Natural disasters have increased in both frequency and destructiveness. In 2020, the United States experienced a record-breaking 22 weather or climate disasters that resulted in the loss of life, billions in property damage, and numerous irreplaceable items. Some of these irreplaceable items included vital business records—information that an organization needs for daily operation.[i] Knowing which disasters to prepare for can help prevent the loss of these crucial documents.

The most severe disasters are hard to predict but not impossible to prepare for. This blog discusses some of the most recent severe weather disasters, how they have impacted vital business records, and what we can learn from them. A tool used by records managers to anticipate and prepare for disasters is the Seven Classes of Disasters chart. Has your business been impacted by one of the disasters in the Seven Classes of Disasters[ii] chart below?

Examples of Type 2 Disasters: Earthquakes, hurricanes, tornados, and fires

Hurricane Katrina

On August 29, 2005, Hurricane Katrina hit Louisiana. It is considered one of the most devastating hurricanes in U.S. history because of the volume of destruction, flooding, and loss of life. Businesses throughout the state were disrupted or completely destroyed and many found they could not access their properties for weeks due to flooding.[i]

What we learned:

According to the Society of American Archivists, “[a]lthough many record keepers were proactive in their attempts to protect records, almost no one foresaw the scale of Katrina’s devastation, and most attempts fell far short of necessary measures.”[ii] It could take days or weeks to be able to return to your business to retrieve and salvage records. These records could be critical in proving an insurance claim or receiving aid from federal agencies.

Camp Fire

November 8, 2018, California experienced the deadliest and most destructive wildfire in the state’s history. The fire consumed the entire town of Paradise within the first six hours. An estimated 95 percent of the town’s buildings were lost in the fire. When the fire began, the residents of Paradise had only minutes to evacuate their homes and businesses.[iii]

What we learned:

A whole town was destroyed along with countless records. Even if some records are untouched by fire, there is a good chance they may be destroyed by firefighters’ efforts to extinguish the fire. Some records, while physically intact, may also have lasting smoke damage.

Examples of Type 3 and 4 Disasters: Water and wind damage, power outages

2021 Flooding in New York

In September 2021, New York was hit with torrential rainfall and damaging winds leading to catastrophic flooding. Buildings, highways, subways, and the airport were completely submerged or impacted by flood waters. Damaging winds impacted thousands with power outages for several days.

What we learned:

While some of your records may survive a flood, they may not survive subsequent mold growth. Flooding also could mean access to your building is limited or impossible due to highways and roads being shut down. Loss of power could limit your access to your records and could cause loss of data and corruption.

How to avoid loss of records

• Be familiar with what natural disasters are most likely hit your area.
• Have a disaster preparedness and recovery plan that considers these types of disasters.
• Back up computerized records regularly.
• Store critical records in a safe location off-premises.
• Back-up records securely to the cloud.

Contact Zasio today to learn how our Versatile technology solutions and Consulting services can help you manage your records.

[i] https://www.climate.gov/news-features/blogs/beyond-data/2020-us-billion-dollar-weather-and-climate-disasters-historical

[ii] Mary F. Robek, Gerald F. Brown, & David O. Stephens, Information and Records Management, Document-Based Information Systems (1^st Ed. 1996). Page 71, Table 4.1.

[iii] https://britannica.com/event/Hurricane-Katrina

[iv] https://www2.archivists.org/news/2005/report-of-hurricane-katrina-damage-assessment

[v] https://www.sfchronicle.com/california-wildfires/article/Evacuations-ordered-across-Butte-County-as-Camp-13374840.php

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

It is that time of year again! Time to look at your retention schedule and decide what needs to be organized. It is a love-hate relationship for some. Most organizations have filed taxes for 2020, making this a great time of year to think about whether older accounting records may no longer be subject to any retention requirements.

Everyone knows how important it is to balance your company books, but where do you even start? Start by determining what accounting documents you have and what your record retention requirements are. All businesses are required to keep accounting documents for certain lengths of time. Keeping your accounting records organized can save you time, money, and headaches every tax season.

What Documents Are Considered Accounting Documents?

Accounting documents describe a business’s transactions. Examples include general ledgers, bank statements, invoices, inventories, and receipts. Accounting documents are important for business and operational needs, but they are vital for audits.

U.S. Governmental Agency Accounting Documents.

