Retention of University Records Policy

Introduction

The New School (“University”) is required to retain various types of records for specific periods of time, and has designated official repositories for their maintenance. These records must be managed according to this Policy and the outlined procedures and guidelines.

Definitions

These definitions apply to these terms as they are used in this Policy.

Active Record: An original record currently used by the department that generated it. Records remain active for varying numbers of years, depending on the purpose for which they were created. Active Records may be retained in the originating department or at an offsite storage company. Active Records include records in all formats, including but not limited to: paper, fiche, digitized or scanned documents, electronic documents, and all other formats.

Archival Record: A record that is inactive; not required to be retained in the department in which it originated or was received; and has permanent or historic value. Archival records are retained and preserved indefinitely-generally in offsite storage.

Confidential Records: Records that are of a private, proprietary or otherwise sensitive nature. The following types of records are absolutely confidential: (a) individual education records of living students or living former students, as defined by the Family Educational Rights and Privacy Act of 1974 (FERPA), as amended, unless the student or former student grants access in writing or unless one of the exceptions contained within FERPA applies; (b) individual employment records of living current or former faculty members, administrators or other staff members, including records which concern hiring, appointment, promotion, tenure, salary, performance, termination or other circumstances of employment, unless the faculty member, administrator, or staff member grants access in writing; (c) records that include “protected health information” as the same is defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 42 U.S.C. 1171 et seq. and regulations promulgated thereunder; (d) records that include “nonpublic personal information” protected under the safeguarding rules of the Gramm-Leach-Bliley Act of 2000 (GLBA); (e) other records where usage might constitute an invasion of privacy; (f) records the use of which has been restricted by contract; and (g) any other records with specific regulatory confidentiality requirements. The following types of records generally will be treated as confidential: (a) administrative records of the University for twenty-five years from date of their creation, with certain exceptions, such as those which must be open in conformance with law; (b) records of a sitting administration; and (c) records the disclosure of which might expose the University to legal liability.

Departmental Records Manager: The individual designated by the administrative head in each department to oversee the management of records within that department who is responsible for: 1) designating which official University Records are archival; and 2) effecting the transfer of Archival Records from the office in which they originated or were received to storage at such times and in the manner and form prescribed by the storage facility and subject to the appropriate retention and disposition schedules that are outlined in this document.

Electronic Record: Any record that is created, received or stored on a University local workstation or central server, i.e. a non-tangible electronic format. Examples include but are not limited to: electronic mail (email), PDFs, word processing documents, spreadsheets, scanned or imaged documents, databases, website content, social media content, or files maintained on a computer hard drive or external storage medium (including disks and thumb drives). The same retention standards that apply to tangible University Records also apply to Electronic Records, and the retention periods outlined in the Record Retention Tables apply equally to University Records in all formats. See Guidelines for Managing Electronic Records for additional guidance.

Inactive Record: An original University Record that is not an Active Record but still must be maintained pursuant to the Record Retention Tables set forth below. Inactive University Records are typically maintained at the University’s preferred offsite storage vendor or at other locations on campus.

Official Repository: The department designated as having responsibility for retention and timely destruction of particular types of official University records.

Personal Information: Records that include an individual’s name together with that individual’s Social Security Number; drivers’ license number or state identification card number; financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password that would permit access to an individual’s financial account; or biometric indicator. Personal Information is highly sensitive, and must be safeguarded and secured at all times.

University Record: The original or official copy of any record including Electronic Records. Official repositories for these records are identified in Record Retention Tables of this document. The definition does not apply to Instant Messaging (IM) which should not be used for conducting University business.

Purpose

In order to operate efficiently throughout the university, The New School requires consistent treatment of records. Maintenance, retention, and disposal procedures for University Records (see the "Definitions" above) must be followed systematically by and is the responsibility of staff in designated official repositories. Failure to properly maintain University Records may expose the university and individuals to legal risks.

In addition, duplicate or multiple copies of these records, retained in locations other than Official Repositories (see the “Definitions” above), must also be disposed of when they are outdated and no longer useful.

This Policy is intended to ensure that the University:

• preserves its history;
• meets legal standards;
• optimizes the use of space;
• minimizes the cost of record retention; and
• disposes of outdated and useless records.

Policy

Electronic Records

Responsibilities for Managing Electronic Records

Maintenance and disposal of electronic records is the responsibility of the Departmental Records Manager or e-mail user, depending on the category of the Electronic Record and must be in accordance with the Guidelines for Managing Records and also in compliance with Record Retention Tables. Failure to properly maintain electronic records may expose the University and individuals to legal risks.

Work-related email is a University record, and must be treated as such. Each e-mail user must take responsibility for retaining, disposing or archiving University records in accordance with the appropriate retention period specified in this Policy based on the content of the email. Email that does not meet the definition of University record, e.g., personal or junk email, should be deleted immediately from the system and not be commingled with work-related messages.

