Policies & Procedures
Policies & Procedures / Records Management Policy

Records Management Policy

Purpose:

To specify the proper administration of university records throughout their lifecycle, including the activities of maintenance, disposal, and archival, to ensure that: 1) the information needed to effectively operate the university is available; 2) there is compliance with the rules of governing authorities, such as state and federal laws and accreditation requirements; 3) university history is preserved; 4) the risk of exposure of confidential information that is no longer needed is minimized; and 5) storage space, both physical and digital, is released when no longer needed. 

Definitions Related to this Policy:

Archives which are officially called the University Archives and Special Collections, is designated by the Board of Trustees (May, 2007) as the official repository for institutional records and university primary source materials of historical, cultural, administrative, legal and/or fiscal value. 

Department Records Manager means the person designated for each department to 1) work with the URM to define the Retention Schedules and 2) ensure that records management activities within the department are adhering to the policy. 

Inactive Records means those that are no longer needed operationally and either: 1) the retention period has been exceeded or 2) the retention indicates it should be permanent.

Retention Schedules means the schedules that specify the categories of university records and key characteristics of each category. Refer to Retention Schedules on the university Risk Management website. For each category, the following information is identified: 

  • Department means the university department that is responsible for maintaining and disposing of the record. The “Department of Record” will in most cases be the office that creates the record.  Categories of records that are present in all departments are labeled “General”. 
  • Series means a unique number assigned to each category. 
  • Retention means a period of time that a record should be retained, as calculated from the record’s creation date or other point in time if specified. If the record should be permanently retained, it will be labeled “Permanent”.
  • Authority means the factor that is determining the retention period, such as a governing body or professional standard, when it is not determined solely based on operational needs. 
  • Vital means vital records are those that are necessary for the operation of the university, at a bare minimum. If a disaster occurred, these are the records that would be necessary to restart the university. 
  • Value means there are five types of value a record can have:
    • Legal: necessary for compliance with legal statutes or as evidence for the legal operation of the university
    • Operational: necessary for the basic running of the university as an organization
    • Historical: of interest to the history of the university and those affiliated with it
    • Fiscal: necessary for the monetary operation of the university
    • Research: historical record of how the university has operated
  • PII means the record contains Personal Identifying Information such as Social Security number, driver license number, passport number, other government-issued identification card number, birthday, biometric identifiers (e.g., fingerprints) or personal medical information.

University Records means units of information in any format that document a transaction, decision, or relationship made by the university. Examples include official correspondence, financial transactions, student educational records, reports, forms, meeting minutes, and university publications. All University Records are the property of the university.

University Records Manager (URM) means the Director of Risk Management or their designee who is the point person for questions about the retention and disposal of records. 

Policy:

  1. Maintaining University Records - maintain records owned by your department as follows:
    1. If there is a computer system of record for the information, maintain the records there and only there. The data may be integrated into other systems by Willamette Integrated Technology Services (WITS).  
    2. Store electronic documents on departmental network drives, shared Google drives, or OnBase document management directories which are set up by WITS.
    3. Store paper documents in secure locations in an organized manner.
    4. Working copies of records can be created but must be destroyed promptly after use.
    5. Records that contain PII must always be kept confidential, throughout their entire life cycle. 
    6. Review records every six months  to determine which are inactive and then follow the instructions for handling Inactive Records.
  2. Handling of Inactive Records - dispose of Inactive Records owned by your department, as follows:
    1. If records are electronic and the schedule lists a retention period, purge them as follows: 
      1. Fill out a Records Destruction Authorization Certificate and send it to the URM.
      2. For records stored on a computer system of record, such as Colleague or Workday, use the system’s provided purge function to delete the records. If the system doesn’t have a provided purge function or you need help, contact WITS at WITS Service Request on willamette.edu before deleting any data.   
      3. For records stored on network drives, Google drives, or OnBase document management, use the system-provided delete or ‘move to trash’ function to purge the records.
      4. If the records contain PII or other Confidential Information as defined in the Information Security Policy on willamette.edu and they are stored on removable media devices, such as external hard drives, USB memory sticks, or CD’s, contact WITS at WITS Service Request on willamette.edu for instructions on how to dispose of them in a secure manner.  
    2. If the records are paper and the schedule lists a retention period, destroy them as follows:
      1. Fill out a Records Destruction Authorization Certificate and send it to the URM.
      2. If the records contain PII or other Confidential Information as defined in the Information Security Policy on willamette.edu, dispose of the records in a secure manner. Contact the URM for help.
      3. If the records do not contain PII or other Confidential Information, dispose of the paper. 
    3. If the records are paper and the schedule indicates that the record is permanent, transfer them to Archives as follows. 
      1. Arrange materials into records cartons.
      2. Fill out Certificate of Transfer form found on the Records Management page on willamette.edu.
      3. Send the paper copy of the Certificate with the paper records to the URM.
      4. Send an electronic copy of the Certificate to the URM.
      5. Contact the URM to arrange the transfer and then follow the agreed upon process to physically transfer the records.
      6. You will receive verification of the transfer from the URM.
    4. If the records are electronic and the schedule indicates that the record is permanent, maintain them in their current form.
  3. Managing the Retention Schedules and Archives - the URM is responsible for managing the Retention Schedules and Archives, as follows:
    1. Sets and periodically reviews the Retention Schedules, enlisting the input of the appropriate departments and General Counsel as needed. 
    2. Maintains an activity log of records transferred to Archives and disposed of.

Effective Date: April 19, 2023
Responsible Person/Primary Contact: Director of Risk Management
Responsible University Office: Risk Management