HHS Policy for Records Management for Emails

May 15, 2008

HHS-OCIO-2008-0002.001

Table of Contents

1. Purpose

The purpose of this Policy is to establish the principles, responsibilities, and requirements for managing Health and Human Services (HHS) records sent, received or temporarily maintained in the electronic mail (email) system.  This Department-wide policy provides the framework for specific program guidance and detailed operating procedures to be developed and implemented at the organizational unit level.

The HHS Policy for Records Management Emails is subordinate to the authority of the HHS Policy for Records Management, HHS-OCIO-2007-0004.001, dated January 30, 2008. The records management of emails is being addressed as a separate component of records management for the purposes of emphasis.  Over time, this policy shall be incorporated into the overarching HHS Records Management Policy, just as the HHS Electronic Records Management Policy (HHS-OCIO-2005-0001), dated September 15, 2005, was obsoleted when incorporated into the HHS Policy for Records Management, HHS-OCIO-2007-0004.001, dated January 30, 2008.

This is first issuance.

2. Background

Government employees/appointees and other staff working for or on behalf of the Federal Government create and maintain several types of Federal records on a variety of media as part of their official responsibilities.  In addition to Federal records, Senior Executives can create and accumulate other types of records on a variety of media types, such as documentary materials, Presidential records and personal notes and records during their appointment in the Federal Government.  All of these various types of documents can be created and/or received on a variety of media. The National Archives and Records Administration (NARA) issues guidance for Federal agencies on the management of all types of Federal records, including other types of documentary material such as emails (General Records Schedule 20-14 &15).  Because of the different possible interpretations that could be made as to when a document is considered to be a record, these guidelines have been consolidated and applied to the HHS work place under this Policy.     

3. Scope

This Policy applies to all Department Operating Divisions (OPDIVs) and Staff Divisions (STAFFDIVs), including the Office of the Secretary, and organizations conducting business for and on behalf of the Department through contractual relationships. This Policy does not supersede any other applicable law or higher level agency directive, or existing labor management agreement in effect as of the effective date of this policy. 

Agency officials shall apply this Policy to employees, contractor personnel, interns, and other non-government employees.  All organizations collecting or maintaining information or using or operating information systems on behalf of the Department are also subject to the stipulations of this Policy.  The content of and compliance with this Policy shall be incorporated into applicable contract language or memoranda of agreement under separate cover, e.g., Interim Health and Human Services Acquisition Regulations (HHSAR) Federal Information Security Management Act (FISMA) policy. 

OPDIV/STAFFDIVs shall use this policy or may create a more restrictive policy, but not one that is less restrictive, less comprehensive or less compliant with this Department Policy.

For the purposes of this policy, the term ‘record’ is used to describe official Federal records of the United States Government.

4. Policy

It is HHS Policy to preserve all official Federal records in accordance with applicable statutory and regulatory requirements, and to promote access to information by staff, partners, and the public, as appropriate.  The adequate and proper management of emails which meet the criteria of Federal records is an ongoing and active process of every office and should not be addressed only when an employee transfers (within the function; within the OPDIV/STAFFDIV; within the Department; between Departments; from Federal to State or local Governments, etc.) or when the email mailbox is full. Each office within HHS is required to establish and maintain Federal record information contained in email or records transmitted by an electronic mail system in a manner that will meet the following minimum requirements:

4.1 Manage Federal records created in or transmitted using electronic mail systems in accordance with 36 CFR part 1234.24.  This includes instant messages and PDA contents that are Federal records and non-records.

4.2  Preserve transmission data (name(s) of sender and addressee(s) and date the message was sent) for all records contained in or transmitted by an electronic mail system.

4.3  Expand records that were transmitted using an electronic mail system addressed to a distribution list (DL) whereby the actual addressees were not visible, so that all names are visible prior to filing the record in a record system.  A complete list of the addresses of the electronically transmitted record must be maintained with the record copy to ensure identification of the sender and the addressee(s) of the record.  This DL expansion is the responsibility of the sender of the record and is part of the sender’s Federal record.