If you are a U.S. governmental agency, the Internal Revenue Service (IRS) has adopted the General Records Schedules (GRS), which contain disposition instructions for administrative functions common to most offices. The GRS recommends businesses keep “financial transaction records related to procuring goods and services, paying bills, collecting debts, and accounting” and to “destroy six years after final payment or cancellation, but longer retention is authorized if required for business use.” [i]  Regarding an audit, the “IRS can include returns filed within the last three years . . .  If we identify a substantial error, we may add additional years. We usually don’t go back more than the last six years. ^[ii]

Accounting Documents for U.S. Business Entities.

If you are a business operating in the United States, retention requirements will differ depending on which state[s] you operate in. Many U.S. companies adopt the retention requirement found in California’s 18 CCR 19141.6, which states:

Records for any year must be retained for the longer of: the time during which the taxpayer’s franchise or income tax is subject to adjustment but not to exceed eight years from the due date or extended due date of return.

Accounting Documents for International Entities.

If your business has a presence in different countries, you could be looking at longer retention periods for accounting documents. To determine retention requirements among multiple countries, ARMA International has put together the Retention of Accounting Records: A Global Survey of Laws and Regulations, a summary of several countries, and their accounting retention requirements. On average, retention periods for accounting documents range from 3 to 10 years. Some companies increase these retention periods to 11 or 12 years to account for fiscal year requirements on top of the applicable base retention period. You will also want to research whether applicable countries have any archival order laws, as these can further increase accounting record retention periods. For example, Poland, Slovenia, and China have archival order laws that create significantly longer accounting record retention requirements.

Now is the right time of year to go through your business accounting records and dispose of any documents not required for legal, business operational, and practical storage needs. Your business will need to weigh the cost of keeping information that is no longer necessary for business operational needs to prevent potential litigation problems.

Are you unsure of which documents you can dispose of? If so, contact Zasio to assist you in identifying gaps in your retention schedule and answer any accounting record retention questions.

[i] https://www.irs.gov/pub/irs-utl/d12829.pdf

[ii] https://www.irs.gov/businesses/small-businesses-self-employed/irs-audits#:~:text=Generally%2C%20the%20IRS%20can%20include,possible%20after%20they%20are%20filed.

 

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The world is in a race to manufacture and produce a safe vaccine for COVID-19. This has led to an unprecedented pace and volume of clinical trial documentation for the many companies and organizations competing in this race and particular implications for trial participant consent and pharmacovigilance requirements.

In the race for a vaccine, Russia recently unveiled “Operation Sputnik,” approving a vaccine ready for human use and is being administered to essential workers. Russia is the first country to claim it has a working vaccine. China revealed it has approved an experimental vaccine and is administering doses to high-risk professionals and military personnel. The United States announced “Operation Warp Speed,” spending billions on pharmaceutical contracts to manufacture and distribute a COVID-19 vaccine. Several pharmaceutical companies around the world are in the final phases of the vaccine clinical trials.

From preclinical testing to the last phase of clinical studies, it takes years for an experimental drug to be manufactured and produced for human use. The COVID-19 vaccine has been fast-tracked to be manufactured and ready for human use within a matter of months, not years. The expedited development brings up concerns about managing the amount of data gathered for these trials and the speed at which the procedures and documentation are occurring. To demonstrate compliance with Good Clinical Practice standards, every essential aspect of a clinical study must be documented.

The United States Food and Drug Administration produced a guideline in March 2020 (updated in July 2020) outlining procedures for clinical trials during the pandemic. The document refers to Part 312 of section 21 of the Code of Federal Regulations which addresses the records that need to be kept for new pharmaceutical drugs, including regulations for clinical investigators. The 2020 guidance document highlights procedures for obtaining and keeping consent documentation[1]. “When feasible, we recommend a traditional method of obtaining and documenting informed consent using a signed paper copy of the consent form, or use of electronic informed consent”. But what if the written consent by the trial participant is not possible? The USDA guidance document provides two additional methods for consent:

• “Method 1: A photograph of the signed informed consent document can be transmitted to the trial staff. The patient (or an individual in the room) takes a photograph of the signed informed consent document and sends it to the investigator/designee. A trial team member enters the photograph into the trial records along with an attestation that states how that photograph was obtained and that it is a photograph of the informed consent document signed by the patient.”
• “Method 2: A witness can attest to the signature, but a photograph of the signed informed consent document cannot be transmitted. When using a witness, documentation in the trial records includes: (1) a signed and dated attestation by the witness who participated on the call that the patient confirmed their agreement to participate in the trial and signed the informed consent document.

