Questions:

• Can I destroy paper records that have been microfilmed or converted to an electronic format? How do I decide which records to convert from hard copy to digital format?
  In most cases, you can destroy paper records that have been converted into a digital format.
• Is it possible to automate our records destruction process?
  While some electronic document management systems (EDMS) allow you to automatically dispose of records at the end of their assigned retention period, it is not a best practice to automatically delete records.
• What standards and/or regulations are important to follow when destroying records?
  In the United States it is customary to follow DoD 5222.22-M, National Industrial Security Program Operating Manual (NISPOM), as a guideline for eradicating all types of data, regardless of the format they are stored on/in.
• What are the different records destruction options I should consider?
  There are different destruction options for different types of media that records are stored on.
• What is the difference between onsite and offsite destruction?
  Vendors usually provide their clients with two options regarding shredding services – onsite or offsite.
• NEW! What do you believe is the best and/or most effective governance structure to orchestrate and manage over RIM for the Public Service? My team and I are currently working on a RIM Transformation Initiative for the Public Service in our country (Trinidad and Tobago). We see RIM as achieving 2 major objectives: Ensuring and creating quality citizen service and improving the internal operations of government ministries and departments. We have looked at Canada, United States, and United Kingdom, among other countries, which all have their specific RIM governance structures and responsibilities.
• Don't see your question on this topic? Submit it here. Ask your question here and this month's expert, Norbert Kriebel, will answer it in a timely manner.

Q: Can I destroy paper records that have been microfilmed or converted to an electronic format? How do I decide which records to convert from hard copy to digital format?

In most cases, you can destroy paper records that have been converted into a digital format. However, certain states, industries, and countries may have specific rules regarding types of records that need to be retained after they have been imaged.  It is important for you to consult local counsel and your records manager to ensure that any federal, state and local laws and regulations have been addressed as well as industry standards. Also review any internal policies and procedures regarding imaging restrictions to determine if any existing internal standards may prevent you from converting your paper documents into a digital format.

It is also a best practice to keep records in a paper format until a quality control check has been performed on the scanned image to ensure that quality standards have been met so that the imaged document is complete and can be clearly viewed.

There are several factors to take into account when considering converting hard copy documents into a digital format. The first is the retention schedule. Records that need to be permanently retained are clear candidates for digitization, or microform conversion.

The next factor is cost. “Nothing is free” so, determining where the normal course of business permits you to ‘do nothing’ can be a cost saving approach to start with (unless litigation is forcing a different strategy altogether). Records that are near the end of their retention period may be able to be kept in paper format. These can always be scanned, if necessary, but otherwise they could be disposed of, in the normal course of business, at the end of their lifecycle.

In the case of back-file conversion, converting all paper to electronic files is rarely required, and the cost of unnecessarily converting files can quickly add up to significant sums of money. Three key factors to consider for converting older, but still viable, paper records to electronic format are: 

• The value of the records to the organization – Some documents may need to be accessed frequently to address various business needs. In an electronic format these records can be accessed faster through assigning search/reporting parameters and full-text search capabilities of the EDMS.
• Time required completing the conversion – For organizations with extremely large volumes of stored hardcopy materials, the sheer labor required and opportunity costs of conversion are prohibitive to do conversion in-house.
• Technology and budget required to automate and upload the files into an electronic document management system (EDMS) – It is important for an organization to assess what their imaging and document management system needs are, and identify the best way in which to create an interface for both systems to work together in addition to meeting allotted budget requirements.

As new scanning/imaging systems are integrated with EDMS, a significant portion of the manual tagging and categorization process can be automated for large cost savings. For organizations that are implementing these systems, a “this day forward” approach to automating document digitization is the best. That is, all relevant documents that are created after a certain date are, by standard business process, scanned and uploaded into the EDMS.

Finally, conversion to microform is still a very viable and cost-effective option for records that need to be retained more than 10 years. Consider that electronic file types will continue to evolve over the next decade. Today’s digital rendering may need to be converted to another format one or more times before destruction. And, data migration costs between software revisions, or even complete systems replacements, can become quite expensive.

Q: Is it possible to automate our records destruction process?

While some electronic document management systems (EDMS) allow you to automatically dispose of records at the end of their assigned retention period, it is not a best practice to automatically delete records. This same practice applies to paper and mixed media records that are stored in offsite storage or in onsite file rooms.

With increased litigation, it is always a necessity for organizations to ensure that proper legal holds are in place to preserve records. Automatically deleting records without checking for existing or future legal holds could place an organization at significant risk or can result in the destruction of records that may still be of value to their owner.

