Retention and Destruction of Records

Policy and Retention Schedule PDF

Policy

The University is committed to compliance with applicable legal and regulatory standards and good business practices in managing its Records (as defined below).  In order to achieve compliance with such standards and practices, it is the policy of the University (as defined below) that standards for retention and destruction of Records should be specified and applied.

Purpose of this Policy

To identify the standards governing retention and destruction of University records, describe the process for destroying Records that have reached the end of their mandatory retention period or are no longer necessary for business operations and designate the appropriate custodians of Records and method for preserving Records.  Records of academic research and data may be governed by additional policies or regulations.  

Scope of this Policy

This policy applies to all University Personnel (as defined below).

Policy Definitions

 A.  “Investigation” means (i) an investigation pertaining to the University University Activities, University Resources or University Personnel where their relationship to or activities at the University may bear on the investigation, which includes but is not limited to an investigation by or on behalf of: any government entity; any quasi-governmental agency; any regulatory or legal oversight authority (e.g. accreditation agencies such as the Middle States Association of Colleges and Schools, The Joint Commission or professional licensure agencies); the University itself; or a private person or entity relating to the University or University Personnel that could lead to Litigation or the filing of a complaint with the University, a government entity, quasi-governmental agency or regulatory or legal oversight authority; or (ii) any other investigation where the University or University Personnel hold Records that are relevant to such Investigation.  An Investigation includes not only an existing Investigation but also includes situations where the University or University Personnel have notice, should know or reasonably can anticipate a future Investigation.

B. “Legal Hold” means a written (which may be by email or other electronic means) directive issued by the OGC directing the retention of Records related to an Investigation or Litigation.

C. “Litigation” means (i) any legal proceeding to which the University or any University Personnel in their capacity as University Personnel is a party or a witness that is brought in any court, alternative dispute resolution forum or administrative agency; or (ii) any other legal proceeding where the University or University Personnel hold Records that are relevant to such legal proceeding.  Litigation includes not only existing Litigation but also includes situations where the University or University Personnel have notice, should know or reasonably can anticipate future Litigation.

D. “Non-Record” means information that would be a Record but for its formal designation as a Non-Record.  Non-Records include blank forms, and publications and periodicals of general circulation (including newspapers and magazines).  In the absence of an Investigation, Litigation or Legal Hold, Non-Records also includes duplicate copies of Records, drafts of documents, items containing information where the nature, content and/or source of the information is not readily identifiable and messages or communications containing information that is short-lived or that contains information of negligible or non-existent permanent administrative value, including without limitation, telephone message slips, self-sticking notes and voice mail communications, provided that such information does not constitute portions of any University patient health record and is not otherwise required to be maintained.  Non-Records includes other items designated as Non-Records from time to time by OGC.

E. “OGC” means the University Office of General Counsel.

F. “Record” means recorded information in any form, regardless of physical form or characteristic, generated or received by or on behalf of the University or University Personnel in their capacity as University Personnel and includes information pertaining to University Activities or University Resources.  A Record includes all original documents, papers, letters radiographic images (e.g., X-rays), clinical readings, cards, books, maps, photographs, blueprints, sound or video recordings (e.g., records, CD’s, DVD’s, audiotape, videotape), microfilm, magnetic tape, electronic media (including information store on computers), emails and other media for recording information.  Original documents means the electronic, digital, microfilmed or other preserved or archived non-hard copy of Records where the University has expressly authorized in writing the destruction of original Records.

G.  “Protected Health Information” (“PHI”) means individually identifiable data that relates to an individual’s health status

H.  “University” means New York University, including all entities controlling, controlled by or under common control with New York University, including, without limitation, NYU Langone Medical Center, except that NYU Langone Medical Center may adopt its own Retention and Destruction of Records Policies which substantially implement the principles of this Policy.

I. “University Activities” means any and all activities, operations, or undertakings, whether undertaken directly or indirectly, of the University or of any University Personnel in their capacity as University Personnel, including without limitation, any University programs, operations, and/or services.

J. “University Facilities” means any and all facilities owned, leased, licensed or otherwise in the possession of the University.

