UNIVERSITY REGULATION
PART V – FINANCE AND BUSINESS MANAGEMENT
Chapter 05.08 - Business Practices

R05.08.022 Records and Information Retention and Disposition

1. Purpose:
   
   This regulation is to guide the Major Administrative Units (MAU) and campuses in the management of university records to ensure compliance with legal requirements, Board of Regents’ Policy, and best business practices for safeguarding records. This regulation also seeks to make university records properly accessible, efficient, and economical by facilitating the identification of records and information retained and destroying dispensable records. 
2. Authority:
   
   Per Board of Regents’ Policy 05.08.022: Records and Information Retention and Disposition, the president charges the chief records officer and the Records and Information Management Office with the responsibility to oversee university compliance with state and federal laws and regulations relating to the preservation and destruction of records and information regardless of media. 
3. Scope of Authority:
   
   The president of the University of Alaska designates the chancellors as record agents for their respective MAUs. All of the aforementioned offices are permitted to further delegate, as they deem appropriate and necessary, authority for the retention and disposition of records to persons they designate. MAU record agents will comply with Board of Regents’ Policy and University Records Programs and coordinate their efforts with the chief records officer. The chief records officer will review and approve all university records retention and disposition schedules. 
4. Maintain a Records and Information Management Program:
   
   The president of the University of Alaska tasks the chief records officer to develop and maintain a Records and Information Management Program that provides effective management of university information and ensures the availability of records from creation to final disposition. The Records and Information Management Program will develop records retention and disposition schedules that provide a timetable with consistent procedures for maintaining information on all campuses in all media, moving the records to inactive storage or archiving when appropriate, and systematically disposing of the records when they are no longer valuable to the organization. Chancellors or their designees will retain and dispose of all records and documents in accordance with university regulations and programs.
5. Legal Authority:
   
   The Records and Information Management Program is the legal authority, designated by the Board of Regents and the president of the University of Alaska, to determine how long records and information must be retained. The Records and Information Management Office is responsible for developing records retention and disposition/destruction schedules that identify records created or received by the university. It is responsible for establishing standards relating to university business requirements and needs to ensure the legal legitimacy of university record and information management-keeping systems. The program counsels and advises the university administration on the implementation of policy and procedure to promote adherence to these standards that minimize risks. It provides a wide range of services designed to ensure the university is meeting its record-keeping responsibilities. Furthermore, the records and information management program will address the following areas:
   1. Develop a strategic records and information management program that ensures compliance with federal and state law, board of regents’ policy and procedure, and financial accountabilities. 
   2. Lead in the creation, implementation, and enforcement of risk-based universitywide records policies applicable to all locations including those for storage and retrieval of active, inactive, and permanent records while promoting appropriate accountability and transparency. 
   3. Lead in the identification of vital records and the creation, implementation, and enforcement of a disaster recovery, business continuity, and vital records protection plan. 
   4. Analyze and evaluate records and information management throughout the university and recommend cost effective improvement strategies to promote and foster systematic and efficient records and information management initiatives. 
   5. Provide guidance to administer inventory audits of physical and electronic records that ensure compliance with standards and policies. 
   6. Identify when records and information are due for destruction and develop systematic procedures to carry out this destruction in accordance with university policy and state laws. 
   7. In conjunction with the general counsel, develop litigation-hold procedures that prevent the destruction of records after the initiation of a legal hold. 
   8. Provide guidance for the management of onsite/offsite records and media storage. 
   9. Provide guidance for creation and maintenance of databases for the control and retrieval of records and information. 
   10. Provide guidance for data classification standards for electronically stored information. 
   11. Provide guidance for safeguards and controls for electronically stored information. 
   12. Develop and conduct instructional programs to train management and employees in sound records and information management practices. 
   13. Provide guidance for records center operations, microfilming storage operations, and a digital document infrastructure.
   14. Provide guidance for establishing working relationships with business partners to ensure compliance with the Records and Information Management Program; thus, identify areas for enhancement. 
   15. Maintain an active program for the economical and efficient management of university records and information, in various formats. 
   16. Promote the use of progressive and innovative technologies to create and manage records. 
   17. Preserve the history and the evidence of the university for scholarly research and public good. Balance historical value with cost, practicality, clutter and other consideration.

(04-21-10)

R05.08.023. Records Management: Security Breach Involving Personal Information

To the extent required by applicable law, the University of Alaska will notify any individual whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person as the result of a security breach. However, notice will not be required if a reasonable investigation determines that there is no reasonable likelihood of harm, in which case the university will comply with AS 45.48.010(c), including notice to the Attorney General.

For purposes of this regulation, “personal information” means information in any form on an individual that is not encrypted or redacted, or is encrypted and the encryption key has been accessed or acquired, and that consists of a combination of the individual’s name or initial and last name, and one or more of the following:

• social security number; 
• driver's license number or state identification card number;
• the individual's account number, credit card account number, or debit card account number in combination with any required security code, access code, or password that would permit access to an individual’s financial account; 
• passwords, PINs, or access codes for financial accounts.

The following factors, among others, will be considered in making a reasonable belief of acquisition determination:

• Indications that the personal information is in the physical possession and control of an unauthorized person, such as a lost or stolen computer or other device containing unencrypted notice-triggering information. 
• Indications that the personal information has been downloaded or copied; 
• Indications that download or copy activity consistent with download or copying of personal information has occurred, even if there is no specific evidence that there was a download or copy of personal information; 
• Indications that the personal information was used by an unauthorized person, such as fraudulent accounts opened or instances of identity theft reported; • Duration the personal information was exposed;
• The extent to which the compromise indicates a directed attack to acquire personal information, such as a pattern showing a machine containing personal data was specifically targeted.

Acquisition determinations will be made in accordance with delegated authority and this regulation: in the case of electronic records, by the applicable MAU Director of Information Resources, in concurrence with the chief information technology officer and general counsel; in the case of paper records, by the applicable MAU vice chancellor for administration, in concurrence with the system vice president for administration and general counsel.

Notice may be by individual mail or delivery, electronic mail, internet posting, notice to the media, or some combination thereof. In choosing the method of notice, cost and effectiveness shall be considered in accordance with AS 45.48.030.

Unless an appropriate law enforcement agency determines that disclosing the breach will interfere with an ongoing criminal investigation, notice shall be given without unreasonable delay, except as necessary to determine that personal information was, or is reasonably believed to have been, acquired by an unauthorized person, the scope of the breach and the method of notice, and to restore the reasonable integrity of the information system.

This regulation is intended to provide internal guidance with respect to applicable law, including AS 45.48, and is not intended to create an independent basis for liability.

(03-19-10)

R05.08.040. Use of Electronic Signatures.

The University of Alaska may conduct business through the use of electronic signatures in all transactions or processes except the following:

1. Any transaction or process that requires a notarized signature. 
2. Any transaction or process that is not legal to conduct electronically.

The chief records officer and chief information technology officer are responsible for developing Administrative Guidelines for the use of Electronic Signatures at the University of Alaska. The Administrative Guidelines for the use of Electronic Signatures can be found as part of the Accounting and Administrative Manual on the controller’s website.

Reference: Alaska Statutes Title 9. Chapter 80 Uniform Electronic Transactions Act and The Uniform Electronic Transactions ACT (UETA)

(03-19-15)