A recent survey showed an interesting split between attitude and action when it comes to data retention and disposition.
Apparently, most organizations don’t follow their own advice. A whopping 87% believe a formal records retention policy would allow them to delete unnecessary information. Yet fewer than half actually have a formal information retention plan in place.
I see this all the time: Having a disposal schedule is not enough. You must adhere to the policy you establish as a standard business practice. Because in the event of a lawsuit or audit, NOT following your own policy could result in a seriously negative outcome.
Simply having some sort of disposal policy will not insure a successful outcome from an audit or lawsuit. Following your policy is much more likely to produce a favorable result.
Think about the famous George Patton quote about a good plan executed today being better than a perfect plan executed at some time in the future.
It’s less important to have a perfect policy. It’s more important to execute the policy you have.
If you’d like some professional advice about writing or executing a records disposal policy, please give me a call: (513) 721-FILE.
Cloud computing is a hot topic these days, but many don’t understand what cloud computing really is. Very simply, cloud computing involves the use of computer services accessed via the Internet. If you’ve ever bought a book from Amazon or paid a bill via your bank’s website, you’ve been computing in the cloud.
Is it safe?
When considering cloud computing, you might wonder if it’s safe. While the safety of public clouds can be debated, private clouds are considered more trustworthy to keep your data secure. That’s because private services utilize firewalls and other data security techniques to create a safe environment.
All business people care about keeping data secure, but it’s not usually cloud computing that puts your information at risk. Most data security failures have resulted from internal hardware and software failures or accidental deletions.
Cloud computing actually helps protect against such problems. By outsourcing your computing operations to companies that specialize in these services, your business has access to state-of-the-art hardware, software, and data security processes.
Leave IT to the pros
Most of us are in business to do something other than provide computer service. IT operations are not our strategic focus. So turning to cloud computing for data processing or IT applications for most of us is an improvement in how we handle our automated processes.
The fact of the matter is, more IT operations are moving into the cloud. Like it or not, we’ll all soon be doing most of our computing there, too.
Does $865,000 seem like a lot of money to you?
That’s how much the UCLA Health System recently agreed to pay in order to settle potential violations of the HIPAA Privacy and Security Rules. UCLA will also have to come up with an action plan to put their system in compliance with those rules, as part of the settlement.
The original complaints stemmed from unauthorized employee access to electronic protected health information of patients. An investigation found that records were repeatedly accessed improperly, leading to the $865,000 settlement in early July.
OCR, the federal office overseeing HIPAA, has been cracking down on organizations that violate HIPAA rules, including another recent $1 million settlement with Massachusetts General Hospital.
Every business with employees is likely to manage records that are subject to HIPAA rules. If you know what you have and are properly protecting those files according to HIPAA, you should feel fairly confident that you’re safe from such litigation. If not, let this hard lesson for UCLA Health Systems be a reminder to get your health records in check–before your business faces a hefty fine from OCR.
My company, BIS, manages HIPAA-protected records for numerous health care organizations in the greater Cincinnati area. If you have questions or concerns about your business’ health care records management, please contact me. We’re happy to help ease your HIPAA worries.
Managing internal business records is something every organization must do.
But handling such a crucial business function according to best practices? That’s something organizations of all sizes struggle with–particularly if they keep records management in house. After all, dedicating resources and attention to a part of your business that’s not a strategic focus can get expensive. It can also cause you to take your eye off the ball, forcing you to spend more time on your records than your mission. Unfortunately, failure to spend enough time on managing internal business records can have serious legal and financial consequences.
You might already be outsourcing other business functions like accounting, advertising, or website hosting. Many businesses have discovered that engaging an outside firm to provide records control service not only reduces risk and liability, but is no more expensive than hiring an outside plant service. Would outsourcing your current internal records management be a smart move?
To decide, ask yourself these questions:
- Do your records management processes deliver a unique value to customers and stakeholders?
- Have you optimized your records management processes or is it just the way it’s always been done at your company?
- Do you use best practices and best-in-class technology?
- How much does it cost to maintain the resources—including staffing, technology and processes—devoted to records management throughout the company?
- Are you satisfied with your current process regarding efficiency, cost, quality and convenience?
- Could your organization benefit from moving the resources currently invested in records management to more mission-critical tasks?
- Could outsourcing reduce your costs and risks, improve flexibility and agility, and free up resources to accelerate growth?
