Records Management and Retention Policy 

This Records Management and Retention Policy (the “Policy”) affirms Moravian University’s (“Moravian” or the “University”)¹ commitment to the effective management and retention of its records as necessary to fulfill its educational mission, comply with legal requirements, and preserve its history.  Moravian complies with applicable federal, state, and local laws and discipline-specific standards in its management of University records.  This Policy is reviewed periodically for accuracy and compliance purposes. 

I. Purpose
The purpose of this Policy is to: (1) establish an efficient University-wide records management system for identifying, maintaining, retrieving, preserving, and destroying records, (2) ensure that records are adequately protected, (3) preserve University history, (4) ensure that records that are no longer needed or of no value are destroyed at the appropriate time and in the appropriate manner, and (5) comply with legal, contractual, and accreditation requirements for the retention, privacy, and security of records.

II. Scope
This Policy applies to each University record, as more particularly defined in Section IV.E below.

III. Applicability
This Policy applies to all employees and/or non-employee representatives who conduct business for or on behalf of the University (“Applicable Members”).

IV. Definitions

1. Custodian of Record - The designated department, as identified in the Record Retention Table, that is responsible for retaining and timely destroying University records in accordance with this Policy. Each department is responsible for identifying a Data Steward and one or more Record Management Administrators who will fulfill the roles set forth in Sections V.F.i. and V.F.ii. belo
2. Data Steward - Individual(s) who have the responsibilities set forth in Section V.F.i. below.
3. Department - All academic, clinical, and/or administrative offices of the University.
4. Office of Information Technology (IT) - The University information technology office (the “IT Office”), and/or, as applicable, any other organizational technology group within the University that maintains University information or resources.
5. Record - Any type of record, file, document and other form of information created, received or transmitted in the ordinary course of the University’s business, regardless of format, whether on paper, electronic (e.g., cloud-based files, A/V recordings, locally stored files), microform (e.g., microfilm, microfiche, magnetic tapes, and CD-ROM), or another medium, and as more particularly set forth in the Record Retention Table. Active Record:
   1. A Record that is currently being used in the ordinary course of University business.
   2. Inactive Record:  A Record that is no longer being used in the ordinary course of University business but must be retained until the end of its Record Retention Period.
   3. Expired Record: A Record that: (a) is no longer being used in the ordinary course of University business, (b) has met or exceeded the Record Retention Period, and (c) is not a Historical Record.
   4. Historical Record:  A Record that is no longer being used in the ordinary course of University business that is permanently retained for its historical value.
6. Record Management Administrator(s) – Individual(s) who have the responsibilities set forth in Section V.F.ii. below.
7. Record Retention Period - The period of time during which the Custodian of Record is responsible for retaining a specified Record in accordance with the Record Retention Table.  
8. Record Retention Table – A chart set forth in Appendix A attached hereto listing the: type of record, Custodian of Record, and the applicable Record Retention Period.
9. University Data Classification - See Data Classification Policy
10. University Information - See Information Technology Acceptable Use Policy

V. Procedures

1. University Records and Record Retention Table

Active Records, Inactive Records, and Historical Records must be maintained in accordance with the Record Retention Table and this Policy.  Expired Records must be destroyed in accordance with this Policy.  The Record Retention Table designates the Custodian of Record for each type of identified Record.

A type of Record not identified on the Record Retention Table must be destroyed once the administrative need is fulfilled.   Any requested exception to the Record Retention Table that is deemed to meet an administrative need must first be approved by the Office of the Provost or the appropriate Vice President.

The Record Retention Table identifies Historical Records.  Any Historical Record must be sent to the University Archives and will reside there permanently.  

If two or more categories apply to a particular type of Record, each having a different retention period, the longer period governs.  To facilitate compliance with this Policy, all Record Retention Periods expiring during a calendar year may be extended to the last day of such calendar year.  Thus, all Records expiring during a calendar year must be destroyed by the last day of that calendar year. 

