Ask the Experts

Risk and cost are closely aligned when it comes to records management. Your cost and risk increase with the amount of information you manage, and they decrease with the degree of control and consistency you have over that information. In other words, good records management reduces your costs and minimizes your risk.

Proactive records management allows you to destroy information that is no longer needed, providing better access to what is relevant and a more efficient and consistent process to do so. It also yields faster access, lower management and storage costs, better results and cost savings.

Reactive records management highlights the risk and exposure of information. What if you can’t find the right information in time? You have kept things that are irrelevant that must now be produced, or worse, can be taken out of context and should not have been retained. Good records management is also about risk mitigation and avoiding these scenarios.

For more, check out my blog post.

It sounds fundamental, but most organizations struggle to know what information they actually have. Information is spread across formats, geography and systems with little consistency or continuity. Not everything is a record, and not all information needs to be managed. So organization must first decide what’s important enough to keep and track.

To get a handle on information inventory, it helps to break it into categories: onsite physical, offsite physical, active digital and archival digital. From here, you can start to compile and review the systems that manage the inventory in each category. The goal is fewer systems with tighter integration to provide better control and consistency.

For more, check out my blog post.

This unfortunately doesn’t happen enough and an example of the issues that could arise is the legal case between GFI Acquisition, LLC v. Am. Federated Title Corp. (In re A & M Fla. Props. II, LLC), 2010 WL 1418861 (Bankr. S.D.N.Y. Apr. 7, 2010). The main problem in this case was that the plaintiff’s counsel failed to produce all relevant information in a timely manner mainly due to a lack of understanding of computer systems and software and how information is stored and preserved.  The result of this was that information was provided in the end, but only with significant delay, which caused the court to order monetary sanctions.

For more, check out my blog post.

Recognizing that the unexpected can — and does — happen is the first step in being able to quickly recover from a disruption or respond to a discovery request. You must also implement disaster recovery processes that ensure a paper record — as well as the system on which electronic information resides — can be restored following an unplanned event. You’ll also need to develop litigation readiness programs that help you identify and produce the records needed during a lawsuit in a timely manner.

Hundreds recently took part in an online survey on this topic, and I think you’ll agree that comparing your company’s concerns against those of your peers can shed light on how you approach these types of initiatives in the future. Some highlights from the survey results include:

1)    Reducing information management risk is key to achieving business success

2)    Trigger events drive action

3)    Applying electronic records to your retention schedule is painful.

It’s a stretch but in some circumstances this capability could significantly raise your Discovery risk. To illustrate this problem further, read my blog post where I specifically talk about an application called TrueCrypt, which is a free open-source disk encryption software application for Windows 7/Vista/XP, Mac OS X, and Linux.

You want to get rid of what you don’t need so you can find what is important. If you open your desk drawer to organize it, the first intuitive step is to throw out the garbage and irrelevant junk. So it’s just as important to eliminate irrelevant information as it is to classify and organize what is relevant. Our ability to generate and distribute information faster only dilutes the real information among the flotsam and jetsam of irrelevant data.

Disposal must be conducted according to a retention schedule that provides a consistent process to identify records that are eligible for destruction. In addition, you may need to place some items on hold, suspending their disposal due to tax, audits or litigation. A centralized system of record that manages all of your inventory will allow you to systematically apply the proper retention and administer any holds that impact this process.

For more, check out my blog post.

- Plan for the “worst-case” requirements and build a disaster recovery plan that adequately addresses your risks
- Securely archive patient records (including paper medical records, backup tapes and digital information) offsite.  Now here’s the tough part.  While you want the records offsite, they also need to be readily accessible for patient care
- Separate your primary and backup data in geographically dispersed data centers.  So, storing your backup tape 2 miles down the road at another hospital in your system simply won’t cut it
- Avoid using the same infrastructure for primary and backup sites
- Test your disaster recovery plans and processes at least once a year

It’s nearly an impossible challenge. The complexity comes from a cocktail of regulation and compliance, information saturation, and an uncontrollable mix of physical and electronic formats and repositories. It is almost an unattainable holy grail. But developing a centralized, policy-based system to manage records of every format and in every location can be achieved.

To do it, it is helpful to break down the primary goals of records management to its core elements. This provides a framework that helps organize the moving parts of a solution.

Here are the 3 principles:

1)    Inventory – know what you have

2)    Policy – know how long to keep it

3)    Process – provide efficient access to it

There is no magic to these principles, but having all three establishes a strong foundation capable of scaling with growing volumes of information, multiple physical and electronic record systems, and mounting regulations and governance issues.

For more, check out my blog post.

At a high level, 36 CFR Part 1234 outlines the requirements for record storage facilities.  It is based on hundreds of criteria related to security, topography, fire protection, disaster recovery and environmental controls like air quality.  Click here to review some of these requirements

Despite countless blogs and commentaries to the contrary, not only is tape still alive and well as a backup and archiving medium for data storage, but there is a growing list of recent announcements from storage and data protection manufacturers highlighting new tape product offerings resulting from their continued investment in this “legacy” technology.

Your information is
all intellectual property that your organization pays individuals to produce,
interpret, use and export to others. After people, it’s a company’s most
valuable asset, and it has many CIOs, GCs and others responsible asking: What’s
in that information; who controls it; and where is it stored?

In simplest terms, I believe that businesses exist to
generate and use information to produce revenue and profit. If you think of information as a commodity, we
must also ask: How much does it cost to generate all that information? What’s the ROI for all that information?

The vast majority of information in an organization is not
managed, not indexed, not backed up and is rarely (if ever) accessed. Consider for a minute all the data in your
company that is not centrally managed and not easily available. This data
includes backup tapes, share drives, employee hard disks, external disks, USB
drives, CDs, DVDs, email attachments sent outside the organization and hardcopy
documents hidden away in filing cabinets.

If your company can’t find information
or doesn’t know what it contains, it is of little value. In fact, it’s
valueless.

For more, check out my blog post.

To establish that starting point, you must collaborate with other stakeholders in your organization.  Successful records and information management professionals know they must seek the input of IT, Legal, Compliance and other critical business departments.  You can’t succeed without collaboration. While the reasons and incentives (namely, reduced cost and risk) seem a given, few organizations have embraced a team-based approach to records and information management governance. 

Whatever you do, don’t leave it up to fate to get you on the way to your goal of compliant records and information management.  Take the initiative to begin assembling a purpose-built committee to support your efforts and break the ever-repeating cycle of inaction.

For more, check out my blog post.