---

Policy Statement

Boston University requires that University records be retained for specific periods of time, and has designated official repositories for their maintenance. These records must be managed according to procedures that are outlined in this document.

Reason for Policy

Boston University is committed to effective records retention to preserve its history, ensure that critical records are available to meet business needs, comply with legal requirements, optimize the use of space, minimize the cost of record retention, and ensure that outdated and useless records are destroyed.

Who Should Know This Policy?

Any University staff responsible for the maintenance of records in any format, as well as all Boston University faculty and staff who create, store, or use University records in any format

Definitions

Active Record: An original University Record currently used by the office, department or other area of the University that generated it. Active Records remain active for varying numbers of years, depending on the purpose for which they were created and regulatory requirements. Active Records may be retained in the originating office or at an offsite storage company. Active Records include records in all formats, including but not limited to: paper, fiche, digitized or scanned documents, electronic documents, and all other formats.

Archival Record: An original University Record that has permanent or historic value, is inactive, and is not required to be retained in the office in which it originated or was received. Archival Records are retained and preserved indefinitely in the University Archives. The University’s Records Administrator will make all final decisions concerning whether records will be preserved in the University Archives.

Electronic Record: A University Record kept in a non-tangible electronic format. Electronic Records include but are not limited to: word processor documents, spreadsheets, databases, HTML documents, scanned or imaged documents, and any other type of file warehoused online, on a mainframe, on a computer hard drive, or on any external storage medium (including disks and thumb drives). The same retention standards that apply to tangible University Records also apply to Electronic Records, and the retention periods outlined in the Record Retention Table apply equally to University Records in all formats.

Fiche: A type of record format consisting of a flat sheet of microfilm, typically used for the purpose of maximizing space efficiency. University records kept on fiche are bound by the same standards and retention periods as records kept in paper or electronic formats.

Inactive University Records: An original University Record that is not an Active Record but still must be maintained pursuant to the Record Retention Table set forth below. Inactive University Records are typically maintained at the University’s preferred Offsite Storage vendor or at other locations on campus; however, Inactive University Records of historical significance are maintained by the University Archives as directed by the Records Administrator or its designee.

Official Repository: The office or department designated as having responsibility for retention and timely destruction of particular types of official University Records. The University’s Records Administrator, or designee, will make the final determination concerning the Official Repository for University Records. For example: The Payroll Office is the official repository for annual employee payroll records. There is no need for offices and departments that are not the Official Repository for a University Record to retain copies of those records.

Offsite Storage: University Records that are in any format and are no longer needed may be stored with the University’s preferred vendor for Offsite Storage. The Offsite Storage vendor provides a fee based service for picking up and maintaining inactive records, and also delivering those records if they are needed again on campus. See the Procedures section of this policy for instructions on how to store records at Offsite Storage.

Personal Information: Records that include an individual’s name together with that individual’s Social Security Number; drivers’ license number or Massachusetts state identification card number; financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password that would permit access to an individual’s financial account; or biometric indicator. Personal Information is highly sensitive, and must be safeguarded and secured at all times.

Records Administrator: The University’s Records Administrator shall be determined by the President, or the President’s designated representative, and shall be initially the Vice President for Administrative Services. In consultation with the Executive Vice President and University Provost, the Records Administrator may designate certain policy implementation functions to other offices.

Records Committee: The University’s Records Administrator shall convene a Records Committee to develop procedures for the implementation of this Policy and to help ensure compliance. The Records Committee shall include representatives from the offices of the President, Information Systems and Technology, University Provost, Provost of the Medical Campus, Controller, Human Resources, Internal Audit, University Registrar, Research Compliance, General Counsel, and any other office or department as the Records Administrator, in consultation with the Executive Vice President and the University Provost, deems appropriate, including representatives from the faculty.

University Record: The original or official copy of any record/document, including Electronic Records, in any format. Formats include but are not limited to: paper, fiche, and electronic. The University’s Records Administrator or its designee will make the final determination concerning the Official Repository for University Records and the Official Repositories for these records are identified in the table at the end of this document. There is no need for offices and departments that are not the Official Repository for a University Record to retain copies of those records.

Responsibilities

The University Records Administrator is responsible for the implementation of this Policy across all departments and units that maintain University Records in any format. The University Records Administrator shall oversee, with the assistance of the Records Committee, the implementation of this Policy, including by developing procedures concerning the review, oversight and governance of this Policy, and including any necessary training. Each unit manager or department head is responsible for implementing this Policy within his or her unit or department consistent with the procedures developed by the Records Administrator and the Records Committee.