K. “University Funds” means funds that are owned, held in trust by or for, or administered by the University, regardless of their origin.  Such funds include, but are not limited to, University operating funds, Board-restricted funds, investment funds, endowments, amounts received by the University from contracts or grants, including sub-contracts or sub-grants, amounts received by the University from contributions, gifts or awards and any income resulting from them.

L. “University Personnel” means Trustees, directors, officers, members of Board committees, employees of the University, trainees, volunteers, observers, contractors, and any other persons who are formally associated with the University for the purpose of overseeing or engaging in any activity, operation or undertaking of the University or for or on behalf of the University that involves the creation or use of University Records, and other persons designated by the President or his/her designee.

M. “University Resources” means University Facilities, University Funds, property or other tangible or intangible assets or resources of the University, such as furniture and equipment, owned, leased, licensed or otherwise in the possession of the University, University inventory and supplies, Intellectual Property owned, licensed or otherwise in the possession of the University, and/or University Personnel during periods when University Personnel are acting within the scope of their relationship with the University or are using University Facilities, University Funds, or other University Resources, including without limitation other University Personnel.

Procedures for Implementation

I.   General Principles

 A.The University will generate, use, maintain, store, retain and destroy Records in accordance with the requirements of applicable legal, regulatory, accreditation and other standards.

 B. All University Personnel who have access to or use Records are responsible for ensuring that Records are generated, used, maintained, stored, retained and destroyed in accordance with this Policy.

C. All Records are owned by the University and constitute University Resources.  University Personnel have no personal or property rights to any Records even where they participated in the creation or making of the Records unless otherwise expressly agreed in writing by the University. 

D. Unauthorized removal or modification of Records from the University is not permitted.  Unauthorized destruction or disposition of Records is prohibited.

E.  In the absence of an Investigation, Litigation or Legal Hold, (i) Non-Records may be destroyed or disposed of upon completion of their use and (ii) Records may be destroyed or disposed of after the expiration of their retention period as set forth in this policy.

F.  The unauthorized alteration, use or disclosure of a Record is prohibited. Anyone who falsifies or inappropriately alters a Record, or removes, uses or discloses a Record without authorization may face disciplinary action, up to an including termination of employment (and, in the case of members of the Medical Staff, disciplinary action pursuant to the Medical Staff By-Laws).

II.  Retention of Records

 A.  Retention Schedule.  The retention schedule attached as Schedule 1 specifies minimum retention periods for certain Records.  The retention periods specified are intended to be consistent with applicable legal, regulatory, accreditation and other standards, including administrative and best practices.  A Record falling within Schedule 1 will be retained for not less than the minimum period specified for that category of record unless the OGC authorizes an exception.

B.  Records Not on Record Schedule.  Where a Record does not fall within Schedule 1, the applicable department head should designate in writing the extent to which Records in his/her department should be maintained, which designation is subject to the approval of his/her Dean or Vice President or designee.

C.  Inappropriate Treatment of Records.  Any University Personnel knowing of the inappropriate removal, modification or destruction of any Record must promptly notify OGC.

D.  Beginning of Retention Period.  The retention period for a specific Record begins on the last of (a) the later of the date filed or the due date for filing in the case of Records filed with a governmental, judicial, regulatory or accreditation authority or (b) the date of the last transaction, encounter or item of information reflected in that record or in accordance with the terms of the Record.  For example, the retention period for a Patient Health Record begins when the last encounter with the patient is recorded; the retention period for a services contract begins on the termination date, the retention period for personnel records begin on the termination of employment and the retention period for research grants/protocols begins upon completion of research and locking of the database.

E. Recalculating Retention Period.  If a Record is reopened, the retention period for that Record will be recalculated in accordance with D above.  For example, if a previously terminated contract is renewed, the retention period for the contract is recalculated to begin as of the date of the new termination date.

F.  Contractual Retention Period.  If an agreement provides that Records will be kept for a period that is longer than the retention period specified in Schedule 1, then the period specified in the agreement controls.

 G.  Changes to the Retention Schedule.  The OGC may make additions, deletions and modifications to the Retention Schedule (Schedule 1) based on the applicable legal, regulatory and accreditation and other standards, including administrative and best practices. 

