FDA STAFF MANUAL GUIDES, VOLUME III - GENERAL ADMINISTRATION
INFORMATION RESOURCES MANAGEMENT
RECORDS MANAGEMENT POLICY
Effective Date: 11/2008
|6. Roles and Responsibilities|
|7. Technical Assistance|
|8. Effective Date|
The purpose of this policy is to establish the principles, standards, responsibilities, and requirements for managing Food and Drug Administration (FDA) records. It is developed to implement requirements, guidelines and instructions specific to records management such as records creation, maintenance, adequate documentation and proper records disposition. It intends to protect FDA records information resources and data from unauthorized use and disclosure, inappropriate records disposition, to improve incident response for records management violations, and to mitigate any indiscretions.
The Federal Records Act of 1950, as amended, requires all Federal agencies to make and preserve records containing adequate and proper documentation of the organization, function, policies, decisions, procedures, and essential transactions. These records are public property and must be managed according to applicable laws and regulations.
The Federal Records Act also requires agencies to establish a records management program. This program is defined as a planned, coordinated set of policies, procedures, and activities needed to manage its recorded information. Essential elements include issuing up-to-date records management policies, properly training those responsible for implementation, and carefully evaluating the results to ensure adequacy, effectiveness, and efficiency.
A. Federal Records Act of 1950, as amended (44 U.S.C. Chapter 21, Chapter 29, Chapter 31, Chapter 33).
B. National Archive and Records Administration Act of 1984 (Public Law 98-497, 44 U.S.C. Chapter 21).
C. Concealment, Removal, or Mutilation of Records (18 U.S.C. 2071).
D. 36 CFR Chapter XII, Subchapter B especially Part 1234, “Electronic Records Management.”
E. 36 CFR Chapter XII, Subchapter G, “Damage to, Alienation and Unauthorized Destruction of Records”.
F. HHS OCIO-2007-0004 “HHH Policy for Records Management”, dated January 30, 2008.
This Policy applies to FDA and organizations conducting business for and on behalf of the FDA, whether owned and operated by FDA, or operated on behalf of FDA, through contractual relationships and/or service level agreements when using FDA resources. It applies to all FDA personnel, contractors, visitors who have access to FDA supported facilities or FDA information, interns, other non-government employees through incorporation by reference in contracts, service level agreements ( SLA) or memoranda of understanding (MOU) as conditions for using Government provided IT resources.
This policy applies to the management of all records, regardless of medium (i.e., paper, electronic, microfiche, PCs in home offices, telephone records, or other) on which the records are created, used, stored, or retrieved.
It is FDA policy to preserve all official records in accordance with applicable statutory and regulatory requirements, and to promote access to information by staff, partners, and the public, as appropriate. Each office within FDA is required to establish and maintain a records management program meeting the following minimum requirements:
A. Create, receive, and maintain official records providing adequate and proper documentation as evidence of FDA activities. Regardless of media, official records shall be:
1. Accessible. The content or substance of the record, including the content or substance of the transaction, the processing of the transaction, the identities of the parties and specific individuals involved, and the intent of the parties, shall be accessible for the life of the record, despite changes to hardware, software, or business procedures.
2. Legally Sufficient. When a transaction must contain a signature in writing in order to be legally enforceable, due care will be taken to ensure that documentation shows that written signature has been provided.
3. Reliable. Records in any media must be sufficiently reliable and persuasive to satisfy courts and others who must determine the facts underlying agency actions.
4. Legally Compliant. The methods used to obtain, send, disclose and store information must comply with applicable laws, such as those governing privacy, confidentiality, recordkeeping, and accessibility to persons with disabilities.
5. Readable. All records must be readable or useable for their established retention period outlined in approved records control schedules.
6. Trustworthiness. All official records systems and document conversion processes must incorporate measures and security to prevent the unauthorized or undocumented alteration or tampering with documents.
B. Manage records, regardless of format, in accordance with applicable statutes, regulations, and HHS and FDA policy and guidance.