4.4  Preserve electronically transmitted messages that are Federal records where an acknowledgement of receipt or an acknowledgment that an addressee opened the message was requested.  Preserve the acknowledgement with the record copy if returned. [New versions of Microsoft Outlook are set up so that the return receipt is an optional step for the receiver of the message.] Preservation of receipts is part of the “sender’s” record copy.

4.5  Email calendars and task lists that meet the definition of a Federal record will be identified and maintained as a Federal record using the appropriate retention value.

4.6  All proposed electronic record keeping systems will include provisions for capturing and maintaining email records.  If this is a contractor developed and/or operated system, the contract needs to include this requirement.

4.7  All email records must be maintained in a manner that allows each to be accessible and readable for its NARA-approved record retention period.   Since the current HHS electronic mail system (Outlook) is not an approved (approved by the HHS Records Officer) recordkeeping system, all email records, as a matter of course, must be printed and filed in a paper recordkeeping system.  Electronic mail is a service provided to transmit and deliver information but is not inherently an approved recordkeeping system. If there is an approved electronic Recordkeeping system then it does not need to be printed to paper and can be maintained in that system. All OPDIV electronic recordkeeping initiatives must come before the HHS Information Technology Investment Review Board (ITIRB) for review and approval after the HHS Records Officer reviews and approves the concept, and, if concept is approved, then it must be approved through HHS Chief Information Officer Council (CIO Council, whereby the Enterprise Architecture, Capital Planning and Investment Control (CPIC) and HHS security functions review for adherence to the Department architectural standards), on its way to the HHS ITIRB for financial review and approval

4.8 However, if a function (OPDIV/STAFFDIV, etc.) has an implemented Files Plan then, rather than printing electronic (email, etc.) Federal records, electronic Federal records may be temporarily transferred to a .pst file in accordance with that Files Plan, and then subsequently transferred to an approved electronic recordkeeping system when HHS has implemented one. See 4.10 below.

4.9  OPDIV Records Officers will determine if General Records Schedule 23, “Records Common to Most Offices Within Agencies,” Item 7, “Transitory Records,” are appropriate for their respective OPDIV email records and issue instructions appropriately.

4.10  Email containing Federal record information does not need to be printed and filed in a paper record keeping system if an enterprise-wide electronic content management system or an enterprise-wide document management system with record keeping functionality is available.

4.11  OPDIV Records Officers may approve temporary deviations to the above procedures depending on the unique requirements of the OPDIV and with concurrence of the HHS Records Officer.  All deviations shall be documented and signed by the approving OPDIV Records Officer and in concurrence with the HHS Records Officer.

4.12   Mail Box Management 

4.12.1    Email records are maintained as outlined above and emails that are not Federal records should be removed from the system as soon as they are no longer needed in electronic form, to reduce the risk of inappropriate disclosure. For example:  a calendar of work activities is commingled with personal appointments.  If personal appointments are not deleted, then that entire calendar, if requested, comes under the Freedom of Information Act (FOIA) and must be presented including those personal appointments.

4.12.2    When email is deleted system back up tapes may only be used to restore the system (inbox, sent folders, draft folders, calendar, etc.) and not restore individual emails.  Any other use of this data requires approval from NARA.  Back up tapes are held for 14 days.

4.13  Email Box When an Employee Departs (Transfers or Separates)    

4.13.1    Supervisors are to work with the departing employee to ensure that all record material, including email records, have been transferred to the appropriate custodian. This includes transfers within the function to another position; between functions; within the Department; between Federal Departments; from Federal to State and/or Local Governments; to the Private Sector; retirements; separations for any reason; etc. Email mailboxes are to be empty.

4.13.2    OPDIV Records Officers, in coordination/conjunction with the managers, are to develop appropriate departure procedures meeting their unique requirements if needed. Otherwise Attachment 1 of this Policy contains a departure process for your use.

4.13.3    In the event an employee leaves the position without notice, the employee’s supervisor in conjunction with the Records Officer, will review the mailbox, make a determination of which emails are Federal records and transfer any Federal record material to the appropriate custodian.  