Based on the answers to the above questions, you have to decide if the pros of “going pro” with records management are worth it. Some of those benefits include:
- Staying compliant with current state and federal rules and regulations
- Automating systems to save time and money
- Digitizing and disposing of records to maximize efficiency and minimize risk
- Being “records-ready” for potential mergers and acquisitions
- Reducing the cost and inefficiency associated with misplaced or lost critical information
- Innovating with new ideas and technologies you might not have thought of on your own
After evaluating all these questions and considerations, you should be ready to make an informed decision on how to handle your records management. If you have any questions about what to look for in a good records management company, please get in touch with us.
Managing business records is a lot of work. But it can also save you time — and money — in the long run.
In 1980, I started the first records control company in the Cincinnati area. Over the years, I’ve discovered a number of best practices that will help you save time while you control your business records.
- Create an inventory of what you have in storage, so you can quickly retrieve records when you need them.
- Consider using a records control company like BIS that barcodes and tracks records, to help you save time when you need to retrieve them.
- Establish a disposal schedule — and follow it — so you don’t keep records beyond their required or useful life. Ask your records control company if you can be automatically notified when it’s time to dispose of records. That way, you can painlessly purge your expired files to achieve compliance with your business records disposal schedule.
For more of my thoughts on saving time, take a look at this short video:
As your business records take on more forms — and get stored in more ways — the idea of “records control” is evolving to something more complex than it used to be.
Controlling your business records means standardizing how you name those files and scheduling them for proper disposal. What? You thought because digital records weren’t filling up your office storerooms, you should just keep them forever? Nope.
Whether records exist on paper stored in boxes or in virtual folders in the cloud, your business is responsible for managing them according to relevant regulations. All of the best practices pertaining to compliance and risk and liability apply to records regardless of storage medium — digital, paper, or film.
Here’s what I tell my customers: For quick and easy retrieval, electronic records need standard names. Just like biologists use a taxonomy to identify different species, businesses need a taxonomy to identify and deal with their records. A records taxonomy will answer these questions:
- What is the standard name for each type of record?
- Who is responsible for the record?
- Where is the record stored?
- When can the record be destroyed?
- How should the record be destroyed (e.g., recycling, shredding, etc.)?
Of course, most companies don’t have a taxonomy for their records, either because they don’t know how valuable it is or they don’t know where to start. In this digital age, taxonomies are more important than ever. Think about it: Human beings may realize that A/P and Accounts Payable mean the same thing when reading a paper record. Computers don’t.
If the prospect of creating naming conventions and disposal schedules seems daunting, get help from experts with records control know-how. For example, our BISplan™ software helps you name files and schedule them for timely disposal. If you have questions about BISplan™ or my thoughts on records control, please get in touch. I’d love to help.
Just as the fresh air and warmer temperatures of spring inspire us to give our homes a thorough cleaning, I think it’s also the perfect time to do a little spring cleaning in the office, too.
I’m not talking about dust bunnies under your desk or leftovers in the office fridge (but by all means, take care of those, too!) I’m talking about spring cleaning your records to ensure you save only what you need and safely dispose of the rest.
A good spring clean will reduce your risk and liability. Start by understanding the business records retention schedule regulations for your business records–personnel files and other HR records in particular. Once you know what you’re required to keep, you can create policies and procedures to be sure records are purged as soon as the applicable disposal period has been satisfied. Timely records purges not only reduce the cost of maintaining inactive files, they also keep possibly damaging records from being used by plaintiff’s attorneys.
Get organized and store the “keepers” to save time and maintain good records. How much time does it take for a file retrieval from your records storage area? Do you have a list of everything you have in file storage? Can you quickly find what documents you need? Time is money, but unlike money, once spent time can never be replaced. Every document you deposit at our Cincinnati document storage facility is barcoded and tracked by business records management software so that you won’t waste time when you need to retrieve records. You can also use tracking to tell you when it’s time to dispose of records so that you can painlessly purge your expired files to achieve compliance with your business records retention schedule. It’s like an automatic cleaning crew for your records.
Safely get rid of records you no longer need. After you fill all those bins with unwanted files (both printed and digital), what are you going to do with them? You can’t simply put them out with the garbage like household trash. Make sure you securely shred the paper and destroy the electronic data. Once the excess clutter is out of your office, you can really enjoy all the extra space and efficiency that comes from a good spring cleaning.
It’s that time of year again, when flowers begin to bloom and accountants work overtime to get tax returns finished before a looming deadline.
