A. Storage of Physical Records
- Physical Records may be stored on-site or must be stored at an off-site storage facility managed by a vendor that has been approved, executed a contract with Altair to provide off-site storage (Approved Vendor). An off-site storage facility managed by an Approved Vendor is referred to in this Standard as an “Off-site Storage Facility.”
- Physical Records must be stored to ensure their protection, usability, and integrity for the required retention period.
- Filing cabinets or other types of stationary storage must not damage the Physical Records during storage.
- Boxes, containers, or other packaging must be packed to withstand the handling and pressure exerted by the contents during storage or transfer between locations.
- Physical Records must be stored in a location that:
- Provides adequate fire protection and suppression
- Protects against risk of theft
- Is protected against possible damage as a result of being located:
- In a flood zone
- Under a fire sprinkler
- In a damp or moist location or subject to mold
- In an area exposed to rodent or insect infestation
- Exposed to temperatures above 70° F (21.11° C)
- In a humidity level below 30% and greater than 50%
- Physical Records stored in an on-site location that does not meet the requirements in 4 (containerized) and 5 (physically secure) above, must be relocated at the earliest opportunity to a location that meets the requirements.
- Physical Records must be reviewed annually to determine whether the applicable Trigger Event has occurred. If the Trigger Event has occurred, the retention period begins, and the physical records enter the Inactive Phase of the records lifecycle. If the Trigger Event has not occurred, the physical records are in the Active Phase.
- Records in the ACTIVE PHASE may be transferred to an Off-site Storage Facility if there is a lack of adequate space to store the records in On-site locations that meet the requirements listed above.
- Records in the INACTIVE PHASE:
- Must be moved to an Approved Vendor Off-site Storage Facility.
- Must be destroyed at the end of the retention period specified, provided the records are not subject to a legal hold.
C. Restricted Records
Physical Records classified as Restricted Records must be stored in a manner that permits immediate access before, during and after an emergency, crisis, or abnormal condition.
D. Transferring Physical Records to and from an Off-Site Storage Facility
All Personnel must comply with the following:
- Physical Records containing internal, confidential, restricted, or privileged information must be labelled and clearly identified on the Records Transmittal form.
- Only Physical Records may be sent to an Off-site Storage Facility. Duplicate and non-records must be stored On-site and should be retained for a maximum of three years if necessary to perform and complete a valid business function and must not be retained longer than the original record, unless subject to a legal hold.
- Requests to transfer Physical Records to an Off-site Storage Facility must be made in compliance with GOV-7104P-01, “Sending Physical Records to Off-Site Storage Procedure”.
- The transfer of Physical Records must be prepared in compliance with GOV-7104P-01-JA01, “Preparing a Box of Records for Transfer.”
- Request to retrieve Physical Records from an Off-site Storage Facility must be made in compliance with GOV-7104P-01-JA02, “Box Retrieval Request.”
- Retrieval records must be approved by the supervisor of the requestor.
- Physical Records may only be released and transferred to the Off-site Storage Facility by Approved Vendor personnel showing proper identification.
- Personnel who have received retrieved records must:
- Acknowledge receipt of the records by sending an email to [Records Custodian].
- Notify the [Records Custodian] when the records they requested are transferred to another person, location or Department within Altair-owned or -leased premises.
- Physical Records that have been retrieved from an Off-site Storage Facility must be returned to the Approved Vendor.
E. Physical Records Disposition
Personnel must follow the procedures for destruction of records if the retention period expired.
- Physical Records not subject to a legal hold must be destroyed at the end of the applicable retention period.
- Physical Records that have been retrieved from an Off-site Storage Facility must be returned to the Approved Vendor for destruction.
- Before Physical Records can be destroyed, personnel must notify the respective client contact via email.
- Physical Records stored On-site that can be destroyed must be placed in secure shred-bins, not in trash or recycle bins.
- Prepare a certificate of destruction sufficient to identify the particulars (client, relocating customer, dates of service, file number, etc.