HHS-OCIO Policy for Records Management

ARCHIVED 2024-03-23, DATE APPROXIMATE · VERSION 20240323_rev01 · COMPARED WITH 20231110_rev01

Full text changes — 20231110_rev01 to 20240323_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

+**Document #:** HHS-OCIO-PIM-2020-06-004
+**Version #:** 2.0
+**Last Reviewed:** May 2020
+**Next Review:** May 2023
+**Owner:** OCIO/PIM
+**Approved By:** Jose Arrieta, Chief Information Officer (CIO)
+**Document #:** HHS-OCIO-CDO-2024-02-001
+**Version #:** 3.0
+**Last Reviewed:** February 2024
+**Next Review:** February 2027
+**Owner:** OCIO/CDO
+**Approved By**: Jennifer Wendel, Acting HHS Chief Information Officer (CIO)
 ## Table of Contents
 . [Nature of Changes]()
 . [Purpose]()
 . [Background]()
 . [Scope]()
 . [Authorities]()
 . [Policy]()
+    - [6.1 Records Management]()
+    - [6.2 Records Maintenance]()
+    - [6.1 Records Lifecycle]()
+    - [6.2 Electronic Records Management]()
     - [6.3 Essential Records]()
     - [6.4 Social Media Records]()
+    - [6.5 Text Messaging Records]()
+    - [6.5 Freedom of Information Act (FOIA)]()
     - [6.6 Control and Custody of Records]()
+    - [6.7 Unlawful or Accidental Removal or Destruction of Records]()
+    - [6.8 Formal Evaluations]()
+    - [6.9 Training]()
+    - [6.7 Transferring and Departing Staff Records]()
+    - [6.8 Unlawful or Accidental Removal or Destruction of Records]()
+    - [6.9 Formal Evaluations]()
+    - [6.10 Training]()
 . [Roles and Responsibilities]()
     - [7.1 HHS Secretary]()
     - [7.2 HHS Assistant Secretary for Administration (ASA)]()
     - [7.3 HHS Chief Information Officer (CIO)]()
+    - [7.4 Agency Records Management Officer (ARO)]()
+    - [7.5 OpDiv Chief Information Officers (CIOs)]()
+    - [7.6 HHS Chief Information Security Officer (CISO)]()
+    - [7.7 OpDiv Chief Information Security Officers (CISOs)]()
+    - [7.8 OpDiv Records Management Officers (ROs)]()
+    - [7.9 OpDiv Records Managers (RMs) and Records Liaisons (RLs)]()
+    - [7.10 OpDiv Records Custodians (RCs)]()
+    - [7.11 Managers and Supervisors]()
+    - [7.12 Contracting Officers (COs) and Contracting Officer Representatives (CORs)]()
+    - [7.13 HHS Employees, Contractors, Interns, and Fellows]()
+    - [7.14 Freedom of Information Act (FOIA) Official]()
+    - [7.15 Office of the General Counsel (OGC)]()
+    - [7.16 Office of the Inspector General (OIG)]()
+    - [7.17 IT Infrastructure and Operations and System Managers]()
+    - [7.4 HHS Chief Data Officer (CDO)]()
+    - [7.5 HHS Chief Information Security Officer (CISO)]()
+    - [7.6 Agency Records Officer (ARO)]()
+    - [7.7 OpDiv and StaffDiv Heads]()
+    - [7.8 OpDiv Chief Information Officers (CIOs)]()
+    - [7.9 OpDiv Chief Information Security Officers (CISOs)]()
+    - [7.10 OpDiv Records Officers (ROs)]()
+    - [7.11 OpDiv and StaffDiv Records Managers (RMs) and Records Liaisons (RLs)]()
+    - [7.12 OpDiv and StaffDiv Records Custodians (RCs)]()
+    - [7.13 Managers and Supervisors]()
+    - [7.14 Contracting Officers (COs) and Contracting Officer Representatives (CORs)]()
+    - [7.15 HHS Employees, Contractors, Detailees, Interns, and Fellows]()
+    - [7.16 Freedom of Information Act (FOIA) Official]()
+    - [7.17 OpDiv and StaffDiv Controlled Unclassified Information (CUI) Points of Contact]()
+    - [7.18 Office of the General Counsel (OGC)]()
+    - [7.19 Office of Inspector General (OIG)]()
+    - [7.20 IT Infrastructure and Operations and System Managers]()
 . [Information and Assistance]()
 . [Effective Date and Implementation]()
 . [Approval]()
+. [Concurrence]()
 [Appendix A: Procedures]()
 [Appendix B: Standards]()
 [Appendix C: Guidance]()
 [Glossary and Acronyms]()
 - * *
 ## 1\. Nature of Changes
+This _U.S. Department of Health and Human Services (HHS) Policy for Records Management_, herein referred to as _Policy_, updates and supersedes the previous version (HHS-OCIO-2016-0004-002, dated June 22, 2016).
