Physical Records Storage

Physical Records Storage

Physical records storage at UVA must adhere to the University's Physical Records Storage Standards. The standards are divided by location type and sensitivity level of the records and include storage requirements for each combination.  

Physical Records Storage Standards

Background

These standards outline requirements for handling and protecting all the University records in physical format, whether the records contain highly sensitive, sensitive, internal use, or public information (not sensitive) information, and regardless of whether the records are the official, reference or convenience copy or where the records are stored (in-office, on-site, or off-site). The University has developed these standards as part of its Records Management Policy. Moreover, following these standards is consistent with steps you are already taking to comply with the Data Protection of University Information policy, and University Data Protection Standards.

Definitions
General Definitions
Physical Records: Includes records in paper or other analog formats, such as audio tape or video tape. Does not include items that are stored in a digital format on a computer, server or some form of digital media. University Record: Recorded information that documents a transaction or activity by or with any appointed board member, officer, or employee of the University. Regardless of physical form or characteristics, the recorded information is a University record if it is produced, collected, received, or retained in pursuance of law or in connection with the transaction of University business. The medium upon which such information is recorded has no bearing on the determination of whether the record is a University record. University records include but are not limited to: personnel records, student records, research records, financial records and administrative records. Record formats/media include but are not limited to: email, electronic databases, electronic files, paper, audio, video and images (photographs). Records Inventory: A listing of all records in storage by box, file drawer, or file (as needed). The list should include record series name, description, file listing if in box or drawer, date range, and required retention and/or destruction date. For agency 207 and related foundations, it is strongly recommended that inventories be maintained via the University Records Management Application (URMA).

 

Storage Locations
In-Office Storage: An office location in a University building where an employee has an active workspace that is used at minimum weekly. On-Site Storage: A location within a University building where the department has active work areas and staff in the same location, but not in the same room. This may include closets, basements, file rooms or conference spaces. Off-Site Storage: An off-grounds warehouse or vendor provided storage space or service.
Storage Container
Open Shelving: Shelving used for in-office storage of records for easy access and without the use of another container – such as a records storage box. Records are either stored in binders or organized in folders on the open shelving. (Does not include shelving for standard records storage boxes). Standard Storage Box: A cubic food box that has measurements of 12” wide x 15” length x 10“ high; made from corrugated cardboard, with a removable lid that has at minimum a 2” coverage of the box; with punch handles on the short sides of the box. Standard boxes are available from The Supply Room Companies via the UVA Marketplace.
  • Internal Use Information: Information that is a public record available to anyone in accordance with the Virginia Freedom of Information Act (FOIA) but is also not intentionally made public.
  • Public Information: Information intentionally made public and is therefore classified as not sensitive.
Records Sensitivity: As Defined in the Data Protection of University Information policy
Highly Sensitive Information: Information that require restrictions on access under the law or that may be protected from release in accordance with applicable law or regulation. Highly Sensitive data (HSD) currently include personal information that can lead to identity theft. HSD also includes health information that reveals an individual’s health condition and/or medical history. Sensitive Information: Information containing data that is not explicitly defined as highly sensitive information or is not intended to be made publicly available.

 

Using the Standards

The Physical Records Storage Standards are divided three categories (in-office, on-site or off-site) and then into three sensitivity levels. To determine which standard applies in each instance:

Determine whether the records will be stored in-office, on-site, or off-site. Determine the sensitivity of the records: highly sensitive, sensitive/internal use, or public information (not sensitive). To assist with identification of sensitivity, please review the records retention and disposition schedule for the sensitivity/confidentiality field of the related records series. If a storage area contains records with different sensitivities, the standard for the highest level of sensitivity should be followed for the entire storage area.

For Assistance or Additional Information

If you have questions regarding this standard or if you storage location meets these standards, please contact the University Records & Information Management Office at [email protected].

      Storage Standards by Location and Records Sensitivity Level

      In-Office Storage Locations

      Category

      		 Highly Sensitive Records Sensitive/Internal Use Records Public Information (Not Sensitive) 
      Storage Containers Standard storage box on shelf or riser at least 3 inches above ground level, with no more than three boxes in one stack.
      File cabinet with 2-4 inch rise at bottom with functional lock.
        Open shelving that supports organization and access to records (example: records in binders)
      Protection Two levels of protection – ex. locked file cabinet plus locked door or person sitting in the same room controlling access.  File cabinets need to be locked at all times (not left open during work day).  If person leaves location, locking of all access doors to rooms required. One level of protection – ex.  locked file cabinet, locked door, or person sitting in the same room controlling access.  File cabinets can be opened during office hours as long as person controlling access is in the room or the room is locked. No explicit protection required for publicly accessible information.
      Inventory A complete inventory of all records is required and should be updated on a regular basis – at least once a year.
      Environment Normal HVAC conditions for an office space.  Boxes and file cabinets should be located away from direct contact to HVAC vents, radiators, and portable heaters.  Area should be free from pests (insects and rodents).  Structure should be able to support the weight of records.  No overhead piping or close contact to drains, sinks or other water access areas.
      On-Site Storage Locations

      Category

      		 Highly Sensitive Records Sensitive/Internal Use Records Public Information (Not Sensitive) 
      Storage Containers Standard storage box on shelf or riser at least 3 inches above ground level, with no more than three boxes in one stack.
      File cabinet with 2-4 inch rise at bottom with functional lock.
      Protection Two levels of protection – ex. locked file cabinet and locked door.  File cabinet and door need to be locked at all times (not left open during work day).  One level of protection – ex. locked file cabinet, or locked door.  File cabinets can be opened during office hours as long as room is locked. No explicit protection required for publicly accessible information.
      Inventory A complete inventory of all records is required and should be updated on a regular basis – at least once a year.
      Environment Normal HVAC conditions for an office space.  Located away from direct contact to HVAC vents, radiators, and portable heaters.  Area should be free from pests (insects and rodents).  Structure should support the weight of records.  No overhead piping or close contact to drains, sinks or other water access areas.
      Off-Site Storage Locations

      Category

      		 Highly Sensitive Records Sensitive/Internal Use Records Public Information (Not Sensitive) 
      Storage Containers Standard storage box on shelf or riser at least 3 inches above ground level, with no more than three boxes in one stack.
      Protection Must comply with National Archives and Records Administration (NARA) Code of Federal Regulations – 36 CFR 1234, Appendix A – Minimum Security Standards for Level III Federal Facilities.
      Inventory A complete inventory of all records is required and should be updated on a regular basis – at least once a year. 
      Environment Environmental controls should meet records storage standards – at minimum cool, dry, dark locations with stable humidity (RH) and temperature.  Location should be free from pests, water sources, and must meet NARA standards specific to environmental controls as appropriate for the record type (NARA 36 CFR 1234 Subpart B 1234.14).
      Facilities Standards Must comply with National Archives & Records Administration (NARA) Code of Federal Regulations – 36 CFR 1234, Subpart B – Facility Standards for non-permanent records.