H. Issues with Retention Schedule.  University Personnel are required to contact the OGC promptly if they believe that applicable legal, regulatory and accreditation and other standards require a retention period for a Record that is longer than that set forth in Schedule 1, and, pending resolution of the matter by the OGC, the Record at issue should be retained for the longer period.  University Personnel who believe that there should be other changes to Schedule 1 with respect to specific Records are encouraged to contact the OGC.

I.  Copies of Records.  In the absence of an Investigation, Litigation or Legal Hold, only one copy (generally the original, fully executed version of the Record where available) of each Record must be retained. 

J. Confidential Records. Confidential Records must be securely maintained, controlled and protected to prevent unauthorized access or disclosure. Unauthorized use or disclosure of a confidential Record may result in disciplinary action, up to and including termination of employment. Confidential Records include patient medical records, student educational records, business plans, strategies, forecasts, business practices and marketing information, know-how, trade secrets, methods, techniques, designs, specifications, computer source code, patient lists, pricing information, personnel information and any other information marked confidential.

 K.  Record Substitution.  To the extent not prohibited by law or regulation, a Record in paper form may be digitally scanned, microfilmed or microfiched and substituted for an original paper document. The applicable retention period for a Record does not change when a properly substituted image of a Record is created. A Record’s mandatory minimum retention period is counted from the creation or receipt of the original Record, not the date on which the substitute image was created.

L. Destruction of Records.  In the absence of an Investigation, Litigation or Legal Hold, (i) Non-Records may be destroyed or disposed of upon completion of their use and (ii) Records may be destroyed upon the termination of the applicable mandatory retention period. The appropriate method of destruction depends on the Record’s physical form or medium and subject matter or content. Records that include Protected Health Information or patient-specific identifiers should be destroyed or disposed of so that the personal data cannot practically be read or reconstructed.  They should not be placed in unsecured trash or recycling receptacles unless first rendered unrecognizable. Paper Records will be redacted, burned, pulverized or shredded and electronic Records will be destroyed or erased. Absent any special instructions or unique circumstances, Records generally will be destroyed at the end of their retention period; retaining any Record past its mandatory retention period should be on an exceptions-only basis after weighing the potential usefulness of the Record against cost or space limitations.

III.  Investigations, Litigation and Legal Holds

A. University Personnel must immediately notify the OGC if they become aware that Litigation or an Investigation has been initiated or have notice, should know or reasonably can anticipate future Litigation or an Investigation.

B. University Personnel also should notify OGC if they have knowledge of facts orcircumstances that suggests the possibility of Litigation or an Investigation against the University or University Personnel in their capacity as University Personnel, even where they do not have notice, should not know or reasonably cannot anticipate future Litigation or an Investigation.

C. The OGC will determine whether to initiate a Legal Hold with respect to Records (which may include Records not previously subject to retention) relating to Litigation or an Investigation.  Records subject to a Legal Hold must be retained while the Legal Hold is in effect, irrespective of the otherwise applicable retention period under this policy.  The Legal Hold also may require retention of specified Non-Record.

 D. Where the OGC initiates a Legal Hold with respect to Records relating to Litigation or an Investigation, the OGC will notify the University Personnel it believes need to be aware of the Legal Hold and will specify the Records (and, if applicable, Non-Records) subject to retention while the Legal Hold is in effect and may issue special instructions relating to such Records.  Such University Personnel are required to follow special instructions.  In addition, such University Personnel should immediately advise the OGC of others (including names, titles and contact information) who may need to know about the Legal Hold (e.g., persons in control of the specified Records, persons who might otherwise destroy or authorize the destruction of the specified Records).

 E.  University Personnel who do not directly receive notice of a Legal Hold but who are aware of Litigation or an Investigation or believe a Legal Hold may have been issued should contact the OGC and retain potentially relevant Records until their status is clarified by the OGC.

 F. The OGC may change the scope of a Legal Hold by written notice at any time.

G.  A Legal Hold remains in effect until OGC formally terminates the Legal Hold by written notice.

H. Unless the OGC provides guidance to the contrary, when a Legal Hold is terminated, (i) Records previously covered by the Legal Hold should be retained in accordance with the applicable retention period under this policy without regard to the Legal Hold, and (ii) retained Non-Records or Records not previously subject to retention may be destroyed.

IV.  Administration and Interpretation

Questions about the administration or interpretation of this policy should be directed to OGC.