41
The Management of University Records Regulations and Guidelines for Maintenance, Retention and Final Disposition FIPPA/PHIA Coordinator’s Office The University of Manitoba 474-8339 or 474-9462 Fax: 474-7913

The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

The Management of University Records Regulations and Guidelines for Maintenance, Retention and Final Disposition

FIPPA/PHIA Coordinator’s Office The University of Manitoba

474-8339 or 474-9462 Fax: 474-7913

Page 2: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

Table of Contents 1. Records Management at the University of Manitoba p. 4 1.1 Components of a Records Management Program p. 4 1.2 Responsibility for the University of Manitoba Records p. 5 1.3 Personnel and Student Records p. 5 2. Records Management Services p. 7 3. Filing and Storage Procedures for Records p. 8 3.1 The Wayne State Universal Filing System p. 9 3.2 Alphabetic Records Management p.11 3.3 Subject or Function Based p.12 3.4 Records Management Binder p.12 3.5 Filing Material p.12 3.6 Labelling Files p.13 3.7 Good Filing Practices for Paper Records p.13 3.8 Guides and File Folders p.14 4. Management of Electronic Records 4.1 Electronic Filing and Filing Procedures p.16 4.2 Email p.17 4.3 Electronic Records Retention p.18 5. Annual Review and Disposition of Records 5.1 Steps in and Annual Review p.19 5.2 Which Records to Keep p.20 6. Records Management Forms 6.1 Records Authority Schedule p.22 6.2 Records Authority Schedule Revision p.22 6.3 Requisition to Destroy Records p.23 7. Disposal Options for Confidential Records with PI and/or PHI p.24 8. Transferring Records to the University Archives. 8.1 Requisition to Transfer Records p.25 8.2 Which Records should go to the Archives p.25 8.3 Steps in the Transfer of Records to the Archives p.26

2

Page 3: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

APPENDIX Definition of Personal Information p.28 Definition of Personal Health Information p.29 FIPPA/PHIA Information Sheet # 1 p.30 FIPPA/PHIA Information Sheet # 2 p.32 FIPPA/PHIA Information Sheet # 3 p.34 FIPPA/PHIA Information Sheet # 4 p.37 FIPPA/PHIA Information Sheet # 5 p.39

3

Page 4: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

1. Records Management at the University of Manitoba Records management is the common term for a set of management techniques developed in the 1940s to address the increased volumes of recorded information in modern offices. The objective of records management is to ensure that an organization creates, accumulates and maintains:

• fewer records • better records • effective records

The pioneers of records management realised that every item of recorded information —whether it be a letter, memo, report, invoice, financial record, computer file, or transcript—has a “life cycle.” Most records will pass through these stages: • Active: referred to or used regularly by an office in the conduct of its business.

These records are kept in the office so that they are readily accessible. • Semi-Active: referred to or used irregularly by the office, but remaining

important for current administrative, legal or fiscal purposes. These records are kept in storage.

• Inactive: no longer required by the office for current administrative, legal or

fiscal purposes. When assessed as inactive, records of permanent value are transferred to an archival facility. Inactive records deemed to have no archival value are destroyed unless they need to be stored for a period of time for fiscal or legal reasons.

Although records management was originally developed for paper records, it can be easily adapted to other forms of records such as electronic files and emails. The classification filing systems that are discussed in this manual were created to manage paper records but they can easily be adapted to suit our technological needs. Thus it is important that offices ensure that the classification filing systems for paper records correspond to emails and electronic files. 1.1 Components of a Records Management Program A records management program ensures the orderly and timely passage of records through these stages. A complete records management program features three main components. • File Classification System: Offices gain significant control over filing by

requiring that all materials be filed according to a standard system. Records managers analyze the kinds of records generated by the office and group files

4

Page 5: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

together into classifications, or series, according to their informational content or physical form.

• Records Authority Schedules: The FIPPA/PHIA Records Analyst works with

individual records managers to prepare Records Authority Schedules which determine the length of time that each series of file will spend at the active, semi-active and inactive stages. The Schedules also identify which series of records have permanent value and will be transferred to an archival facility when they are no longer required for current operations.

• Annual Records Review: Offices review the entire records system each year

in order to move records through the system efficiently. 1.2 Responsibility for the University of Manitoba Records At the University of Manitoba, compliance with government legislation has meant the implementation of The Freedom of Information and Protection of Privacy Act (FIPPA) and The Personal Health Information Act (PHIA). FIPPA sections 36 to 45 stipulate the conditions under which a public body collects, uses, protects and disposes personal information. FIPPA defines a record as information recorded in any form such as written and printed records, maps, plans and audio-visual recordings, as well as information stored and retrieved electronically, such as emails. Additionally, a record could be in the form of an original, a copy, a draft or working papers. University records are defined as any records or documenting material, regardless of physical form or content, made or received in the conduct of University business by any officer, authority or department. This includes student and employee records, minutes of meetings, letters, memoranda, faxes, emails, journals, daybooks, voice mails and their transcriptions, hand-written notes and sticky notes. These records are the property of the University. Responsibility for their retention or disposition rests with the Board of Governors. FIPPA does not apply to the teaching materials or research information of an employee of an educational institution. Similarly, FIPPA does not apply to annotations, related to teaching, that are made in the teaching materials. 1.3 Personnel and Student Records Many offices around the University hold personnel and student records. As mentioned above, these records may be in the form of electronic (computer) or non-electronic (paper, photographs, cassette tapes, etc.) and may appear as files, documents, or data items. The information in these records is personal information, and subject to FIPPA and PHIA. (For a complete listing of personal information see Appendix.)

5

Page 6: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

Because of the sensitivity of these records, special care must be taken with regards to access, use, and disclosure. “Access” means seeing or handling records with personal information. “Use” means using, dealing with or employing information within the University to accomplish the purposes for which the information was collected. “Disclosure” means releasing information for an unauthorized purpose or releasing information to an individual or an organization outside of the University.

• Unauthorized access happens when employees have access to records that they do not need to see or handle to accomplish University business related to their duties

• Unauthorized use happens when records are used, not for a University purpose, and/or, not for a purpose that is permitted under FIPPA and PHIA

• Unauthorized disclosure happens when records are made known, revealed, exposed, shown, provided, sold or given in circumstances that are not permitted under FIPPA and PHIA. Unauthorized disclosure may occur verbally, through the provision of electronic or non-electronic copies, or by other means

As with personnel records, University employees should be aware that they may not access, use, or disclose student records out of curiosity, private interest, or on a “wish to know” basis. FIPPA section 36(2) emphasizes that the University should collect only the amount of information required to accomplish the purpose for which it is collected.

