1. Legal Issues in Records Management
Brad Houston, University Records Officer
July
Legal Issues in Records Management

2. Records Management and the Law
RM programs in public institutions (like UWM!) driven by legal mandate
Provides legal protection in case of public records request, subpoena, etc.
Privacy laws and concerns: dictates disclosure

3. Goals of this presentation
Introduce participants to relevant laws, court decisions, and policies
Explain steps you can take to ensure compliance and limit liability
Focus on electronic records and requirements for storing and producing digital files
Describe basic procedures for dealing with records requests

4. What this presentation will not do
Do NOT rely on this presentation for legal advice!
Guidelines for compliance, preparation for discovery/disclosure
Not intended to provide SPECIFIC instruction for individual litigation cases
If your office is subject to litigation/discovery:
Contact Legal Affairs (x4278)

5. Part I: Basic Relevant Statutes
Laws and what they mean for you as a UWM Employee

6. Wis. Stat. 16.61: Public Records Law
Definition of a public record
Materials “made or received… in connection with the transaction of public business”
Public records are property of the State of Wisconsin
Public records may not be destroyed without approved records retention schedule
Electronic/Microfilm copies may be considered official records

7. 16.61: Public Records Definition
Defined regardless of format
“books, papers, maps, photographs, films, recordings, optical disks, electronically formatted documents or other documentary materials”
Major Exceptions:
Convenience/Reference copies
Notices/Invitations
Drafts/Notes (not shared with colleagues)
Routing Slips/Envelopes

8. 16.61: State ownership of records
An accountability measure!
Provision for internal audit of department activities
No destruction without records schedules (RRDAs)
General Records Schedules: Fiscal, Personnel, etc.
Specific Records Schedules: Dept. series
Records Schedules must be renewed every 10 years

9. 16.61: How do I comply?
Make sure all records in office have applicable record schedules
Most offices are mostly covered by general records schedules
Separate records from non-records
Maintain filing by record series and disposition date

10. 19.31: Open Records Law
All public records potentially available to any public requestor
“The denial of public access generally is contrary to the public interest…”
Public records requests coordinated by UWM Records custodian
Exceptions to required disclosure
Limitation of scope of disclosure

11. 19.31: Who can request records?
ANY requestor may request viewing of public records except as otherwise provided by law!
Confidential Records: subject or his/her designee may view (but see exceptions)
Requestors NOT required to provide reason
If requested records are internal use (i.e. not intended for public), refer requestor to Public Records Custodian

12. 19.31: Exceptions to disclosure
Information gathered in connection with a complaint/grievance/arbitration
Information which may endanger an individual’s life/safety
Information which identifies informants

13. 19.31: Limitations on Disclosure
You are not required to disclose:
Trade Secrets, including research data
Identities of applicants for public positions (until finalists)
Plans/Specifications of State Buildings
Personnel Records (including some supp. materials)
Financial Identifying Information
If you suspect requested records to include these materials, inform the records custodian!

14. 19.31: How do I comply?
Defer ALL public records requests to UWM Public Records Custodian
Maintain appropriate security levels for all records
Suspend records destruction once a public records request is received
Be prepared to make ANY eligible record in your office available
Requestors may sue for “unnecessary delay”, so be timely in responding to the Records Custodian!

15. Federal Rules of Civil Procedure
Define rules and regulations re: discovery of records for subpoenas/litigation in federal court
Describe scenarios under which records disposition can/cannot occur
Provide for potentially severe penalties for non-compliance or premature destruction
In all cases, FRCP-relevant cases will be handled through Legal Affairs

16. What to do if you’re being sued
Contact Legal Affairs IMMEDIATELY
If electronic records are involved, also contact UITS to preserve backup tapes
Cease all records management activities (especially records destruction)
Assess your ability to produce records, and how quickly

17. Scope of FRCP Discovery
ANYTHING in subpoenaed files may be subject to discovery and use!
Protect yourself:
Keep files on different cases/projects discrete
Destroy files scheduled for destruction in a timely manner unless litigation has started
Do not use your personal for work purposes, or vice-versa
Why? You may need to produce in connection with litigation

18. “What if I’ve already destroyed those records?”
FRCP “Safe Harbor” clause! Applies if:
Records schedule for that series exists
Disposition of that series is performed on regular basis
Records were destroyed before Legal Affairs became aware of litigation possibility
Strongest argument for practicing good records management

19. Part II: Special Cases
FERPA, HIPAA, and UWM’s Personnel File Policy

20. Family Educational Rights and Privacy Act (FERPA)
Students have right to view educational records
Educational records are only accessible to student
Student may authorize disclosure
Directory Information may be made available
Exception: if a student has opted-out
Certain other exceptions exist

21. FERPA: Educational Records
All records pertaining to students maintained at UWM
Presumption of confidentiality
Major exceptions:
Instructor personal/sole possession notes
Employment Records
Campus Security Records
Alumni records

22. FERPA: Directory Information
Defined as information publicly available:
Name, Address, Contact Info
Year in school, major, enrollment status
Participation in activities
Degrees, graduation date, awards received
Students may choose to opt out of directory information release
Contact Enrollment Services
Campus Directory?

