Blog

The Indiana Oversight Committee for Public Records (OCPR) has taken the first step in establishing a state-wide framework for electronic records management programs by recently adopting an Electronic Records Policy. It is important for government entities and their information technology providers to review the policy and determine whether their management of electronic records complies with the policy.

Purpose of the policy

The policy applies to all electronic records of governmental entities including email, text documents, spreadsheets, databases, websites, images, video, audio/multimedia, interactive documents, and scanned/digitized documents. The policy also rescinds and replaces the existing Email Records Policy adopted in 2005. Its stated purpose is to “ensure that governmental entities create and maintain trustworthy electronic records that demonstrate authenticity, reliability, integrity, and useability.”

Policy summary

In accordance with its stated purpose, the policy focuses on the following:

• Each governmental entity will be responsible for developing and implementing its own internal guidelines and procedures to control the creation, receipt, transmission maintenance and disposition of records and all record creators and users should receive related training appropriate to their role.
• Electronic records should be associated with metadata (e.g., title, date created/received/modified, creator/editor, reference number, record series, access/use restrictions, subject, relationship to other records)
• Electronic records should be protected against unintentional or unauthorized access, modification or deletion.
• Electronic records should be protected against corruption or loss due to technical failure or to disaster.
• Electronic records should be retained and disposed of in accordance with the retention schedule that covers the records’ informational content, as approved by the Indiana Oversight Committee on Public Records.
• Electronic records should remain accessible and readable for the duration of their retention period, in compliance with State Board of Accounts audits and legal holds.

It is important to note that government entities are responsible for ensuring files are not tampered with and do not degrade over time.  There must also be an ability to migrate files over time, even if they are in a proprietary format.  The policy also makes it clear that employees should not have any expectation of privacy for any items that are public records.

Local control of document retention

Each Indiana governmental entity should also be aware that it is responsible for protecting confidential and sensitive information in electronic communications. The OCPR has sought to clarify through the draft policy that while the Indiana Office of Technology (IOT) performs electronic record backups on government issued computers for state agencies, it is still the responsibility of the individuals and agencies to retain the electronic records in accordance with applicable laws, policies and retention schedules, as IOT does not permanently store the backed up data and certain electronic records such as e-mails can be deleted before they are backed up by IOT. 

Compliance

The State Board of Accounts and Indiana Commission on Public Records will have the authority to review governmental entities for compliance with the policies. The OCPR is planning to roll out a training program in the next calendar year to train all state employees to help them understand the rules and their obligations. The policy will also be sent to all agency heads in state government to raise awareness of the obligations of each agency concerning electronic records.  It is not known at this time whether the OCPR will offer training for local government employees.

An opportunity to influence policy

The OCPR chose to use a policy at this time, instead of an administrative rule, so that it can assess its impact on government entities and change the policy as needed until such time that the OCPR feels comfortable adopting a rule. A copy of the policy can be found on the website of the Indiana Commission on Public Records (ICPR) at http://www.in.gov/icpr/3103.htm.

If you have questions about whether your electronic records management program complies with the new policy, please feel free to contact us, as we have been closely following the development of the policy and have attended meetings of the Oversight Committee on Public Records in which the policy was discussed.