5. Roles and Responsibilities

5.1 The Deputy Assistant Secretary for Information Technology/HHS Chief Information Officer

The Deputy Assistant Secretary for Information Technology (DASIT)/HHS CIO, under the authority delegated by the Assistant Secretary for Resources and Technology (ASRT), shall:

5.1.1   Ensure the Department compliance and conformance with Public Laws, NARA regulations, OMB and GAO regulations, policies, standards, procedures, and instructions concerning agency operations and reviews;

5.1.2  Ensure development of new, and update of existing, Department Resources Management (RM) Policy;

5.1.3  Disseminate the HHS RM policy for OPDIV review, comment, and,

5.1.4  Disseminate the approved HHS RM Policy.

5.2 Department (HHS OCIO) Records Officer

5.2.1   The Department (HHS OCIO) Records Officer shall provide entrance briefings to the Secretary, Deputy Secretary and Assistant Secretaries within the first 30 days of their arrival regarding the role and responsibility of those positions for Records Management;

5.2.2   Develop and present “RM new employee training” during HHS orientation  training;

5.2.3   Develop mandatory annual RM training for all HHS employees, interns, contractors, etc., and distribute for OPDIVS and STAFFDIVs to conduct their own training; and,

5.2.4   Develop RM security controls and RM standards for dissemination throughout HHS.

5.3 Operating Division Chief Information Officers

OPDIV Chief Information Officers (CIOs) must :

 5.3.1   Approve, disseminate and implement HHS RM Policy within their respective organizations;

 5.3.2   Develop and approve, when needed, OPDIV specific RM policies that are consistent with or more restrictive than the HHS (Department issued) policies but not less restrictive, less comprehensive or less compliant with the Department Policy;

5.3.3   Ensure Records Officers are adequately trained and remain current on RM policies and procedures;

5.3.4    Train all employees and non-Federal staff on RM policies (Department Policy and/or OPDIV/STAFFDIV policy), as appropriate; and

5.3.5    Implement security controls required by the RM Policy.

5.4 Operating Division (OPDIV) Records Management Officers

5.4.1   Identify and establish records management standards, when there is an OPDIV need for more restrictive policies than the HHS (Department issued) policies.  OPDIV policies shall not be any less comprehensive and shall comply with the Departmental policy ;

5.4.2   Conduct periodic annual inspections for approved certifications of record removal;

5.4.3   Evaluate and measure compliance with Federal and HHS records management Policies; and,

5.4.4   Conduct Records Management training.

5.5 Freedom of Information Act (FOIA) Official

Provide approval to provide a copy of a Federal record, if appropriate, for release to the general public.

5.6 Management Officials

Management officials, in their supervisory role, are responsible for:

 5.6.1   Ensuring employees and non-Federal staff within their purview participate in the development of and the timely review of HHS RM Policy and are aware of and adhere to HHS RM Policies;

5.6.2    Ensuring employees attend records management training;

5.6.3        Informing users (employees, contractors, interns, etc.) of their rights and responsibilities and disseminating the information in policy; and

5.6.4        Ensuring compliance with Attachment 1 of this policy when employees depart the OPDIV.

5.7 HHS Employees

Users, including employees, contractors, interns, etc., are responsible for:

5.7.1  Participating in the development of policy or initiating OPDIV specific RM policy that is not less restrictive, less comprehensive or less compliant with the Department Policy;

5.7.2  Responding in a timely manner to comments made regarding policy during the formal HHS-OCIO Policy Three Level Review Process;

5.7.3  Adhering to the HHS Records Management Policies;

5.7.4  Notifying the RMO of records issues and working collaboratively to address these issues with the Records Officer;

5.7.5  Seeking guidance from their supervisors or RMO when in doubt about the implementation of a specific RM policy;

5.7.6  Familiarizing themselves with any special requirements for accessing, protecting and utilizing data, including Privacy Act and Section 508 requirements, copyright requirements, and  procurement sensitive data;

5.7.7  Attending RM training; and,

5.7.8  Adhering to all conditions set forth in Chapter 4, Policy.

6. Applicable Laws/Guidance

Authorities include:

a.  44 U.S.C 22  Presidential records.

b.   44 U.S.C. 29  Records Management by the Archivist of the United States and by the Administrator of General Services.

c.   44 U.S.C.31 Records Management by Federal Agencies.