• For University business, that is, programs or activities authorized by the University

• With the minimum amount of information necessary to accomplish the purpose for which the records are accessed, used, or disclosed

An additional restriction on use and disclosure is placed on personal information under FIPPA Sections 42 to 45 including:

• The records should only be available to those with a “need to know” the information.

o “Need to know” means that the employee will only be able to do authorized University business, related to his or her duties, by accessing, using, or disclosing the records.

In order to properly protect personnel and student records, the records should be stored in an area with limited public access and/or with a locked door, and stored in lockable filing cabinets. Faculties and departments should ensure that these records are available only to those with designated access, such as the Records

6

Page 7: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

Administrator or student advisor. (see FIPPA/PHIA Information Sheets #2 and #5 in the Appendix.)

7

Page 8: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

2. Records Management Services The Records Management Program, administered by the FIPPA/PHIA Coordinator’s Office (the FIPPA Office), facilitates the University’s accountability for its records. In addition to responding to FIPPA access requests, the FIPPA Office offers records management services to administrative units of the University. These services include:

• records analysis

• records scheduling

• advice on records destruction

• identification of records with archival value

• advice on filing classification systems

Records analysis and scheduling is a four-step process:

1. The Records Analyst consults with the records manager of a faculty, department, or unit that holds records. The purpose of these consultations is to identify record series and to determine retention periods and final dispositions for each series.

2. The Records Analyst prepares a formal Records Authority Schedule for each series, incorporating the retention period and final disposition.

3. The schedules are submitted to the FIPPA Review Committee (FRC) for approval.

4. Upon approval by the FRC, the Records Authority Schedule is returned to the originating department to be used for maintaining systematic records management.

Offices wishing to gain the benefits of a records management program or needing advice on any aspect of records management should contact our office.

8

Page 9: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

3. Filing and Storage Procedures for Records When records are filed consistently and systematically, information can be retrieved efficiently and quickly. In order to have a standardized filing system, the filing procedures used in the office must be determined, recorded, approved and should be followed without any divergence in protocol. These procedures ensure that anyone in the office should be able to locate any record at any given time. The real test of an efficient file system is in being able to find records quickly once they have been stored. There are numerous benefits to be achieved through implementation of a standardized filing system:

• better control over filing • fewer problems with file retrieval • less time spent on filing • elimination of duplicate records • better identification of archival records

There are many different kinds of classification systems. Care should be taken in selecting and designing the records management system since the system will most likely be used for a long time. Factors to keep in mind include:

• The total volume of records to be stored • The expected activity, or frequency, of use for the files – an estimate on

how many times a record will be requested and retrieved • The length of time the records are to be kept • Time and resources available for filing, storing, and retrieving records

This manual provides an overview of some of the most common types of filing systems. The system we recommend is an adaptation of the Wayne State Universal Filing System, which we believe is best suited for the University. (Other types of filing systems are described below.)

9

Page 10: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

3.1 The Wayne State Universal Filing System This filing system is an alpha-numeric system that groups records into categories that are suitable for a university. There are seven categories in this filing system, each one with an assigned block of numbers:

100 Creating Office (i.e. Faculty of X, Dept. of Y, etc.) 200 Offices Connected to the Creating Office 300 Other Offices of the University of Manitoba 400 Other Educational Institutions 500 Associations, Councils and Societies 600 Government, Business and Industry 700 Students

Each of these categories is further divided to reflect the function of the office, unit, department or faculty. 100 - The Creating Office All records which result from an activity or function primarily or exclusively performed by your office, the Creating Office, are contained in this category. This includes records both created and received by the unit. Most departmental records can fit into the following divisions within this level.

100 General Administrative/Office Records 110 Correspondence 120 Minutes of Meetings 130 Financial Records, including Equipment & Supplies 140 Personnel Files 150 Functions and Forms 160 Records Unique to the Creating Office 170 Policies and Procedures 180 Reference Materials 190 Course and Curriculum Records

Note: 160 - Records unique to the Creating Office, refer to those records that are created or generated for a specific function of that particular office. These records are not found in other offices, and reflect those functions that are only performed by the Creating Office. 200 - Offices Connected to the Creating Office All records that pertain to offices connected with the Creating office are contained in this category. This category exists so that records from Offices that have a special relationship with the creating office are kept together. Divisions in this category are similar to those in section 100.

10

Page 11: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

210 Correspondence 220 Minutes of Meetings 230 Financial Records 240 Personnel and Named Offices 250 Other 260 Foundations

300 - Other University Offices This category includes all other records that relate to the University of Manitoba. The records filed in this category reflect the broader relationship between the creating office and the University of Manitoba.

310 Colleges, Faculties and Schools 320 Academic Departments 330 Administration and Services 340 Unions 350 Centres and Institutes 360 Chairs 370 Board of Governors 380 Senate

400 - Other Educational Institutions This category includes all records produced by other universities, colleges, educational and vocational institutions. The records are filed sequentially within the divisions listed below.

410 Canadian Universities 420 American Universities 430 Foreign Universities

500 - Associations, Councils and Societies These are records related to associations, councils, societies, etc., outside of the University of Manitoba. Other than the Association of Universities and Colleges of Canada (AUCC), which has its own division (510), these should be arranged alphabetically by name, under 520. 600 - Government, Business and Industry These are records of governmental agencies, private businesses and industries, which may fund grants, support programs, hire students, etc.

610 Government – Municipal 620 Government – Provincial 630 Government – Federal 640 Health 650 Business and Industry

11

Page 12: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

700 - Students Records relating to students are filed here. Depending on the function of the office, this category may not be used. Conversely, it may be the predominate category. The subject areas in 700 depend on what the various functions of the office are in relation to students. This category may need to be further divided into series by offices that generate a lot of records about students. Subdividing the Divisions Depending on the functions of the office, the divisions may need to be broken down further into series. For example, for Personnel Files an office may have personnel files for several different kinds of employees. These records can be broken down into series as follows: 140 – Personnel Files - Faculty 141 – Personnel Files – Full Time Staff 142 – Personnel Files – Part Time Staff 143 – Personnel Files – Hiring Files As long as the series are clear and used consistently dividing the categories works well.