FDA records/materials are the property of the Federal government, not the property of individual employees or contractors acting as an agent for the Government, and may not be removed from the FDA without proper authority. All employees/contractors shall maintain records and non-record documentary materials separately from one another.
C. Print and file records, including e-mail and instant messages, in a paper record keeping system. If an enterprise-wide electronic content management system with record keeping functionality or an electronic records repository compliant with the NARA requirements is available, file records in accordance with the requirements of that system or repository.
Word processing and email systems are not appropriate to maintain Federal Records.
If the email message, including instant messages, is a record, you must capture and save the date and time the message was sent or received as part of the record. The following will help in managing the mail box.
- The record copy must be transferred to an appropriate record keeping system. When an enterprise-wide electronic content management system with record keeping functionality or an electronic records repository compliant with the NARA requirements is not available, the record copy must be printed and maintained in a paper record keeping system.
- When you leave, your access to the email account will be closed. All emails residing in the mail box will eventually be deleted. Emails under the control of FDA are subject to the discovery process.
D. Maintain records according to a designated file structure.
1. Each mission area or Staff Division shall maintain a centralized list and description of its official records, including official electronic files. Mission areas or Staff Divisions shall strive to standardize file arrangement systems, filing procedures, and filing techniques of official records. These shall be designed to enhance the current use of the files, the preservation of archival records, and the prompt and systematic disposition of temporary records according to the appropriate records schedule.
2. Records shall be easily retrievable and securely maintained to protect the legal and financial rights of the Government and persons affected by Government activities.
E. For mission program records, follow instructions for disposition of records as specified in the approved FDA Records Control Schedules. All records of the FDA shall be listed and described in an approved records schedule and shall be disposed of only as authorized by that schedule.
F. Review program records control schedules regularly and propose revisions as appropriate.
1. Each mission area is required to regularly review their current records control schedules and, when required, to draft records control schedules for new programs and unscheduled records as specified in 36 CFR 1228, in coordination with Assistant Records Liaison Officers in Centers/Offices and the Agency Records Officer.
2. After the review, proposed schedules are to be submitted to NARA for final approval.
G. For general administrative records, apply the NARA generated General Records Schedules (GRS). As required by regulation, FDA must ask NARA for a variance when not following the retention periods outlined by these schedules (36 CFR 1228.42(c)).
H. Records and other documents that are no longer sufficiently active to warrant retention in office space shall be removed, in accordance with an approved records schedule, as rapidly as possible by:
1. transfer to a Federal Records Center, or
2. transfer to a records retention facility meeting the requirements of 36 CFR Part 1228, Subpart K, or
3. disposal, if authorized.
I. Provide appropriate training. ARLOs shall provide records orientation training to new employees and adequate training to other employees to ensure they continue to be aware of their responsibilities to maintain and safeguard Agency records.
1. New Employee - Mission areas, Staff Divisions and all offices shall provide records orientation training to new employees within their first 30 days of duty.
2. Annual Training – Annual training will be provided to all employees as a reminder of their responsibilities to maintain and safeguard FDA records.
3. New Supervisors – New Supervisors are to work with their ARLOs to determine the type of training needed for the position they fill. This will include a review of their Records Program and the need for their team members to obtain training to identify and protect FDA records.
J. Establish an appropriate employee departure program.
This pertains to employees departing their existing position, the immediate organization, the agency, or the federal government. The Staff Manual Guide 3291.3, “Records Management Guidance for Departing Employees” provides detailed records management responsibilities for departing personnel.
K. Support a Vital Records Program in coordination with the FDA Continuity of Operations (COOP) Program.
6.1 The FDA Commissioner and the Deputy Commissioner for Operations
The FDA Commissioner is ultimately responsible for creating and preserving records that adequately and properly document the organization, functions, policies, decisions, procedures, and essential transactions of FDA. The responsibility for establishing a program to ensure compliance with applicable Federal laws and regulations has been delegated to the Deputy Commissioner for Operations, Office of Information Management (OIM).
