2. 1 Record Management Medical Center Administrative Group Fall Symposium November 15, 2000 University Audit

3. 2 Office of University Audit 4 Salim M. Alani, Director ext. 5-2291 salani@audit.rochester.edu 4 Sandra E. Dano, Auditor ext. 5-1100 sdano@audit.rochester.edu website: http://listener.uis.rochester.edu/audit/

4. 3 Office of University Audit Organizational Chart

5. 4 Mission Statement 4 To provide audit and advisory services to the University Community by assessing risks, analyzing controls, and ensuring that business practices are effective, efficient, and compliant with University and regulatory policies.

6. 5 Records Management Topics 4 What are Records 4 Proper Treatment of Confidential Records –security over storage, limiting access, transporting, faxing, legislation 4 Compliance Issues 4 Destruction of Records 4 Petty Cash Funds

7. 6 Three Words to Remember: 4C4Communicate 4C4Compliance 4C4Confidentiality

8. 7 What are Records? 4 The records we’re talking about in today’s presentation are collections of items of data and information.

9. 8 Records may be on: 4 computer-stored files 4 paper notes, forms and reports 4 x-rays 4 drawings 4 photographs 4 video or sound tapes 4 microfilm/microfiche 4 e-mail 4 electronic imaging

10. 9 Confidential Records Include: (but are not limited to) 4 social security numbers 4 salary information 4 information about patients and their care 4 student grades 4 employee performance evaluations

11. 10 Confidential Records 4 Must be stored to protect confidentiality. - locked drawer, cabinet, office 4 Access is limited to appropriate users. - legitimate business purpose; need to know basis 4 Secure records sent to other areas. - lock totes, seal envelopes 4 Exercise caution when faxing data. - consider adding a disclaimer to your cover page

12. 11 Health Insurance Portability and Accountability Act (HIPAA) 4 Access of patient information is to be limited to the minimum necessary to perform specific jobs. 4 Protection of health care information to ensure privacy and confidentiality when health information is electronically stored, maintained or transmitted.

13. 12 New York State Bill A09965 4 This is an act to amend the education law. 4 It prohibits the use of social security numbers as student identification numbers. 4 It was passed into law and will go into effect on July 1, 2001.

14. 13 Why not keep all records forever ?

15. 14 Factors to Consider for Retention Periods: 4 University policies 4 external compliance requirements 4 optimizing use of space 4 minimizing the cost of retention 4 preserving the history of the University 4 audit or enforcement proceeding where the records need to be kept

16. 15 Risks and Costs of Excess Retainage Periods 4 If the records are stored in an outside facility, then expenses are incurred for this storage. 4 If the records are stored internally, there are staff costs to consider for the time it takes your employees to sort through, maintain and move around the records. 4 There are opportunity costs for the internal space used to store the excess records.

17. 16 Risks and Costs of Excess Retainage Periods 4 Holding onto records for extended periods of time can expose the University to undue risk. 4 Rights of access are extended beyond the legally required periods, if the records are retained, and last as long as the records are retained.

18. 17 Destruction of Records 4 Historic value to UR? 4 Non-sensitive material 4 Sensitive Information disposal without confidential status being compromised

19. 18 Destruction of Confidential Records 4 Paper Shredders –small volumes of paper records –can be done in each office 4 Autoclave –large volumes or heavy paper records –call MC Housekeeping/Environmental Services at 5-3666 to request pickup of records –follow records through to actual destruction

20. 19 Three Words to Remember: 4C4Communicate 4C4Compliance 4C4Confidentiality

21. 20 Petty Cash Funds 4 Collect original receipts when paying out of fund. Receipts plus cash on hand must equal the total fund amount. 4 Account for food purchases and human subject payments in accordance with UR policies. 4 Properly secure this fund in a locked cash box, which is kept in a locked desk or cabinet (or a safe for large amounts).

22. 21 Questions?