3.2 Alphabetic Records Management

This system uses an alphabetical ordering for storing records. Since this is a direct access method, it does not require the use of an index. Related records from one name such as an individual or a department can be grouped together. Storage is easy if standard procedures are followed; however, misfiles can occur through the transposition of letters, misspellings of names, and placement of files under the wrong name. This method is based upon filing records according to the alphabet (a, b, c, etc.). Other rules and procedures include:

• Filing records under the most commonly used name or title, and cross-reference the other names or titles that may be used

• The word The is dropped from the name, if The is the first word of the name (The Faculty of Pharmacy becomes Faculty of Pharmacy);

• Ignore all punctuation when filing • Symbols (&, $, #, etc.) are spelled out and filed alphabetically • The records that begin with digits (1, 2, 3, etc.) are filed before all

alphabetic names • Arabic numerals precede Roman numerals (1, 2, 3 before I, II, III)

12

Page 13: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

3.3 Subject or Function Based

This system groups records according to a thematic or subject guide. A good subject based classification system should be logically arranged by groups of related subjects that cater to the main or primary functions of the unit, department or office. This system allows for the flexibility of adding or deleting subject titles, and merging or separating files and can be beneficial for businesses whose organizational structure is subject to frequent change.

In maintaining the functions described in the subject classification system, the modifications in the subject titles and files reflect organizational mobility. This enables the transfer of records from one office to another with little disruption of the filing system. As with the alphabetical classification system, a standardization of terms will ensure that the records are filed under the appropriate subject title. 3.4 Records Management Binder It is highly recommended that you create a records management binder, either in paper or electronic format, in order to keep together all material related to your files and their maintenance. The binder would contain this guide and descriptions of your file classification system. It would also contain Records Authority Schedules, lists of files that have been transferred to storage or to the Archives and lists of files that have been destroyed. 3.5 Filing Material No matter how well-designed a filing system is questions will still arise about the proper place to file particular records. The most important procedure is to scan the material to identify exactly what it is that you are filing. Then you consider: does the record relate mostly to your office? Does it relate to a faculty within the University? Is it related to a professional organization? Once you have identified the category it is a matter of determining the specific file. If there is no file already started on the subject, you have two options: starting a new file or temporarily storing the information in an existing file. Open a new file if you are reasonably certain that more material of the same nature will enter the system, either by being created by your office or coming from an outside source. Otherwise try to group similar subject matter until sufficient material warrants splitting the records into two or more files. Try to avoid: • files that are overstuffed

o Files of more than two inches in thickness are cumbersome to store and make finding particular items difficult. It is usually easy to split these files

13

Page 14: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

by shifting older material to semi-active storage, by creating a new file that continues the older material, or by splitting particular types of records in the file into a sub-file classification.

• files that contain only a few sheets

o It is often unnecessary and wasteful to maintain these files. It is usually possible to file the contents in another classification.

3.6 Labelling Files Being consistent is the most important aspect of labelling your files. Be sure to use the same structure for the titles of similar material. For example, University of Manitoba and Government files should always be titled according to the official title of the creating office, as in “FIPPA Co-ordinator” or “Foreign Affairs, Ministry of.” File labels can also include any tertiary information necessary to denote its specific contents, such as “Institutional Analysis - Student Enrolment Statistics.” Always date the file labels, as this will make it easier to compile accurate box lists for file retrieval when files are sent to storage or for destruction. When a file is started, create the label with the start date and fill in the closing date when your file is full. 3.7 Good Filing Practices for Paper Records

1. Don’t allow filing to pile up, otherwise it will eventually overwhelm you. Filing decisions do not get any easier to make by putting them off.

2. Keep files neat and your labels legible and dated. Crease the files along

their fold lines so bulky material sits flat. Remove the file to place material in it if you cannot slide the paper completely inside. Papers sticking out of file folders get damaged with handling and make file labels difficult to read.

3. If you remove a file or a paper, use a brightly coloured “flag” to mark the

spot. (Any paper will do but it should be large enough to be visible when inserted.)

4. If any material is removed on loan, record the details of the loan, including

the person’s name, their office or department and expected date of return. No loan is too small or too quick to warrant skipping this procedure. Upon return, make sure the contents are intact, if possible.

Great care should be taken in filing records since misfiles of records may lead to lost files, and increased expenditure of time in searching for the record. Prior to the actual filing of the records, remember to:

14

Page 15: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

• Remove paper clips from the records. • Staple those records that go together in the upper left-hand corner. • Mend torn records. • Unfold folded records to conserve storage space unless the folded record

fits the file folder better than unfolded. • Avoid overstuffing file folders by placing more records than the file folder

can contain. Note:

Refolding a file folder at the score marks reduces the danger of file folders bending and sliding under others, avoids curling papers, and results in a neater file. A file folder lasts longer and is easier to use if it is not stuffed beyond its capacity. If too many records are in an individual file folder, prepare a second folder for that heading or label.

3.8 Guides and File Folders We recommend using guides to facilitate easy storage (filing) and retrieval of records. A guide is a rigid divider with a projecting tab to identify a section in a filing cabinet and to facilitate reference to a particular record location. Guides serve as signposts that identify a main division or section of the file classification system. The recommended number of guides is approximately 20 guides for each file drawer or for each 28 linear inches (70 linear centimetres) of stored (filed) records. There are two types of guides: primary and auxiliary. A primary guide identifies the main division or section of the file classification system, and precedes all other material in a section. An auxiliary guide is used to quickly direct staff to a specific place in a file. Auxiliary guides are used to:

• Indicate the location of a file folder or a group of file folders with a high volume of activity, or is frequently used.

• Introduce a special section of subjects, such as Applications, Conferences, Projects, etc.

• Identify a section reserved for names with the same primary index unit, such as Smith, Johnson, University of Manitoba, etc.

The placement of guides and file folders should be carefully positioned to efficiently direct staff to the correct file folder. The location of the file folder tab, is important as a way of visually separating the headings or labels on guides and file folders. The tab on a guide should be located on the far left-hand side of the cabinet drawer; whereas, the tab on the file folder should be located on the far right-hand side. Separating the tabs of the guides and file folders facilitates a quicker search and retrieval of records. In addition, a straight-line arrangement

15

Page 16: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

that aligns the tabs in one position is recommended, as this position is more efficient in scanning the headings or labels of the tabs.

