1. Records Retention for Non- Profits in a Digital Age United Partners for Human Services December 2, 2014 Karen D. Walker Holland & Knight LLP 315 S. Calhoun Street, Suite 600 Tallahassee, Florida 32301 (850) 425-5612 karen.walker@hklaw.com

2. 2 Reasons Non-Profits Are Required to Retain Records Statutory or regulatory requirements relating to particular types of records (different laws and regulations will apply depending on the type of records held by an agency and the type of services it provides). Contractual requirements. Auditing requirements. To preserve evidence in the event of a real or anticipated claim.

3. 3 Reasons Non-Profits Are Required to Retain Records Examples of Federal Records Retention Requirements IRS requirements: –Form 1023 (application for exempt status) to be retained permanently. –Form 990 or 990 EZ to be retained for a minimum of seven (7) years. IRS now asks on Form 990 if entity has a document retention policy. Financial records, supporting documents, statistical records and all other non-Federal entity records pertinent to a Federal award must be retained for three (3) years from the date of submission of the final expenditure report, except in the event of an audit or litigation in which event the records shall be retained until such matter is resolved. 2 C.F.R. § 200.332.

4. 4 Reasons Non-Profits Are Required to Retain Records Examples of Federal Records Retention Requirements (Continued) Records relating to real property and equipment acquired with federal funds must be retained for three (3) years after final disposition. 2 C.F.R. § 200.332. Sarbanes-Oxley requires retention of records relating to lawsuits. –Intentionally destroying records that are the subject of litigation can result in criminal liability.

5. 5 Reasons Non-Profits Are Required to Retain Records Examples of Florida Regulatory Records Retention Requirements Rule 64B19-19.003, Florida Administrative Code (Department of Health) - requires a psychologist to keep psychological records for 3 years and a summary of such records for 4 additional years. Rule 65E-4.014, Florida Administrative Code (Department of Children and Families (“DCF”)) - client records of a Community Mental Health Provider must be retained for at least 7 years after date of last entry.

6. 6 Reasons Non-Profits Are Required to Retain Records Contractual Requirements From DCF Standard Contract: “Retention of all client records, financial records, supporting documents, statistical records, and any other documents (including electronic storage media) pertinent to this contract shall be maintained by the Provider during the term of this contract and retained for a period of six (6) years after completion of the contract or longer when required by law. In the event an audit is required under this contract, records shall be retained for a minimum period of six (6) years after the audit report is issued or until resolution of any audit findings or litigation based on the terms of this contract, at no additional cost to the Department.”

7. 7 Records Retention Under Florida’s Public Records Act Public Records May Only Be Disposed Of Pursuant to Approved Retention Schedules An agency in the possession of public records must comply with the rules of the Florida Department of State, Division of Library and Information Services regarding records retention and disposal. § 119.021(2)(b). “A public record may be destroyed or otherwise disposed of only in accordance with the retention schedules established by the division.” § 257.36(6), Fla. Stat. (2014).

8. 8 Records Retention Under Florida’s Public Records Act Requirement for Non-Profit to Keep Records In the Same Manner as an Agency A public agency that contracts for services must include in the contract requirements that the contractor must: “Keep and maintain public records that ordinarily and necessarily would be required by the public agency in order to perform the services.” “Meet all requirements for retaining public records” and transfer such records at no cost to the agency upon termination of the contract. Store records electronically in a format that is compatible with that of the public agency. § 119.0701, Fla. Stat. (2014).

9. 9 Records Retention Under Florida’s Public Records Act Approved Record Retention Schedules T he Division has adopted a series of approved general records retention schedules: http://dos.myflorida.com/library-archives/records-management/general-records- schedules/ http://dos.myflorida.com/library-archives/records-management/general-records- schedules/ The general schedule applicable to most state and local government agencies (and non-profits holding records on their behalf) is General Records Schedule GS1-SL. –Examples: Employee attendance and leave records - 3 fiscal years. Records of independent audits - 10 fiscal years. Bid records (non-capital improvement) - 5 fiscal years after awarded. Client case files (human/social services) - 5 fiscal years.

10. 10 Records Retention Under Florida’s Public Records Act Approved Record Retention Schedules (Continued) Agencies have their own records retention schedules approved by the Division relating to certain types of records specific to that agency.

11. 11 Records Retention Under Florida’s Public Records Act Disposing of Public Records Ensure all applicable retention periods have been met. Ensure that there is no need to retain the records beyond the standard retention period: –Litigation –Audit –Pending public records request Document disposal of the public record.

12. 12 Records Retention Under Florida’s Public Records Act Disposing of Public Records (Continued) Ensure proper destruction of records (including that confidential and exempt information is destroyed such that there is no unauthorized access to such information). –Paper records -- burning in industrial incinerator facility, pulping, pulverizing, shredding or macerating. –Electronic records - destruction of storage media such as by shredding, crushing or incineration; high level overwriting that renders the data unrecoverable; or degaussing/demagnetizing.

13. 13 Types of Records to Which Public Records Retention Laws Apply What Is a “Record”? Definition of “Public Records”: all documents, papers, letters, maps, books, tapes, photographs, films, sound recordings, data processing software, or other material, regardless of the physical form, characteristics, or means of transmission, made or received pursuant to law or ordinance or in connection with the transaction of official business by any agency. § 119.011(12), Fla. Stat.

