Records Security and Information Privacy

Chapter 12: Records Security and Information Privacy
http://web.archive.org/web/20050301010413/http://xnet.rrc.mb.ca/recmgmt/chapter12.htm

Records security and information privacy

Content security

• Provision for the protection against intentional destruction, disclosure, modification, or breach of confidentiality of information
• Based on principal people have right to decide what personal information they wish to divulge, to whom and for what purpose. People have right to expect the information will be kept private and used only for purposes for which it was obtained.
• Growing proliferation of electronic databases containing personal information
• Government: health, income tax, census, military, etc.
• Private sector: credit cards, affinity cards, etc.
• Information highway: integrated computer, communication, and cable/satellite TV networks
• Need to balance need for access with protection from unauthorized users

Canadian privacy legislation

• Officer of the Privacy Commissioner of Canada http://www.priv.gc.ca/index_e.asp

Access to information act

• Access to Information and Privacy Homepage
  https://www.tbs-sct.gc.ca/atip-aiprp/index-eng.asp
• In order to help requestors find government records and determine where to send their requests, the Access to Information Act and the Privacy Act require each government institution subject to the two Acts to describe the nature of their records in Infosource http://infosource.gc.ca

PIPEDA

• Personal Information Protection and Electronic Documents Act
• All Canadian Provinces were to pass like legislation by January 1, 2004 or fall under the Federal Legislation
• Electronic and paper documents are equivalent

Manitoba Privacy Legislation

• Freedom of Information and Protection of Privacy Act (FIPPA) http://www.gov.mb.ca/chc/fippa/index.html
• Personal Health Information Act (PHIA) https://www.gov.mb.ca/health/phia/index.html

Voluntary Organizational Protection

• Voluntary programs by businesses are emerging in the private sector
• Altruistic motives
• Voluntary compliance to head off legislated compliance
• Self protection from law suits for the breach of confidentiality and invasion of privacy
• Voluntary Privacy Codes http://web.archive.org/web/20100211204326/http://www.ic.gc.ca/eic/site/oca-bc.nsf/eng/ca01361.html
• The following Associations are examples of Canadian organizations which have developed important voluntary codes dealing with privacy:
• Canadian Association of Internet Providers
• Canadian Bankers Association
• Canadian Marketing Association
• Canadian Medical Association
• Insurance Bureau of Canada

Security management

• Establish objectives
• Define responsibilities
• Assess risk
• Establish into security policies and procedures
• Audit, monitor, and evaluate security management

Area and facility access

• Security measures vary from organization to organization
• System of controlled access must be established to maintain safeguards against unauthorized invasion of equipment and records
• Primary criterion for entrance: admit only those whose work requires access

Types of access controls

• Keys
• Easily duplicated and lost
• Anyone can use
• Lock itself vulnerable
• Electric, electronic, or mechanical entry (keypad systems)
• People forget the code or record it where others may find it and use it
• Combination can be shared easily
• Vulnerable to electronic lock picking
• Plastic cards with coded strips
• Card can be lost (should carry no ID which allows finder to know what it unlocks)
• More difficult to duplicate
• Biometric and physical attributes
• Match individual characteristics electronically
• Biometric devices: fingerprints, voice, chromosomes in strand of hair, retinal eye patterns
• Combination systems

Audit trails

• Ability to record an audit trail of all access attempts can be built into many of the area and facility access systems
• Printouts showing who has had access, date and time of entry, unauthorized entry attempts, etc.
• Useful in monitoring access system

Equipment access

• Procedures for controlling theft and unauthorized access must be provided
• Keep current inventory including date of purchase, serial no., cost
• Tag with ID no. both inside and out
• If employees can borrow have sign out system with due dates for return
• Supervise and monitor equipment use during breaks, lunch, after hours
• Train building security guard to check for computer equipment, etc.
• Need to balance security with employee privacy rights

Security devices

• Cables
• Locking cabinets
• Computer alarms
• Anchoring pads

Paper document access

• Desirable to have central source with one person responsible for compliance with company guidelines
• Guidelines to be written, disseminated and enforced

Typical procedures

• Review of personal record
• 2 pieces of ID, completion of authorization form
• Copy of personal record
• 2 pieces of ID, completion of authorization form, plus signature for receipt of copy
• Company employee
• Signature on receipt for copy, or signature on a log identifying record logged out
• Request by mail
• Verify legitimacy; obtain written permission for release when necessary
• Highly confidential records
• Check requestor’s name against “authorized to see” list
• All other requests
• Records manager or designee must grant authorization on case-by-case basis
• Signature on log or request form