16

Page 17: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

4. Management of Electronic Records

4.1 Electronic Filing and Filing Procedures While technology has eased many records management tasks, the use of electronic records has presented some new concerns. Some of these issues, however, may be resolved through systematic filing procedures. Generally, a record should be retained in one form only, either paper or electronic. Thus for each record created there is a need to consider the most appropriate form for retention. With the current emphasis on reducing paper consumption, the better practice is to save in electronic form. This also has the advantage of decreasing use of office space and filing cabinetry. Even so, there may be occasions when saving a record in paper form seems to be the more appropriate. For example, a high-level document carrying one or more signatures of senior administrators should usually be retained in its original form. Organizing files and file folders for electronic records is based upon many of the same procedures as paper records. As with manual filing procedures, rules must be established to standardize the electronic filing procedures as much as possible. Electronic records must be accurately filed and organized as they are more susceptible to random filing procedures than paper records since individuals are responsible for naming, filing and saving records on their own computer. As mentioned above, classification and filing systems for electronic records, including email should follow the same system used for paper records. The records should be placed in the appropriate series within the category that best reflects the function of the record. Some guidelines for electronic filing procedures include:

• The files and file folders should be easily identified to allow for easy retrieval and usage

• The filename should be descriptive and meaningful • The file folder heading should comply with established filing rules and

procedures • The electronic file folder structure is more effective if it is shallow (many

folders at the same level) rather than deep (folders within folders within folders – having several layers)

Electronic records and emails that are used in the development of policies and procedures, in the administration of program delivery or have historical

17

Page 18: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

significance should be retained permanently, preferably in their original electronic form.

4.2 Email Email, as we know, is one of the most popular modes of communication in many organizations. As with any electronic records, emails should be stored and retained in a manner similar to paper-based correspondence. Email messages can multiply and accumulate at an alarming rate, congesting computer systems and reducing office efficiency. Some emails are of a fleeting nature and can be deleted on a regular basis. Some examples of this type of email are:

• Personal messages (“Let’s meet for coffee”). • Extra copies of documents kept for convenience in your e-mail storage. • Communications about routine office administrative activities (“I’ll be away

tomorrow,” “Please book the large board room,” etc.).

If you are not sure if a message can be deleted, it is best to err on the side of caution and assume that the particular message should be retained.

Saving Email Messages This step is particularly important for those whose systems are running out of email space.

• Create folders that correspond with the file classification system you are using for your paper records.

• Delete emails that are not necessary to keep as per the suggestions listed directly above.

• Save large attachments onto your hard drive, or on your departmental server, either in a folder labelled “Email Attachments” or in a folder created for the subject.

• Do not keep two copies of sent mail. In other words do not cc yourself as your email keeps a copy of every email sent out in either a “sent mail” or “copies to self” folder. Sending a copy to yourself duplicates outgoing mail and very quickly uses up available email space.

General Tips for Email

• Limit each email to only one subject. • Be careful when sending confidential messages. Attach a confidentiality

statement if necessary. • Email messages or attachments that contain confidential, sensitive or

personal health information should be encrypted. • Send copies of email messages only to those who need to know the

contained information. • Be concise. Avoid the temptation to send long, rambling messages.

18

Page 19: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

• When answering a message, send the original message back with your reply.

• Make sure you are sending the message to the right person. Check and update your address lists regularly.

• Email has the capability of being copied and forwarded to numerous individuals, and messages may be retained long after their intended function is completed. Email users should never create an email containing information that they do not want to become public knowledge.

4.3 Electronic Records Retention The retention periods and procedures for electronic information records will follow the Records Authority Schedules developed by the FIPPA/PHIA Coordinator’s Office. If your office has not yet been scheduled please contact our office for more information.

19

Page 20: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

5. Annual Review and Disposition of Records Conducting an annual review of your records is an essential part of good records management. In university offices, space is often at a premium and budgets are stretched to the limit. Significant savings can be achieved under a well run records management program by reducing the need to buy new filing cabinets and filing supplies. The timely removal of semi-active and inactive records to storage allows for the best use of limited space in the office. These benefits plus the other benefits of the records management program cannot be achieved without a conscientious annual review. There is a tendency to put off these reviews for several years. When the review can no longer be postponed, the amount of work becomes so daunting that no one will want to do another until several more years have elapsed. Reviews of filing systems do not have to be this painful. If they are conducted on a yearly basis, you should be able to complete a thorough annual review in a day. 5.1 Steps in an Annual Review Start in the Storage Area with Semi-active and Inactive Files 1. Review your previously stored semi-active and inactive files. Remove the

files that have become inactive since the last review and separate out the files from this group that have been designated as archival.

2. Transfer the inactive files designated as archival to the Archives using the

procedures set out below. 3. Determine which of the remaining inactive files are eligible for destruction

based on the Records Authority Schedules as determined by the FIPPA Office. For files that have been scheduled for a period of continued storage for fiscal, historical or legal reasons either maintain these in your storage area or prepare them for transfer to the Archives. We recommend that an accurate file list be maintained for these records. Inactive files whose retention period has elapsed, are not archival and do not require further storage are eligible for destruction. (See below for instructions on dealing with records eligible for destruction)

4. Rearrange storage space to accommodate incoming semi-active and

inactive records. 5. Review your active records and pull out those that have become semi-active

or inactive since the last review. (Some records have a very short life span. After only a few years they will pass directly from active to inactive, skipping the semi-active stage altogether.)

20

Page 21: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

6. Check both the active and semi-active files to see if they contain extraneous

material. This material can be removed and discarded without listing. (See Which Records to Keep guidelines below).

7. Make up any new file labels and folders required for active and semi-active

files and make sure that all file labels are dated. 8. Box the semi-active files, number the boxes and make a file list noting the

box numbers; this will assist in future file retrieval. Keep this list in your records management binder. A copy of the list can also be placed inside the box, but please do not attach the list to the outside of the box. This is to ensure that list is not damaged or removed and will ensure that details about the contents of the box are not easily available.

9. Box the inactive files that must be stored for a period of time for fiscal or

legal reasons. Make a file list and insure that file labels are dated. 10. Transfer the semi-active boxes and inactive boxes that must be kept to the

storage area. Please note that the storage of semi-active and non-archival inactive files is normally the responsibility of the office that created them. Unless there are special circumstances, the Archives accepts only archival records.

11. The last step in the annual review is to deal with the records you have

identified as eligible for destruction. All of these files should now be boxed together in your storage area. Make sure you have an accurate list of these files.