+This _U.S. Department of Health and Human Services (HHS) Policy for Records Management,_ herein referred to as _Policy,_ updates and supersedes the previous version (HHS-OCIO-PIM-2020-06-004, dated June 12, 2020) and the HHS Policy for Implementing Electronic Mail (Email) Records Management (HHS-OCIO-PIM-2020-06-005, dated June 4, 2020).
 ## 2\. Purpose
+The purpose of this _Policy_ is to establish the principles, responsibilities, and requirements for managing HHS records. This _Policy_ provides the framework for records management program guidance and operating procedures. This _Policy_ does not address the supplemental preservation requirements for records associated with litigation, investigations, and audit matters.
+The purpose of this _Policy_ is to establish the principles, responsibilities, and requirements for managing HHS records. This _Policy_ provides the requirements for creating, maintaining, using, and dispositioning records, regardless of media, while protecting and safeguarding HHS records and information within HHS's approved electronic records management systems. This _Policy_ also provides the framework for records management program guidance and operating procedures.
 ## 3\. Background
+The Federal Records Act of 1950 (The Act) defines a record as: All recorded information, regardless of form or characteristics, made or received by a federal agency under federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them, excluding library and museum material made or acquired and preserved solely for reference or exhibition purposes; or duplicate copies of records preserved only for convenience. 44 U.S.C. § 3301(a)(1)(A)-(B) (2008).[1]()
+The Federal Records Act of 1950 (FRA), as amended, defines a record as: All recorded information, regardless of form or characteristics, made or received by a federal agency under federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them, excluding library and museum material made or acquired and preserved solely for reference or exhibition purposes; or duplicate copies of records preserved only for convenience. 44 U.S.C. § 3301(a)(1)(A) and (B).[1]()
+The Act requires all federal agencies to create and preserve records that document the agency's organization, function, policies, decisions, procedures, and transactions. These records must be managed in accordance with subchapter B, chapter XII, of Title 36, Code of Federal Regulations (CFR) and chapters 29, 31, 33, and 35 of Title 44, United States Code (U.S.C.). The Act calls for agencies to establish a records management program consisting of policies, procedures, and activities to manage recorded information. The Presidential and Federal Records Act Amendments of 2014 modernize records management by requiring the transfer of records from federal agencies to the National Archives and Records Administration (NARA) in digital or electronic form to the greatest extent possible.
+The FRA requires all federal agencies to create and preserve records that document the agency's organization, function, policies, decisions, procedures, and transactions. These records must be managed in accordance with subchapter B, chapter XII, of Title 36, Code of Federal Regulations (C.F.R.) and chapters 29, 31, and 33 of Title 44, United States Code (U.S.C.). The FRA calls for agencies to establish a records management program consisting of policies, procedures, and activities to manage recorded information. The Presidential and Federal Records Act Amendments of 2014 modernize records management by requiring the transfer of records from federal agencies to the National Archives and Records Administration (NARA) in digital or electronic form to the greatest extent possible.
+Records are managed using the three phases of the records lifecycle:
+Effective and efficient management of records provides the information foundation for decision-making at all levels, mission planning and operations, personnel services, Congressional and legal inquiries, business continuity, and preservation of U.S. history.
+. Creation or Receipt
+. Maintenance and Use
+. Disposition - Dispose or destroy (temporary records) or transfer to NARA (permanent records)
+Effective and efficient management of records provides the information foundation for decision-making at all levels, mission planning and operations, personnel services, legal inquiries, business continuity, and preservation of U.S. history.