6.2 The FDA Chief Information Officer (FDA CIO)
The Chief Information Officer (CIO) in the Office of Information Management (OIM) is responsible for providing the leadership, planning, overall policy, guidance, and general oversight of records management in FDA, and its incorporation into the broader information resources management framework. CIO will:
A. Incorporate records management requirements and policies into the Agency's overall information resources management (IRM) policy and planning.
B. Designate in writing an FDA (Agency) Records Officer responsible for:
- Leading and managing the Agency-wide records management program.
- Ensuring Agency senior officials are aware of their programmatic and individual records management responsibilities.
- Advising FDA on records management issues and developing records management policies, procedures, guidance, and training materials.
- Reviewing and coordinating the approval of FDA records schedules, including schedules for the records residing in electronic information systems.
- Coordinating records management issues with other Federal agencies, including Federal oversight agencies such as the Office of Management and Budget (OMB), National Archives and Records Administration (NARA), and the General Services Administration (GSA).
- Providing technical advice and training to all FDA organizations regarding the establishment and maintenance of effective records management programs.
- Promulgating and communicating FDA wide policies and guidance that reflect records management missions and goals and incorporate Federal requirements.
- Conducting periodic evaluations of records management programs within FDA as part of the records management and oversight program to determine the effectiveness of the program.
- Coordinate records storage activities and ensure funds availability.
- Provide support to a vital records program.
6.3 Center/Office Directors
A. Designate in writing an Assistant Records Liaison Officer (ARLO) accountable to the FDA Records Officer who is designated to oversee the program.
B. Ensure the ARLO has adequate skills, training, resources, time, and appropriate authority to do the job.
C. Implement a records management program within their area of responsibility to accomplish the objectives identified in Federal regulations and HHS/FDA policies and procedures. Minimum program components include responsibilities for:
1. Identifying record keeping requirements for major programmatic and administrative records, including the records maintained in electronic or other media.
2. Evaluating the value of records within their span of responsibility to serve as a basis for assigning records retention and disposition instructions and implementing the most responsive and cost-effective means for managing them.
3. Developing file plans and indexing approaches, where appropriate, to simplify the use of, access to, and integration of information within the organization.
4. Drafting and updating records schedules for records created and maintained by the organization. Records schedules should be updated in the following situations:
- Creation of a new program within the Agency.
- Changes in statutory or regulatory requirements.
- Changes in the nature or responsibilities of the program documented by the records, such as changes resulting from reengineering a program or process supported by the records.
- Changes in the function of the records.
- Changes in the way the records are used or the way that staff members use the records to do their work.
- Changes in the contents of a series of records by including records previously managed separately or by splitting one series into two or more series.
- Changes in the data collected as part of the electronic recordkeeping system.
- Transfer of functions from one executive department or independent agency to another (36 CFR 1228.50(c)(3)).
5. Implementing approved records schedules to ensure that records are not destroyed without proper authorization.
6. Reviewing file plans and procedures at least every three years to ensure they are current and updating them as necessary.
7. Assisting in planning and implementing information management technology and reviewing the purchase of records management equipment and services to ensure they conform to Federal statutory and regulatory requirements.
8. Providing records management briefings for all managers and training to staff within their organizations.
9. Developing records management oversight roles and communication networks with all program units including field offices and other facilities, as appropriate, to ensure that the records management program is implemented at all sites under their jurisdiction.
10. Developing and disseminating instructions and operating procedures, as needed to supplement Agency-wide policy to meet the unique records management needs of their organizations and to support a records management program within the organization.
11. Ensuring records and other types of required documentary materials are not unlawfully removed from FDA by current or departing officials, employees, or contractors.
12. Performing an annual inventory to determine changes in any programs that would create a change in the records schedule and taking the appropriate action.
13. Ensuring funds availability for records storage.
14. Providing support to a vital records program. While emergency operation records should be identified and managed in the Continuity of Operations Plan (COOP), ARLOs need to work with the FDA COOP coordinators to ensure all of the records are protected. The location and access rights for the legal and financial rights records are to be included in the COOP.