Whenever records are being destroyed, it is critical to alert the owner of the record first and obtain a written confirmation that the records in question:

• Are in compliance with an organization’s retention schedule to be destroyed
• Have had any assigned legal holds released
• Have satisfied their business need
• Are destroyed in the normal course of business

Q: What standards and/or regulations are important to follow when destroying records?

In the United States it is customary to follow DoD 5222.22-M, National Industrial Security Program Operating Manual (NISPOM), as a guideline for eradicating all types of data, regardless of the format they are stored on/in. This standard provides details regarding methods about how to destroy data, the type of security required for classified documents, etc.

ISO 14001 Environmental Management, is a newer certification, however, this issuance can allow a destruction vendor to measure against a “green standard” and further certify they are operating as efficiently as possible and recycling whatever materials they can. This is an optional standard.

Certain laws (e.g., Health Insurance Portability and Accountability Act of 1996) in the United States provide that records should be securely destroyed, but does not specify the method in which destruction will occur. However, the fines for a violation are high and it is critical that secure destruction methods, such as those prescribed in DoD5222.22-M are followed.

The National Association of Information Destruction (NAID) offers various certifications to ensure certain quality standards are being met by destruction vendors. Request a NAID certificate(s) from prospective vendors.

Individual states, counties, and local governments, as well as other countries, may have additional records destruction parameters to follow, such as a restriction on burning records to preserve local air quality laws. It is imperative to double check on any specific destruction laws that may exist based upon your location, industry, or required security for your records.

Q: What are the different records destruction options I should consider?

There are different destruction options for different types of media that records are stored on. The methods chosen will depend upon the physical nature of the material to be destroyed, how confidential the data to be destroyed is, and the cost associated with destroying data according to a particular method.

For paper records, the following destruction methods are available:

• Shredding – This process is the most common and affordable method to destroy paper records. For standard documents with non-confidential material, the strip-shred method is acceptable. For confidential documents, a cross cut shredder is recommended to prevent a document from easily being pieced together to reconstruct data.
• Incineration – This process relies on burning documents for total obliteration. This method should be utilized for extremely confidential documents as the paper cannot be recycled and is thus not considered a “green” option.
• Pulping/maceration – This process combines paper with water to create a pulp with no discernable data, which is then sold to various manufacturers to form recycled paper products. Ideally documents will be strip-shred or cross-shred, depending upon security needs, prior to pulping to prevent even the smallest bit of data from appearing after the pulping process.

For microforms, the following destruction methods are available:

• Shredding – This process is similar to paper destruction, using the strip-shred and cross-cut methods. However, it is possible to combine classified material with unclassified material to prevent reconstruction of data. Incineration should be considered after shredding for highly classified materials.
• Incineration – This method is utilized for highly classified materials to ensure total eradication of data. While burning is an effective destruction method, be very careful with certain types of microforms as they are highly combustible and dangerous if improperly handled. A closed incinerator is best for mircoforms because parts of them could be blown away by the wind if destroyed in an outdoor environment; be sure to stir the ash afterwards to ensure full eradication has occurred. However, local air quality laws may prevent burning.
• Chemical stripping – This process applies chemical solutions to microforms to eradicate stored data. This method contains volatile chemicals that may also interfere with local air pollution laws, caution is advised.

For digital records the following destruction methods are available:

• Shredding – This process is similar to paper. Shredding is an effective method when destroying CDs or floppy disks. The type of shredder used, strip-shred vs. cross-cut, will depend on the security requirements of the content.
• Overwriting – If an organization would like to recycle the currently written-upon media for future use, there are two major types of overwriting techniques:
  • Degaussing – This process is very effective for magnetic tape destruction, in which a very powerful magnet removes discernable data and essentially creates a blank tape ready for reuse. If confidential data is stored on a tape, it is essential to ensure the “civil track” or core of the tape is also destroyed. In many cases, degaussing is the first phase to occur depending upon the confidential nature of the data to be destroyed.
  • Media overwrite – The process in which a software program is utilized to fully write random data over existing data many times until the original data has been completely obliterated. DoD 5220.22-M is a good standard to follow when overwriting data. A media overwrite is often the second phase to occur in the destruction process and is highly effective for CDs, magnetic tapes, and hard drives.
• Incineration – The process where media is burned until only ash remains. Depending upon the confidentiality of the data, shredding or overwriting may occur first to fully ensure that all data has been eradicated.
• Melting – A process that is a “greener” option over incineration. The plastic and metal components are melted down and recycled into other products. Melting is more expensive than incineration and the vendors that offer this type of service may not be as readily available as those who offer incineration. Shredding or overwriting of data should occur if utilizing this method when recycling confidential data to ensure total content obliteration.

