Legal standards for records and information management programs

NOTICE: This article contains information related to sensitive and important legal issues. No section of this article should be construed as providing legal advice. All legal decisions related to records and information management should be reviewed by competent legal counsel.

Organizations develop records and information management programs to create, maintain, and dispose of records quickly and efficiently. These programs must also comply with a myriad of federal and state statutes, regulations, and rules of evidence, or the organization could be subject to fines, penalties, loss of rights, adverse consequences in litigation, and other legal problems.

In order to ensure compliance, records and information managers or their legal departments must research, analyze and apply these laws to the design and operation of the program. With tens of thousands of laws to consider, this can be an extremely difficult process.

UNIFORM LAWS

In response to the legal need for consistency for business records, the National Conference of Commissioners on Uniform State Laws has prepared and promoted uniform laws related to evidence and business conduct. To date, the following four uniform laws have gained significant acceptance in the United States:

*The Uniform Rules of Evidence

*The Uniform Photographic

*Copies of Business and Public Records As Evidence Act

*The Uniform Preservation of Private Business Records Act

*The Uniform Business Records Act

Once the Conference approves a uniform law, the law must be accepted by a jurisdiction before it becomes binding. Because each jurisdiction may accept, reject, or accept the uniform law with modification, the goal of uniformity is rarely achieved.

This process, however, has provided significant advantages to date:

*Rules of evidence related to admissibility of original and duplicate records are now fairly consistent between the state and federal courts.

*Reproduction of records and destruction of originals is now viewed as a standard business practice and accepted in most jurisdictions, unless the law specifically requires maintenance of the original.

These uniform laws have primarily resulted in consistency in the area of duplicate records. The uniform laws, however, have not addressed system requirements for the legal acceptance of original records produced by sophisticated computer technology or new information technology system that will be developed in the future.

Even phrases in the Uniform Rules of Evidence and the Uniform Photographic Copies of Business ad Public Records As Evidence Act that permit duplicate records to be produced by any technology that accurately reproduces the original, have created problems. Many lawyers fail to be convinced that technologies such as electronic imaging are included, unless they are specifically enumerated.

THE CANADIAN APPROACH

Instead of uniform laws, Canada has developed a unique and effective approach to the standardization of records and information management systems for purposes of evidence. Canadian rules of evidence specify that reproductions of records may be admitted in place of the original records (even if the original records have been destroyed) if certain procedural safeguards have been met. In particular, the Evidence Acts recognize that reproductions produced under "national standards" improve the accuracy of the reproductions, justifying the destruction of the original records in the "usual and ordinary course of business." The national standards create a quasi-legal standard against which the courts will determine the accuracy of the reproductions and whether they will be admitted into evidence.

In 1993, the Canadian General Standards Board issued a revised National Standard of Canada entitled Microfilm and Electronic Images As Documentary Evidence (CAN/CGSB-72.11-93). This document specifies the standards for producing microfilm and electronic images for admissibility in evidence and the appropriate procedures for the destruction of original records. The document provides extensive detail and recommendations for making an accurate reproduction using either technology.

AIIM PERFORMANCE GUIDELINE

The Association for Information and Image Management (AIIM) mobilized a Task Force from 1991 to 1994 to examine the performance requirements of a records and information management system to ensure the admissibility of records in evidence or the acceptability of records by regulatory agencies. This Task Force produced the Performance Guideline for the Legal Acceptance of Records Produced By Information Technology Systems. The guideline contains four parts.

*Part I deals exclusively with the admissibility of records in evidence.

*Part II addresses legal acceptance of records by government agencies.

*Part III provides implementation guidelines.

*Part IV provides a new proposed uniform law and model rule for implementation by government.

The Task Force consisted of lawyers, managers, vendors, system users, consultants and other interested parties from both government and the private sector. As the first step, they reviewed existing legal requirements for both evidence and regulation. They also examined available information related to legal requirements for records and information management systems.

The performance guideline will initially be published as an AIIM "technical report." After extensive review and analysis, it is hoped that they will be adopted as national standards in the United States. In addition, the project resulted in proposed uniform laws and model rules that, if adopted by the states or federal government, could become legal requirements.

The performance guideline responds to the multitude of legal requirements facing both the public and private sector. It also responds to a problem raised by even the uniform laws regarding technologies that did not exist at the time the uniform laws were adopted. Even though most uniform laws incorporate "any technology," they do not specify technologies such as electronic imaging or specify appropriate technologies that may be used for original records.