6.3 Chief Counsel
The Chief Counsel assists in determining what records are needed to provide adequate and proper documentation of FDA activities and in specifying appropriate disposition for FDA records. Submissions of Records Schedule additions/changes will be coordinated with the Office of the Chief Counsel.
6.4 FDA Chief Information Security Officer (CISO)
The CISO is responsible for ensuring the technical security of the FDA electronic data records. The CISO is responsible for implementing this policy and providing the detailed monitoring, and enforcement tools and procedures as well as the requirements for incident reporting established under the Staff Manual Guide 3253.4, Data Security.
6. 5 FDA Physical Security Staff
The FDA Physical Security Staff (HFA-204) is responsible for developing and transmitting policy and procedures, and providing programmatic guidance and direction to FDA components and contractors on the safeguarding, release and removal and/or destruction of Non Public Information as defined in the Staff Manual Guide 2280.10.
6.6 The FDA Enterprise Architect
The FDA Enterprise Architect shall ensure that any and all systems development plans, schedules, work breakdown structures, business cases and OMB Exhibits 300, “Capital Asset Plan and Business Case Summary”, address records management provisions upfront in the planning and development stages of the lifecycle by establishing the requirement that an architectural records management layer be addressed as standard development.
6.7 All FDA employees are responsible for:
- Creating and managing the records necessary to document the Agency's official activities and actions, including those records generated by FDA contractors and grantees, in accordance with FDA recordkeeping requirements.
- Destroying records only in accordance with approved records schedules and never removing records from FDA without authorization.
- Maintaining records in a safe storage area that promotes efficient retrieval and maintaining personal papers and non-record materials separately from official FDA records.
Questions on records management should be addressed to the Assistant Records Liaison Officer (ARLO) in each Center/Office or to the Agency Records Officer. Any violation of the statutory and regulatory limitations placed on the removal of documentary materials by FDA employees or individuals conducting business on behalf of FDA under agreements who are separating from the Agency, should be forwarded to the Division of Ethics, Office of Management Programs and the ARLO in each Center/Office.
This guide is effective upon approval on November, 2008. It supersedes the following SMGs titled: SMG 3291.1, “Assistant Records Liaison Officers” issued on February 1, 1995; and SMG 3291.7, “Changes to Records Control Schedule”, issued on February 16, 1989.
|STATUS (I, R, C)||DATE APPROVED||LOCATION OF CHANGE HISTORY||CONTACT||APPROVING OFFICIAL|
|Revision||11/2008||N/a||Office of Information Management (OIM)||FDA Chief Information Officer (CIO)|
Alienation – Losing care and custody. Not protecting from loss or access.
Disposal – The action taken regarding temporary records after their retention periods expire and consisting usually of destruction or occasionally of donation. Also, when specified, “disposal” refers to the actions taken regarding non-record materials when no longer needed, especially their destruction. (See NARA, “A Federal Records Management Glossary.”)
Disposition – The action taken with regard to records no longer needed for current Government business. The actions include transfer to agency storage facilities or Federal records center; transfer from one Federal agency to another; transfer of permanent records to the National Archives; and disposal of temporary records. “Disposition” is also the action taken regarding non-records materials when no longer needed, including screening and destruction.
Electronic Records – Any information that is recorded in a form that only a computer can process and that satisfies the definition of a Federal record in 44 U.S.C. 3301. Electronic records include numeric, graphic and text information, which may be recorded on any medium capable of being read by a computer and which satisfies the definition of a record.
This includes, but is not limited to, magnetic media, such as tapes and disks, and optical disks. Unless otherwise noted, recordkeeping requirements apply to all electronic records systems, whether on microcomputers, minicomputers, or mainframe computers, regardless of storage media, in network or stand-alone configurations. (FIRMR Bulletin B-1).
Electronic Records System – Any information system that produces manipulates or stores Federal records by using a computer.