With April 18 just a few days away, you should have already filed your business taxes, and hopefully your personal returns as well. Still pulling your hair out, frantically searching for records and receipts? Here’s a little advice to make next spring a lot less painful for you:
Get and keep your records in order, and your future tax seasons will go much more smoothly. Not only will you have everything ready for a simpler filing process, you’ll likely save on tax expenditures, including fees, missed deductions and penalties.
Our friends at the IRS point out multiple tax benefits of good recordkeeping on their website. Those benefits include:
- Monitoring the progress of your business
- Preparing accurate financial statements, such as income (profit and loss) statements and balance sheets.
- Identifying the source of your receipts
- Keeping track of deductible expenses
- And of course, preparing your tax return
If the IRS does want to examine any of your tax returns (also known as the dreaded tax audit), you may be asked to explain items you’ve reported. It will certainly help matters for you if you have a complete set of records to show the auditors.
For personal taxes, I like the “four shoebox” method, which means keeping the past three years’ worth of records in three corresponding shoeboxes. The fourth shoebox should be empty, ready to house the current year’s records as you accumulate them. Once you file your return next year, you can dispose of the records in the oldest shoebox (because you can only be audited for the past three years’ worth of returns). Then the newly empty box serves as the new tax year’s record holder. Sounds low-tech and simple, but it works.
I know it isn’t always easy to get your ducks in a row when it comes to business records — during tax season, and all year long. Want to get some help achieving pain-free tax returns in 2012? Learn more about how you can save time with offsite document storage and imaging, as well control business records management costs.
If you’re a BIS customer, you’ll often hear me preach about “keeping only what you have to” when it comes to business records. That’s why I found this recent post from the Formtek Blog interesting.
The post’s title hits the nail on the head: Record Destruction is a Major Pain Point. Managing records is one thing, but identifying which ones need to be disposed of, and when, is quite another. Here are a couple of facts I learned from the Formtek post, gleaned from a Compliance, Governance and Oversight Council forum on retention and e-discovery:
- 98 percent of forum attendees said that defensible disposal of records is their goal, yet 78 percent said that they are not able to properly dispose of their data.
- 85 percent agreed that better processes and collaboration between IT, legal and records is the best way to fix the problem.
Are you with the majority here? After being in this business for three decades, I can say with some authority that deciding what to keep and throw away is not a new (or uncommon) problem for businesses. Every business should have a records disposal policy specifying which records should be kept and for how long. (Watch this video to get a better understanding of what to consider when maintaining official records.)
As regulations change and new legislation is passed, those records disposal policies need to be reviewed and updated. Take the Lilly Ledbetter Fair Pay Act, for example. This relatively new federal statute will probably spend years in litigation until Supreme Court finally rules on what is considered the “right” length of time to maintain payroll records. Business owners should keep a lookout for this kind of legislation, and how it plays out, as they check in periodically on their records disposal.
Have you heard the term “cloud computing” or simply “the cloud” and wondered what the heck it’s referring to? I know a lot of business executives have probably come across this concept and scratched their heads, and maybe even worried about how this cloud could affect their companies.
Essentially, cloud computing means computer processing that’s done via Internet. Take Gmail, for example. Google provides you with free email service, using data centers located in different cities. If you have a Gmail account, you’re already in the cloud.
If you really want to get a good overview of cloud computing and what it means to you, read this recent Infoworld article. It outlines the various types of cloud computing, including software as a service (SaaS) such as Salesforce.com, web-based services like ADP payroll processing, and managed service providers (MSP). After running through the various cloud concepts, the author concludes:
Today … cloud computing might be more accurately described as “sky computing,” with many isolated clouds of services which IT customers must plug into individually.
So should you tether yourself to the “grounded” computing you’re used to, or float up into the cloud? Well, think of it this way: What if you had stubbornly clung to keeping all your business data on floppy disks, even as they shrank in size and eventually disappeared altogether? Or forced your employees to keep clacking away on typewriters when competitors moved to PCs?
Similarly, technology continues to evolve, and the practice of computing in our own data centers will disappear. Business today–and increasingly, tomorrow–will be done in “the cloud.”
Worried about what happens to the data you store in these cloud-based systems and programs? Don’t be. The cloud is actually much safer than your own computer. Due to economy of scale, the cloud can provide higher levels of data security and backup than any individual user can by mirroring data on redundant computers in different locations.
The privacy of your data is another matter. My only advice is to read service providers’ privacy policies and decide if you trust them to comply with their own policies.
Frank J. Albi