12. Add all file lists compiled or updated during the annual review to your

records management binder. 5.2 Which Records to Keep Extraneous material with little or no informational value tends to accumulate in active files. This material should be assessed on a regular basis and can be done during the annual review. The guiding principle for assessment is to keep those documents that are created by your office or pertain to the functions of your office. You should keep:

• correspondence and memoranda which document the daily operations of your office

21

Page 22: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

• minutes and agendas of meetings of departments, boards, committees and other bodies directly related to the functions of your office

• reports, studies, plans, projections, proposals and accreditations. (This may include successive drafts of reports and plans which show how the thinking behind these documents evolved during the period in which the document was being drafted.)

• personnel files including faculty appointments and career files • current student files • all documents that may have an impact, either positive or

negative, on an employee, student or other person associated with the University

• current budget projections, financial reports and year-end statements

You could discard:

• duplicates of an official copy maintained permanently elsewhere (such as non-current student transcripts)

• items without any enduring value (form letters, telephone message slips, invitations)

• items bearing no direct relationship to the University (circulars, catalogues, conference programs, etc.)

• copies of minutes and working papers distributed throughout the University from other boards, councils, faculties, departments and committees (such as Senate minutes and papers). However, you should retain this kind of item if it relates directly to your office and has required a response from your office

• routine correspondence and memoranda consisting of announcements, invitations, thank you letters and acknowledgements, circulars, etc.

• copies of annual or routine reports received from other offices, departments, institutions or organizations

• printed and published documents unrelated to the University and its functions

If you are uncertain whether to keep or discard particular kinds of records, call the FIPPA Office.

22

Page 23: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

6. Records Management Forms

6.1The Records Authority Schedule The Records Authority Schedule is an important tool for the management of records at the University of Manitoba. This form is used to manage the records of the faculty, department or office from the time of the record’s creation until final disposition. The Records Authority Schedule identifies the records held by the University of Manitoba, and provides an important inventory needed for planning, protecting and providing access to records. These schedules facilitate records management requirements and practices by providing offices with:

• a record description (the type of records held in this series) • the record function (the context in which the records are created and

used) • records retention (how long records are kept).

Records Authority Schedules provide retention and disposal rules for series of records. A record series consists of records, which have been brought together in the course of their active life to form a discrete sequence. The sequence may be based on a filing system, function, content or form. The retention rules are determined in advance, and are applied consistently and routinely for all records. The records scheduling process is a collaborative one, with the FIPPA Office working in consultation with each department or office to develop schedules appropriate to their records. The schedules remain in effect until they are replaced by a revised schedule, or terminated when the records series has ended. Records retentions should be understood and taken into account when considering whether to convert records to microfilm or digital images for current business purposes. The retention requirements set out in records schedules are business requirements that should be included in the planning of electronic systems. A completed and signed Records Authority Schedule is a permanent document under which records in a series are retained or destroyed.

6.2 The Records Authority Schedule Revision The Records Authority Schedule Revision documents the changes that occur in the management of a record series. When amendments or revisions are

23

Page 24: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

required, this form is submitted for approval and attached to the appropriate Records Authority Schedule. Amendments or revisions may include:

• The transfer of responsibility of the records from one department or office to another department or office

• The dates of the series has changed, or the series has ended • The retention period has changed • The final disposition has changed • The contents of the record series has changed • The series function has changed • The amalgamation of two or more scheduled records series has occurred

Please contact us for more information on the Records Authority Schedule Revision, or for a copy of the revision form.

6.3 The Requisition to Destroy Records The Requisition to Destroy Records manages the records in a series that are scheduled for destruction at the end of the series retention period. When a Requisition to Destroy Records (RDR) is required:

• If the records in question have been scheduled and are represented by and Records Authority Schedule an RDR is not required unless this is the first destruction for the series

• Accumulations of records that have not been scheduled require an RDR A separate RDR must be completed for each series of records to be destroyed. The RDR is completed to reflect the information in the corresponding Records Authority Schedule. In the General Description of Records to be Destroyed box, the Quantity of this series refers to the total linear distance of the records to be destroyed, not the yearly accumulation of records information as provided in the Records Authority Schedule. The FIPPA Office should be contacted for a RDR # which is based on sequential numbering and maintained in our office. The requisition must be signed by the Unit Records Administrator and the Head, Director, or Dean and can be submitted by mail, fax or email. The Requisition to Destroy Records becomes effective and destruction can begin when it has been approved by the FIPPA/PHIA Coordinator and returned to the originating department or office. As required in The Personal Health Information Act (PHIA), this form also serves as the required destruction log for all records that contain personal health information.

24

Page 25: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

7. Disposal Options For Confidential Records with Personal and/Or Personal Health Information Records containing personal and personal health information that are ready for destruction need to be destroyed using a secure method. The best method for destroying confidential records is shredding. Records can be shredded in the office, onsite through Shred-It, or offsite through VersaTech. All of these options comply with the standards for the secure destruction of records containing personal and personal health information. In-office Shredding This option is optimal for shredding small amounts of records using in-office shredders. Shred-It (onsite) and VersaTech (offsite) These are both economical options for the destruction of large amounts of paper records, and/or removable computer storage disks (CDs, DVDs, floppy disks, memory sticks, etc.) There are no limits on the amount of paper records or removable computer storage disks that can be disposed of, however, if the amount of removable computer storage disks is over 10% of the total weight of records sent for destruction, these disks must be separated from the paper records prior to disposal. If the total weight of the material for destruction consists of more than 10% storage disks, please contact Shred-It, or your department’s confidential material destruction service. VersaTech (Physical Plant) for paper only:

1. Pack records into box(es) 2. Label box(es) “Confidential Disposal” 3. Phone Physical Plant at 474-9646 for pick-up 4. Keep the records in a secured location until pick-up

Shred-IT:

1. Pack records into box(es) or place paper records into Shred-IT bins or consoles

2. Prepare a Requisition (Available through Purchasing Services or online at http://www.umanitoba.ca/admin/financial_services/secure/electronic_forms.htm)

3. Phone Shred-It at 987-4733 for pick-up 4. Keep Certificate of Destruction provided by Shred-It

Note: If you wish to reuse magnetic tapes instead of destroying them, please contact IST at 474-8946 for further information on the availability of the Degausser.