14. 14 Types of Records to Which Public Records Retention Laws Apply Information Stored on a Computer Information stored on a non-profit's computer system that is subject to the Public Records Act is a public record just as much as if stored in writing in a book or in a file in a filing cabinet. “Automation of public records must not erode the right of access to those records. As each agency increases its use of an dependence on electronic recordkeeping, each agency must provide reasonable public access to records electronically maintained...” § 119.01(2)(a), Fla. Stat. (2014). See National Collegiate Athletic Association v. Associated Press, 18 So. 3d 1201 (Fla. 1 st DCA 2009) (records accessible to agency's attorneys via electronic database were public records); Op. Att'y Gen. Fla. 98-54 (1998) (computer records of association used in licensing security dealers are public records subject to Chapter 119, Florida Statutes); Op. Atty's Gen. Fla. 91-61 (computer data software disc is a public record).

15. 15 Types of Records to Which Public Records Retention Laws Apply E-Mail E-mail messages made or received in connection with public business are public records unless subject to a specific legislative exemption. Op. Att'y Gen. Fla. 07-14 (2007). It matters not if the e-mail is made or received through an officer, employee or agent's personal e-mail account. What determines whether it is pubic record is the nature of the record and whether it relates to public business. E-mail messages are subject to the statutory restrictions on destruction of public records. Op. Att'y Gen. 96-34 (1996).

16. 16 Types of Records to Which Public Records Retention Laws Apply Websites Information on an agency's website that meets the definition of public record is subject to the retention requirements for public records. Op. Att'y Gen. Fla. 08-07 (2008) (website maintained by city council member that related to transaction of city business would be subject to city's policies and retention schedule relating to the city's public records).

17. 17 Types of Records to Which Public Records Retention Laws Apply Facebook Information relating to government business on a Facebook page is subject to the Public Records Act just as if such information was in a hard-copy written document. Op. Att'y Gen. Fla. 09-19 (2009) (“to the extent that the information on the city's Facebook page constitutes a public record, the city is under an obligation to follow the public records retention schedules established by law.”).

18. 18 Types of Records to Which Public Records Retention Laws Apply Other Types of Electronic Communications (including Text Messages and Twitter) “The same rules that apply to email should be considered for electronic communication including Blackberry PINs, SMS communications (text messaging), MMS communications (multimedia content), and instant messaging conducted by government agencies.” Informal Advisory Opinion from Florida Attorney General to Secretary of State, March 17, 2010. The Division's general retention schedule recognizes that “[r]ecords retention schedules apply to records regardless of their physical format” and that such schedules apply to text files.

19. 19 Types of Records to Which Public Records Retention Laws Apply Transitory Messages The Division's general retention schedule recognizes that certain electronic communications may be transitory in nature, such as a text message reminding employees about a scheduled meeting. These records “are created primarily to communicate information of a short-term value.” Transitory messages must be retained until “obsolete, superseded, or administrative value is lost.”

20. 20 What Does All This Mean for Non- Profits? Electronic records that are public records must be retained for the same period of time as if the record was in paper format. Electronic records that are public record may only be disposed of in accordance with an approved retention schedule and pursuant to approved disposition methods. A non-profit that has electronic public records must have systems in place to back-up and preserve such electronic records for the applicable retention periods. Electronic record keeping systems must be capable of being searched to locate pertinent records that may be the subject of public records requests, audit requests, or discovery requests in litigation. Non-profits should consider how they are using things such as text messaging, instant messaging, Facebook, Twitter, and websites.

21. 21 Considerations for Developing a Records Retention Policy 1.Identify what type of records your agency generates or receives. 2.Determine applicable statutory, regulatory and contractual retention requirements for your agency's records. 3.Develop a written retention schedule (consistent with any governmental schedule that may apply including that developed by the Department of State for Florida public records and of the agency with which the non-profit contracts). 4.Ask the agency with which you contract for a copy of their records retention schedule that would apply to records in your possession relating to services you are preforming on their behalf.

22. 22 Records Retention Holds These should be used in the event of actual or anticipated litigation. Notifies your employees that records should not be disposed or destroyed even if the normal retention period has expired. –Records subject to the hold must be specifically described. –Notice should specifically state that it includes electronic records. –IT systems should be adjusted to make sure that records subject to the hold are backed up and are not being automatically deleted or destroyed. –Should provide contact information in the event employees have questions.

23. 23 Best Practices for Records Retention by Non-Profits Have a records retention and destruction policy (and consult with your auditor and legal counsel in developing such policy). Make sure all statutory, regulatory and contractual records retention requirements flow through to subcontractors. Certain organization information should be retained permanently such as audit reports of accountants, records of deeds or mortgages, financial statements, general ledgers, property records, and tax returns. Back up e-mail and any other forms of electronic communications and all information on your computer systems. Make sure systems are only destroying records in accordance with retention policy and all applicable laws and contractual requirements.

24. 24 Best Practices for Records Retention by Non-Profits (Continued) Consider eliminating use of text messaging except where absolutely necessary. Evaluate what you are putting on your Website and/or Facebook page and avoid including anything that might be public record. When in doubt, use the longer retention period for any records to which it may apply. Never destroy records that are the subject of a dispute and put a records hold in place in the event of real or anticipated litigation.

25. 25 Questions?