The applicability of the performance guideline is stated in Part I as follows:

3.4 APPLICABILITY.

The guideline applies to records produced by information technology systems regardless of the physical characteristics of the record media or technology employed. This includes records produced by any technique employing an information technology system as defined above.

For purposes of this performance guideline, a new set of definitions was developed for such common terms as "record," "original record," "duplicate record," and "information technology system":

3.3 DEFINITIONS

The following definitions apply to the process or system assessment criteria set forth below:

3.3.1 RECORD: Information preserved by any technique in any medium, now known, or later developed, that can be recognized by ordinary human sensory capabilities either directly or with the aid of technology.

3.3.2 ORIGINAL RECORD: A record prepared in the first instance or any counterpart intended to have the same effect by a person executing or issuing it. If data are stored in a computer or similar device, any printout or other output readable by sight shown to reflect the data accurately is an "original."

3.3.3 DUPLICATE RECORD: A record that is produced by the same impression as the original, or from the same matrix, or by any other technique that accurately reproduces the original.

3.3.4 INFORMATION TECHNOLOGY SYSTEM: Any process or system that employs a mechanical, photo-optical, magnetic, electronic or other technological device for producing or reproducing records.

The performance guideline specifies factors for assessing the legal acceptance of records produced by any technology system. The quality of the records "relates to the ability of the information technology system to reliably produce and preserve records so that they may be used or recognized by the intended audience" (3.5.1). Original records, for example, may "preserve information over time in the identical or functionally equivalent form to the original information" (3.5.1.2). Duplicate records, on the other hand, must accurately reproduce the originals to the extent that "information that is readable and recognizable on the originals should be readable and recognizable on the duplicates" (3.5.1.3).

In order to produce accurate records, the guidelines provide specific recommendations related to the characteristics and components of the system (3.5.4.1). In order to meet legal requirements, the records must be produced as part of a regularly conducted business activity, by methods to ensure or enhance their accuracy, within a reasonably short time of the event.

The process or system used to produce the records will be critical for controlling the preparation of the records (3.5.4.2). Three key components need to be included to successfully withstand challenges to the trustworthiness of the records and information management program as a whole:

*Procedures: Procedures specify the methods for creating, modifying, duplicating, destroying or otherwise managing the records in a consistent and defensible manner.

*Training: Formal training of staff related to system operation and procedures raises a strong presumption that the staff knew what they needed to do and did in fact correctly follow procedures.

*Audit: Audit confirms that the process or system produces accurate results by comparing the procedures with the actual results. Audit trails specifically confirm what procedures were followed and can identify unauthorized or suspicious activity.

Documentation of the procedures, training and audit must also be kept to verify details about the process or system used to produce the records.

The performance guideline addresses a variety of other issues that have been raised regarding the legal status of records:

*Records must be maintained for the period required by the organization's records retention program, regardless of the life expectation of the media or technology used. For example, media with a short life expectancy can be used for maintaining long-term records, provided that a method is developed for recopying or reconstituting the media so that the records will exist for the requisite period.

*Regardless of the technology used, records must be submitted to courts and regulatory agencies in a form acceptable by those groups. At the current time, any organization should expect to convert its records to paper form or to another form accepted by those groups. Some government agencies, for example, require data to be submitted on magnetic tape.

*The records and information management program must be available for review by outside parties, including court and government representatives, to confirm the accuracy of the records.

*"Image enhancement" does not affect the legal status of records provided that the techniques do not change the information content of the records.

If the requirements of the performance guideline have been met, the records should be admissible in evidence and acceptable by regulatory agencies. However, until the guidelines or other proposed uniform laws become law, you should still review prevailing state and federal law to determine whether any provision exists that is contrary to the guidelines. In most cases, however, adherence to the performance guideline will result in compliance with state and federal laws related to records and information management.

FUTURE DEVELOPMENTS

The State of New Mexico has already adopted a version of the performance guideline for state government records. This action converts the status of the performance guideline to a legally enforceable obligation to those state government agencies affected.

The AIIM Task Force has also developed a proposed uniform law and model rule that reflects the philosophy found in the performance guideline. Once adopted by a jurisdiction, the uniform law or rule would also have the effect of law. (The proposed uniform law and model rule will be the subject of a future article.)

Until the performance guideline has been enacted as part of a statute, regulation or rule, it does not have the status of law. However, since the provisions reflect prevailing law in the United States, adherence to the performance guideline should enable an organization to comply with most state and federal laws.

Copyright Association of Records Managers Administrators Inc. Jul 1994
Provided by ProQuest Information and Learning Company. All rights Reserved