The European Medicines Agency also produced guidance documentation regarding Clinical Trials and procedures[2]. This document also refers to Directive 2001/20 EC Good Clinical Practice for the conduct of clinical trials on medicinal products for human use which addresses record-keeping practices. The guidance document added:

…the following specific aspects should be taken into account with trials involving COVID-19 patients:

• If written consent by the trial participant is not possible (for example because of physical isolation due to COVID-19 infection), consent could be given orally by the trial participant (Art 2(j) of Directive 2001/20/EC) in the presence of an impartial witness. In such cases, the witness is required to sign and date the informed consent form and the investigator is expected to record how the impartial witness was selected.
• In addition, it could be considered that the trial participant and the person obtaining consent sign and date separate informed consent forms. In either case, all relevant records should be archived in the investigator’s site master file. A correctly signed and dated informed consent form should be obtained from the trial participant later, as soon as possible.

What about the pharmacovigilance aspect? Monitoring the safety of medicines is a top priority for pharmaceutical companies. The UK Medicines and Health Regulatory Authority released guidance as to what documents need to be kept for pharmacovigilance inspections since the manner of inspections have changed because of the pandemic.[3] These documents include: “procedural documents (such as SOPs, working instructions, and guides); outputs from pharmacovigilance activities such as safety review meeting minutes; documented product safety reviews; audit risk assessments; agreements in place with partners and service providers”. The 2020 Guide by the USDA touches on pharmacovigilance data they require pharmaceutical companies to keep, “data, which includes the pre-licensure clinical safety database, preclinical data, and available safety information for related vaccines, among other considerations”. There will be extra scrutiny for pharmacovigilance documents as these vaccines are being used globally on a wider scale.

Good Clinical Practice has always set forth very particular and detailed standards for recordkeeping during clinical studies and trials. It is now more important than ever to adapt to regulatory changes. Pharmaceutical companies are receiving, reporting, and creating records on the effectiveness of the vaccine at an accelerated rate. Contact Zasio today to determine whether your company is up to date with the influx of clinical record keeping requirements, pharmacovigilance record keeping, and GDPR requirements.

 

[1] https://www.fda.gov/regulatory-information/search-fda-guidance-documents/fda-guidance-conduct-clinical-trials-medical-products-during-covid-19-public-health-emergency

[2] https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-10/guidanceclinicaltrials_covid19_en.pdf

[3] https://www.gov.uk/guidance/good-pharmacovigilance-practice-gpvp

 

If your company does business or has a business presence in Russia, then you may be familiar with Order No. 558 which sets out a list of storage periods for recordkeeping. On December 20, 2019, the Ministry of Justice of Russia approved Order No. 236, Updating the List of Typical Administrative Archival Documents Generated in the Course of Activities of State Bodies, Local Governments and Organizations, With an Indication of Their Storage Time (hereinafter “Archives Order”) which replaces Order No. 558.

If you are not familiar with the Russian Archives Order, it is a “legal act establishing the storage periods for typical administrative archival documents generated in the course of organizations’ activities…taking into account the practical tasks of document storage and their historical value.” The Order contains several long retention periods for typically minimal retention periods for Organizations operating in Russia. For example, organizations are required to keep payroll information for 50 to 75 years, occupational health and safety records for 45 to 75 years, and where there is loss of life in an industrial accident, organizations must keep those records 45 years.

Basically, this Order is a guide as to which records need to be retained for many organizations, and for how long they should be keeping them. It can be an overwhelming task to go through the large document and its thousands of retentions. This blog aims to sort through what changes have been made and provides language from the law to help you determine if the changes apply to your organization.

Who Does the Russian Archives Order Apply to?

Order No. 237 of the Federal Archival Agency, Instructions for Use of the List, dated 20.12.2019 notes the following about the term “Organizations”:

• “The list includes the types of documents generated during the documentation of the same type (common to most organizations) managerial functions performed by organizations regardless of their organizational and legal forms and forms of ownership.”

• “The terms of temporary storage of documents (1 year, 3 years, 5 years, 6 years, 10 years, 15 years, 45 years, 50 years and 75 years) established by the List must be respected by all organizations regardless of their organizational and legal forms of ownership”.

