Businesses create a vast amount of records every day for their business, clients, and employees. A business may have physical records, Electronically Stored Information (ESI), or a combination of both. In today’s highly technical environment, businesses are increasingly creating and maintaining voluminous documents electronically. Even a small business can create ten, hundred, to thousands of records a day. Whether a large or small business, businesses should be aware of their legal and practical obligations and use this information to properly manage the way that they create, maintain, preserve, and dispose of records.
Why is record management so important?
Effective record management helps businesses in many ways. It can help a business run more efficiently and smoothly by keeping the business records and processes organized while reducing the potential risk of exposure to claims, audits, and litigation. All of these actions can save a business significant cost.
In addition, it can help with ensuring that a business is abiding by state and federal compliance standards for record retention and destruction. This may include compliance with the following:
- Laws regarding tax documentation requirements pursuant to the Internal Revenue Service (IRS) and/or the California Franchise Tax Board (FTB) (this may become useful during an audit);
- Employment laws under the Fair Labor Standards Act (FLSA), California Labor Code, and Equal Employment Opportunity Commission (EEOC) (a former employee may ask for certain personnel and employment records, which you may be required to provide);
- Laws regarding the retention or production of employee and/or consumer information under the Health Insurance Portability Act (HIPAA);
- Laws regarding record retention requirements under the Employment Retirement and Income Security Act (ERISA);
- Laws regarding the collection of consumer information, how it can be used, maintained, and disclosed by a business, pursuant to the California Consumer Privacy Act of 2018 (CCPA);
- Laws regarding record keeping and reporting, as required by the Occupational Safety and Health Administration (OSHA) and Cal-OSHA; and
- Other federal, state, and local record retention provisions, depending on the business.
Businesses Should Have a Reasonable Record Retention Policy
As further protection from risk, all businesses, even small businesses, should have a document retention policy prepared and tailored to the specific business’s needs that covers all records, whether physical or ESI, with a retention schedule for each type of record.
For any business that may be subject to litigation, arbitration, audit, or investigation, a reasonable document retention policy can greatly reduce the costs of discovery, especially electronic discovery and legal fees, as a policy may make records easier to find and retrieve. In addition, such a policy can help businesses avoid the risk of claims of improper destruction of evidence or claims of spoliation of evidence if a business destroys documents pursuant to a reasonable record retention policy that demonstrates that there were legitimate and neutral purposes for destroying records. The policy should be followed consistently by the business for it to be effective in protecting the business.
A business can create a reasonable document retention policy tailored to the business with the assistance of legal counsel and/or Records and Information Management (RIM) professionals, and the cooperation of management level persons from the business with knowledge of the business’s records and processes. The process of creating such a policy may include taking inventory of a business’s records, appraising the records, creating a record retention schedule for each type of business record, creating a plan to implement the schedule, and creating a plan on how records will be retained, maintained, and disposed of.
How long should a business retain documents?
How long a business retains records should be determined by a record’s usefulness depending on the type and needs of a business, the lifecycle of specific documents, and whether there is a legal requirement to retain a document for a certain period of time. Some samples of suggested retention periods for various records are provided below:
The retention period for records generally ranges between 1 to 10 years, with some records requiring a business to keep them permanently.
How Should Records Be Maintained?
Whether in physical or electronic form, records should be kept in an organized manner so they can be located easily. The records should also be kept in a manner to ensure that the information in the record and the record itself is safe and maintains the record’s confidentiality. It is common now for businesses to electronically store documents, especially when a business has voluminous records, as it may be an easier way to maintain, secure, and retrieve documents.
- Bank Deposit Slips should be kept for 3 years;
- An Employment Application should be kept for 3 years;
- Accounts Payable and Receivables documents should be kept for 7 years;
- Records of an employee after discharge should be kept for 7 years; and
- Accident Reports should be kept for 7 years.
How Should Records Be Disposed Of?
A record should not be disposed of until the end of its retention period, which should be documented in a retention schedule in a business’s record retention policy. If the records are in physical paper form, the documents should be shredded and the destruction should be documented, in case proof of compliance with a company’s record retention policy is required. Businesses should consider taking such records to a shredding facility or using a service that certifies that the records are fully destroyed.
Destroying electronic records can be tricky, since deleting a file does not actually remove the data or record. This may require the use of certain specialized software to permanently remove specific files or delete entire hard drives. Some items, such as portable hard drives, flash/thumb drives, CDS or DVDs, can be physically broken. A business may require the assistance of IT or other professionals to assist with this.
If a business uses a cloud or remote storage, an inquiry should be made into the provider’s data/record destruction policies and process.
Legal Holds: The Exception to Following the Record Retention Policy
The regular retention procedures prescribed in a record retention policy should be suspended when records, or a group of records, are placed on a “legal hold.” A legal hold requires preservation by the business of certain records under special circumstances, such as when a claim is made against the business, there is litigation, a government investigation, or an audit. When these events occur, the business has a duty to preserve these records as evidence, arising as early as when a business’s management learns of any a potential claim that could reasonably give rise to litigation, government investigation, or an audit. The business should consult with legal counsel to determine whether there is a need for a legal hold and the records that should be placed under the hold, if one is required. A business’s records retention policy should include a section that addresses how a legal hold should be handled by the business.
Conclusion
Although there will be costs associated with the proper management of a business’s records, the benefits the business will receive will significantly outweigh these costs. A reasonable record retention policy that is followed by a business will organize and streamline the business and its processes and reduce the business’s exposure to claims while ensuring that the business is complying with its legal and practical obligations with regards to the creation, maintenance, retention, and disposal of records. At the end of the day, these actions help reduce a business’s exposure to risk and save costs.