But litigation and fines are not the only reasons for agencies to be able to find the data that they are supposed to have on hand. "The reality is that if you deal with citizens, you're often going to have to deal with paper. No matter how much we capture on the Web, no matter how much we do in the interview-style of data capture, citizens are often going to need paper," said Gary Rodgers, worldwide public sector for HP, at the same event.
When a citizen applies for some kind of a benefit, he or she normally has to go through a certification process and there is typically some kind of a case-management system that tracks that. The citizen brings his or her evidence of identity: birth certificate, driver's license, passport, a document from the agency -- these all need to be captured and stored in a secure repository which is tied to a database accessible to a caseworker who can take appropriate action.
Rodgers and Trosset urged agencies to be methodical about how they implement records management policies. "Having to go back and rebuild stuff is what blows your budget out," Rodgers said.
How does an agency go about defining a records management policy? And once the policy is defined, how does one go about implementing it? However an agency decides to proceed, "it is not a technology project. You need to have your records management folks involved. They need to take the lead," Trosset said.
King County, Washington
King County, Wash., has answered just such questions. The 13th largest county in the nation by population, the government consists of seven separately elected bodies and employs 13,000 people. "What we're doing is implementing a records management system across all of that," Trosset said.The county is capturing many kinds of unstructured data: e-mail, documents, spreadsheets, etc. "We're also implementing a physical-records module for our records center which has about 100,000 boxes in it. We have a Web records component that we're implementing, and we're going to make digital imaging available if it makes business sense for county government to use," Trosset said.
"As we've been talking with county agencies about our records management system the first thing I hear is 'God, I can't wait till you guys come in because we've needed document management for so long.' We have to burst their bubble. We're not doing document management," Trosset said.
"There's a huge pent-up demand for document management in the county, but there's also a records management need. The problem is that agencies don't recognize that they had a records management problem because their immediate concern is document management," he said.
The first step is to define the policy, because the policy should drive the technology implementation. The Federal Rules for Civil Procedure played a large role in the development of King County's records management policy, Trosset said. "Two years ago when the rules were revised they specifically talked about electronic records. And as those rules are promulgated in the federal courts, they tend to get adopted by the local jurisdictions. So if you are not having to deal with the requirements of the federal rules now, because you don't go
to federal court, you eventually will," he predicted.
The Four Elements
"At a very high level the federal rules talk about four elements," Trosset continued. "The first element being the parties need to discuss ... the discovery aspects of ESI, or electronically stored information. Second, they need to be able to provide that information -- ideally in native format -- to opposing counsel. They need to be able to preserve that ESI, those records, with their metadata intact. That's why you need to be able to produce it in native format. And you need to be able to provide for a verifiable chain of custody," he said.A sound records management program has several goals regardless of the storage medium. First, it should be media neutral. It is the content that dictates the record. Beyond that, the three high-level goals of the records management program are to protect the record from alteration or destruction, to preserve it for legal, fiscal, business or historical requirements, and to be able to produce that record upon request.
Agency data is very decentralized, Trosset said. It is stored on hard drives, file shares, Microsoft Exchange servers and thumb drives. "Rather than have a robust taxonomy, we have a very flexible taxonomy or a 'folksonomy.' We have Bob's records and Joe's records," he said.
"The right approach is to have a sound records management program that does a couple of things: one, it applies retention policy consistently and is media neutral. It doesn't matter whether the citizen's complaint is on a piece of paper or an e-mail. Retention policies applied consistently regardless of media, and everyone has to play. Nobody is exempt, Trosset said.
Having defined the records management policy, the records management office then informs users of the policy so they can file their records, but the records management office controls the retention period. "We don't have agency X over here deciding 'well I'm going to keep these records for 6 years' and agency Y 'I'm going to keep these same records for 10 years,'" Trosset said. The retention requirements are based on Washington state law.
In the case of e-mail the county is capturing the subject, the author or sender, who the addressees were, who the blind addressees were, when was it created, when was it filed, was there an attachment with it, who filed it. "This information helps us to document the chain of custody and to prove the authenticity of that record," Trosset said.
"And because we are capturing all this information and we're indexing the record, and associating it with the retention schedule in the system, it enhances the ability to search for that record. So that when somebody goes in to search for records to respond to a public disclosure request or discovery, we can actually find that information," he said.
"The records management system does the retention, disposition or destruction of the record. It takes care of legal holds. It protects the records from being deleted if there is a legal hold on them," he said. The records are retained in their native format and in the original location. The records management system knows where the records are and wraps protection around it preventing it from being deleted.
The other side of the spectrum is having a central repository. And again the records management system does all the functions: retention, disposition, holds and discovery. But instead of being managed in place, the record is moved into the system when declared. Users can still access the record but they can't delete it.
Transferring the record on declaration does require larger storage. "We purchased what we call the 'Mother of all [Storage Area Networks],'" Trosset said. Out of the box King County's SAN was three terabytes. "We
can scale it up to 27 terabytes," he said.
The Big Bucket approach poses security challenges. King County selected a system certified by the Defense Department to manage top secret information. "We know in the county we're not going to have anything that approaches that. But we were able to give that assurance to our end users that [your records] will not be accessible by anybody outside of your organization unless you give the approval.
Next is scope. Is the records management system going to include paper and electronic documents or just electronic? "We'll let the agency know what those records are, what the retention requirements are, but we're not going to tell them 'you need to move those records on to our system,'" he said.
Web pages are becoming increasingly important public records, Trosset said. Agencies need to capture that information and protect it as a public record. "If an agency is looking to have a citizen walk in with a permit, they want to scan the record right there. We're going to start putting some of the workflow into that and start doing some of the [Optical Character Recognition] software and have that record flow through a work process where it's being annotated by a couple different folks and eventually approved," Trosset said. But that's document management.
"Regardless of if you are implementing a records management system by itself or a records management system with document management you have to have a taxonomy built up front -- especially if you're doing a document management solution," Trosset said.
"We also made sure our system would plug and play with a number of document management solutions out there. We wanted to know that if we walked into an agency and they had a document management solution or were getting ready to implement one, the end product of that workflow could flow into our system," he said.
A local government in Washington state adopted the Big Bucket approach and classified all e-mail as "correspondence" regardless of their contents. When the retention period for that e-mail came to pass, an agency head said "wait a minute. You can't do that." Turns out the e-mail scheduled for deletion contained other records with retention periods of six years, 10 years and permanent. That agency is now going through that correspondence to pull out all the records with longer retention periods.
One size does not fit all. "Look at what's out there; see what works best for your organization," Trosset recommended. King County decided to implement a "plain vanilla " solution -- out of the box without much customization. "These systems are extremely configurable. We can make the system look very unique for all of our end users," Trosset said.
When agencies start implementing a records management solution -- which they'll have to do eventually, Trosset says -- the key is to involve all the right players. It's not a technology project so much as a records management project. "You need to have the right records management folks," he said. "Somebody who understands the technology, not as an IT expert but how it gets used by the end-users. IT plays a critical role in implementing these systems, but records management has to have the lead," he said.
