retention period. Duplicate copies, reference copies, or courtesy copies must be disposed of on a periodic basis. At a minimum, duplicate copies, i

10 reference copies, and/or courtesy copies must be disposed of consistently with those retention periods designated in UCP s Retention Schedule, and they may not be sent to off-site storage. Legal Hold/Disposal Suspension UCP may have a duty to preserve documents and information that are relevant to a pending or reasonably foreseeable lawsuit, regulatory action, audit, or other investigation. At the initiation of a lawsuit or a regulatory inquiry, the Administrator or the UCP s Legal Counsel will issue a disposal suspension order to appropriate UCP personnel, instructing them to cease any planned or routine disposal of any Business Records or electronically stored information relating to the specific subject matter described in the Disposal Suspension Notice. Record Copy The Record Copy is the document that is kept on file as an original or official or master record for the total retention period. The Record Copy is distinct from a working or convenience copy, which is a duplicate used for reference purposes and must not be sent to off-site storage. Record Maintenance and Disposition In order to ensure compliance and reduce the overall risk to UCP, Business Records that are stale, i.e., for which the retention period has expired, that are no longer needed for operational purposes, and that are not subject to a Legal Hold or a Disposal Suspension Notice, must be disposed of in a timely manner and by way of a secure, controlled method. To ensure compliance, each department should take steps to identify and dispose of stale records based on the Retention Schedule at the conclusion of each fiscal year. Record Owner The Record Owner is the holder (i.e., department) of the Record Copy, as defined in the Retention Schedule. Records Management Records Management is the systematic control of all records from creation or receipt, through processing, distribution, maintenance, and retrieval, to their ultimate disposal. Records Retention Retention, as reflected in the Retention Schedule, reflects the exact length of time the records should be kept and when they should be disposed of. Retention Schedule UCP s Records Retention Schedule, containing a list of Business Record types and their required retention periods, is included as Appendix B of this Records Management Policy. ii

11 Retention Event This is the event after which the retention period begins. For example, if the legal retention period is listed as ACT + 10 and the retention event is When a contract is executed, then the Business Record should be kept for the entire period that the contract is in effect, plus ten years after the contract terminates. Retention Period The number of years that the Business Record is to be retained by the UCP, as specified in the Retention Schedule. Transitory Documents Documents of short-term (less than 90 days) interest that have minimal or no documentary or evidentiary value. Transitory Documents involve routine activities containing no substantive information, such as routine notifications of meetings, scheduling of meeting and other activities, and routine requests for information requiring no substantive response. Examples include reference materials and notes, out-of-office replies, routine system messages and log files, work sheets, and s with no ongoing legal, compliance, or operational value (i.e., those records not otherwise covered by or relating to the Retention Schedule). Transitory Documents should be retained only as long as they are needed for operational or reference purposes (no longer than 30 days). iii