Information System – Is defined by the Office of Management and Budget (OMB) in Circular No. A-130 as “a discrete set of information resources organized for the collection, processing, transmission and dissemination of information in accordance with defined procedures, whether automated or manual.”
Non-record Materials – are those Federally-owned informational materials that do not meet the statutory definition of records (44 U.S.C. 3301), or that have been excluded from coverage by the definition. Excluded materials are extra copies of documents kept only for reference, stocks of publications and processed documents, and library or museum materials intended solely for reference or exhibit. (36 CFR 1220.14)
OMB Exhibit 300 - Capital Asset Plan and Business Case Summary – As prescribed and described in OMB’s Circular A-11, Preparation, Submission and Execution of the Budget.
OMB Circular A-130 - Management of Federal Information Resources – Establishes policy for the management of Federal information resources. OMB includes procedural and analytic guidelines for implementing specific aspects of these policies. The policies in this Circular apply to the information activities of all agencies of the executive branch of the Federal government.
Personal Papers – Documentary materials belonging to an individual that are not used to conduct Agency business. This includes professional materials created by the official before entering Government service, files relating to previously held positions and reference files; private materials brought into the office that were not created or received in the course of transacting Government business, such as family and personal correspondence, drafts of articles and books, and community service records; and work related personal papers that are not used in the transaction of Government business or as documentary reference for legal issues such
as diaries, notes, or personal appointment schedules. Also called personal files or personal records.
Records – includes all books, papers, maps, photographs, machine readable materials, or other documentary materials, regardless of physical form or characteristics, made or received by an agency of the United States Government under Federal law or in connection with the transaction of public business, and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decision, procedures, operations or other activities of the Government, or because of the information value of the data in them. (44 U.S.C. 3301).
Records (Control) Schedule – A document providing mandatory instructions for what to do with records (and non-record materials) no longer needed for current Government business, with provision of authority for the final disposition of recurring or nonrecurring records. Includes the SF 115, agency records schedules for Agency specific program records and the General Records Schedules (GRS) for common administrative records. Also called records disposition schedule, records retention schedule, or schedule.
Records Disposition – is any activity with respect to:
- disposal of temporary records no longer needed for the conduct of business by destruction or donation to an eligible person or organization outside of Federal custody;
- transfer of records to Federal agency storage facilities or records centers;
- transfer to the national Archives of the United States of records determined to have sufficient historical or other value to warrant continued preservation; or
- transfer of records from one Federal agency to any other Federal agency. (44 U.S.C. 2901(5).
Records Management – the planning, controlling, directing, organizing, training, promoting, and other managerial activities involved with respect to records creation, records maintenance and use, and records disposition in order to achieve adequate and proper documentation of the policies and transactions of the Federal Government and effective and economical management of agency operations. (44 U.S.C. 2901(2).
Records Series – file units or documents arranged according to a filing system or kept together because they relate to a particular subject or function, result from the same activity, document a specific kind of transaction, take a particular physical form, or have some other relationship arising out of their creation, receipt, or use, such as restrictions on access and use.
Reference Materials – Non-record materials. Includes extra copies of documents kept only for convenience of reference, stocks of publications and of processed documents.
Reviewing Official – either the employee’s manager of record; a Records Officer; or, a Freedom of Information Act (FOIA) Officer.
Scheduling – the process of developing schedules for the disposition of records, along with disposition instructions for nonrecord materials.
Sensitive Data – Sensitive data are data that require protection due to the risk and magnitude of loss or harm that could result from inadvertent or deliberate disclosure, alteration, or destruction of the data. The term includes data whose improper use or disclosure could adversely affect the ability of an agency to accomplish its mission, proprietary data, records about individuals requiring protection under the Privacy Act, and data not releasable under the Freedom of Information Act.
Staff Division – Sub-components of the Office of the Commissioner or Center/Office Director
Vital Records – There are two types of vital records:
a. Emergency Operating Records – Documents needed immediately, such as orders of succession.
b. Legal and Financial Rights Records – Documents essential to protect the legal and financial rights of the Government and of the individuals directly affected by its activities, such as social security records.