2. Non-University Records

All Non-University records (i.e., any communications not listed in the Record Retention Table, informal communications) should be destroyed after the administrative need is fulfilled as determined by the Custodian of Record.  

3. Copies of University Records

Departments and Applicable Members that are not the designated Custodian of Record for an identified University record are required to only retain copies and drafts of such University records to the extent necessary to conduct University business.  Such University Departments and/or Applicable Members must destroy such copies/drafts once they are no longer needed to conduct University business unless subject to a litigation hold (see Section V.D.). The designated Custodian of Record for an identified Record should only retain originals of Inactive Records and destroy all copies and drafts.

4. Litigation Holds

University Counsel will issue a litigation hold, as required, as part of the University’s response to actual or potential litigation, subpoenas, administrative proceedings, governmental investigations or audits, or other legal proceedings (a “Legal Proceeding”). A litigation hold requires the University to retain all Records that may be relevant to the Legal Proceeding. In the event a litigation hold is necessary, the University Counsel will send a preservation notice to specific employees who may have Records containing information that is relevant to the Legal Proceeding. Employees who receive a preservation notice must maintain such Records in accordance with the terms of the notice and must not alter or delete them. 

An electronic record must be preserved in its original electronic form so that it (and all information contained within it, including metadata) can be retrieved, if necessary, later. It is not sufficient to print a hard copy of the electronic record. 

University employees must immediately notify University Counsel if they become aware that a Legal Proceeding has been initiated or have notice, should know, or reasonably can anticipate further Legal Proceedings. 

A litigation hold remains in effect until the University Counsel formally terminates the litigation hold by written notice. Unless University Counsel provides guidance to the contrary, when a litigation hold is terminated, Records previously covered by the litigation hold should be retained in accordance with the applicable Retention Period under this Policy without regard to the litigation hold. 

5. Security-Confidential Information

Many Records contain confidential information which is protected by University policies and procedures, as well as federal, state, and local laws and regulations, including but not limited to the Family Educational Rights and Privacy Act (“FERPA”), the Health Insurance Portability and Accountability Act (“HIPAA”), the Gramm-Leach-Bliley Act, and the Fair and Accurate Credit Transactions Act of 2003.  This Policy shall be implemented in a manner consistent with all such policies, procedures, laws, and regulations, as amended from time to time. 

6. Records Management Responsibilities

Records management is the responsibility of all Applicable Members of the University.

1. Responsibilities of Departmental Data Steward  
   The Data Steward of each University Department is responsible for: 
   1. Developing and maintaining practices and procedures that meet the specific requirements under this Section V and Section VI below;
   2. Ensuring Applicable Members of the Department comply with this Policy;
   3. Reporting any potential or actual non-compliance with this Policy to their respective Vice President;
   4. Alerting appropriate offices regarding needs for additional storage (e.g., IT for cloud-based storage that is approaching its limit) in a timely manner and managing, coordinating, or notifying associated budgetary processes. Certain cloud storage platforms are institutionally managed and will require escalation of discussion to the appropriate institutional team of decision makers;
   5. Designating one or more Record Management Administrators (depending on the organizational structure). If a Department is small or has fewer records management obligations, the Data Steward of the Department may consider serving as the Record Management Administrator; if a Department is large or has more or complex records management obligations, the Data Steward should consider designating more than one Record Management Administrator; and
   6. Designating an alternate Record Management Administrator in the event the current Record Management Administrator for the Department is unavailable.
       
2. Responsibilities of Record Management Administrator
   The Record Management Administrator(s) must implement the Department’s established record management practices and procedures.  Specifically, the Records Management Administrator(s) is responsible for: 
   1. Coordinating retention, preservation, and destruction of Records in accordance with this Policy and the Department’s records management practices and procedures as they pertain to this Policy;
   2. Coordinating the Department’s efforts to comply with and respond to any issued litigation holds, internal or external investigations, court orders, or other requests for Records in a timely manner;
   3. Managing the space constraints of various record storage locations. This includes auditing records to determine what data has expired, destroying Expired Records, as well as Non-University records and copies/drafts (in consultation with the Custodian of Record), and migrating files to alternate University-sanctioned storage locations; and
   4. Communicating needs for additional storage to the Data Steward, all within a timely manner to be respectful of the University resources.
       