Electronic files access

• The bigger you get and the more private information that you maintain online, the more of a target you become to hackers. Hackers may be after your private information, but they may also be after the notoriety that comes with cracking your site.
• Security breaches can be caused by problems with the technological systems that you use, but they can also be caused by negligent staff

Security measures

• Firewalls
• hardware and/or software that controls information entering your computer system or network
• Intrusion detection software
• detects unauthorized intrusions into your computer systems
• Encryption
• a security method that transforms information into random streams of bits to create a secret code. There is software-based encryption such as Public Key Infrastructure (PKI) and Secure Sockets Layer (SSL). Hardware-based encryption, such as smart cards, is another type of encryption.
• PKI
• the combination of software, encryption technologies, and services that enables enterprises to protect the security of their communications and business transactions on the Internet.
• SSL
• a program layer created by Netscape for managing the security of message transmissions in a network
• Smart card
• a plastic card resembling a credit card that contains a computer chip, which enables the holder to perform various operations, including limiting access to individual computers to legitimate users

Nonremovable media security

• To prevent access to data stored on hard disks must control access to equipment
• Assigned numeric code for each person, a password or combination of the two

Removable media security

• Key and lock for disks
• Deny access to employees who resign, then immediately change access codes
• Encrypt (scramble) sensitive and confidential files
• Mutilate or erase disks before disposal
• Turn off modems when not in use
• Turn off computers when not in use so unauthorized users cannot access files

Virus protection

• Use and update antivirus software
• For further information on computer security see: 
• NIH Computer Security Awareness Training Course http://irtsectraining.nih.gov/

Records classification

Class	Definition	Example	Recommended Protection
Class 1 - Vitals	Records essential to the continued life of the business. These records are irreplaceable because they give evidence of legal status, ownership, and financial status.  Vital records are generally housed in active records storage.	Accounts receivable Inventory Contracts Creative materials Research records	Fire resistant vaults Dispersal Fire resistant safes/cabinets
Class 2 -Important	Records necessary to the continued life of the business.  While these records can be replaced or reproduced, this can be done only at considerable time and money. Important records can be housed in either active or inactive storage.	Accounts payable Directives Payroll records	Safes Vaults
Class 3 - Useful	Records useful to the uninterrupted operation of the business. These records are replaceable although their loss could cause temporary inconvenience.	Bank statements Correspondence	File cabinets
Class 4 - Nonessential	Records having no present value and should be destroyed.	Requests answered Advertisements Announcements	Use, then destroy

Source: Gordon P. McKinnon, editor. Fire Protection Handbook, 15th ed. (Boston : National Fire Protection Association, 1981).

Recovery priority by types of records media

Recovery Priority by Type of Records Media from http://www.arma-gla.org/presentation/2001-02/armafeb20workshop2.pdf

			Salvage techniques
Media	Recovery priority	Initial action	Initial purpose	Follow-up action	Follow-up purpose	Comments
Magnetic media Magnetic tapes Disc packs Floppy diskettes and disks Flexible disks Audio and video tape cassettes CD-ROM Computer Output Laser Disk&	Immediately	Contact vendor	To obtain professional advice	May include freeze or vacuum drying, special cleaning techniques professional assistance in retrieving data	To remove all moisture and other contaminants from the media, to access data in case of damaged media	Such advice should be sought well in advance of a disaster. Contingency plans for data and word processing groups may be advisable. Heat and water damage to media may result in subsequent damage to hardware or irretrievability of data. Proper backup and salvage procedures are essential. It is worth noting that such records are among the easiest to duplicate and share off-site.
Photographic materials Colour film and photographs	Immediately	Once wet, keep wet	To avoid further damage and image toss			Colour dyes are inherently unstable and should be handled immediately to prevent loss of colour and other damage
	Within 48 hours	Obtain professional advice and/or assistance with cleaning, drying and restoring		Freeze if professional help must be delayed longer than 48 hours	To stabilize color dyes
Silver or emulsion films and photographs	Immediately within 48 hours	Immerse totally in water. Formaldehyde to a 1% solution, may be added to cool, clean water. One tablespoon of salt may be added to hard water.	To avoid further damage. To avoid softening or filling of gelatin or emulsion layer. If materials are allowed to dry out, they tend to stick to adjacent surfaces, with image loss and other damage.	Seek professional advice and help with cleaning and drying. Freeze only if necessary.	To restore films to original state. Freezing may lead to image damage, but less damage is likely to be caused by freezing than by delayed treatment.
Diazo or vesicular (duplicate) films	Last	If time and staff are available, rinse off and lay out to dry, otherwise, leave until last.	To prevent water sooting and curting of films and fiche.	Wash with liquid detergent and rinse and lay out on absorbent paper to dry.	To remove water spots and other contaminants and to restore film.	Diazo and vesicular films are nearly impervious to water damage and should clean-up easily. Diazo films sometimes fade with age. Fading or other damage discovered after the disaster can be related to poor quality control rather than to the disaster.
Paper Bond, rag, duplicating other	Within 48 hours (depending on temperature and humidity levels at disaster site and on extent of damage). In fires, paper is least vulnerable media.	Air dry in well ventilated area: if volume of wet records is large, consider freeze or vacuum drying.	To prevent further deterioration of paper materials and eruption of mold and fungus.	May include freeze or vacuum drying. If mold erupts, treat with fungicides. May place paper towels or newspaper print between wet pages.	To remove moisture from materials and to reduce humidity levels in damaged materials: to eradicate mold.	In high humidity levels, deterioration of wet paper records can begin within 2-3 hours.
Coated or clay paper	Immediately	Freeze	To hold damaged materials until freeze or vacuum drying can be arranged.	Freeze or vacuum drying.	To remove all moisture from paper, without damaged or removing coated surface.	Freeze or vacuum drying is the only successful recovery technique for this medium.