 ## 4\. Scope
+This _Policy_ applies to all HHS components, as well as organizations conducting business for or on behalf of HHS through contractual, grant-making, or other relationships. HHS Operating Divisions (OpDivs) and Staff Divisions (StaffDivs) must adopt and implement this _Policy_, or may create a more restrictive policy, but not one that is less restrictive or less comprehensive than this _Policy_.
+This _Policy_ applies to HHS employees, contractor personnel, grant recipients, detailees, interns, and other non-government persons supporting HHS. All organizations collecting or maintaining information or using or operating information systems on behalf of [2]() the Department are also subject to the stipulations of this _Policy_. The Records Management Program promotes standard processes, procedures, practices, and guidelines that ensure the proper handling of HHS records in accordance with applicable law and NARA guidelines. Adherence to this _Policy_ will ensure that all HHS records are maintained in accordance with federal laws, standard business practices, and all regulatory requirements.
+This _Policy_ does not supersede any other applicable law or higher-level agency directive or policy guidance.
+This _Policy_ also applies to all HHS components, as well as organizations conducting business for or on behalf of HHS through contractual, grant-making, or other relationships. The requirement to comply with this _Policy_ must be incorporated in the language of each applicable contract, grant, or memorandum of agreement.[3]()
+This _Policy_ also applies to HHS employees, contractor personnel, grant recipients, interns, and other non-government persons supporting HHS. All organizations collecting or maintaining information or using or operating information systems on behalf of the Department are also subject to the stipulations of this _Policy_. Compliance with this _Policy_ must be incorporated into applicable contract, grant, or memoranda of agreement language under separate cover, as appropriate.[2]()
+HHS Operating Divisions (OpDivs) and Staff Divisions (StaffDivs) must adopt and implement this _Policy_, or may create a more restrictive policy, but not one that is less restrictive or less comprehensive than this _Policy_.
+This _Policy_ does not supersede any other applicable law or higher-level agency directive or policy guidance_._
 ## 5\. Authorities
 Authorities include:
+. [Agency Records Management Responsibilities, 36 CFR, Chapter XII, Subchapter B (2011)](https://www.ecfr.gov/cgi-bin/text-idx).
+. [Unlawful of Accidental Removal, Defacing, Alteration, or Destruction of Records, 36 CFR, Chapter XII, Subchapter B, §§ 1230.1 - 1230.18 (2011)](https://www.ecfr.gov/cgi-bin/text-idx).
+. [Electronic Records Management, 36 CFR Chapter XII, Subchapter B, §§ 1236.2 - 1236.36 (2011)](https://www.ecfr.gov/cgi-bin/text-idx).
+. [Damage to, Alienation and Unauthorized Destruction of Records, 36 CFR Chapter XII, Subchapter B §§ 1228.100 - 1228.106 (2009)](https://www.govinfo.gov/content/pkg/CFR-2009-title36-vol3/pdf/CFR-2009-title36-vol3-part1228-subpartG.pdf).
+. [Public Money, Property or Records, 18 U.S.C. § 641 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title18/pdf/USCODE-2011-title18-partI-chap31-sec641.pdf).
+. [Concealment, Removal, or Mutilation Generally, 18 U.S.C. § 2071 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title18/pdf/USCODE-2011-title18-partI-chap101-sec2071.pdf).
+. [National Archives and Records Administration, 44 U.S.C. §§ 2101 - 2120 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap21.pdf).
+. [Records Management by the Archivist of the United States and by the Administrator of General Services, 44 U.S.C. §§ 2901 - 2910 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap29.pdf).
+. [Records Management by Federal Agencies, 44 U.S.C. §§ 3101 - 3107 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap31.pdf).
+. [Unlawful Removal, Destruction of Records, 44 U.S.C. §§ 3106 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap31-sec3106.pdf).
+. [Disposal of Records, 44 U.S.C. §§ 3301 - 3324 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap33.pdf).
+. [Definition of Records, 44 U.S.C. § 3301 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap33-sec3301.pdf).
+. [Coordination of Federal Information Policy (Paperwork Reduction Act of 1980, as amended, Paperwork Reduction Reauthorization Act of 1995, and Government Paperwork Elimination Act), 44 U.S.C. §§ 3501 - 3549 (2011)](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap35.pdf).