25

Page 26: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

8. Transferring Records to the University Archives

8.1 The Requisition to Transfer Records The Requisition to Transfer Records manages the records series that is scheduled for transfer to the Archives & Special Collections. A separate requisition should be completed for each series of records to be transferred. Following the same directions as for the Records Authority Schedule, complete each box with the requested information. In the General Description of Records to be Transferred box, the Quantity of this series refers to the total linear distance of the records to be transferred, not the yearly accumulation of records information as provided in the Records Authority Schedule. The form must be signed by the Unit Records Administrator, and forwarded to the Acquisition and Access Archivist, Archives & Special Collections, 331 Elizabeth Dafoe Library. The Acquisition and Access Archivist will return a copy to the department or office for their records. The requisition to transfer records is effective once it has been approved by the Acquisition and Access Archivist. 8.2 Which Records Should Go to the Archives A small percentage of records throughout the University have been identified as worth keeping permanently. These records should be retained in the Archives when they are no longer required for the current operations of your office. Records are deemed to have permanent value when they

• are essential to the conduct of the business of the office • reflect the history of the office’s development • reflect the history of the University and the role of the office in that history • provide testimonial or legal evidence of actions taken or not taken • establish fiscal responsibility and document revenues and expenditures • support administrative policies, programs and proposals • record confidential, privileged or personal information

Records that would be of archival value include:

• All minutes and proceedings of meetings, as well as the guidelines and/or by-laws which result from the meetings

• Files documenting all policy decisions, and all committee and/or task force reports or questionnaires

• Office files created during the general course of business, including: correspondence and memoranda (both incoming and outgoing) and subject files concerning projects, activities and functions

26

Page 27: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

• Copies of all newsletters, brochures, monographs, programs, posters, announcements, bulletins, and other publications produced by the unit

• Audio-visual records, including all images, sound and voice recordings, which document the unit’s activities or events

Records that would not be of archival value include:

• Low level or routine financial records (bills, receipts, invoices) • Routine letters of acknowledgement, non-personally addressed

correspondence, or circulars, unless you are the creating unit The FIPPA Office or the Archives staff will be pleased to assist you in identifying records that should be transferred to the Archives. 8.3 Steps in the Transfer of Records to the Archives It will be helpful both to your office and to the Archives if you could designate one person to deal with the Archives on matters relating to the transfer. If possible, choose the person who has dealt with the Archives before and is familiar with the process. 1. Contact the Archives for a consultation on your inactive records. Archives

staff will identify records of permanent value that should be transferred to the archives.

2. If the files designated as archival have not been reviewed previously to

remove extraneous material, do so now by using the guidelines set out above. Ask Archives staff about what to discard if you are uncertain.

3. Packing procedures for transfer are extremely important. Please note the

following:

• Material must be contained in file folders. There should be no loose material

• Do not use hanging folders for transferring files • Packing material in binders wastes space. Material in binders must be

removed and placed in file folders 4. The Archives uses standard records storage shelving and therefore requires

that offices transferring records to the Archives pack their material in standard one cubic foot bankers boxes. Please do not use photocopy paper boxes as they are awkward to handle and do not stand up to wear and tear. The required bankers boxes can be purchased by your office or the Archives will provide them on a cost recovery basis. If boxes are to be provided by

27

Page 28: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

the Archives, please make sure to give a budget number when the transfer is initiated so that you can be billed.

5. Once the files have been boxed, prepare a complete file list noting box

numbers; this will assist in future file retrieval. This list should contain the accurate file title and opening and closing dates of the file.

6. Transfer the file list to the Archives as an attachment to an e-mail message.

That way the Archives has the data in electronic format and can manipulate it to produce finding aids. Hard copies of the file list formatted as individual box lists can be placed inside the boxes. Please do not attach the list to the outside of the box. The list will be vulnerable to damage or removal and it is preferable that details about the contents of the box not be widely available.

7. Once boxing and listing is completed, send the boxes via truck messenger

to: Archives and Special Collections c/o Dafoe Shipping 8. Once the transfer is completed the Archives will accession the transferred

records and assign an accession number to them. The accession number will be sent to you with a revised file list if re-boxing has been necessary. Please keep the accession number and file list in your records management binder.

28

Page 29: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

APPENDIX

Definition of Personal Information Personal Information means recorded information about an identifiable individual, including: (a) the individual's name, (b) the individual's home address, or home telephone, facsimile or e-mail number, (c) information about the individual's age, sex, sexual orientation, marital or family status, (d) information about the individual's ancestry, race, colour, nationality, or national or ethnic origin, (e) information about the individual's religion or creed, or religious belief, association or activity, (f) personal health information about the individual, (g) the individual's blood type, fingerprints or other hereditary characteristics, (h) information about the individual's political belief, association or activity, (i) information about the individual's education, employment or occupation, or educational, employment or occupational history, (j) information about the individual's source of income or financial circumstances, activities or history, (k) information about the individual's criminal history, including regulatory offences, (l) the individual's own personal views or opinions, except if they are about another person, (m) the views or opinions expressed about the individual by another person, and (n) an identifying number, symbol or other particular assigned to the individual.

29

Page 30: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

Definition of Personal Health Information Personal Health Information means recorded information about an identifiable individual that relates to: (a) the individual's health, or health care history, including genetic information about the individual, (b) the provision of health care to the individual, or (c) payment for health care provided to the individual, and includes, (d) the PHIN and any other identifying number, symbol or particular assigned to an individual, and (e) any identifying information about the individual that is collected in the course of, and is incidental to, the provision of health care or payment for health care.

30

Page 31: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

FIPPA/PHIA Information Sheet # 1 Personal Health Information Use and Disclosure Use (within the university) and disclosure (outside the university) of personal health information when staff members are absent for medical reasons. A fundamental principle of The Personal Health Information Act is the limiting principle. Use and disclosure of personal health information must be limited to: The persons who need to know; The minimum amount necessary. When a member of staff is absent for medical reasons, inform only those who need to know in order for the authorized functions of the department to continue. Provide only the minimum amount necessary. A statement such as "person x is away for medical reasons and will not be in until next Monday at the earliest" is appropriate and should be provided to the person's supervisor and any other colleagues whose work functions may be affected. The Act does not easily accommodate the use and disclosure of health information for compassionate purposes such as sending flowers and cards. However, PHIA 22(2)(c)(i) says that personal health information may be disclosed if the disclosure is for the purpose of contacting a relative or friend of an individual who is injured, incapacitated, or ill. This permits, but does not oblige, the notification of staff members who are friends of the individual. The limiting principle still applies. There should be a common understanding among staff members about who will be informed and what will be done when an individual is absent for medical reasons. In a given situation, if there are reasonable grounds to believe that the individual will not mind, it may be appropriate to release limited health information to a limited number of people, provided that the individual has not instructed otherwise. Departments and units should: Establish rules as to who will be informed and what will be done when someone is absent for medical reasons. If possible, staff members who are notified of such absences should ask to what extent this information can be shared. Check with the individual first if there is any doubt about who should be informed and what health information should be given, especially if the information seems to be particularly sensitive.

