A. REASON FOR POLICY

Xavier University requires that its records be managed in a systematic and logical manner according to the procedures outlined in this policy, which are consistent with all applicable laws.

This policy outlines broad responsibilities related to records management, retention, disposal, and preservation. This policy applies to all departments and all records, regardless of whether the records are maintained in hard copy (paper), electronically, or in some other fashion.

Xavier is committed to effective records management so that the university:

• Meets legal standards for protection, storage, and retrieval;
• Protects the privacy of faculty, staff, and students of the university;
• Optimizes the use of space;
• Minimizes the cost of record retention;
• Destroys outdated records in an appropriate manner; and
• Preserves records of permanent and historical importance.

B. POLICY

In accordance with this Policy and the university General Records Retention Schedule, the managers of each Responsible Office/department are responsible for establishing and documenting standards, mechanisms, and procedures to address the following recordkeeping issues:

• Ensure effective retrieval mechanisms for departmental information and records using appropriate records classification and file organization;
• Ensure that all recordkeeping is compliant with relevant legal and regulatory requirements;
• Protect sensitive or critical departmental information and records from disclosure; and
• Protect information and records to ensure continuity of departmental operations.

C. DEFINITIONS

University Record: Is any document or item, regardless of form, that is created or received by Xavier University, which serves to document the organization, functions, policies, decisions, procedures, operations or other business of the university. The term includes documents, papers, letters, books, drawings, maps, plans, photographs, tapes, film or sound recordings, microforms, digital or analog files, information stored or maintained electronically, and data- or image-processed documents.

Some examples of university records include: official university publications; incoming/outgoing correspondence, memos and emails; reports and studies; financial and accounting information; audit records; employment records; student education records; alumni records; meeting minutes; data; maps; drawings; photographs; audio recordings; film and video; and administrative logs. For a list of university record categories see Appendix A, the Records Retention Schedule.

Not all records must be retained. Some transient items may be deleted or destroyed at any time if they are no longer needed by the office holding them, except in the case of records relevant to legal matters as described herein. Examples of transient records include: preliminary drafts; notes or working papers once a project is completed; large quantities of duplicate materials and all duplicates of ‘official copies’; non-university catalogs, journals, or other printed matter used for informational purposes; and routine messages, routing slips, and meeting announcements.

Records Lifecycle: All records have a lifecycle, albeit some longer than others. Records are created or received; used; and kept for valid legal, fiscal, or administrative reasons. In general, the Records Lifecycle is as follows:

• Active record: A record that continues to be used with sufficient frequency to justify keeping them in the office of creation; a current record. Active records are consulted routinely in the daily performance of work. Ex: Active +7 years for personnel records. Personnel records should be maintained for seven years after the employee’s last date of employment.
• Inactive record: A record that is no longer used in the day-to-day course of business, but which may be preserved and occasionally used for legal, historical, or operational purposes. Inactive records are rarely used, but must be retained for occasional reference or to meet audit or legal obligations.
• Permanent or archival records: ‘Permanent’ records, also called ‘archival records,’ are records which have historical, administrative or research value to the University and which Xavier intends to keep indefinitely.

Record Copy: The single copy of a document or data, often the original, that is designated as the primary and official copy for preservation.

Local or Convenience Copy: Extra identical copies of “record copy,” documents, or data created only for convenience, reference, or research by employees.

Responsible Office: The University Office/department/division/program that is responsible for ensuring that a particular University Record is maintained for the required retention period and properly disposed of or transferred to University Archives in accordance with the General Records Retention Schedule.

Records Retention Schedule: A descriptive schedule that provides a guideline for the minimum length of time that selected records should be retained before they are deleted/destroyed or placed in archival preservation. Attached to this Policy as Appendix A.

Retention Period: The length of time a record must be kept before it should be deleted/destroyed, retained, or sent to university archives.

University Archives: The repository, housed in the University Library, that preserves permanent, inactive University records of enduring value.

D. PROCEDURES

Consistent with this Policy and the Records Retention Schedule, the Responsible Office is responsible for documenting its procedures for managing records in accordance with applicable law and with the approval of executive leadership. The Responsible Office must also educate staff with regard to implementing these procedures. In developing its records management procedures, all official repositories must consider electronically stored information, and analog or paper records.

Certain units or offices within the university follow professional standards, legal/regulatory requirements, or legal precedents dictating best practices for records management. Compliance with such legal and regulatory requirements must be documented by the Responsible Office. Each Responsible Office should undertake research to determine which laws and regulations are applicable to records it holds and then report to the University Office of General Counsel who will confirm the applicability and assist with determining the final list of applicable laws and regulations.