Alternatively, Order N 1293-p dated June 27, 2018 as amended April, 2020, On Approval of the List of Organizations Subordinate to the Ministry of Science and Higher Education of the Russian Federation, the Ministry of Education of the Russian Federation , lists several different types of organizations and institutions that could be included in that term of “Organizations.”

What Was Changed in the New Order?

Order No. 236 of 2019, adds new documents to be retained, and increases and decreases retention periods for organizations. Below are a few examples of retention period changes:

Labor:

• Retention periods for documents that have increased: Books, record cards, vacation databases stored, for 5 years, previously 3 years;

• Retention periods for documents that have decreased: Vacation schedules, store for 1 year, previously 3 years; Documents to improve working conditions and labor protection, store for 5 years, previously permanently; Documents on industrial accidents, accident records, store for 45 years, previously permanently.

• Retention period for personnel records generated before January 1, 2003, store for 75 years, if after January 1, 2003, store for 50 years.

Financial:

• Retention periods for documents that have increased: Invoices store for 5 years, previously 4 years; Correspondence with tax authorities, store for 6 years, previously 5 years.

• Retention periods for documents that have decreased: Registers of information on personal income store for 5 years, previously 75 years; Accounting documents for income and expenses, store for 5 years, previously constantly.

This blog highlights just a few of the many changes that Order No. 236 is requiring in 2020. It looks like a new trend in counties that have these large Archive Orders to decrease larger retention periods and slightly increase shorter retention periods. Russia, for example, now requires organizations to keep documents on industrial accidents for 45 years, rather than its previous requirement to keep them permanently. Similarly, Poland repealed a 50-year pay-roll retention requirement applicable to employers from its Archive Act in 2019.

Depending on your business presence in Russia, the Archives Order could be something you should consider in implementing in your records retention program. If you are unsure of what changes apply to your business, Zasio’s consulting team can guide you through the new changes and how they can be implemented. Contact Zasio

 

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

In an ever-changing competitive world, businesses need to be flexible with technology and work environments. This flexibility allows employees to work from remote locations, on-site and from home offices on company-owned or personal devices such as cell phones, laptops and tablets. With this technology comes the responsibility of the business owner to protect their valuable records, trade secrets, proprietary information, intellectual property, and personally identifiable information stored on those devices. Federal, state and international laws require companies to protect personal information and lay down heavy sanctions when that information is not properly secured.

Courts have routinely held through the Federal Electronic Communications Privacy Act that when an employee uses a company-owned device, they have no reasonable expectation of privacy. If you use a company-owned device, it is the property of the employer, as is the information stored on it. Employers are free to monitor those devices once consent is given. California recently updated their Consumer Privacy Act to better protect consumers and it excludes employees from this definition from consumers. The law states that the title does not apply to a natural person’s personal information collected and used by the business solely within the context of the natural person’s role or former role as a job applicant, an employee of or a contractor of that business.

The advantage of mobile devices is the convenience of access to your records and information in real-time, allowing your employees to be competitive and stay on top of your business needs. It is beneficial for an employee to remain in contact with coworkers and customers, and mobility allows for faster communication, such as drafting an email during the train or bus ride home. Mobile devices have increasingly greater file storage capacity and ease of sharing those files. Mobile apps can be used to schedule, design and collaborate, and can be tailored to your business specifics. A mobile work-station reduces the cost of having dedicated office space for employees.

The disadvantages are that devices are portable and valuable records and information can be lost through damage or loss of the device. Devices can be stolen, allowing unauthorized access to sensitive data if they have not been properly secured with passcodes, biometric authentication, and encryption. Mobile devices can be easily hacked through phishing scams, social engineering, malicious apps freely downloaded, or unsecured Wi-Fi. Accessible information on a device could include: passwords, credit card numbers and banking information, text messages, phone calls, recently visited sites, GPS location, contacts, recent files and deleted files. Information cached on a mobile device may still be discoverable even if the original copy was deleted based on the company’s retention schedule.

Many states have laws with specific requirements for the use of devices. South Carolina Code § 38-99-20, requires insurance companies to implement security measures to protect by encryption nonpublic information transmitted over external networks and stored on laptop computers, portable computing or storage devices or media, regularly test to detect attempted attacks, include audit trails to detect and respond to cybersecurity events and protect against destruction, loss, or damage of nonpublic information due to environmental hazards.