+. [The Privacy Act of 1974, 5 U.S.C. § 552a (2016)](https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf).
+. [Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes, Federal Rules of Civil Procedures, Rule 34 (2014)](https://www.law.cornell.edu/rules/frcp/rule_34).
+. [Delivering Government Solutions in the 21st Century - Executive Office of the President, Reform Plan and Reorganization Recommendations (2018)](https://www.whitehouse.gov/wp-content/uploads/2018/06/Government-Reform-and-Reorg-Plan.pdf).
+. [National Archives and Records Administration (NARA) Bulletin 2010-05: Guidance on Managing Records in Cloud Computing Environments (2010)](https://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html).
+. [NARA Bulletin 2014-02: Guidance on Managing Social Media Records (2014)](https://www.archives.gov/records-mgmt/bulletins/2014/2014-02.html).
+. [NARA Bulletin 2015-02: Guidance on Managing Electronic Messages (2015)](https://www.archives.gov/records-mgmt/bulletins/2015/2015-02.html).
+. [NARA Criteria for Successfully Managing Permanent Electronic Records, (2018)](https://www.archives.gov/files/records-mgmt/policy/2019-perm-electronic-records-success-criteria.pdf).
+. [NARA Guidance on Records Management Language for Contracts (2019)](https://www.archives.gov/records-mgmt/policy/records-mgmt-language).
+. [OMB Circular A-130, Management Information as a Strategic Resource (2016)](https://www.govinfo.gov/content/pkg/FR-2016-07-28/pdf/2016-17872.pdf).
+. [OMB/NARA Directive M-12-18, Managing Government Records Directive (2012)](https://www.archives.gov/files/records-mgmt/m-12-18.pdf).
+. [OMB M-14-16, Guidance on Managing Email (2014)](https://www.archives.gov/files/records-mgmt/m-14-16.pdf).
+. [OMB/NARA Directive M-19-21, Transition to Electronic Records (2019)](https://www.archives.gov/files/records-mgmt/policy/m-19-21-transition-to-federal-records.pdf).
+. ["Public Law 113-187: Presidential and Federal Records Act Amendments of 2014", (128 Stat. 2003, Date: 11/26/2014)](https://www.govinfo.gov/content/pkg/PLAW-113publ187/pdf/PLAW-113publ187.pdf).
+. [Universal Electronic Records Management Requirements (2017)](https://www.archives.gov/records-mgmt/policy/universalermrequirements).
+. [NARA General Records Schedules (2017)](https://www.archives.gov/records-mgmt/grs.html).
+. [HHS Agency Records Control Schedules (2019)](https://www.archives.gov/records-mgmt/rcs/schedules/index.html).
+. [General Record Schedule 6.1: Email Managed under a Capstone Approach (2017)](https://www.archives.gov/files/records-mgmt/grs/grs06-1.pdf).
+. HHS Policy for Litigation Holds (2019).
+. HHS Policy for Implementing Electronic Mail (Email) Records Management (2019).
+. [HHS Policy for Rules of Behavior for Use of Information and IT Resources (2019)](https://www.hhs.gov/web/governance/digital-strategy/it-policy-archive/hhs-rules-of-behavior-for-the-use-of-hhs-information-and-it-resources-policy.html).
+. HHS Policy for Mobile Devices and Removable Media (2019)
+. [Agency Records Management Responsibilities, 36 C.F.R., Chapter XII, Subchapter B (consisting of Parts 1220 through 1232)](https://www.ecfr.gov/cgi-bin/text-idx); see, in particular:
+    (a) Scheduling Records, 36 C.F.R., §§ 1225.10 - 1225.26.
+    (b) Damage to, Alienation and Unauthorized Destruction of Records, 36 C.F.R., §§ 1228.100 - 1228.106.
+    (c) [Unlawful of Accidental Removal, Defacing, Alteration, or Destruction of Records, 36 C.F.R., §§ 1230.1 - 1230.18.](https://www.ecfr.gov/cgi-bin/text-idx)
+    (d) Transfer of Records to the National Archives of the United States, 36 C.F.R., §§ 1235.1 - 1235.50.