31

Page 32: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

Avoid disclosing any staff member's home address, phone number, email address, or other personal information, unless the individual has given permission for this disclosure. If you are unsure about the use and disclosure of personal health information contact the FIPPA/PHIA Coordinator's Office at 474-8339 or 474-9462. (April 28, 2003)

32

Page 33: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

FIPPA/PHIA Information Sheet # 2 The Purpose of this Information Sheet is to remind EMPLOYEES about the ACCESS, USE, and DISCLOSURE of STUDENT RECORDS. “Student records” are personal information. Many offices, including Registrar/Student Records Office, hold student records. The records may be electronic (computer) or non-electronic (paper, photographs, cassette tapes, etc.). Textual records may appear as files, documents, or data items. All student records are subject to FIPPA and PHIA limits on access, use, and disclosure. Employees must limit access, use, and disclosure of student records to:

• University business, that is, programs or activities authorized by the University;

• the minimum amount of information necessary to accomplish the purpose for which the records are accessed, used, or disclosed;

• a “need to know” the information. “Need to know” means that the employee will only be able to do authorized University business, related to his or her duties, by accessing, using, or disclosing the records.

Employees may not access, use, or disclose student records out of curiosity, private interest, or “wish to know.”

• Unauthorized access happens when employees have access to student records that they do not need to see or handle to accomplish University business related to their duties.

• Unauthorized use happens when student records are used, not for a University purpose, and/or, not for a purpose that is permitted under FIPPA and PHIA.

• Unauthorized disclosure happens when student records are made known, revealed, exposed, shown, provided, sold or given in circumstances that are not permitted under FIPPA and PHIA. Unauthorized disclosure may occur verbally, through the provision of electronic or non-electronic copies, or by other means.

The Background for this Information Sheet is detailed below. The Freedom of Information and Protection of Privacy Act (FIPPA) and The Personal Health Information Act (PHIA) are provincial laws. All employees of the University must comply with these laws. FIPPA places limits on access, use, and disclosure of personal information. “Personal information” incorporates fourteen broad categories of information. PHIA places strict limits on access, use, and disclosure of personal health

33

Page 34: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

information. “Health information” is any information about an individual’s health or health care, including the individual’s PHIN number. “Access” means seeing or handling information. “Use” means using information within the University. “Disclosure” means releasing information to an individual or organization outside the University, or releasing information for an unauthorized purpose. Avoid accessing, using, or disclosing student records except in the carrying out of authorized University business related to your duties. It’s the law! If you have questions please contact the FIPPA/PHIA Coordinator's Office at 474-8339 or 474-9462. (September 16, 2003)

34

Page 35: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

FIPPA/PHIA Information Sheet # 3

Reference Letters for UMFA Members Managing Reference Letters in Accordance with the UMFA Collective Agreement A. Personal Files

1. The official personal file for each UMFA member is kept by the Dean/Director of the academic unit. The file is treated in accordance with the relevant articles of the UMFA Collective Agreement (“the Agreement”). As of April 1, 2004, the relevant articles are Articles 11; 19, section D.5; and 20, section C.

2. According to section 11.1.3 of UMFA Collective Agreement, April 22,

2002, an UMFA member’s official personal file cannot contain any anonymous material. Anonymous material is material of which the authorship has not been disclosed to the member. Anonymous materials include any oral or written comment received by the University related to a Member’s performance or conduct where the Member has not received a copy of the written comment(s) and/or a detailed summary of the oral comment(s) including authorship within a reasonable period of time of receipt by the University.

3. Signed letters of reference, written up to and including April 22,

2002, may be kept in the official personal file. These letters are not shown to the member unless the referee has given written consent. If given, the written consent is attached to the letter of reference. (For letters of reference written after April 22, 2002, see B. and C.)

B. Letters of Reference for Search and Recruitment

1. Letters of reference for Search and Recruitment, written after April 22, 2002, are kept in the Search and Recruitment file.

a. The originals of these letters are retained a minimum of one year after the Board of Governors has approved an appointment, or, one year after last action, whichever is greater. At the end of the greater time the original letters are shredded, including letters pertaining to the appointee. Letters are shredded confidentially, the arrangements and/or shredding carried out by the Chair of the Search Committee or designate.

b. All copies made for Search and Recruitment committee members are shredded when an appointment has been made, including copies pertaining to the appointee. As with the

35

Page 36: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

originals, copies are shredded confidentially, the arrangements and/or shredding carried out by the Chair of the Search Committee or designate.

2. Letters of reference in Search and Recruitment files, whether from internal or external referees, are not disclosed to any candidate, including the successful candidate, unless the author of the letter has provided written consent for such disclosure. In the event that the person that the letter is about requests the Dean/Director or the Chair of the Search Committee for access to a letter of reference, such letter will not be disclosed unless the referee has provided written consent. If given, the written consent is attached to the letter of reference.

3. Under FIPPA, however, the person that the letter of reference is about

has the right to request access through a formal written application to the FIPPA/PHIA Coordinator’s Office. Under FIPPA, Part II, sections 17(1), 17(2), and 17(3), access will be denied, unless other sections of Part II apply. Access may be given if the referee provides written consent.

C. Letters of Reference for Promotion or Tenure

1. Letters of reference for Promotion or Tenure, written after April 22, 2002, are kept in the Promotion or Tenure file.

a. The originals of the letters are retained for a minimum of one

year after the Board of Governors has approved promotion or tenure, or, one year after last action, whichever is greater. At the end of the greater period, the original letters are shredded. Letters are shredded confidentially, the arrangements and/or shredding carried out by the Chair of the Promotion or Tenure Committee or designate.

b. All copies made for Promotion or Tenure committee members

are shredded at the end of the proceedings. As with the originals, copies are shredded confidentially, the arrangements and/or shredding carried out by the Chair of the Promotion or Tenure Committee or designate.

2. According to the UMFA Collective Agreement, April 22, 2002, copies of all letters of reference, with identifying information removed, are to be provided to the candidate within ten days of the submission of the letters. The Chair of the Promotion or Tenure Committee is to provide the copies to the candidate.