44 U.S.C. 3301 Definition of Records

General Records Schedule (GRS) 20, Item 14 - Electronic Records

d.   GRS 24, Item 12 - Information Technology Operations and Management Records

e.    General Records Schedule 23, Item 15, Records Common to Most Offices Within Agencies, Item 7, Transitory Records.

7. Information and Assistance

Direct questions, comments, suggestions or requests for further information to the HHS Records Officer at (202) 205-8548.

8. Effective Date and Implementation

The effective date of this policy is the date the policy is approved.

These policies and procedures will not be implemented in any recognized bargaining unit until the union has been provided notice of the proposed changes and given an opportunity to fully exercise its representational rights.

The HHS policies contained in this issuance shall be exercised in accordance with Public Law 93-638, the Indian Self-Determination and Education Assistance Act, as amended, and the Secretary's policy statement dated August 7, 1997, as amended, titled "Department Policy on Consultation with American Indian/Alaska Native Tribes and Indian Organizations."  It is HHS' policy to consult with Indian people to the greatest practicable extent and to the extent permitted by law before taking actions that affect these governments and people; to assess the impact of the Department's plans, projects, programs and activities on tribal and other available resources; and to remove any procedural impediments to working directly with tribal governments or Indian people.

9. Approved

______________/s/________________                      __________May 15, 2008___________

        Michael W. Carleton                                                                 DATE

        HHS Chief Information Officer

 Attachment 1 - Employee Departure Process  (Transfers; Separations of all types)

 Steps that will help you meet your record keeping requirements.

1. Sort–

   1. Record material.
   2. Non-record material.
   3. Personal material

      As you sort the material:

    Purge –

Destroy extra copies.

Destroy reference material that only you would need.

NOTE:  Your email mailbox may be of special concern. If you do not have a Files Plan, then all Federal records in your email mailbox must be printed to paper and filed in paper files according to an approved Schedule.  If you do have a Files Plan, but your email mailbox is not organized to match your Files Plan, the following is suggested:

Create .pst folder named to match the Files Plan to hold all emails that are a Federal “record”. To ensure Federal records are not destroyed prematurely, each .pst folder must be named to match the office Files Plan as well as provide the disposal date (e.g., --FY 2005, DESTROY: 10/2011)

2. Turn over –   All Federal record material to the proper custodian.

3. Seek permission – You are likely to have extra copies of records kept for convenience of reference in your office or workstation. You may take these with you when you leave if you have the approval from your Records Officer, FOIA Officer, or legal counsel.
4. Follow Guidance established by your organizational unit for the transfer of records residing in electronic format (email, local drives, etc). 

Federal Record = Records include all media, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the Government or because of the informational value of the data in them (44 U.S.C. 3301).

Most records are in the form of a document, although records in other forms are possible, such as photographs, videos, maps, voice mail, etc. 

The Federal record copy you leave provides the evidence and history of the work you performed.  It must be organized in a meaningful manner and in most cases transferred to the National Archives.  In the event the record copy does not exist or is not properly categorized for retrieval then questions can arise regarding your performance.  Don’t give anyone the opportunity to question your service to the Health and Human Services mission. 

 Glossary

Adequate Documentation - Regardless of media, official records shall be:

a.  Accessible. The content or substance of the record, including the content or substance of the transaction, the processing of the transaction, the identities of the parties and specific individuals involved, and the intent of the parties, shall be accessible for the life of the record, despite changes to hardware, software, or business procedures.

b.  Legally Sufficient. When a transaction must contain a signature in writing in order to be legally enforceable, due care will be taken to ensure that documentation provides a record that is not subject to imperfect memory or competing claims as to what parties to the transactions intended.

c.  Reliable. Records in any media must be sufficiently reliable and persuasive to satisfy courts and others who must determine the facts underlying agency actions; and

d.  Legally Compliant. The methods used to obtain, send, disclose and store information must comply with applicable laws, such as those governing privacy, confidentiality, recordkeeping, and accessibility to persons with disabilities.

e.  Readable.  All records must be readable or useable for their established retention period outlined in approved records control schedules.

f.   Trustworthiness.  All official records systems and document conversion processes must incorporate measures and security to prevent the unauthorized or undocumented alteration or tampering with documents.