23. Who has unrestricted access?
Individual Students
UWM Employees with “Genuine Educational Interest”
Exempted classes
Financial Aid Providers
Other educational institutions (for transfers, etc.)
Specifically exempted officials (FERPA Manual)
Accrediting groups/student study groups

24. Student Consent of Release
Students must provide WRITTEN consent (with signature), including:
Specification of records to be released
Identify to whom records may be released
Indication of purpose of release
Provide requested records within 45 days
No consent needed if records are subpoenaed or requested via public records request
But contact Records Custodian first to determine validity of subpoena

25. Just don’t do it! Release FERPA-protected information to parents
Exception: if student is under 18
Post test or course grades using social security numbers
Provide records to UWM staff without “legitimate educational interest”

26. Logging your FERPA activities
Keep a log of all disclosures of FERPA-protected information
Exceptions: access by student or student-permitted party, directory info disclosure
Keep a log of notifications to students of disclosure
Maintain letters of consent for AT LEAST six years after student graduates/leaves UWM

27. If in doubt re: FERPA disclosure
Do not disclose student information if you have ANY doubt re: permissions
Contact Legal Affairs for guidance
Advise requestor to direct request to Public Records Custodian
Current Legal Affairs stance: presume ALL student information is private
Why? Directory Info “Opt Outs”

28. UWM Personnel File Policy
Defines Official Personnel File and contents
Provides provisions and restrictions for access
Prescribes official custodian, length of retention
This section being revised
Does not in itself have force of law
Clarifies key provisions of Public Records Law

29. Official Personnel File
Copy of the Personnel File held by Dean or Division Head or their designate
Usually the PRep, but they may delegate
Contains all information related to employment actions by a UWM employee
Become inactive after employee leaves:
Classified: 7 year retention and destroy
Unclassified: 10 year retention and destroy
Faculty: 30 year retention and transfer to archives

30. Access to the Official P-File
Employees may view their own personnel file
May not view confidential records within P-file
Coordinate request with Public Records Custodian, especially if sent to Archives
Employees may authorize access to their personnel file
Requires written permission from employee
Route through public records custodian
All subpoenas subject to review by Legal Affairs

31. Health Information Portability and Accountability Act (HIPAA)
Defines and protects certain classes of health information
Indicates which entities are required to protect information, and which are excluded
Provides right of patients to access health records

32. Who follows HIPAA on campus?
Surprisingly, not applicable to most departments on campus!
Employer medical information not subject to HIPAA regulation
Three main groups of covered depts/people:
Provider units (Athletic trainers, Health Center, Health Sciences and Nursing Centers)
Administrative units (Bursar, BFS, Institutional Review Board, some members of UITS)
Researchers and students using clinical info

33. For more HIPAA information
UWM HIPAA resource site
UWM HIPAA manual
Other questions? Contact Legal Affairs directly

34. Part III: Legal Issues and E-records
Wisconsin Administrative Rule 12, Digital Millenium Copyright Act

35. A Record is a record is a record
Electronic documents are records too, and subject to public records request/subpoena!
Latest revisions to FRCP include e-discovery provisions:
E-records are discoverable and usable as evidence
Must be produced within 30 days, in the form in which they are used
Requestor may specify form of production
Third parties may be subpoenaed (Twitter, anyone?)

36. Wisconsin Admin. Code Ch. ADM 12
Puts forth criteria for maintaining electronic records
Mandates design and use of information systems to support e-records
Does NOT require departments to maintain records electronically
DOES apply to records already being maintained electronically exclusively

37. Properties of an ADM12 record
Electronic records must be:
Accurate: reflects the original record
Accessible: Record can be retrieved
Authentic: can be substantiated as accurate
Reliable: produces the original record every time
Legible: letters and numbers are identifiable
Readable: Groups of letters recognized as words
All of these properties must be maintained throughout a record’s active life

38. How can I comply with ADM 12?
Legible and Readable: keep file formats up to date, migrate files
Usually applies only to long-retention records
Accurate and Reliable: write-protect final copies of electronic records
Authentic: use versioning/logging features of PantherFile
Accessible: Create logical filing system
Robust search terms, tagging, metadata?

39. Digital Millennium Copyright Act
Defines illegality of republishing copyrighted information via file-sharing
Prohibits circumvention of anti-piracy software or code (incl. DRM on music files)
Limits liability of ISP (i.e. UITS) for violations
Does provide expectation of ISP action, however
Provides exceptions for certain departments/circumstances (mostly Fair Use)

40. File Sharing: Don’t Do It!
UWM takes DMCA violations VERY seriously
Also violation of UWM Computing Policy!
UITS is required to facilitate removal of protected information
Remember: Your work computer is NOT your personal property!
Info Security Office will not hesitate to seize it for forensic analysis if necessary
DO NOT DELETE offending material
It can still be found, AND you get in more trouble!

41. If you get sued under DMCA…
You will NOT be eligible for legal defense from UWM
Limits UWM’s own liability
Legal Affairs may facilitate contact between you and litigant
e.g. forwarding letters of intent, pre-settlement or settlement letters, etc.
Your UWM computing privileges may be revoked

42. Part IV: Conclusion
Summary and resources

43. Legal Principles: Routine RM
Create record schedules for all records in your office
General Schedules cover a lot of these
Maintain appropriate security levels for protected records (FERPA, personnel, HIPAA, etc.)
Destroy records as soon as retention time expires
Separate work-related and personal records

44. Legal Principles: Litigation
STOP destruction of records as soon as you are aware of litigation possibility
Inform legal affairs immediately of situation
Organize your records and prepare for potential format conversion
Don’t discuss the terms of the litigation any more than strictly necessary

45. Resources UWM FERPA Guide UWM HIPAA Guide
UWM HIPAA Guide
Digital Millennium Copyright Act– Info Security

46. Resources, cont’d. Office of Legal Affairs
Legal Topics in Higher Education
General Legal Resources
Wisconsin Statutes (16.61 and 19.31)

47. UWM-Specific policies
Personnel File Policy
Public Access to Records
Information Security Policy

48. Thank You This presentation available online:
Or, contact UWM Records Management:
(Brad Houston)