United States

Records management practices and standards are delineated in many federal regulations. Also, there are a number of state statutes that have passed and in some cases they actually supersede federal regulations; therefore it is crucial to understand compliance within the state or states where an organization operates.

On the federal level, public companies must be vigilant in verifying, protecting, and reporting financial information to comply with requirements under Sarbanes-Oxley and the Gramm-Leach-Bliley Act (GLBA). Healthcare concerns must meet the requirements of HIPAA, and investment firms must comply with a myriad of regulations by the Securities and Exchange Commission (SEC) and National Association of Securities Dealers (NASD).

Following is a brief description of current rules, laws, regulators, and their records retention and corporate policy requirements. (Note: This is an overview, and firms should consult their own legal counsel for interpretation and applicability.)

Gramm-Leach-Bliley Act

The Financial Institution Privacy Protection Act of 2001 and Financial Institution Privacy Protection Act of 2003 (Gramm-Leach-Bliley Act) was amended in 2003 to improve and increase protection of nonpublic personal information. Through this Act, financial records be properly secured, safeguarded, and eventually completely destroyed so that the information cannot be further accessed.

Healthcare Insurance Portability and Accountability Act of 1996 (HIPAA)

HIPAA requires that security standards be adopted for: (1) controlling who may access health information; (2) providing audit trails for electronic record systems; (3) isolating health data, making it inaccessible to unauthorized access; (4) ensuring the confidentiality and safeguarding of health information when it is electronically transmitted to ensure it is physically, electronically, and administratively secure; and (5) meeting the needs and capabilities of small and rural healthcare providers.

PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001)

The PATRIOT Act: (1) requires that the identity of a person opening an account with any financial institution is verified by the financial institution, and they must implement reasonable procedures to maintain identity information; and (2) provides law enforcement organizations broad investigatory rights, including warrantless searches.

Sarbanes-Oxley Act (SOX)

The key provisions of SOX require that: (1) public corporations implement extensive policies, procedures, and tools to prevent fraudulent activities; (2) financial control and risk mitigation processes be documented and verified by independent auditors; (3) executives of publicly traded companies certify the validity of the company's financial statements; and (4) business records must be kept for not less than five years.

SEC Rule 17A-4

SEC Rule 17A-4 requires that: (1) records that must be maintained and preserved and be available to be produced or reproduced using either micrographic media (such as microfilm or microfiche) or electronic storage media (any digital storage medium or system); and (2) original copies of all communications, such as interoffice memoranda, be preserved for no less than three years, the first two in an easily accessible location.

CFR Title 47, Part 42—Telecommunications

CFR Title 47, Part 42 requires that telecommunications carriers keep original records or reproductions of original records, including memoranda, documents, papers, and correspondence that the carrier prepared or that were prepared on behalf of the carrier.

CFR Title 21, Part 11—Pharmaceuticals

CFR Title 21, Part 11 requires: (1) controls are in place to protect content stored on both open and closed systems to ensure the authenticity and integrity of electronic records; and (2) generating accurate and complete electronic copies of records so that the Food and Drug Administration (FDA) may inspect them.

US Federal Authority on Archives and Records: National Archives and Records Administration (NARA)

The National Archives and Records Administration (nara.gov):

• Oversees physical and electronic recordkeeping policies and procedures of government agencies, requiring adequate and proper documentation on the conduction of US government business;
• Defines formal e-records as machine-readable materials created or received by an agency of the US federal government under federal law or in the course of the transaction of public business;
• Requires that organized records series be established for electronic records on a particular subject or function to facilitate the management of these e-records.

NARA regulations affecting Federal agencies and their records management programs are found in Subchapter B of 36 Code of Federal Regulations Chapter XII.^1,2

• Part 1220—Federal Records; General
• Part 1222—Creation and Maintenance of Records
• Part 1223—Managing Vital Records
• Part 1224—Records Disposition Program
• Part 1225—Scheduling Records
• Part 1226—Implementing Disposition
• Part 1227—General Records Schedule
• Part 1228—Loan of Permanent and Unscheduled Records
• Part 1229—Emergency Authorization to Destroy Records
• Part 1230—Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records
• Part 1231—Transfer of Records from the Custody of One Executive Agency to Another
• Part 1232—Transfer of Records to Records Storage Facilities
• Part 1233—Transfer, Use, and Disposition of Records in a NARA Federal Records Center
• Part 1234—Facility Standards for Records Storage Facilities
• Part 1235—Transfer of Records to the National Archives of the United States
• Part 1236—Electronic Records Management
• Part 1237—Audiovisual, Cartographic, and Related Records Management
• Part 1238—Microform Records Management
• Part 1239—Program Assistance and Inspections
• Part 1240–1249—[Reserved]

US Code of Federal Regulations

In the Code of Federal Regulations there are over 5,000 references to retaining records. The Code can be found online at: www.ecfr.gov.