 Control and Custody of Records - HHS records/materials are the property of the Federal government, not the property of individual employees or contractors acting as an agent for the Government, and may not be removed from the Department without proper authority. All employees/contractors shall maintain records and non-record documentary materials separately from one another: different file folders, email folders, etc. Co-mingling of Federal record and non-record materials means FOIA requests can and will be afforded both.

Disposal – The action taken regarding temporary records after their retention periods expire and consisting usually of destruction or occasionally of donation.  Also, when specified, “disposal” refers to the actions taken regarding non-record materials when no longer needed, especially their destruction. (See NARA, “A Federal Records Management Glossary.”)

Electronic Mail (Email) system -The email system is a data transmission system and not an appropriate location to maintain Federal Records.  If the email message is a record, it must be saved with the name(s) of the sender(s) and recipient(s), date and time the message was sent or received as part of the record. Receipt confirmations are kept as part of the “sender’s” record.   The following will help in managing your mail box.

•  The email system is not a record keeping system.  The Federal record copy must be transferred to an approved (approved by the HHS Records Officer) record keeping system. Therefore, without an approved record keeping system, Federal records shall be printed and maintained in a paper file unless you have a Files Plan.  Then, your email Federal records may be sent to a .pst file(s) that is organized and labeled with the appropriate File Plan designation and held in that .pst until an approved record keeping system is operational upon which time the .pst can be transferred to that approved record keeping system.

•  When you leave, your access to the email account will be closed.  All emails residing in the mailbox will eventually be deleted.  Emails under the control of HHS are subject to the discovery process

File - A collection of related documents or papers arranged so that they can be consulted easily.

Files Plan - A listing of all files in a container (regardless of the media), office or organization.

Information System – Is defined by the Office of Management and Budget (OMB) in Circular No. A-130   “….the organized collection, processing, transmission and dissemination of information in accordance with defined procedures, whether automated or manual.”

Mandatory Records Schedules - All records of the HHS shall be listed and described in an approved records schedule and shall be disposed of only as authorized by that schedule. Schedules shall be reviewed annually. Agencies shall update their records schedules when there are program changes that will result in the establishment of new types of records, the transfer or termination of records no longer required, or an increase or decrease in the retention time of the records, to ensure the schedules accurately reflect current records and the functions they document (36 CFR 1228.50(d)).

Whenever possible, HHS should apply the NARA generated General Records Schedules (GRS) for routine administrative records.  As required by regulation, HHS must ask NARA for a variance when not following the retention periods outlined by these schedules (36 CFR 1228.40(c)). 

Non-record Materials – are those Federally-owned informational materials that do not meet the statutory definition of records (44 U.S.C. 3301), or that have been excluded from coverage by the definition.  Excluded materials are extra copies of documents kept only for reference, stocks of publications and processed documents, and library or museum materials intended solely for reference or exhibit. (36 CFR 1220.14)

Office of the Secretary (OS) – includes the STAFFDIVS and Offices of the Regions.

OMB Exhibit 300- Capital Asset Plan and Business Case Summary – As prescribed and described in OMB’s Circular A-11, Preparation, Submission and Execution of the Budget.

OMB Circular A-130-Management of Federal Information Resources – Establishes policy for the management of Federal information resources. OMB includes procedural and analytic guidelines for implementing specific aspects of these policies. The policies in this Circular apply to the information activities of all agencies of the executive branch of the Federal government.

Operating Division (OPDIV) – An entity of Health and Human Services (HHS) that is an independent Agency.

Organization of Records - Records shall be maintained so that they are easily retrievable. Record systems shall be designed to furnish information necessary to protect the legal and financial rights of the Government and of persons directly affected by the Government's actions.

OS Operating Division (OPDIV) – Includes the Inspector General, as well as the Office of the Secretary and its STAFFDIVs as a combined, single entity. 

identifying number or code, telephone number, email address, etc.), or (2) by which an agency intends to identify specific individuals in conjunction with other data elements, i.e., indirect identification. (These data elements may include a combination of gender, race, birth date, geographic indicator, and other descriptors.)