General Statement of Procedures

In consultation with and under the direction of the University Records Administrator or its designee, each unit manager or department head, or a designee, must:

• Determine the appropriate format for University Records under their area of responsibility;
• Implement the unit’s and/or office’s record management practices;
• Ensure that these management practices are consistent with this policy;
• Educate staff within the administrative unit in understanding sound record management practices;
• Preserve Inactive University Records (see the “Definitions” Section of this document) of historic value, and transfer those records to the University Archives;
• Ensure that access to confidential files and documents or electronic media that contain Personal Information is restricted in accordance with all University policies. Long term restrictions on access to selected Archival;
• Records should be noted at the time of their transfer to the University Archives; and
• Destroy Inactive University Records that have no archival value upon passage of the applicable retention period.

Record Disposal and Destruction

When the prescribed retention period (see the Record Retention Table) for University Records has passed, the unit’s administrative manager should ensure that the records are properly disposed of unless the records are of historic value to the University. The administrative manager should consult the University Records Administrator to designate those records that are archival.

Personal Information, including Student Personal Information (defined in the Definitions section of this Policy) should be securely disposed, in accordance with University data protection standards. All supporting documentation in paper format is required to be disposed security no later than two years after the last date the information is used, unless a legitimate business purposes exists, is otherwise required to be retained by law or regulation, or where targeted disposal is not reasonably feasible due to the manner in which the information is maintained. Electronic support is currently maintained by the University indefinitely based on business needs.

Option A: Inactive University Records

If you have determined that Active Records are no longer needed for business reasons but the applicable retention period has not yet expired, the Inactive University Records may be transferred to one of the University’s preferred Offsite Storage vendors. Contact the University Records Administrator or its designee to:

1. Review records to be sent to Offsite Storage.
2. Request storage boxes (1 full file drawer = 2 boxes).
3. Request a transfer form from the University’s preferred Offsite Storage vendor.
4. Schedule a time for boxes to be picked up.

Option B: Archival Records

If you, in consultation with the University Records Administrator or its designee, have determined that you are in possession of Archival Records and the applicable retention period has expired, please forward those records to the University Archives.

Option C: Non-Archival Records

If you have determined that Active Records are not Archival Records and the applicable retention period has expired, you should destroy those records in one of the following ways:

1. Recycle non–confidential paper records that do not contain Personal Information.
2. For records that contain Personal Information:
   1. Records must be redacted, burned, pulverized or shredded so that Personal Information cannot practicably be read or reconstructed;
   2. Electronic Records and other non-paper media containing Personal Information shall be destroyed or erased so that Personal Information cannot practicably be read or reconstructed. Contact the Office of Information Technology to ensure that electronic media are destroyed appropriately.

Periodically review records generated and maintained in university information systems or equipment (including mainframe, mini, and micro computing/storage systems) to ensure that these requirements are met.

The attached table (see Tools & References section) lists the official repositories for University Records as well as how long these records must be retained.

Record retention periods may be increased by government regulation; judicial or administrative consent order, private or governmental contract, pending litigation or audit requirements. Such modifications supersede the requirements listed in this policy. The suspension of record destruction required by any of these reasons will be accomplished by a notice sent out to affected units by the General Counsel, the Office of Internal Audit, the Office of the Vice President for Financial Affairs, the Office of Research Administration or the Office of Sponsored Programs.

No document list can be exhaustive. Questions regarding the retention period for any specific document or class of documents not included in these tables should be addressed to the University Records Administrator, its designee, or the Office of the General Counsel.

Departments and units that are not Official Repositories and that retain duplicate or multiple copies of these university records should dispose of them when the records are no longer useful (no later than the duration noted in this policy).

Tools and References

Record Retention Table

Special Situations and Exclusions

Amendments to the Record Retention Table: The Record Retention Table may be amended from time to time as approved by the Record Retention and Data Security Policy Committee, in consultation with the Executive Vice President or Provost, as appropriate. The Executive Vice President or Provost may refer any proposed amendment that raises a substantive issue to the appropriate committee.

Contacts

Electronic Media Storage
595 Commonwealth Avenue, Room 658
Boston MA 02215
617-353-2780

Offsite Storage of Inactive University Records
Access Corp.
Brad Walker, Account Executive for Boston University
brad.walker@accesscorp.com
978-399-5002
See also: /sourcing/wdyn/record-retention/

Regulation Interpretations and Retention Period Inquiries
Office of the General Counsel
125 Bay State Road
Boston MA 02215
617-353-6500

University Records Administration
Vice President Administrative Services
One Silber Way
Boston MA 02215
617-353-6500

---