The University servers are not intended for long-term record retention. Information Technology (IT) performs backups on a regular schedule of the email and electronic files stored on central servers for disaster recovery. These backups are to be used for system restoration purposes only. IT administrators are not the legal custodians of messages or records which may be included in such backups.

When email is used as a transport mechanism for other records types, it is possible, based on the content, for the retention and disposition period of the email and transported record(s) to differ. In this case, the longest retention period shall apply.

See Guidelines for Managing Electronic Records for additional recommendations.

Litigation Holds

Responsibilities for Preserving Documents Relevant to Active Litigation

When litigation against the University or its employees is filed or threatened, the law imposes a duty upon the University to preserve all documents and records that pertain to the issues. As soon as University Counsel is made aware of pending or threatened litigation, a litigation hold directive will be issued to the legal custodian. The litigation hold directive overrides any record retention schedule that may have otherwise called for the transfer, disposal or destruction of the relevant documents, until the hold has been cleared by University Counsel.

If a litigation hold is placed with respect to certain documents, there is a legal duty to maintain these documents in their original form and they should not be destroyed or altered until the lawsuit is resolved. The documents may be scanned into electronic form, but the original paper documents should not be destroyed after scanning and should be maintained for the pendency of the lawsuit. Once the litigation is resolved and the litigation hold is lifted, after the documents have been scanned, the paper documents may be shredded.

Email and computer accounts of separated employees that have been placed on a litigation hold by University Counsel will be maintained by IT until the hold is released.

No employee who has been notified by University Counsel of a litigation hold may alter or delete any record that falls within the scope of that hold.

Violation of the hold may subject the individual to disciplinary action, up to and including termination, as well as personal liability for civil and/or criminal sanctions by the courts or law enforcement agencies.

See Exhibit A – “Notification to Hold/Preserve Document.”

Procedure

Responsibilities for Managing Official University Records

Departments and units that maintain University records are called “official repositories.” These specific departments are responsible for establishing appropriate record retention management practices. Each department’s administrative manager must designate a Departmental Records Manager to:

• implement the department’s and/or office’s record management practices;
• ensure that these management practices are consistent with this Policy;
• educate staff within the administrative unit in understanding sound record management practices;
• preserve Inactive Records (see the “Definitions” above) of historic value, and transfer those records to storage;
• ensure that access to Confidential Records is restricted. Long term restrictions on access to selected archival records should be negotiated at the time of their transfer to storage; and
• destroy Inactive Records that have no archival value upon passage of the applicable retention period.

If you have any questions about your responsibilities, contact the Records Manager (see "Additional Information" below), who will work closely with you to ensure understanding of this Policy and implementation of these responsibilities. Additionally, please refer to the Guidelines for Managing Records as well as the Guidelines for Managing Electronic Records.

Preserving or Disposing of Official University Records

When the prescribed retention period (see Record Retention Tables, which follow) for official University Records has passed, a determination of whether to preserve or dispose of the documents must be made. To decide if the record is of historic value to the University, consult the Departmental Records Manager (see the “Definitions” above) who has the authority to designate which records are stored permanently.

Option A
Archival Records

If you have determined that the records are archival, they may be transferred to permanent storage, call the Departmental Records Manager to:

1. Review records to be sent to permanent archival storage.
2. Request archival boxes (1 full file drawer = 2 boxes).
3. Request all relevant forms.
4. Schedule a time for boxes to be picked up.

Option B
Non-archival Records

If you have determined that it is appropriate to dispose of the records, destroy them in one of the following ways:

1. Recycle non–confidential paper records that do not contain Personal Information.
2. Shred or otherwise render unreadable Confidential Records or records that contain Personal Information.
3. Erase or destroy electronically stored data or Electronic Records. Contact the Office of Information Technology to ensure that Electronic Records are properly destroyed.

Caution: Periodically review records generated and maintained in University information systems or equipment (including mainframe, mini, and micro computing/storage systems) to ensure that these requirements are met.

Records Retention

Record Retention Tables list the official repositories for University records as well as how long these records must be retained.

Record retention periods may be increased by government regulation, judicial or administrative consent order, private or governmental contract, pending litigation or audit requirements. Such modifications supersede the requirements listed in this Policy. Suspension of record destruction required by any of these reasons will be accomplished by a notice sent out to affected departments by the Office of General Counsel, Human Resources, Office of Finance & Business (F&B), the Division of Financial Affairs, or the Office of Sponsored Programs.

Note: No document list can be exhaustive. Questions regarding the retention period for any specific document or class of documents not included in these tables should be addressed to the Office of the General Counsel (OGC).

Caution: Departments and units that are not official repositories and that retain duplicate or multiple copies of these University records should dispose of them when they are no longer useful.

Additional Information

Additional Records Information

• Record Retention Tables
• Guidelines for Managing Electronic Records
• Guidelines for Managing Records
• Exhibit A – “Notification to Hold/Preserve Document”

Contacts

Direct any questions about this Policy to your department’s administrative manager. If you have questions about specific issues, call the following offices: