Compliance profile

1

Record Type

compliance.recordType

Known record type (select from controlled vocabulary). Retention and disposal policies in different states may vary by record type.

1

Record Type Controlled Vocabulary  

The record types of the CSH project documents are already defined.

This will be coded via a lookup on the finding aid.

2

Retention Schedule

compliance.retentionSchedule

RetentionSchedule

Retention period for the document. Retention periods may be specified as a combination of initiating event, duration, and terminating event.

0-1

3

Disposition

compliance.disposition

Disposition 

Details about mechanisms for destroying or transferring custody of a document after the retention period has ended.

0-1

4

Access

compliance.access

Array of Access

Information about demographics or user roles that may access this record.

0-1

1

Authority

compliance.retentionSchedule.authority

Authority

The agency or legislature that defines the governing retention schedule

1

2

Initiating Event

compliance.retentionSchedule.initiatingEvent

An event that signifies the beginning of a retention period

0-1

Creation

Last Action

Death of patient

Does it make more sense to not separate the events and duration? → What would it look like if they were combined? In my mind, they convey very different info. (Lorrie)

@Lorrie: So, the combined would be exactly what appears in a typical retention schedule: for example, "5 years after last action" or "30 years after death of the patient"

3

Duration

compliance.retentionSchedule.duration

The duration of time the document must be retained for after the initiating event.

0-1

75 years

6 years

20 years

4

Terminating Event

compliance.retentionSchedule.terminatingEvent

An event that signifies the end of a retention period. At the end of this period the holding institution must dispose of this document in a the manner specified by .compliance.retentionSchedlue.authority (see compliance.disposition).

0-1

What would be an example of this? (Lorrie)

@Lorrie: We have not seen an example in the Virginia or Texas schedules but I expect it will be something like: for example, "death of the patient", which will indicate that the record must be preserved till the death of the patient.

Since we are only dealing with inactive records, I imagine that "death of patient" would not be an example that we would come across, but rather something more like "End of 25 year retention period."

@Lorrie: Certainly a much better example

5

URL

compliance.retentionSchedule.url

Address of a Web-accessible format for the retention schedule.

0-1

6

Effective Date

compliance.retentionSchedule.effectiveDate

The date on which the retention schedule went (or will go) in to effect

0-1

Extended Date-Time format: EDTF (LoC)

20050704T071530-0500 [July 4, 2005 at 7:15:30 a.m. EST]

2006-07-16T19:20:30+01:00

20050705T0715-0500/20050705T0720-0500 [from 7:15 a.m. EST to 7:20 a.m. EST on July 4, 2005]

2004-03-17 [March 17, 2004, only the date is known]

Recommended practice is to record the most specific time possible and to designate the time zone. → If we are talking about retention of the physical records (and not born-digital or digitized records), we would not be able to have very specific times. E.g., at best, we would know the day that a patient died. (Lorrie)

@Lorrie: Based on past conversation, we are NOT designing a schema for physical records. All our metadata pertains to the digital masters. We can revisit this decision if we need to but a chance would then cause us to change other profiles–technical, preservation, descriptive, and so on... our current working principle is that when retention schedules don't specify formats, these schedules apply to physical and digital formats. This may not be true but it's the best approach we have at this point.

To clarify what I was thinking, wouldn't the retention schedules for the digitized objects be the same as they are for the physical objects that they are copies of? So, if a physical record's retention period is for 25 years, wouldn't it be the same for the digital version?

 @Lorrie: Thanks for the clarification. I see what you are getting at. This field is for the date on which the RETENTION SCHEDULE went (or will go) into effect, NOT the date of the date of the records.

7

Notes

compliance.retentionSchedule.notes

Array

Other notable information related to this retention schedule. As there may be several such notes attached, these must be included in an array.

0-1

1

Authority

compliance.disposition.authority

Authority

The agency or legislature that defines the governing disposition process or mechanism.

1

2

Method

compliance.disposition.method

The disposition method as specified in compliance.disposition.authority

0-1

Confidential Destruction

3

URL

compliance.disposition.url

Address of a Web-accessible format for the disposition document

0-1

4

Effective Date

compliance.disposition.effectiveDate

The starting date from which the disposition document is in effect

0-1

Extended Date-Time format: EDTF (LoC)

20050704T071530-0500 [July 4, 2005 at 7:15:30 a.m. EST]

2006-07-16T19:20:30+01:00

20050705T0715-0500/20050705T0720-0500 [from 7:15 a.m. EST to 7:20 a.m. EST on July 4, 2005]

2004-03-17 [March 17, 2004, only the date is known]

Recommended practice is to record the most specific time possible and to designate the time zone.

5

Notes

compliance.disposition.notes

Array

Other notable disposition-related information. As there may be several such notes attached, these must be included in an array.

0-1

1

Demographic

compliance.access.demographics

Array

The demographics permitted to access the document. As mutiple demographics may be mentioned, these values must always be recorded as arrays.

1

Demographic Controlled Vocabulary  

Perhaps add an option of "authorized personnel" (e.g., medical staff) only? Also, we may also want to add "public," which could be different from a researcher who received permission from a Privacy Board. (Lorrie)

@Lorrie: We are basing these controlled vocabularies on the classification that @Victor O Obaseki developed based on the the demographics found in the rules or statutes of Virginia and Texas. We expect that an implementing project will add more terms to the vocabulary to reflect the scenarios in their state. We have not yet come across mentions of public or "authorized personnel" in Virigina or Texas statues but remain open to adding any demographics that are mentioned in the rules of these states.

I was thinking specifically of HIPAA and the modification to the Privacy Rule in which individually identifiable health information of individuals who have been deceased for more than 50 years is not considered protected health information even if the records are held by a covered entity. I don't think the "public" is ever specifically mentioned, though.

 @Lorrie: Those are good points but I need help connecting them to this specific field. This property records the demographics that may be mentioned in the statutes or the rules (hence the controlled vocabulary below has two possibilities: researchers and families). We could always add more or remove what's there.

1

Name

compliance.[property].authority.name

The agency, department, or legislature that has created the related policy

1

Dept. of Behavioral Health and Development Services

I agree with Pat that we should also consider the possibility of family members requesting greater restrictions than what is called for by law. (Lorrie)

@Lorrie: General access policies are best left to a different profile. The compliance profile is specific to reflecting the rules and statues as defined by the governing authority

2

URL

compliance.[property].authority.url

The website for the authority (agency, department, or legislature)

0-1

http://www.dbhds.virginia.gov/

3

Affiliation

compliance.[property].authority.affiliation

The jurisdiction of operation for the authority

0-1

VA

We can potentially have a controlled vocabulary of states

1

Administrative Document

admin-doc

A document that contains details regarding operations

Series I - Minutes

Series II - Annual Reports

Series IV - Finances

2

Register Log

register-log

A document that contains logs of certain events

Series V - Patient Registers

Ward books

Records of Application and Admission

Correspondence