Skip to Content

University of Virginia - Institutional Physical Records Storage Standards

 


Last update: January 2, 2013

Download a PDF copy of the University of Virginia - Institutional Physical Records Storage Standards


BACKGROUND

These standards outline requirements for handling and protecting all the University's institutional physical records, whether the records contain highly sensitive, moderately sensitive or public information (not sensitive) information, and regardless of whether the records are the official record for the University or a reference/convenience copy or where the records are stored (in-office, on-site, or off-site).  The University has developed these standards as part of its Records Management Policy.  Moreover, following these standards is consistent with steps you are already taking for the University's Protection & Use of Social Security Numbers and Electronic Storage of Highly Sensitive Data policies, and Institutional Data Protection Standards

DEFINITIONS

General Definitions:

  1. Physical Records: Includes records in paper or other analog formats, such as audio tape or video tape.  Does not include items that are stored in a digital format on a computer, server or some form of digital media.
  2. University Record:  Recorded information that documents a transaction or activity by or with any appointed board member, officer, or employee of the University.  Regardless of physical form or characteristics, the recorded information is a University record if it is produced, collected, received or retained in pursuance of law or in connection with the transaction of University business.  The medium upon which such information is recorded has no bearing on the determination of whether the record is a University record.  University records include but are not limited to: personnel records, student records, research records, financial records and administrative records.  Record formats/media include but are not limited to: email, electronic databases, electronic files, paper, audio, video and images (photographs).
  3. Records Inventory:  A listing of all records in storage by box, file drawer, or file (as needed).  The list should include record series name, description, file listing if in box or drawer, date range, and required retention and/or destruction date.  For agency 207 and related foundations, it is strongly recommended that inventories be maintained via the University Records Management Application (URMA).  Information on URMA is available on the URMO site (www.virginia.edu/recordsmanagement).

    Records Sensitivity: (as defined in the Administrative Data Usage Policy, Appendix A: its.virginia.edu/policy/itcadminappendixa.html)

  4. Highly Sensitive Records:  Physical records containing personal information that can lead to identity theft if exposed and health information that reveals an individual’s health condition and/or history of health services use. 
  5. Moderately Sensitive Records:  Physical records containing data that is not explicitly defined as highly sensitive information or is not intended to be made publically available.
  6. Public Information (not sensitive) Records:  Information that is intentionally made available to the public.
  7. Storage Container:

  8. Open Shelving:  Shelving used for in-office storage of records for easy access and without the use of another container – such as a records storage box.  Records are either stored in binders or organized in folders on the open shelving.  (Does not include shelving for standard records storage boxes).
  9. Standard Storage Box:  A cubic food box that has measurements of 12” wide x 15” length x 10“ high; made from corrugated cardboard, with a removable lid that has at minimum a 2” coverage of the box; with punch handles on the short sides of the box.  Standard boxes are available for purchase (PTAO required) at cost from the University Records Management Office (URMO) at www.virginia.edu/recordsmanagement/storage.html.
  10. Storage Locations:

  11. In-Office Storage:  An office location in a University building where an employee has an active working area/desk that is used at minimum weekly.
  12. On-Site Storage:  A location within a University building where the department has active work areas and staff in the same location, but not in the same room.  This may include closets, basements, file rooms or conference spaces.  URMO will review on-site storage upon request.
  13. Off-Site Storage:  An off-grounds warehouse or vendor provided storage service that has been reviewed and approved by the University Records Management Office (URMO) and meets all requirements of the standards.  For a complete list of approved storage vendors please visit the URMO website (www.virginia.edu/recordsmanagement)

USING THE STANDARDS

The Institutional Physical Records Storage Standards are divided three categories (in-office, on-site or off-site) and then into three sensitivity levels. To determine which standard applies in a given instance:

  1. Determine whether the records will be stored in-office, on-site or off-site.
  2. Determine the sensitivity of the records: highly sensitive, moderately sensitive, or public information (not sensitive). To assist with identification of sensitivity, please review the records retention and disposition schedule for the sensitivity/confidentiality field of the related records series located here: www.virginia.edu/recordsmanagement.
  3. If a storage area contains records with different sensitivities, the standard for the highest level of sensitivity should be followed for the entire storage area.

FOR ASSISTANCE OR ADDITIONAL INFORMATION

If you have questions regarding the standards, definitions or descriptions, please contact the University Records Management Office, ISPRO at records@virginia.edu.  Additional information is available at www.virginia.edu/recordsmanagement.


 

STORAGE STANDARDS BY LOCATION & RECORDS SENSITIVITY LEVEL

In-Office Storage Locations

 
Category Highly Sensitive Records Moderately Sensitive Records Public Information (Not Sensitive) Records
Storage Containers Standard Storage Box on shelf or riser at least 3 inches above ground level, with no more than three boxes in one stack.
File Cabinet with 2-4 inch rise at bottom with functional lock.
  Open Shelving that supports organization and access to records (example: records in binders)
Protection Two levels of protection – ex. locked file cabinet plus locked door or person sitting in the same room controlling access.  File cabinets need to be locked at all times (not left open during work day).  If person leaves location, locking of all access doors to rooms required. One level of protection – ex.  locked file cabinet, locked door or person sitting in the same room controlling access.  File cabinets can be opened during office hours as long as person controlling access is in the room or the room is locked. No explicit protection required for publically accessible information.
Inventory A complete inventory of all records is required and should be updated on a regular basis – at least once a year.
Environment Normal HVAC conditions for an office space.  Boxes and file cabinets should be located away from direct contact to HVAC vents, radiators, and portable heaters.  Area should be free from pests (insects and rodents).  Structure should be able to support the weight of records.  No overhead piping or close contact to drains, sinks or other water related areas.

 

On-Site Storage Locations

 
Category Highly Sensitive Records Moderately Sensitive Records Public Information (Not Sensitive) Records
Storage Containers Standard Storage Box on shelf or riser at least 3 inches above ground level, with no more than three boxes in one stack.
File Cabinet with 2-4 inch rise at bottom with functional lock.
Protection Two levels of protection – ex. locked file cabinet and locked door.  File cabinet and door needs to be locked at all times (not left open during work day).  One level of protection – ex.  locked file cabinet, or locked door.  File cabinets can be opened during office hours as long as room is locked. No explicit protection required for publically accessible information.
Inventory A complete inventory of all records is required and should be updated on a regular basis – at least once a year.
Environment Normal HVAC conditions for an office space.  Located away from direct contact to HVAC vents, radiators, portable heaters.  Area should be free from pests (insects and rodents).  Structure should support the weight of records.  No overhead piping or close contact to drains, sinks or other water access areas.

 

Off-Site Storage Locations

 
Category Highly Sensitive Records Moderately Sensitive Records Public Information (Not Sensitive) Records
Storage Containers Standard Storage Box on shelf or riser at least 3 inches above ground level, with no more than three boxes in one stack.
Protection Must comply with National Archives and Records Administration (NARA) Code of Federal Regulations – 36 CFR 1234, Appendix A – Minimum Security Standards for Level III Federal Facilities
Inventory A complete inventory of all records is required and should be updated on a regular basis – at least once a year. 
Environment Environmental controls should meet records storage standards – at minimum cool, dry, dark locations with stable humidity (RH) and temperature.  Location should be free from pests, water sources, and must meet NARA standards specific to environmental controls as appropriate for the record type.  (NARA 36 CFR 1234 Subpart B 1234.14)
Facilities Standards Must comply with National Archives & Records Administration (NARA) Code of Federal Regulations – 36 CFR 1234, Subpart B – Facility Standards