Many offices and units within the university operate within computer applications and systems (e.g. Banner and Canvas). All record purges and/or destruction of records within computer applications and systems will require a coordinated effort between the responsible office(s) and application administrators (i.e. Information Technology) to ensure implementation and continuing efforts are consistent with regulation and university policies. Copies of materials created and maintained, in computer applications and systems need not be retained outside of the application/system, and convenience copies should be destroyed once the administrative value ends. For copies of materials uploaded into and then maintained by computer applications and systems, the department should follow the retention schedule and/or contact the University Archivist or Office of General Counsel to determine if the original copies have independent administrative need.

Occasionally, university functions shift from one university department/office to another. When this occurs, the departments are expected to collaborate with one another on records transfer, maintenance, and destruction to avoid inconsistent retention and duplication.

Confidentiality Requirements

Many records subject to record retention requirements contain non-public confidential data. Such records are required to be maintained as confidential by federal, state and local statutes, including the Family Educational Rights and Privacy Act (FERPA), the Gramm-Leach-Bliley (GLB) Act, and the Health Insurance Portability and Accountability Act (HIPAA), and other current or future privacy
regulations. In addition to the statutory requirements, any record that contains confidential data should be classified and treated in accordance with the University’s privacy and security policies, which can be found at Information Technology Policies - Policy | Xavier University.

Computer drives, flash drives, CDs/DVDs, and paper/electronic files that may contain private or confidential data should be disposed of properly, including shredding all paper copies and destroying/erasing hard drives and discs so that the data are not retrievable. Consultation with Information Technologies staff on how to properly erase hard drives is vital before computers are transferred to other users or discarded.

Preservation of Records Relevant to Legal Matters

Any document, email or other message that is relevant to any pending or anticipated litigation, claim, audit, agency charge, investigation or enforcement action shall be retained at least until final resolution of the matter. In these circumstances, relevant departments will be notified and staff will identify and preserve any emails and other records that could be relevant to the matter. This will include a directive that the relevant unit’s normal document destruction policies or protocols temporarily be suspended. Employees who become aware that an investigation or legal proceeding has commenced or is anticipated that may involve their department must immediately notify their divisional vice-president and the General Counsel, so that all records with potential relevance to the investigation or legal proceeding can be preserved as required.

Email

Email should be treated like any other electronic or paper record. Email that has significant information should be retained according to the department’s needs and retention requirements. Each email user is responsible for retaining email containing important information. Email, that are defined in this Policy as records, should be retained with their related records.

Storage of Records

It is the responsibility of each Responsible Office to: securely and safely store records either on campus or at a contracted and secure storage facility; keep an inventory of the records; and label storage boxes descriptively. Digital files must also be maintained securely, backed up regularly, and labeled/named descriptively so that they can easily be found.

University Archives

The University Archives acts as the central entity to ensure the proper management and safeguarding of Xavier’s permanent, archival records, regardless of format except for situations in which the Responsible Office retains the records, such as education or personnel records. (See Records Retention Schedule). ‘Permanent’ or ‘archival’ records have historical, administrative or research value to the University and which Xavier intends to keep indefinitely. Examples of archival records include, but are not limited to: University publications; Board of Trustees meeting materials; annual reports; meeting minutes of University committees; significant correspondence from the University President and other administrators; theses and dissertations; and photographs of events and buildings.

Please contact Xavier’s University Archivist if you have records that may be considered permanent, archival or historical. The Responsible Office may transfer archival records to University Archives by following the procedures outlined in the University Archives Collection Development Policy.

Disposal and Destruction of Records

If a department has determined that, consistent with this policy, the Records Retention Schedule, and records management practices and procedures applicable to that department, it is appropriate to dispose of any records, they can be destroyed in one of the following ways:

• Recycle non-confidential paper records;
• Shred confidential paper records; or
• Erase or destroy electronically stored data. (Information Technologies can assist you in effectively disposing of this data.)

Each department must keep an inventory of all records recycled or destroyed on the Record Destruction Inventory Form, found here in Appendix B. This form should be maintained for ten years post destruction.

Compliance Audit

On an annual basis, the Office of Risk Management will initiate an audit plan.

E. EXHIBITS

Records Retention Schedule - Appendix A.
Record Destruction Inventory Form – Appendix B

Other Applicable polices and/or resources:

• Office of Human Resources. Personnel Policy (2008)
• Xavier University Student Handbook
• Office of the Registrar. Family Educational Rights and Privacy Act. Education Records and Student Records Policy
• HIPAA Privacy and Security Policy
• Information Classification Policy
• Policy on the Privacy of Electronic Information
• Acceptable Use of University Computers and Network Systems
• University Archives Collection Development Policy