UMGC Policy X-1.03 Records and Information Management

Purpose

University of Maryland Global Campus ("UMGC" or "University") Records (as defined below) must be managed in a consistent, systematic, and secure manner to ensure their authenticity, reliability, integrity, confidentiality, and availability. This Policy provides the requirements for managing UMGC Records throughout their lifecycle, including archiving or secure destruction and, together with any related procedures or administrative guidelines, and the UMGC Records Retention Schedule, forms the basis for a UMGC Records Management Program which complies with federal and state laws and regulations and University System of Maryland ("USM") Policy VI-6.10-Policy on Records Management.

Scope

This Policy applies to all employees, including exempt, non-exempt, and overseas staff, 12-month collegiate faculty and Overseas Collegiate Faculty as well as third parties working for and providing services or products to or on behalf of UMGC such as adjunct faculty, contractors, consultants, and temporary employees. Every employee and third party working on behalf of UMGC who creates, sends, or receives electronic or paper Records is responsible for making sure Records are properly maintained.

Definitions

Defined terms are capitalized throughout this Policy and can be found in the Information Governance Glossary.

Roles and Responsibilities

The following positions are critical to ensuring the accountability, transparency, integrity, and compliance of the UMGC Records Management Program:

1. Employees are responsible for knowing and complying with this policy. This includes all aspects of records management throughout the lifecycle of the Record, as outlined in the following section.
2. A Business Record Owner is the UMGC business unit or individual employee who is responsible for ensuring the integrity of an Official Business Record during its lifecycle.
3. A Business Unit Head is responsible for oversight of the records management program within their operational area and for the management of the Records associated with their specific business area.
4. Records Management Coordinators are individuals appointed by the Business Unit Head to be responsible for the application of the Records Management Program for a specific business unit. The Records Management Coordinator serves as the single point of contact for all Records Management inquiries related to the specific business unit's Records and is a subject matter expert and champion for the Records Management Program within the business unit.
5. The University Records Manager is responsible for oversight, control, and administration of the Records Management Program. The University Records Manager is supported by the business unit Records Management Coordinators in the implementation of the Program, ongoing Records Management activities and ensuring controls are in place so that Records are maintained, classified, and destroyed in accordance with all applicable laws, regulations, and the retention schedule.

1. Record Lifecycle

   Records must be managed throughout their lifecycle, regardless of format, storage location or office of record.

   1. Create and Classify. When a Record is created, it should be assigned a Record category on the Retention Schedule to properly identify what type of Record it is.
   2. Use and Manage. Employees should access and use Records only as required in connection with their UMGC employment and manage them in a manner appropriate for preservation and protection of the content.
   3. Store and Retrieve. Records must be maintained in appropriate UMGC information systems and at appropriate locations. The following factors should be used to determine whether a particular system or location is appropriate for maintenance of Records: frequency of use of the Records, classification of the Record(s) in accordance with UMGC's Data Classification Policy (High-Risk, Moderate Risk, and Low Risk) and format. Records must be searchable and retrievable. Appropriate locations include but are not limited to those maintained by vendors under service agreements with UMGC addressing records management and storage requirements.

   4. Review and Dispose. Records Management Coordinators will review the Department inventory of Records at least once annually to determine whether the applicable Retention Schedule period has expired and, if so, determine the appropriate means of disposal or destruction (See Section V.C. Records Disposition and Destruction below).

   Records Management Coordinators will maintain an inventory of the categories and location of Records in each department. A sample UMGC Records Inventory Log can be found on the Maryland State Archives website. A fillable copy can be obtained by sending a request to RecordsManagement@umgc.edu.

2. Records Retention Schedule

   The University Records Retention Schedule establishes categories of Records and provides examples of Records from each category and the length of time that the Records from each category must be maintained (retention period) by UMGC and third parties providing services on behalf of UMGC. The categories of Records are distinguished based on business function.

   The content or the intended use of the Record determines the retention period, the length of time the Record must be maintained, not the media or format. Records (paper, electronic, structured, and unstructured) must be retained in compliance with the retention periods in the Records Retention Schedule and must not be destroyed before the retention period expires. Changes to the Schedule must be approved by the Office of Legal Affairs, to ensure those changes follow applicable statutory and regulatory requirements.

3. Records Disposition and Destruction

   Once a Record reaches the end of the applicable scheduled retention period, it must be destroyed unless it is needed for compliance with an audit or Public Information Act request, subject to a Legal Hold Order (See Section V.D.1. Legal Hold Orders below), or of historical value appropriate for archiving (See Section V.D.2. Archiving below). Employees and third parties working on behalf of the University must seek approval for Records destruction from the applicable Record owner, or the Business Unit head. All employees including third parties working on behalf of UMGC are responsible for following the Records Retention Schedule and ensuring Records have met their retention period and that no applicable Legal Hold Order exists before the Records are destroyed.