36

Page 37: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

3. Copies of letters of reference of which the authorship has been removed are considered anonymous material. Because anonymous material cannot be kept in the official personal file, letters of reference for Promotion or Tenure, written after April 22, 2002, must be kept in the Promotion or Tenure file.

4. In the event that the person that the letter is about requests the

Dean/Director or the Chair of the Promotion or Tenure Committee for access to a letter of reference, such letter will not be disclosed unless the referee has provided written consent. If given, the written consent is attached to the letter of reference.

5. The Member has the right to request access to original letters of

reference through a formal written application to the FIPPA/PHIA Coordinator’s Office. Under FIPPA, Part II, sections 17(1), 17(2), and 17(3), access to such letters will be denied unless other sections of Part II apply. Access may be given if written consent is obtained from the referee.

(Revised September, 2005)

37

Page 38: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

FIPPA/PHIA Information Sheet # 4

Principles of Access and Privacy of Information Legislation The PURPOSE of this Information Sheet is to explain the PRINCIPLES that underlie ACCESS and PRIVACY LEGISLATION. Access and privacy legislation is based on two fundamental rights of people in contemporary democratic society: $ The right to access information held by governments and other public

bodies, including information about oneself, subject only to certain specified exceptions;

$ The right to privacy for personal information collected, stored, used and disclosed by public bodies.

The rights to access and privacy of personal information are based on principles of fair information practices. These practices have been presented in various ways in different countries and organizations. In Manitoba, the principles have been articulated in The Freedom of Information and Protection of Privacy Act (Manitoba). These principles apply directly to the University because it is a local public body in the Province of Manitoba. In Canada, access and privacy principles have been articulated in the Personal Information Protection and Electronic Documents Act (PIPEDA). PIPEDA applies to the Canadian private sector, that is, to organizations that conduct commercial activities in this country. It does not directly apply to the University. However, it applies to the many organizations with which the University does business. Agreements with these organizations are required in order to protect personal information that may be transferred between the University and the organizations. For a comparison of the articulation of principles, see following table:

Manitoba Canada The Freedom of Information and Protection of Privacy

Act (FIPPA) Personal Information Protection and Electronic

Documents Act (PIPEDA) Limiting Collection The collection of personal

information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.

Collection Organizations must collect personal information from the individual concerned, except in specified circumstances, and collect only what is required.

Identifying Purposes The purposes for which personal information is collected shall be identified by the organization at or before the time the

38

Page 39: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

information is collected. Use Personal information

collected for one purpose cannot be used for another purpose, without the consent of the individual.

Limiting Use, Disclosure, and Retention

Personal information shall not be used for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as is necessary for the fulfilment of those purposes.

Disclosure

Personal information cannot be released to another organization or individual, except in specified circumstances.

Consent The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate.

Information management

Records and data management procedures must be followed to ensure that personal information is secure and not retained any longer than necessary.

Safeguards Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

Individual Access Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

Individual access

An individual must be able to access his or her own personal information and to correct or annotate this information

Accuracy Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

Openness

Documentation about information management policies and practices, as well about personal information holdings, should be available to the public and easily understandable.

Openness An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.

Accountability

Organizations are accountable for their personal information policies, practices and holdings. They shall designate an individual who is responsible for the organization’s compliance with fair information practices.

Accountability A public body is responsible for personal information in its custody or under its control and shall designate an individual or individuals who are accountable for compliance with the ten principles.

Independent review

There should be an avenue of independent review for individuals concerned about the personal information policies, practices or holdings of an organization.

Challenging Compliance An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individual accountable for the organization’s compliance.

39

Page 40: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

FIPPA/PHIA Information Sheet # 5 ACCESS and USE Of PERSONAL INFORMATION At The UNIVERSITY The PURPOSE of this Information Sheet is to explain the appropriate access and use of personal information, including health information, under The Freedom of Information and Access to Privacy Act and The Personal Health Information Act.

1. Use means using or handling personal information within the University, or, if beyond the University, for the purposes of the University. (See below* for a fuller definition of “use.”)

2. In a University unit or office, the Records Administrator (RA) or other

designated person is the one who has the responsibility for access and use of records. The RA in charge of a particular group or groups of records is the one to whom the first approach should be made for access and use. The RA in charge of employee records is the one to be approached for access and use of those records. Similarly, the RA in charge of student records is the one to be approached for those records. It is the duty of the RA or designated person to make initial decisions about access and use of records.

3. Generally access by other employees and use will depend upon the job

descriptions of these employees. There may be occasions when an RA will have doubts about access and use by others. Employees other than the RA or designated persons do not have automatic access to employee or student files. If the RA is doubtful, he or she must ascertain the purpose for access and use. The RA should ask questions. If satisfied, he or she should provide the access, limited to the amount of information necessary for the requesting employee to carry out their task.

4. In an office situation, information can be used for:

a. The purpose for which it was collected b. A purpose that is consistent with the purpose for which it was

collected.

5. For a purpose to be consistent, it must meet all of the following criteria:

a. The proposed purpose must have a reasonable connection to the original purpose, that is, there should be a logical and direct connection.

40

Page 41: The Management of University Records · The Management of University Records Regulations and Guidelines for Maintenance, Retention and ... incorporating the retention period and final

b. The proposed purpose must be necessary for performing the duties that the requester is responsible for and the requester would be unable to accomplish the task without the use of the information.

c. The individual that the information is about should be able to anticipate that the information could be used in this way.

6. In certain situations where the contemplated use is unusual or open to

question, it is advisable to obtain consent from the person that the information is about. The University has a standard consent form, available from the FIPPA/PHIA Coordinator’s Office (474-8339 or 474-9462). The personal information can be used once the person has given informed written consent.

7. FIPPA section 46 describes volume uses of personal information. Volume

uses includes “administrative research.” The University has a policy for administrative research which is outlined in Administrative Bulletin #79. If you have questions about volume use or any other use of personal information, please consult the FIPPA/PHIA Coordinator’s Office.

*Use means using, dealing with or employing personal information, which is in the custody or control of the University, by or on behalf of the University, to accomplish the University’s objectives. In most cases, “custody” of a record means having physical possession of the record, and “control” of a record means having the authority or power to make decisions respecting the use or disclosure of the record. In practical terms, “use” of personal information means access to and use of personal information by the officers, employees, and agents of the University for the purposes of the University. (See also Information Sheet #1, April 28/03)

(August, 2006)

41