Vital records, disaster prevention and recovery

Vital records, disaster prevention and recovery http://web.archive.org/web/20041224122434/http://xnet.rrc.mb.ca/recmgmt/chapter11.htm

Vital records: disaster prevention and recovery

Vital records

• Business records must be protected from disaster
• 60% of organizations experiencing a business closure of >2 days go out of business within one year

Identification and analysis of vital records

• Vital records (essential records) – those records essential to the continued life of a business, also called class 1 records
• May take any form
• Hard copy, magnetic tape, microform, optical disk, etc.
• May be active or inactive records
• “A Vital Records Program is a systematic method of selecting, protecting, and having available at time of emergency:
• records considered essential to the continued operation of an agency or business, commensurate with its emergency responsibilities
• records require to protect rights of individuals and the government, and
• records that are absolutely essential to reconstruction.”
• The ID of vital records and the implementation of the protection program for them evolves from the records inventory
• Vital records normally comprise 1 to 5% of an organization’s records

Organization analysis

• Organization analysis – management must determine vital functions or organization a functional organization chart is helpful
• Ask: “What information and/or records are needed to resume business immediately following a disaster?”

Classification of vital records

• Records are classified as vital, important, useful, or nonessential
• Read: Disaster Preparedness & Response Appendix B, p. 38 http://www.arma-gla.org/presentation/2001-02/armafeb20workshop2.pdf

Determining physical volume of records by class

• Paper
• How many square feet of shelf space occupied?
• How many file drawers with records and the square footage of these file drawers?
• How much total space required for Class 1(vital), 2 (important), and 3 (useful) records?
• What should be done with Class 4 (nonessential records)?
• Vital records in electronic form, gather for each record series
• Series title
• Storage media and other physical characteristics
• Location
• Method of protection
• Security requirements
• Brief rationale for categorizing series as vital

Determining space needed to house inventoried records

• Based on physical volume of records by class
• How much space should be allocated for each class?
• What is estimated rate of accession at which records added to each class?
• What is rate of transfer/disposal for each class?
• How much space required if total allocation for each class included accessions and transfers?

Determining production necessary for safe records storage

• Protection for paper records and magnetic media records must be considered
• Vital records require most protection
• Fire, main hazard
• Magnetic media and their containers do not pose a more severe fire hazard than paper
• Polystyrene cases and reels pose a more severe fire hazard

Analysis of risk

• The greatest cost to the organization concerns the loss of all records classified as vital
• Evaluate the dollar cost to the organization if all records classified as vital were lost
• Repeat for all the other classes of records
• Of those organizations whose records are destroyed, 35% go out of business

Fire and other natural and human hazards

• The primary risk to records safety is fire
• Associated risk: water or chemicals used in fire containment
• Other possible elements of destruction include earthquakes, wind and rainstorms, broken water mains, mould and mildew, insects and rodents, dust, theft, and vandalism

Methods of protecting vital records

• A vital records program is more important than insurance
• Protection of the organization’s vital records ensures the continued life of the business, while insurance pays the organization after its death following a disaster
• It is virtually impossible to provide 100% risk-free protection, need to use minimum risk storage techniques

Duplication

• A method of providing a copy of an original document
• Duplicates can take the form of paper copies, roll microfilm, microfiche, magnetic tapes, or other media
• Special requirements for storage must be considered

Dispersal

• Dispersal is one method of providing a copy of an original document for records reconstruction by having copies distributed internally or externally
• Examples of external dispersal include:
• Federal income tax records
• Bank records
• Insurance policies
• Normally used with paper copies only

Vital records transfer and storage procedures

• Vital records master list identifies all vital records in each department, including
• Department name
• Storage location
• Page number
• Vital records identification code
• Vital records name
• Retention periods
• Office of record (office responsible for maintaining “official records copy”)
• Vital records protection
• Protection instructions

Transfer of vital records
Vital records can be transferred on a daily, weekly, or monthly basis.