+    (e) [Electronic Records Management, 36 C.F.R., §§ 1236.2 - 1236.36.](https://www.ecfr.gov/cgi-bin/text-idx)
+. Controlled Unclassified Information, 32 C.F.R., Subtitle B, Chapter XX, Part 2002
+. [Public Money, Property or Records, 18 U.S.C. § 641.](https://www.govinfo.gov/content/pkg/USCODE-2011-title18/pdf/USCODE-2011-title18-partI-chap31-sec641.pdf)
+. [Concealment, Removal, or Mutilation Generally, 18 U.S.C. § 2071.](https://www.govinfo.gov/content/pkg/USCODE-2011-title18/pdf/USCODE-2011-title18-partI-chap101-sec2071.pdf)
+. [Records Management by the Archivist of the United States and by the Administrator of General Services, 44 U.S.C. §§ 2901 - 2910.](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap29.pdf)
+. [Records Management by Federal Agencies, 44 U.S.C. §§ 3101 - 3107.](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap31.pdf)
+. [Unlawful Removal, Destruction of Records, 44 U.S.C. §§ 3106.](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap31-sec3106.pdf)
+. [Disposal of Records, 44 U.S.C. §§ 3301 - 3324.](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap33.pdf)
+. [Definition of Records, 44 U.S.C. § 3301.](https://www.govinfo.gov/content/pkg/USCODE-2011-title44/pdf/USCODE-2011-title44-chap33-sec3301.pdf)
+. Government Paperwork Elimination Act (GPEA), P. L. 105-277, Title XVII, 44 U.S.C. § 3504.
+. [The Privacy Act of 1974, 5 U.S.C. § 552a.](https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf)
+. [Producing Documents, Electronically Stored Information, and Tangible Things, or Entering onto Land, for Inspection and Other Purposes, Federal Rules of Civil Procedures, Rule 34.](https://www.law.cornell.edu/rules/frcp/rule_34)
+. [NARA Bulletin 2010-05: Guidance on Managing Records in Cloud Computing Environments.](https://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html)
+. NARA Bulletin 2013-02: Guidance on a New Approach to Managing Email Records.
+. [NARA Bulletin 2014-02: Guidance on Managing Social Media Records.](https://www.archives.gov/records-mgmt/bulletins/2014/2014-02.html)
+. [NARA Bulletin 2015-02: Guidance on Managing Electronic Messages.](https://www.archives.gov/records-mgmt/bulletins/2015/2015-02.html)
+. NARA Bulletin 2023-02: Expanding the Use of a Role-Based Approach (Capstone) for Electronic Messages.
+. [NARA Criteria for Successfully Managing Permanent Electronic Records.](https://www.archives.gov/files/records-mgmt/policy/2019-perm-electronic-records-success-criteria.pdf)
+. [NARA Guidance on Records Management Language for Contracts.](https://www.archives.gov/records-mgmt/policy/records-mgmt-language)
+. NARA Universal Electronic Records Management Requirements.
+. Office of Management and Budget (OMB) Circular A-130, Management Information as a Strategic Resource.
+. [OMB/NARA Directive M-19-21, Transition to Electronic Records.](https://www.archives.gov/files/records-mgmt/policy/m-19-21-transition-to-federal-records.pdf)
+. OMB/NARA Directive M-23-07, Update to Transition to Electronic Records.
+. HHS Policy for Litigation Holds.
+. HHS Policy for Rules of Behavior for Use of Information and IT Resources.
+. HHS Policy for Mobile Devices and Removable Media.
 ## 6\. Policy
+The HHS Records Management Program establishes records management policies, standards, and procedures for maintaining HHS records and information in a manner facilitating ease of use, access, and disposition, and consistent with HHS records disposition schedules, regulations, and guidelines implemented by NARA and OMB.
 In order to maintain all HHS records in accordance with applicable statutory and regulatory requirements, each OpDiv and StaffDiv is required to establish and maintain a records management program meeting the following minimum requirements:
+### 6.1 Records Management
+### 6.1 Records Lifecycle
+Records management is the planning, controlling, directing, organizing, training, promoting, and other managerial activities related to the creation, maintenance and use, and disposition of records, carried out in such a way as to achieve adequate and proper documentation of Federal policies and transactions and effective and economical management of agency operations. (44 U.S.C. § 2901(2)).[3]()
+Proper record management practices ensure successful recordkeeping activities starting from record creation through final disposition. In compliance with the FRA and NARA regulations, HHS must establish effective management controls over the creation, maintenance and use, and disposition of federal records in any media, including but not limited to paper, email, instant messaging (IM), text messages, telephone messages (analog), voice mail messages, presentations, websites, social media, word processing documents, spreadsheets, and information systems, throughout their life cycle.