 Personal Records (36 CFR 1222.37)  - All employee records shall clearly be designated as ‘personal,’ and be maintained separately from other records of the office.  Personal records are those papers of a private or non-official nature that pertain to personal affairs. Materials labeled “personal,” “confidential,” or “private,” or similarly designated, and used in the transaction of public business, are Federal records subject to the provisions of pertinent laws and regulations. The use of a label such as “personal” is not sufficient to determine the status of documentary materials in a Federal office.

Personal papers are excluded from the definition of Federal records and are not owned by the Government. Personal papers shall be clearly designated as such and shall at all times be maintained separately from the records of the office. If information about both private matters and Department business appear in the same document, the document shall be copied at the time of receipt, with the personal information deleted, and treated as a Federal record. Examples of personal papers include:

a. Materials accumulated by an official before joining Government service that are not used subsequently in the transaction of Government business;

b.  Materials relating solely to an individual's private affairs, such as outside business pursuits, professional affiliations, or private political associations that do not relate to agency business; and

c. Diaries, journals, personal correspondence, or other personal notes that are not prepared or used for, or circulated or communicated in the course of, transacting Government business.

However, if this separation of Federal record material from personal papers is not made, then the entire document is a Federal record and shall be treated as such and in accordance with the rules and regulations of Federal records for instances such as a Freedom of Information Act (FOIA) request or legal/judiciary (Office of General Council; Department of Justice, etc.) requests.

Records – includes all books, papers, maps, photographs, machine readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business, and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decision, procedures, operations or other activities of the Government, or because of the information value of the data in them. (44 U.S.C. 3301).

Records Disposition – is any activity with respect to:

-   disposal of temporary records no longer needed for the conduct of business by destruction or donation to an eligible person or organization outside of Federal custody;

-   transfer of records to Federal agency storage facilities or records centers;

-    transfer to the National Archives of the United States of records determined to have sufficient historical or other value to warrant continued preservation; or

-   transfer of records from one Federal agency to any other Federal agency. (44 U.S.C. 2901 [5]).

Records Management – the planning, controlling, directing, organizing, training, promoting, and other managerial activities involved with respect to records creation, records maintenance and use, and records disposition in order to achieve adequate and proper documentation of the policies and transactions of the Federal Government and effective and economical management of agency operations. (44 U.S.C. 2901 [2].

Records Schedule – means:

-  an SF 115, “Request for Records Disposition Authority,” that has been approved by NARA to authorize the disposition of Federal records;

-  a General Records Schedule (GRS) issued by NARA; or

-   a printed agency manual or directive containing the records descriptions and disposition instructions approved by NARA on one or more SF 115s or issued by NARA in the GRS. (36 CFR 1220.14).

Records series – file units or documents arranged according to a filing system or kept together because they relate to a particular subject or function, result from the same activity, document a specific kind of transaction, take a particular physical form, or have some other relationship arising out of their creation, receipt, or use, such as restrictions on access and use. (NARA, “A Federal Records Management Glossary”).

Reference Material - shall be clearly marked and maintained separately from the records of the office.

Reviewing Official – either the employee’s manager of record; a Records Officer; or, a Freedom of Information Act (FOIA) Officer.

Scheduling – the process of developing schedules for the disposition of records, along with disposition instructions for non-record materials. (NARA, “A Federal Records Management Glossary”).

Sensitive Data – Sensitive data are data that require protection due to the risk and magnitude of loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data.  The term includes data whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary data, records about individuals requiring protection under the Privacy Act, and data not releasable under the Freedom of Information Act.

Vital Records - Mission area, OPDIV/STAFFDIV and offices shall maintain a program for the selection, protection, and reporting of vital records, in accordance with the provisions of 36 CFR 1236.  There are two types of vital records:

a.  Emergency Operating Records - Documents needed immediately, such as orders of succession.

b.  Legal and Financial Rights Records - Documents essential to protect the legal and financial rights of the Government and of the individuals directly affected by its activities, such as social security records.

While your emergency operation records, should be identified managed in the Continuity of Operations Plan (COOP), Records Officers need to work with the COOP coordinators to be sure all of the records are protected.  The location and access rights for the legal and financial rights records are to be included in the COOP.