   The methods used to destroy Record types (e.g., paper, electronic files, microfiche, CDs, and other data storage devices) must ensure the confidentiality of the information. Records pending destruction must be protected in accordance with the UMGC Data Classification Policy until they can be destroyed. A Destruction Log or Certificate of Destruction (for third-party vendors) must be retained by the business unit as evidence of the destruction of official business Records. A sample UMGC Records Destruction Log can be found on the Maryland State Archives website. A fillable copy can be obtained by sending a request to RecordsManagement@umgc.edu.

   Convenience Records must be maintained only so long as reasonably necessary (unless subject to a Legal Hold Order or audit).

4. Exceptions

   1. Legal Hold Orders. A Legal Hold Order is a directive from the Office of Legal Affairs (OLA) specifying certain Records that should not be destroyed until the Legal Hold Order is rescinded by OLA. Records subject to Legal Hold Orders must continue to be stored by the University even if those Records have expired or will expire during the time the Legal Hold Order goes into effect.

      OLA is responsible for notifying Records Management Coordinators, other employees and third parties such as contractors of actual or potential litigation, investigation, or other circumstances that may require the preservation of evidence or prevent a Record from being destroyed. OLA shall also notify Records Management Coordinators of any Legal Hold Order applicable to their business unit. Upon OLA notification, employees and third parties working on behalf of UMGC shall not destroy relevant Records or information. Individuals who have received a Legal Hold Order should contact OLA immediately with any questions regarding preservation or destruction of Records in relation to the Legal Hold Order or legal proceeding.

   2. Archiving. Records in any format of permanent or historical value to the University must be archived. Records include, but are not limited to board meeting minutes, photographs, audio and video recordings, organization charts, annual reports, program development, UMGC related newsletters / journals / magazines / newspapers (faculty, student, alumni), and major initiative information (e.g. creation of related entities, university reorganization). Please contact recordsmanagement@umgc.edu for more information.

   For a records management decision tree to assist with making decisions related to Records Disposition and Destruction, please contact recordsmanagement@umgc.edu or visit The Source.

5. Physical Records Converted to Electronic Records

   Unless prohibited by law, paper Records may be transferred to other durable media that does not permit alterations, deletions or additions to the Record or metadata about the Record. Quality control review must be performed to ensure that the integrity and authenticity of all information contained in the original Record has been maintained in a durable medium and that the transferred Record is of equal quality to the original Record. Upon meeting the quality control review standards, the original paper Record may be destroyed in accordance with established archiving requirements, unless destruction of the paper record is prohibited by law.

6. Electronic Records

   Records created, generated, or stored by electronic means, including electronic communications received and copies of electronic communications sent (e.g., instant messages, email messages, SMS text messages, blogs, social media, etc.), must be preserved consistent with the Records Retention Schedule.

   The electronic storage media used to retain electronic Records must:

   1. Preserve the Records exclusively in a non-rewriteable, non-erasable format where required by law, USM or UMGC policy or other regulatory body.
   2. Verify the quality and accuracy of the storage media recording process.
   3. Ensure that the storage is properly indexed and can be searched for the purposes of electronic discovery.
   4. Ensure that the Records can be produced as soon as reasonably possible to facilitate a legal or regulatory request.
   5. Have in place an audit system providing for accountability regarding inputting of Records required to be maintained and preserved.

7. Training

   Everyone working at UMGC should understand their responsibilities for the appropriate creation, use, retention, and destruction of Records. Training and communication about the Records Management Program emphasizes the importance of protecting UMGC Records and that risks and consequences exist when this responsibility is ignored. Therefore, the University Records Manager shall provide training and other information to support the Records Management Program from time to time.

8. Transferred or Terminated Staff and Faculty

   Individuals transferring positions within UMGC or leaving UMGC employment must leave all Records for their successors. The manager/supervisor of the departing individual is responsible for the appropriate handling and disposition of the Records.

9. Monitoring, Oversight, and Enforcement

   Periodic reviews of the Records Management Program should examine UMGC performance and adherence to the Records Management policy and be documented to evidence the review, the results, and identify any processes that are found to be ineffective.

   The University Records Manager shall review this Policy at least annually and will recommend updates as needed based on changes in regulations, new information system implementations, and business requirements.

   Any employee and third-party working on behalf of UMGC who violates this Policy may be denied access to Records and may be subject to disciplinary action, up to and including termination of employment or contract.

   Any exceptions to this policy must be approved by the University Records Manager and the SVP and General Counsel.

1. UMGC Records and Information Management Source page
2. UMGC Procedures X-1.03 Records and Information Management Procedures
3. Maryland State Archives: Records Management Guidance