A vital records program identifies and protects records containing vital information necessary for an organization to continue its key functions and activities in case of an emergency or disaster. Vital records should be restricted to those records that really are crucial for start-up of operations after a disaster occurs.
Developing a Disaster Plan Implementing a Disaster Plan
Vital Records Policy
All University records designated as vital or essential to the operation of the University and which if destroyed would seriously impair or disrupt normal University affairs, or which by their loss might place the University in a state of legal or fiscal jeopardy, are to be secured, either by microfilm or other comparable duplication or suitable backup method of protection.
University departments have the primary responsibility to keep records designated as vital records safe and secure on a continuing basis regardless of the media format on which it is stored. Departmental responsibility for vital records is defined in the Business Policy Manual under the guidelines of Records and Records Management, Policy #907.
Based on business document analysis and in light of various recent disasters, all programs, offices, departments and laboratories must determine what information must be protected and how to protect it. Departments should develop a plan of action to respond to emergencies or disasters that may damage their business records and provide for the recovery of needed information.
Vital Records Program Objectives
The objectives of a vital records program are to:
Identify records needed to conduct business under emergency operating conditions within the first 72 hours following a disaster.
Identify records needed to perform or reconstruct the organization's most mission-critical functions.
Identify records protecting the legal and financial rights of the organization/institution, its employees and the people it serves.
Develop and implement cost effective methods, including off-site storage and the application of technology, to protect and safeguard those records identified as vital from loss, misuse and unauthorized access or modification.
Develop policies, procedures and a plan of action to assess damage and to begin recovery of any records that may be affected by and emergency or disaster, regardless of the storage medium.
Types of Vital Records
There are two types of vital records.
Emergency operating records: Records essential to the continued functioning of an organization during and after an emergency to ensure the continuation of the organization, e.g. list of UM recovery staff, system backups, emergency preparedness plans.
Rights and interests records: Records essential to the protection of the legal and financial rights of an organization and of the individuals directly affected by the organization's activities, e.g. payroll records.
A small percentage of business records are essential to emergency functioning and to business continuance and are difficult or impossible to replace. ARMA International and the National Archives and Records Administration (NARA) estimate that in most organizations, only 1-10% of their records are deemed vital.
The length of time the records are kept does not necessarily indicate that a record is vital, nor does a record designated as vital always remain vital.
Vital records may be in any format or medium (paper, electronic, microfilm, etc.). The vital records copy may not be the "original." The information contained, not the medium, is most important. If the information is contained in a medium other than paper, consideration must be given to the technology required to access the information and the availability of that technology in the event of a disaster.
The Records Center (RC) can store vital records and can offer 24-hour access. In many cases, the RC may be the best place to store records for protecting the department's or institution's financial and legal rights, but not the best place for emergency operating records, unless housed in a special and separate location within that facility.
Developing a Plan
Developing a Plan
- Review the current status of any vital records program in your office.
- Identify what is to be accomplished.
- Outline how the program will be developed and administered.
Forms to list vital functions and records supporting those functions.
- Categories may include part or all of a records series or group of records.
- Examples: personnel records, system documentation, credential files
For plan implementation, get approval from the highest level of authority possible.
Coordinate with other offices, e.g. Emergency Coordinator, Facilities Management, Security, Information Management, Risk Management, etc.
Establish and assign program responsibilities, positions, I.D. badges and job descriptions. Responsibilities include:
- Facility Vital Records Officer ensures the protection of organizational vital records and oversees the vital records program.
- Facility Vital Records Liaison coordinates the vital records program in the backup position.
Communicate the vital records plan initiative to all staff.
- Announcements at management coordinators meetings, executive team meetings and in directives and postings
- Memoranda to unit chiefs and/or all staff from management
- Newsletters
- Email announcements
Develop a timeline for completion of the plan.
Identifying Vital Records
Identify essential staff to assist in vital records identification. This staff will include:
Vital records officer
Unit managers
Records coordinators/liaisons
Local emergency operations officer
After identifying your staff, you鈥檒l need to brief department managers and train people who will interview temporary or student staff, if needed. With your staff, refine list of potential records documenting vital functions. These may include:
Emergency procedures
Business resumption records
Legal and financial rights records
Assessing the Threat
Review existing disaster recovery plans and consolidate where possible, then identify applicable threats and risks. Examples include:
Fire damage
Water damage
Winds, storms/tornadoes
Earthquake
Sabotage or terrorism
Human error or carelessness
Building or equipment failure
Power loss or electric surge
Insects, rodents or other pests
Mold and mildew
Media deterioration or break-down
Civil emergencies (riots, war, etc.)
