Records Retention for NonProfits in a Digital Age
United Partners for Human Services
December 2, 2014
Karen D. Walker
Holland & Knight LLP
315 S. Calhoun Street, Suite 600
Tallahassee, Florida 32301
(850) 425-5612
karen.walker@hklaw.com
Reasons Non-Profits Are Required to
Retain Records
• Statutory or regulatory requirements relating to particular types of
records (different laws and regulations will apply depending on the
type of records held by an agency and the type of services it
provides).
• Contractual requirements.
• Auditing requirements.
• To preserve evidence in the event of a real or anticipated claim.
2
Reasons Non-Profits Are Required to
Retain Records
Examples of Federal Records Retention Requirements
• IRS requirements:
– Form 1023 (application for exempt status) to be retained permanently.
– Form 990 or 990 EZ to be retained for a minimum of seven (7) years.
• IRS now asks on Form 990 if entity has a document retention policy.
• Financial records, supporting documents, statistical records and all other
non-Federal entity records pertinent to a Federal award must be retained for
three (3) years from the date of submission of the final expenditure report,
except in the event of an audit or litigation in which event the records shall be
retained until such matter is resolved. 2 C.F.R. § 200.332.
3
Reasons Non-Profits Are Required to
Retain Records
Examples of Federal Records Retention Requirements (Continued)
• Records relating to real property and equipment acquired with federal funds
must be retained for three (3) years after final disposition. 2 C.F.R. § 200.332.
• Sarbanes-Oxley requires retention of records relating to lawsuits.
– Intentionally destroying records that are the subject of litigation can result in criminal
liability.
4
Reasons Non-Profits Are Required to
Retain Records
Examples of Florida Regulatory Records Retention Requirements
• Rule 64B19-19.003, Florida Administrative Code (Department of Health) requires a psychologist to keep psychological records for 3 years and a summary
of such records for 4 additional years.
• Rule 65E-4.014, Florida Administrative Code (Department of Children and
Families (“DCF”)) - client records of a Community Mental Health Provider must
be retained for at least 7 years after date of last entry.
5
Reasons Non-Profits Are Required to
Retain Records
Contractual Requirements
From DCF Standard Contract:
“Retention of all client records, financial records, supporting documents,
statistical records, and any other documents (including electronic storage
media) pertinent to this contract shall be maintained by the Provider during
the term of this contract and retained for a period of six (6) years after
completion of the contract or longer when required by law. In the event an
audit is required under this contract, records shall be retained for a minimum
period of six (6) years after the audit report is issued or until resolution of any
audit findings or litigation based on the terms of this contract, at no additional
cost to the Department.”
6
Records Retention Under Florida’s
Public Records Act
Public Records May Only Be Disposed Of Pursuant to Approved
Retention Schedules
An agency in the possession of public records must comply with the rules of the
Florida Department of State, Division of Library and Information Services
regarding records retention and disposal. § 119.021(2)(b).
“A public record may be destroyed or otherwise disposed of only in accordance
with the retention schedules established by the division.” § 257.36(6), Fla. Stat.
(2014).
7
Records Retention Under Florida’s
Public Records Act
Requirement for Non-Profit to Keep Records In the Same Manner as an
Agency
A public agency that contracts for services must include in the contract
requirements that the contractor must:
• “Keep and maintain public records that ordinarily and necessarily would be
required by the public agency in order to perform the services.”
• “Meet all requirements for retaining public records” and transfer such records at
no cost to the agency upon termination of the contract.
• Store records electronically in a format that is compatible with that of the public
agency.
§ 119.0701, Fla. Stat. (2014).
8
Records Retention Under Florida’s
Public Records Act
Approved Record Retention Schedules
The Division has adopted a series of approved general records retention schedules:
http://dos.myflorida.com/library-archives/records-management/general-recordsschedules/
• The general schedule applicable to most state and local government agencies
(and non-profits holding records on their behalf) is General Records Schedule
GS1-SL.
– Examples:
• Employee attendance and leave records - 3 fiscal years.
• Records of independent audits - 10 fiscal years.
• Bid records (non-capital improvement) - 5 fiscal years after awarded.
• Client case files (human/social services) - 5 fiscal years.
9
Records Retention Under Florida’s
Public Records Act
Approved Record Retention Schedules (Continued)
• Agencies have their own records retention schedules approved by the Division
relating to certain types of records specific to that agency.
10
Records Retention Under Florida’s
Public Records Act
Disposing of Public Records
• Ensure all applicable retention periods have been met.
• Ensure that there is no need to retain the records beyond the standard retention
period:
– Litigation
– Audit
– Pending public records request
• Document disposal of the public record.
11
Records Retention Under Florida’s
Public Records Act
Disposing of Public Records (Continued)
• Ensure proper destruction of records (including that confidential and exempt
information is destroyed such that there is no unauthorized access to such
information).
– Paper records -- burning in industrial incinerator facility, pulping, pulverizing, shredding or
macerating.
– Electronic records - destruction of storage media such as by shredding, crushing or
incineration; high level overwriting that renders the data unrecoverable; or
degaussing/demagnetizing.
12
Types of Records to Which Public
Records Retention Laws Apply
What Is a “Record”?
Definition of “Public Records”:
• all documents, papers, letters, maps, books, tapes, photographs,
films, sound recordings, data processing software, or other material,
regardless of the physical form, characteristics, or means of
transmission, made or received pursuant to law or ordinance or in
connection with the transaction of official business by any agency.
§ 119.011(12), Fla. Stat.