+.1.1. Electronic Records Management System (ERMS)
+.1.1. Records Creation and Receipt
+ERMS, often referred to as a records management application (RMA), is an electronic management system in which any agency records, regardless of format (paper, electronic, microform, etc.), are collected, organized, and categorized to facilitate their preservation, retrieval, use, and disposition. An ERMS:
+The FRA requires every federal agency to "make and preserve records containing adequate and proper documentation of the organization, functions, policies, decisions, procedures, and essential transactions of the agency and designed to furnish the information necessary to protect the legal and financial rights of the Government and of persons directly affected by the agency's activities."
+. Provides document content, context, and structure.
+. Ensures authenticity, integrity, and reliability - i.e., contains unchanged, redundant information (prevents unauthorized alternation, modification, concealment, or deletion).
+. Provides for compliance and disposition - i.e., meets regulations and complies with agency records schedules.
+HHS must properly and adequately document Agency business in accordance with the FRA and NARA regulations. To meet that obligation, all HHS employees, contractor personnel, grant recipients, detailees, interns, and other non-government persons supporting HHS who manage HHS records must create and maintain records that:
+.1.2. Agency's responsibility working with contractors
+. Document the persons, places, things, or matters dealt with by HHS.
+. Facilitate action by HHS officials and their successors in office.
+. Protect the financial, legal, and other rights of the Government and of persons directly affected by the Government's actions.
+. Document the formulation and execution of policies and decisions and the taking of necessary actions, including all substantive decisions and commitments reached orally (person-to-person, by telecommunications, or in conference) or electronically.
+. Document significant board, committee, or staff meetings.
+An OpDiv and StaffDiv maintains responsibility for managing its records whether they reside in a contracted environment or under agency physical custody (see 36 CFR Part 1222.32 (b)).[4]() When working with a contractor, a Contracting Officer must include a records management clause in any contract or similar agreement. At minimum, a records management clause ensures that the Federal agency and the contractor are aware of their statutory records management responsibilities. (NARA Guidance on Records Management for Contracts)[5]()
+All records created or received by an official, employee, or contractor of HHS in the course of conducting federal government business for HHS are the property of HHS, wherever the record resides (for example, in a government issued mobile device or in a personal email account during an emergency). No person attains a personal or proprietary interest in any record that the person creates, provides input into, or acquires custody or possession of while acting as a federal official, employee, or contractor.
+A template of a general records management clause for use in contracts or similar agreements can be found in Appendix D.
+.1.1.1. The FRA prohibits the creation or transmission of a federal record using a non-HHS electronic messaging account unless the person creating or sending the record either:
+.1.3. NARA-Approved records schedule
+. Copies the person's HHS electronic messaging system (email) account at the time of initial creation or transmission of the record or,
+. Forwards a complete copy of the record to the person's email account within 20 calendar days of the original creation or transmission of the record.
+.1.3.1. Records schedules must be in place for all HHS records. Approval of the schedules must be obtained from NARA in accordance with Subchapter B, chapter XII of Title 36, Code of Federal Regulations.
+.1.2. Records Maintenance and Use
+HHS records must be listed and described in an approved records schedule, and must be disposed of only as authorized by that schedule. HHS OpDivs and StaffDivs must update their records schedules when there are program changes that will result in the establishment of new types of records and the transfer or termination of records, or an increase or decrease in the retention time of the records. (36 CFR 1224.10(c))[6]()
+HHS records must be maintained (e.g., captured and organized) in an appropriate manner to ensure timely search and retrieval for internal Agency use, as well as for responses to outside inquiries.
+.1.4. File plans
+Agency records maintenance programs must:
+.1.4.1. Each HHS OpDiv and StaffDiv must maintain a centralized file plan that includes the title and description of its records, including electronic media. Each HHS OpDiv and StaffDiv must standardize file arrangement systems, filing procedures, and filing techniques of records. File plans must be designed to enhance the current use of the files, the preservation of archival records, and the prompt and systematic disposition of permanent and temporary records according to the appropriate records schedule.