Depending upon the quantity of records to be destroyed and the internal capacity of an organization to processes records according to a specific destruction method, the method of destruction required may best be outsourced to a vendor who specializes in these methods, particularly when regarding safety issues for burning or chemical use to destroy records.

A certificate of destruction should always be obtained from any internal staff or external vendor(s) destroying official records along with the method of destruction used. 

Q: What is the difference between onsite and offsite destruction?

Vendors usually provide their clients with two options regarding shredding services – onsite or offsite. The two main differences between onsite and offsite destruction are cost and security.

If your business deals with highly confidential materials (e.g., documents with personal and/or medical information that need to be securely destroyed) then onsite destruction is an ideal option. Onsite destruction permits videotape, special supervision, and/or direct and constant control of the physical destruction of the records. Certificates of destruction can be immediately issued.

There is, however, a higher cost associated with onsite destruction. The vendor is required to move shredding machines onsite, absorb trucking and transport fees, and employ additional staff. All of this raises the price of onsite destruction services, as well as the opportunity costs of the physical space required.

If your business has non-confidential material or a very large volume of data to destroy, offsite destruction is a more cost-effective option. Working with a reputable and trustworthy destruction vendor that follows industry destruction standards, has high security systems in place (e.g., cameras in destruction areas and guards), and follows additional specifications required by your organization are often baseline requirements. Offsite destruction can result in significant cost savings over time.

Finally, certain destruction services simply cannot be performed onsite. For example, chemical destruction, incineration, and pulverization techniques can introduce safety, transportation, and space requirements that cannot be accommodated onsite.

Reader Submitted Questions:

Q: What do you believe is the best and/or most effective governance structure to orchestrate and manage over RIM for the Public Service? My team and I are currently working on a RIM Transformation Initiative for the Public Service in our country (Trinidad and Tobago). We see RIM as achieving 2 major objectives: Ensuring and creating quality citizen service and improving the internal operations of government ministries and departments. We have looked at Canada, United States, United Kingdom, among other countries, which all have specific RIM governance structures and responsibilities.

Thank you for your question. I agree wholeheartedly that a successful RIM practice is essential in any organization to drive increases in productivity, reduce waste and empower knowledge workers. When spearheading a RIM initiative of the size and stature you speak of it is essential to begin with establishing the proper governance structure in order to drive compliance, user adoption and ensure success. In general, you need a structure that ensures the RIM group, IT, legal and executive level business owners or champions are all on the same page and helping drive a successful implementation. In government, this structure may vary based upon country and laws in addition to specific titles or functions, but again the formula remains the same.

The ability to have the buy in and governance provided by this structure is essential in moving forward with the many decisions that lie ahead in respect to RIM as a whole and now more than ever specifically with how to deal with the multitude of born digital records and big data that we now deal with on a daily basis. Functionally, the RIM group must drive the imitative while coordinating with IT and empowerment through both senior leadership and legal. Whatever decisions are made by the governance structure must focus on both the physical and digital records world. Again, if there is not solid buy-in and support from all involved in the governance structure you are opening yourself up for the potential of a less than successful RIM program.

In our experience with RIM in working with the U.S. government and in the private sector with large corporations, we have succeeded with this formula. I would also like to provide you with what I have found is a great resource, it is a Records Management GAP Analysis that was performed by the U.S. Department of Health and Human Services. I think you will find it very useful as a point of reference to both the governance structure of a large agency, but more importantly the recommendations for improvement to the RIM program as a whole.

I hope you have found my answer helpful. At MBS we are dedicated to delivering real results in the RIM field through both our technical and subject matter experience. Managed Business Solutions can offer a “Full Suite of RIM Services” and be your partner on the journey to a best in class RIM implementation. Specifically we can help with consulting services like RIM assessments and project roll-out or even assist with setting up retention schedules and overall programs. MBS also has the expertise in various software solutions such as EMC Documentum, HP TRIM and Microsoft SharePoint®.

Additionally, MBS has an extensive network available for clients in the area of offsite data storage, archiving, scanning and back-file data conversions.  If you have any additional questions please do not hesitate to contact us through the information below and take a look at both our RIM Solutions and ARMA RIM BI Presentation:

MBS RIM Solutions - http://mbshome.com/Records-Management-Solutions.aspx

MBS ARMA RIM BI - http://bit.ly/HLcPYs

Ask the Expert sponsored by