3. Responsibilities of Applicable Members
   All Applicable Members are responsible for the Records in their possession.  Applicable Members are responsible for reviewing the content of the Records they use in conducting University business and complying with this Policy.  
   
   The IT Office is not responsible for determining whether an electronic record must be retained or destroyed in accordance with this Policy. Every Applicable Member is responsible for complying with this Policy and the record management practices and procedures established by their Department.  
   
   Failure to comply with this Policy may result in disciplinary action, up to and including termination of employment, and/or legal action.  If an Applicable Member believes another Applicable Member is violating this Policy (e.g., destroying University records required to be retained), such Applicable Member should immediately contact the Vice President in their division to report such incident. 

VI. Requirements for Department Record Management Practices and Procedures

A Department’s practices and procedures must cover all aspects of records management, including identifying, maintaining, retrieving, preserving, and destroying University records in accordance with this Policy.  Such practices must consider business needs as well as legal and security requirements.  In addition, such practices should allow for efficient access and retrieval of Records. 

1. Protective and Security of Confidential Information

Departments must implement practices that protect confidential information contained in Records in accordance with relevant laws and University policies.  Such protection must be applied in maintaining Active Records, storing Inactive Records and Historical Records, and destroying Expired Records.  Thus, the level of security that applies to an Active Record must be maintained when such a Record becomes an Inactive Record or a Historical Record.  

2. Physical Storage Practices

A Department’s storage facility practices must allow for efficient compliance and response to any litigation hold, internal or external investigation, court order, or other request for Records in a timely manner.  A Department’s storage facility practices must ensure a good faith effort to preserve all Records in their original condition while also ensuring efficient retrieval of such Records.  Departments should secure any physical on-campus storage facility to avoid unauthorized access.  In addition, such a facility and setup should protect such Records from common physical damage such as pest infestation, fire, smoke, sprinkler damage, water damage, and/or magnetic field damage.  

3. Retention Practices

Records must be retained by the Custodian of Record in the following manner: 

1. Hardcopies must be retained in hardcopy form unless converted to electronic format in a University managed system; and 
2. Electronic records stored within a University managed system must comply with the requirements under Sections VI.A and B above and other applicable University policies.  The Custodian of Record is responsible for consulting with the IT Office to ensure such compliance. 

4. Destruction of Expired Records

If the Custodian of Record believes that an Expired Record has historical value and should be permanently retained as a Historical Record, they should consult with their respective Vice President.  Otherwise, all Expired Records must be destroyed by the Custodian of Record in the following manner: 

1. Hardcopy Destruction - Expired Records in hardcopy form that do not contain confidential information should be recycled.  Expired Records in hardcopy form that do contain confidential information must be shredded in a confidential manner that renders them unreadable, and that would prevent them from being reconstructed.  Security of the Expired Records must be maintained by the Custodian of Record until proper destruction is performed.
2. Electronic Records - Emails and other electronic documents (e.g., Word and Excel documents and pdfs) should be deleted.

The Custodian of Record is responsible for consulting with the IT Office to ensure that Expired Records contained in a University-managed system are properly destroyed.  Devices or other media that store electronic records (e.g., hard drives, servers, and cloud-based locations) should be destroyed or erased in a manner consistent with media sanitization methods which include disintegration, incineration, pulverization, or melting.  The type of sanitization required will depend on the type of device and the nature of the information contained in the device. Such destruction methods require trained professionals and must be conducted by authorized personnel.  Please contact the IT Office for instructions.

This policy was reviewed and approved in March 2024 by University Council.  

¹ Moravian University includes its schools, centers, institutes, divisions, subsidiaries, and affiliates.