Documentation Retention Policies and their Potential Ramifications

This discussion on records retention policies is discussed in regards to a legal office environment, and briefly in respect of documentation prepared in the course of health administration.

In “Records Retention – An Essential Part of Corporate Compliance,” published by the American Bar Association in “Records Retention and Destruction Current Best Practices, written by R. Thomas Howell, Jr. and Rae N. Cogar, Howell & Cogar state the following:

1. Records retention is an important substantive component of many of the laws with which most corporations must comply; and,

2. Retained records are often the vehicle by which compliance is established.[1]

Howell & Cogar also make reference to other academics/professionals writing on the topic of records retention policies, that good retention policies shall include a pre-determined or industry-specific “minimum and maximum” shelf-life for certain classifications of documentations, as well as a “framework for the administration of the policy.” Basically, a decision needs to be made as to who in your organization will be responsible for overseeing the creation of, the adherence to and the maintenance of retention programs.  For example, an Information Security technician, Information Technology technician or Records Management / Knowledge Management Specialist/Co-Ordinator in your firm or organization.

Another component to a comprehensive retention policy is to determine (i.e. classify) what documents are meant to be part of/addressed in your corporate records retention program.  To aid your organization in both determining the minimum/maximum retention periods of specific documents, Howell & Cogar suggest referring to “both federal and state requirements, contractual obligations, intellectual property requirements and statutes of limitation.”  Industry-specific “business consideration” must also be taken into account, in conjunction with potential industry-specific ‘legal considerations’ such as the “demands of litigation, investigation and [regular or pop quiz] audits.”

During the classification process, one must work with the specialists in their organization charged with effecting a document retention program and determine which among the many categories of documents their firm or organization handles daily, monthly, yearly and quarterly can be classified as a “business document” as well as which documents fall outside of the “record” definition.  As Howell & Cogar write, this is important for several reasons:

1. Through establishing definitions one therefore establishes classifications and this in turn makes “operational recordkeeping decisions easier”;
2. Business documents are normally created in the process of: “complying with government regulatory or statutory reporting requirements, documenting daily business activities (minute books: a corporation’s directors’ and shareholders’ resolutions, directors’ and shareholders’ ledgers and registers, and corporate summaries, etc.; share purchase agreements, amalgamations, dissolutions, etc.), documenting research and development methods for possible patent application, as well as preserving the legal rights of the business.”
3. Documents classified as “business records” have a notable and an important shelf-life and should be dealt with differently compared to non-business records with one comprehensive retention program policy dealing with each category of document individual, in the sense of providing guidance regarding their maintenance and disposal.[2]

Electronic Records

There could be an implied inference that the above discussion is merely referring to physical, hard copy documentation created in the process of a business’ normal activities.  However, as Howell & Cogar allude to, an organization should also prepare a retention program policy which acknowledges the importance of e-records.

In a paper written by Contoural, Inc.[3] in 2007 entitled, “How Long Should Email be Saved?” the authors state that “as email has become more critical in the business world, many companies are weighing the question of how long [emails] should be retained, what should be done with [the emails], and when [the emails] should be deleted.”  The article states the answer to this particular question depends on mandatory and numerous regulations (perhaps state and federal) which stipulate how long emails must be retained.

During the litigation process, there is the advent of e-discovery, which is continuously evolving.  E-discovery may include information stored on cellular phones and other electronic devices, computer hard drives, and electronic mail. According to the paper’s author, organizations must balance the following two aspects inherent in email retention: “long-term retention and preservation of email, and many business circumstance demand recovery of historic messages”[4] (Emphasis added). Your organization will have to decide whether email retention (choosing which emails to keep and which to destroy) is done manually by users via record retention policy manuals or via technicians who can create a system which automatically determines which emails to keep and where, and which emails to delete or destroy and when; however, a computer may have difficulty effecting such a feat due to technological limitations – a combination of both ventures would be ideal. [5]

Legal Risk Management and a Lack Thereof

In “Document Retention & Destruction Policies for Digital Data: What You Don’t Known Can Hurt You,” published by a popular international legal practice management software company, LexisNexis, also writing on the topic electronic document discovery, the contributor notes two (2) very important things:

“Even the most the proactive company with a comprehensive retention policy that includes electronic data may not be enforcing policy to the extent necessary to avoid legal risk……An ABA [American Bar Association]survey conducted in May 2000 asked litigators whether their clients had an established protocol for handling electronic discovery requests.”