Procedures for handling vital records

1. In case of disaster during work hours, records in use should be returned to their proper places within the files if at all possible
2. Records in use but belonging in vaults should be returned to the safe or vault at the end of each working day. Never leave out overnight.
3. Employees should not allow important records to accumulate on desks or in in-baskets.
4. Records normally protected may be unprotected when temporarily in other hands. Copies should be distributed when possible.

Electronic vital records protection

• Electronic records present special problems and should be dealt with accordingly
• Analysis of each computer application must be done
• Procedures for backup must be established
• An alternative site for the processing of data must be considered

Alternative site location methods

• Reciprocal agreement
• Cold site
• Warm site
• Vendor agreement
• Commercial service bureau
• Hot site
• Redundant site
• Electronic vaulting

Method	Characteristics	Advantages	Disadvantages
Reciprocal agreement	An agreement between two or more compatible organizations to provide computer time for each other in case of a disaster	Inexpensive; little cash outlay	Hardware and software configurations may change; both organizations may experience the same disaster; not to be used on a long-term basis
Cold site	An alternative without environmental controls or hardware	Inexpensive; may be shared by two or more organizations; long-term use	If sharing, two organizations may need at the same time
Warm site	An alternative site with environmental controls and some or all computer peripherals	More expensive; may be shared by two or more organizations; long-term use	If sharing, two organizations may need at the same time
Vendor agreement	Contracting organization uses vendor's corporate facilities	Availability, lower cost than  other options	May be available for long term use; lack of configuration compatibility; other organizations may have similar arrangements
Commercial Service Bureau	This company provides data processing facilities	Pay only for the time used, immediate availability	Variable service; possibly security problems, expensive for long-term use, may not have the time and capacity for processing needed
Hot site	Fully equipped facility on continuous standby, on a first-come, first-served basis.	Security, availability, ease of plan testing, costs may be covered through business-interruption insurance	Very high costs, possible distance from data centre
Redundant site	Duplicate of the current data centre at an alternative site run by your organization	Assured compatibility, availability, security, ease of use	Most expensive option; trying to keep both sites compatible through reconfiguration and software updates
Electronic vaulting	Backup is done on a real-time basis. Data are duplicated in real-time and transferred to an offsite but connected system.	Direct access, tape vaults with communication facilities	Very expensive, new technology for disaster recovery

Source: Adapted from Brett Balon, “Disaster Planning for Electronic Records” (Proceedings of the Association of Records Managers and Administrators International 34th Annual Conference, New Orleans, Louisiana, October 2-5, 1989)

Action plan

• Contains procedures to protect electronic records
• Action plan must be tested

Vital records protection manual

• Lists all vital records according to department and contains both vital record code number and retention date
• May be a separate document or part of another documentation manual

Salvage methods

• Water-damaged materials result from 95% of all disasters
• Need to deal with both water damage and mould
• Salvage procedures for water damaged materials
• Air-drying
• Labour and space intensive but not cheap, not recommended for coated glossy paper as in magazines (pages can easily become permanently stuck together)
• Freezing
• Stabilizes wet materials and provides time to plan course of action if completed as soon as possible to prevent deterioration 
• Vacuum drying
• not recommended as heat involved is damaging to paper and photographic materials (Microwave ovens are not recommended for same reason)
• Vacuum freeze drying
• Safest and most successful salvage method for paper but most expensive

Recovery priority by type of records media
See chart on pp. 21-22 Disaster preparedness and response http://www.arma-gla.org/presentations/2001-02/armafeb20workshop2.pdf

Additional information

• Disasters Come In All SizesThis article, from the March 2000 issue of InfoPro Magazine, talks about the basics of planning ahead for disaster recovery.
• Emergency Management for Records & Information Management Programs
  Excerpted here are two chapters, including forms and checklists, from the book Emergency Management for Records and Information Management Programs. This material focuses on the steps for responding to an emergency or disaster and for beginning the recovery of information assets. These response and recovery steps are but a small part of a comprehensive emergency management plan that organizations need to formulate in order to prepare for disasters and prevent or minimize the loss of records.

• Access both from http://www.arma.org/rim/fundamentals/index.cfm?View=other

Electronic records management

http://web.archive.org/web/20041224123926/http://xnet.rrc.mb.ca/recmgmt/chapter9.htm