13
Types of Records to Which Public
Records Retention Laws Apply
Information Stored on a Computer
Information stored on a non-profit's computer system that is subject to the Public
Records Act is a public record just as much as if stored in writing in a book or in a file in
a filing cabinet.
“Automation of public records must not erode the right of access to those records. As
each agency increases its use of an dependence on electronic recordkeeping, each
agency must provide reasonable public access to records electronically maintained . . .”
§ 119.01(2)(a), Fla. Stat. (2014).
See National Collegiate Athletic Association v. Associated Press, 18 So. 3d 1201 (Fla. 1st
DCA 2009) (records accessible to agency's attorneys via electronic database were public
records); Op. Att'y Gen. Fla. 98-54 (1998) (computer records of association used in licensing
security dealers are public records subject to Chapter 119, Florida Statutes); Op. Atty's Gen.
Fla. 91-61 (computer data software disc is a public record).
14
Types of Records to Which Public
Records Retention Laws Apply
E-Mail
E-mail messages made or received in connection with public business
are public records unless subject to a specific legislative exemption. Op.
Att'y Gen. Fla. 07-14 (2007).
• It matters not if the e-mail is made or received through an officer,
employee or agent's personal e-mail account. What determines
whether it is pubic record is the nature of the record and whether it
relates to public business.
E-mail messages are subject to the statutory restrictions on destruction of
public records. Op. Att'y Gen. 96-34 (1996).
15
Types of Records to Which Public
Records Retention Laws Apply
Websites
Information on an agency's website that meets the definition of public
record is subject to the retention requirements for public records.
Op. Att'y Gen. Fla. 08-07 (2008) (website maintained by city council
member that related to transaction of city business would be subject
to city's policies and retention schedule relating to the city's public
records).
16
Types of Records to Which Public
Records Retention Laws Apply
Facebook
Information relating to government business on a Facebook page is
subject to the Public Records Act just as if such information was in a
hard-copy written document.
Op. Att'y Gen. Fla. 09-19 (2009) (“to the extent that the information
on the city's Facebook page constitutes a public record, the city is
under an obligation to follow the public records retention schedules
established by law.”).
17
Types of Records to Which Public
Records Retention Laws Apply
Other Types of Electronic Communications (including Text Messages
and Twitter)
“The same rules that apply to email should be considered for electronic
communication including Blackberry PINs, SMS communications (text
messaging), MMS communications (multimedia content), and instant
messaging conducted by government agencies.” Informal Advisory
Opinion from Florida Attorney General to Secretary of State, March 17,
2010.
The Division's general retention schedule recognizes that “[r]ecords
retention schedules apply to records regardless of their physical format”
and that such schedules apply to text files.
18
Types of Records to Which Public
Records Retention Laws Apply
Transitory Messages
The Division's general retention schedule recognizes that certain
electronic communications may be transitory in nature, such as a text
message reminding employees about a scheduled meeting.
These records “are created primarily to communicate information of a
short-term value.”
Transitory messages must be retained until “obsolete, superseded, or
administrative value is lost.”
19
What Does All This Mean for NonProfits?
• Electronic records that are public records must be retained for the same period
of time as if the record was in paper format.
• Electronic records that are public record may only be disposed of in accordance
with an approved retention schedule and pursuant to approved disposition
methods.
• A non-profit that has electronic public records must have systems in place to
back-up and preserve such electronic records for the applicable retention
periods.
• Electronic record keeping systems must be capable of being searched to locate
pertinent records that may be the subject of public records requests, audit
requests, or discovery requests in litigation.
• Non-profits should consider how they are using things such as text messaging,
instant messaging, Facebook, Twitter, and websites.
20
Considerations for Developing a
Records Retention Policy
1. Identify what type of records your agency generates or receives.
2. Determine applicable statutory, regulatory and contractual
retention requirements for your agency's records.
3. Develop a written retention schedule (consistent with any
governmental schedule that may apply including that developed by
the Department of State for Florida public records and of the agency
with which the non-profit contracts).
4. Ask the agency with which you contract for a copy of their records
retention schedule that would apply to records in your possession
relating to services you are preforming on their behalf.
21
Records Retention Holds
These should be used in the event of actual or anticipated litigation.
• Notifies your employees that records should not be disposed or
destroyed even if the normal retention period has expired.
– Records subject to the hold must be specifically described.
– Notice should specifically state that it includes electronic records.
– IT systems should be adjusted to make sure that records subject to the
hold are backed up and are not being automatically deleted or destroyed.
– Should provide contact information in the event employees have
questions.
22
Best Practices for Records Retention
by Non-Profits
• Have a records retention and destruction policy (and consult with your auditor
and legal counsel in developing such policy).
• Make sure all statutory, regulatory and contractual records retention
requirements flow through to subcontractors.
• Certain organization information should be retained permanently such as
audit reports of accountants, records of deeds or mortgages, financial
statements, general ledgers, property records, and tax returns.
• Back up e-mail and any other forms of electronic communications and all
information on your computer systems. Make sure systems are only
destroying records in accordance with retention policy and all applicable laws
and contractual requirements.
23
Best Practices for Records Retention
by Non-Profits (Continued)
• Consider eliminating use of text messaging except where absolutely
necessary.
• Evaluate what you are putting on your Website and/or Facebook page and
avoid including anything that might be public record.
• When in doubt, use the longer retention period for any records to which it
may apply.
• Never destroy records that are the subject of a dispute and put a records hold
in place in the event of real or anticipated litigation.
24
Questions?
25