Warren Bean, Sr. Sales Engineer for Zasio, recommends a few security measures to encourage compliance for company-owned mobile devices:

• Use randomly-generated passwords so that you can’t fall victim to social engineering tricks (such as getting your pet’s name or favorite color from your social media account);
• Don’t use the same password on multiple apps or sites;
• Never click on links or attachments from unknown sources;
• Don’t leave your mobile device unattended;
• Keep up to date on operating system updates and browser patches (the bad guys scour the internet looking for unpatched systems);
• Use the strongest authentication methods available for your device, such as fingerprints and facial recognition, two-factor authentication, and automatic lock-outs for too many failed login attempts;
• If you frequently utilize public wi-if networks consider investing in a VPN service that routes your data through an encrypted private network, especially when traveling in foreign countries;
• Company-owned devices should also be centrally managed via mobile device management software that allows for remote updating and wiping of devices.

Ultimately, employers need a clear policy for company-owned devices regarding consent, record retention and how they will monitor, access, view and preserve employee texts, emails and other mobile device information. Employers need to verify the legitimacy of the applications, understand where any data is being stored, how it’s being transmitted, and whether privacy agreements exist between the organization and the data processor. If you have any questions on your company’s policies or how company-owned devices should be accounted for in your records management strategy, contact Zasio.

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

A National Archives Agency preserves official documents, photos, artifacts and records that have important historical value to a country. The purpose of an Archive’s Agency is to preserve these important records for future generations and provide public access to these records.

Why are archive laws so important? Archive laws set out standards for preservation of records and regulations for accurate record-keeping from their creation to disposal or storage.  Archive laws also set mandatory standards for security, storage conditions, protection of records from damage or loss, as well as conditions for storing records in specific mediums.

At first glance, archive law requirements could be understood as being only applicable to governments and their preservation of valuable historical, scientific, social, economic and cultural records.  While most archive laws are focused on government agencies, in some countries, such as the Eastern Block of Europe and China, archive laws can extend record-keeping requirements to include public corporations and non-governmental organizations. Do not be quick to ignore archive laws based on the assumption that they apply only to governments and the retention of historical records. Organizations that are guilty of violating archive law requirements in these countries could potentially bear civil, administrative and criminal liability.

A few areas where an organization could potentially be impacted are as follows:

• Administrative and internal regulations of an organization
• Accounting and payroll
• Tax
• Labor
• Occupational accidents and hazards
• Social security/pensions
• Environmental

Below are examples that include archive law requirements applicable to some types of corporations and non-governmental organizations:

• Russia’s Order of August 25, 2010, N 558 on archival documents encompasses “state bodies, local governments and organizations”, while Russia’s Archival Documents of Scientific, Technical and Production Activities Order is applicable to “archival documents on scientific, scientific-technical, production-technical, design and construction activities of organizations, with an indication of the shelf life applied in various sectors of the economy”.
• China’s National Archives Order 10 applies to “enterprises registered and established within the territory of the People’s Republic of China”.
• Poland’s Dz. U. 1983 No. 38 item 173 Archive Act applies to “entrepreneurs” and “business activity in the field of personal documentation, storage and payroll of employers with a temporary storage period”.
• Latvia’s Archival Law applies to “every institution, as well as to individuals, who have documents with archival value…and natural or legal person exercising an economic activity engaged in an economic activity, or on the basis of a contract of employment, business or author, and other persons as well as an association of person”.

When deciding if an archives law applies to your specific industry, it is helpful to look for an explanation of the law on the country’s main archive website or secondary sources. This can help determine the applicability to your specific industry.

It is important to note that countries are updating their archive laws to reflect changing privacy and data protection legislation. Changes to archive laws aim to correct gaps in definitions, transferring of records within a country and cross-border transferring requirements, location requirements, conditions and disposal of records. For example, Poland’s Data Protection Law repealed a fifty-year retention requirement applicable to employers from its Archive Act. Although the retention was repealed from the Archive Act, it can still be found in other employment laws. Because governments are continuously evaluating and strengthening privacy and data protection, there is potential for further repeal of archival record requirements.

If you need help interpreting how archival laws impact your business, contact Zasio and speak with our team of in-house experts.

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.