Data retention, and how your organization stores and manages employee and customer records, is critically important for both private and public institutions. Public institutions need to keep track of records of birth, death, ownership, tax information, and so forth. Private organizations often need to retain documents and data related to transactions, loan applications, employee information, and the list goes on.
With more of those records existing electronically, data retention laws and best practices around encryption and security are that much more important. What are the current regulations, and how could those data privacy laws impact your department? By following best practices, you can prevent regulatory issues, as well as potential oversight from local, federal, or state law enforcement.
Retention and privacy standards of course vary from industry to industry. The most common and well known typically mandate strict privacy and disposal requirements, even if they’re not explicitly spelled out in the law.
Healthcare records are strictly managed by HIPAA. The Federal Department of Health and Human Services (HHS) stipulates that “entities must ensure that the disposal method reasonably protects against impermissible uses and disclosures of [personal health information] PHI and protects against reasonably anticipated threats or hazards to the security of electronic PHI.” That could include shredding, and also secure and responsible disposal of electronic data.
Financial organizations are equally bound by several data-related oversight laws, including Sarbanes Oxley, or SOX. While SOX largely sought to force more transparent financial disclosures, it also established recordkeeping mandates for accounting and financial firms. Section 404 of SOX requires the maintenance of “adequate” internal controls, including financial reports, and internal controls over financial reporting.
Passed in 1999, the Gramm-Leach-Bliley Act (GLBA) is more commonly known as the Financial Modernization Act. As a result, U.S. companies are required to disclose both how they share and how they protect personal data, including how they encrypt and store financial non-public personal information (NPI). The fine structure for companies that fail to protect private data starts with $100,000 per violation.
Because various requirements impact industries, departments, and organizations differently, how you manage and implement a data retention policy largely depends on the type of data you store and process. Where and how do you start?
First, do your own research and consult with a legal expert in your field to help you create a policy. Legal should also be quite involved in consulting on how you disclose that policy to your stakeholders correctly. When you conclude the research phase, that’s when you can start building or putting a system together that makes sense for your own workflows. Consult with a team of internal experts and seek their input before you put mandates, or that system, in place. That team could include a member of your internal legal staff, accounting, customer service management, and more.
Remember that this also has to be relatively straightforward for everyone–including staff and customers–to understand. The point isn’t to put forth complex language and processes that are draconian and impossible to decipher. The more simple and concise the language and clarification around your policies, the more both employees and customers will comply with them.
Because not every single piece of data has to be stored for the same length of time, you may need different policies for different types of data. That goes back to working with legal and accounting to apply the right set of rules to the right accounts and records. In many cases, you don’t have to hold onto data indefinitely. In fact, the longer you hold onto data that you aren’t required to store, the more you may be leaving yourself–and your customers–open to vulnerabilities.
This is going to be an ongoing process. You don’t have to stick with the same policy forever. Plan on revisiting and updating your policies regularly. Ultimately, the more transparent you are about any changes with both your staff and your customers, the more you will create an environment of trust and security.
QFlow specializes in enterprise and government records management and has the experience and knowledge you need to stay on top of your retention schedules. By automating the deletion and proper disposal of records on a fixed schedule, you are supporting both your team and your company, allowing them to focus on the core business.
Our specialized electronic document management platform Q-Action® Records Management identifies your historical, fiscal, and legal records (electronic or physical), tagging them with a taxonomy best suited to you. We can then further deploy a document management strategy as a part of your overall enterprise environment.
When you partner with us, you have access to a team full of experienced and certified professionals with a range of expertise in different industries. Our experts will consult and design a strategy customized for your workflows and are in complete compliance with NARA retention mandates.
For more information and to schedule a demo, feel free to reach out to us today.