Managing Public Records

for Local Government Agencies

Electronic Records Management: A Brief Overview

Electronic records are public records and subject to the same laws as paper records.  Public records include anything created in the course of public business regardless of format. This includes any type of electronic record and could be an Access database, e-mail, Word documents, images, or Web sites.  Keep in mind that a public record is defined by its content.

An electronic record is a series of 1s and 0s that require computer hardware and software to interpret and present. Unlike information written on paper or available on microfilm, electronic records are not human-readable. They require something – hardware and software – to translate those 1s and 0s into a language we can understand and see.  Because electronic records rely on technology to be accessible, they require active management if you plan on being able to read them more than five years from now.

Creating Trustworthy Electronic Records

Electronic records, like paper records, can have serious implications in court cases, and can be requested during e-discovery.  Creating and maintaining trustworthy and admissible electronic records involves complying with the specific guidelines set out in the publication, North Carolina Guidelines for Managing Public Records Produced by Information Technology Systems.  You must be prepared to create an electronic records policy for your office.  The basics that should be included are:

• Passwords
• Everyone should have a password on his/her computer.  The passwords should follow guidelines to create safe passwords; they should be long, complicated, and changed frequently.
• Back-ups
• Routine back-ups should take place according to your office's back-up schedule; the back-ups should be labeled, checked for accuracy, and examined annually.  Store a back-up in secure off-site storage, and maintain at least one copy within the office. Current recommendations for hurricane-prone areas indicate that back-ups should be stored over 80 miles from the original site, in a region less affected by hurricanes. 
• Physical and intellectual security
• Protect the hardware – consider who has access to computers, disks, and external hard drives -- but also protect the software and files. Who can modify files or move them?  Identify potential causes of errors and maintain records of all inspections.  Explain your prevention strategies for errors and document all provisions against unauthorized access.
• File-naming
• Apply the Best Practices for File-naming available on the DCR Web site (follow the link in the sidebar) to implement file-naming standards for your office. Consider which abbreviations you will use, and which kind of file structure.
• State and federal laws and regulations
• All policies should comply with state and federal laws.
• Record-keeping practices
• Explain your record keeping practices, and show that records were created during the normal course of business.  Show that your records are reliable and provide an audit trail if necessary.  Also, document that your records are legally disposed of in accordance with the records schedule.
• System Operation
• Document specific hardware and software applications, and all aspects of system operation, including information that operation is monitored and all problems are quickly resolved.

Once you have an electronic records policy, ensure that everyone in your office is trained on the policy, including new employees. Making training a regular part of your records management will ensure compliance. 

Destroying Electronic Records

Unless they are archival, electronic records, like paper records, should be destroyed in accordance with the records schedule. And, like paper records, electronic records generate many copies. When it is time to destroy these records, the electronic copies should be destroyed as well.  Keep in mind that simply hitting the delete key on a computer does not delete the file – it merely removes the index pointer and allows the file to be written over.  It is possible to re-create files from hard drives, diskettes, and servers that were deleted with the delete button.  Ensure that when you destroy electronic records, they are destroyed.  This is especially important when surplusing old computers. Recommended methods for destroying electronic records include, in some cases, the physical destruction of the media on which electronic data is written; consult your IT office or department for further details on technical issues such as wiping hard drives on surplused computers.

For a further discussion of electronic records management, please take the time to complete our "Managing Electronic Public Records: Recognizing Perils and Avoiding Pitfalls" tutorial. 

Also consult the GRB Web site for additional guidance.

 

toc | return to top | previous page | next page