Canada*

The National Standards of Canada for electronic records management are: (1) Electronic Records as Documentary Evidence CAN/CGSB-72.34–2005 (“72.34”), published in December 2005; and, (2) Microfilm and Electronic Images as Documentary Evidence CAN/CGSB-72.11–93, first published in 1979 and updated to 2000 (“72.11”).³ 72.34 incorporates all that 72.11 deals with and is therefore the more important of the two. Because of its age, 72.11 should not be relied upon for its “legal” content. However, 72.11 has remained the industry standard for “imaging” procedures—converting original paper records to electronic storage. The Canada Revenue Agency has adopted these standards as applicable to records concerning taxation.⁴

72.34 deals with these topics: (1) management authorization and accountability; (2) documentation of procedures used to manage records; (3) “reliability testing” of electronic records according to existing legal rules; (4) the procedures manual and the chief records officer; (5) readiness to produce (the “prime directive”); (6) records recorded and stored in accordance with “the usual and ordinary course of business” and “system integrity,” being key phrases from the Evidence Acts in Canada; (7) retention and disposal of electronic records; (8) backup and records system recovery; and (9) security and protection. From these standards practitioners have derived many specific tests for auditing, establishing, and revising electronic records management systems.⁵

The “prime directive” of these standards states: “An organization shall always be prepared to produce its records as evidence.”⁶ The duty to establish the “prime directive” falls upon senior management:⁷

5.4.3 Senior management, the organization's own internal law-making authority, proclaims throughout the organization the integrity of the organization's records system (and, therefore, the integrity of its electronic records) by establishing and declaring:

1. The system's role in the usual and ordinary course of business.
2. The circumstances under which its records are made.
3. Its prime directive for all RMS [records management system] purposes, i.e. an organization shall always be prepared to produce its records as evidence. This dominant principle applies to all of the organization's business records, including electronic, optical, original paper source records, microfilm, and other records of equivalent form and content.

Being the “dominant principle” of an organization's electronic records management system, the duty to maintain compliance with the “prime directive” should fall upon its senior management.

Because an electronic record is completely dependent upon its ERM system for everything, compliance with these National Standards and their “prime directive” should be part of the determination of the “admissibility” (acceptability) of evidence and of electronic discovery in court proceedings (litigation) and in regulatory tribunal proceedings.⁸

There are 14 legal jurisdictions in Canada: 10 provinces; 3 territories; and the federal jurisdiction of the Government of Canada. Each has an Evidence Act (the Civil Code in the province of Quebec⁹), which applies to legal proceedings within its legislative jurisdiction. For example, criminal law and patents and copyrights are within federal legislative jurisdiction, and most civil litigation comes within provincial legislative jurisdiction.¹⁰

The admissibility of records as evidence is determined under the “business record” provisions of the Evidence Acts.¹¹ They require proof that a record was made “in the usual and ordinary course of business,” and of “the circumstances of the making of the record.” In addition, to obtain admissibility for electronic records, most of the Evidence Acts contain electronic record provisions, which state that an electronic record is admissible as evidence on proof of the “integrity of the electronic record system in which the data was recorded or stored.”¹² This is the “system integrity” test for the admissibility of electronic records. The word “integrity” has yet to be defined by the courts.¹³

However, by way of sections such as the following, the electronic record provisions of the Evidence Acts make reference to the use of standards such as the National Standards of Canada:

For the purpose of determining under any rule of law whether an electronic record is admissible, evidence may be presented in respect of any standard, procedure, usage or practice on how electronic records are to be recorded or stored, having regard to the type of business or endeavor that used, recorded, or stored the electronic record and the nature and purpose of the electronic record.¹⁴

There are six areas of law and records and information management (RIM) applicable to paper and electronic records:

1. The laws of evidence applicable to electronic and paper records¹⁵
2. The National Standards of Canada concerning electronic records¹⁶
3. The records requirements of government agencies, such as the Canada Revenue Agency¹⁷
4. The electronic commerce legislation¹⁸
5. The privacy laws¹⁹
6. The guidelines for electronic discovery in legal proceedings²⁰

These six areas are closely interrelated and are based upon very similar concepts. They all make demands of records systems and of the chief records officer or others responsible for records. Therefore, a failure to satisfy the records management needs of any one of them will likely mean a failure to satisfy all of them. Agencies that manage these areas of law look to the decisions of the courts to determine the requirements for acceptable records.

Each of these areas of law affects records and information management, just as they are affected by the laws governing the use of records as evidence in legal proceedings—the laws of evidence. These relationships make mandatory compliance with the “prime directive” provided by the national standards, which states: “an organization shall always be prepared to produce its records as evidence.”²¹

United Kingdom

Australia

Identifying Records Management Requirements in Other Legislation

Your agency [or business] needs to be aware of the legislation governing its own records practices.

Some legislative requirements apply to many agencies [and businesses]. For example, occupational health and safety legislation requires an organization to keep certain types of records for prescribed periods of time. Requirements that apply to all agencies are included in the National Archives’ Administrative Functions Disposal Authority.

Other legislative requirements may apply only to the particular business of one or a number of agencies.

Recordkeeping requirements may be stipulated in your agency's enabling legislation (legislation that established the agency) or in specific legislation that your agency is responsible for administering.²⁴