Selecting Protection Methods
Review completed questionnaires and forms, then compare the list of vital records to the records retention authorizations to determine if the retention of the records have a bearing on decisions on how the records will be protected. For example, if the records are permanent and are microfilmed, microfilm copies may be the best protection method.
Assess current on-site storage and practices. For example, there may already be fire-resistant cabinets in use for other reasons that could be used for vital records protection.
Determine which records:
Have "built-in" duplication or dispersal and identify the location(s) and media format.
Need to be duplicated and stored off-site and identify the type of duplication.
Need to be stored in fire-resistant equipment on-site.
Have special considerations such as records with confidential business information (CBI) or other sensitive information.
Create a resource list of disaster recovery firms in your geographic area. Talk to Risk Management and determine response times, approaches and capabilities of those firms contracted by the University's insurance company. Update the information at least annually.
Identify "hot" and "cold" sites to accommodate electronic records, including applications for running the systems and system documentation.
Submit lists of vital records and protection methods for each type of vital record to unit managers for comments, then revise as needed. Compile final list of vital records and protection methods, and obtain approval from top management.
Implementation and Testing
Select appropriate off-site and on-site storage space and equipment. This storage space may be the Records Center, or other storage facilities or agency offices.
Purchase and maintain supplies and equipment for recovery of records after a disaster. Supplies you may need include:
Rolls of plastic sheeting
Work gloves
Protective face masks
Develop a rotation schedule and procedures for transfer of duplicates that includes who will oversee the transfer, what media will be transferred and when and how the media will be transferred. Make sure staff are trained.
Transfer backup copy of vital records to off-site and safe on-site storage equipment and test the program for one or two months prior to drafting final plan. For testing, choose one or two departments and include drills on equipment use, supplies and procedures for recovery of records on all media. Be sure to rotate duplicates on a predetermined schedule.
Upon successful completion of the testing, implement the program throughout the facility.
Documenting the Program
Identify each facility's vital records procedures by highlighted tabs in each plan manual and include a list of the vital records with location and method of protection. The facility's Continuity/Disaster Plan is not complete without the Vital Records Protection and Retention Plan.
Write 鈥淔inal Report鈥 on the development, implementation, testing and management of your two-fold vital records and disaster prevention plan manual. A possible title for your final report: Disaster Recovery and Vital Records Protection Plan Manual. A copy of the complete plan should go to each facility department, top management, off-site backup, Fire and Police Departments, all team leaders, other team members and a copy to Campus Archives.
Maintaining the Program
Transfer duplicates of vital records to off-site and on-site storage facilities (hot site and cold site) on an ongoing basis according to an established rotation schedule. Be sure to dispose of duplicates that have reached their destruction date as directed by the rotation/retention schedule.
Perform periodic audits and testing of the plan and established procedures (once a year or more).
Identify and evaluate alternate protection techniques as they become available.
Identify additional records to be included or records to be removed from the program.
Simulate a disaster (desktop exercises).
Retrieve the necessary records.
Ensure the capability of re-establishing operations from the backup resources.
Additional Resources
For more information, here is a selected list of other resources for vital records and disaster recovery.
, PO Box 116, Jefferson City, MO 65102, (573)526-9113.
.
, PO Box 510110, St. Louis, MO 63151, (314)894-0276.
Disaster Recovery Yellow Pages (Eighth Edition) by Dr. Steven Lewis. The Systems Audit Group, Inc., 1999. For this listing, see UM Records Management (in-house resource). Information on the publication can be found on the.
Emergency Management for Records and Information Programs by Virginia A. Jones, CRM and Kris E. Keyes. ARMA International, 1997. Information on the publication can be found on the .
Disaster Prevention and Response for Special Libraries: An Information Kit by Miriam Kahn. Special Libraries Association, 1995. For information on this author, contact UM Records Management. Information on this publication can also be found on the .
Total Contingency Planning for Disasters by Kenneth N. Myers. Wiley, 1993. Information on the publication can be found on the .
Vital Records - A Guideline by ARMA International Standards Vital Records Task Force. ARMA International, 1993. Information on the publication can be found on the .
: Instructional Guide, National Archives and Records Administration.