+. Assign responsibilities for maintenance of records in all formats within each agency component, including designation of the officials that are responsible for maintenance and disposition of electronic records and management of automated systems used for recordkeeping.
+. Issue appropriate instructions to all agency employees on handling and protecting records.
+. Maintain records and non-record materials separately, in accordance with 36 C.F.R. § 1222.16.[4]()
+. Maintain personal files separately from records in accordance with 36 C.F.R. § 1222.20.[5]()
+### 6.2 Records Maintenance
+.1.2.1. NARA-Approved Records Retention Schedules
+OpDivs and StaffDivs must implement a records maintenance program so that complete records are filed or otherwise identified and preserved; records can be readily found when needed; and permanent and temporary records are physically segregated from each other; or for electronic records, are segregated. (36 CFR 1222.34)[7]()
+Proper retention ensures that records are kept in accordance with legal, regulatory, fiscal, operational and/or historical needs. All HHS records must be associated with a NARA-approved records control schedule. If records do not have an approved records schedule, then they must be treated as permanent records (indefinitely retained) until a records control schedule is approved.
+HHS must ensure new schedules are created for unscheduled records to meet regulations so that records do not remain subject to records requests and security requirements and exposed to security incidents after the records are no longer needed for agency business. NARA-Approved HHS Records Retention Schedules can be found on the NARA website [6]().
+HHS must manage records using the following order of precedence of approved schedules:
+. NARA-issued General Records Schedule (GRS).
+. Component-wide records schedules.
+. Office program specific records schedules.
+HHS OpDivs and StaffDivs must update their records schedules when there are program changes that will result in the establishment of new types of records and the transfer or termination of records, or an increase or decrease in the retention time of the records. (36 C.F.R. 1224.10(c))[7]()
 . Temporary records are records approved by NARA for disposal after a specified retention period.
+. Permanent records are records appraised by NARA as having sufficient historical or other value to warrant continued preservation by the Federal Government beyond the time it is needed for administrative, legal, or fiscal purposes.
+. Electronic records are records stored in a form that only a computer can process. Records can be numeric, graphic, and text information; media can include, but are not limited to, magnetic media, such as tapes and disks, and optical disks.
+. Unscheduled records are records whose final disposition has not been approved by NARA. Unscheduled records may not be destroyed or deleted.
+. Permanent records are records appraised by NARA as having sufficient historical or other value to warrant continued preservation by the federal government beyond the time it is needed for administrative, legal, or fiscal purposes.
+. Unscheduled records are records whose final disposition has not been approved by NARA. Unscheduled records may not be destroyed or deleted.
+.2.1. Electronic Recordkeeping System (ERKS)
+.1.2.2. File Plans
+.2.1.1. Electronic recordkeeping system (ERKS) is an electronic system that captures, organizes, and categorizes records to facilitate their preservation, retrieval, use, and disposition (36 CFR 1220.18)[8]()
+Each HHS OpDiv and StaffDiv must maintain an up-to-date centralized file plan that includes the title and description of its records providing the identification, format, custodian, and location of all categories of records created and received in the course of official business. File plans must be designed to facilitate the identification of records, the preservation of archival records, and the prompt and systematic disposition of temporary and permanent records according to the appropriate records schedule. File plans can help Freedom of Information Act (FOIA) and records management teams identify where and how the information for a specific office or program is stored. File plans of each Program Office can be obtained by contacting their respective OpDiv and StaffDiv Records Manager or Records Liaison.
+This system must:
+.1.2.3. Non-records
+. Use automated processes to manage the electronic records of an agency.
+. Preserve the content of electronic records, and their context and structure, over time.
+. Collect, organize, and categorize records to facilitate their preservation, retrieval, use, and disposition.
+. Be distinguished from an information system by linkages to activities its documents and by its ability to preserve and provide access to the content, structures, and context of the records.
+A non-record refers to documentary materials excluded from the legal definition of a federal record. Non-records must be managed and disposed of but are not subject to the same requirements as federal records. However, non-record information may be subject to record holds or production requests such as FOIA or litigation hold requests. HHS employees must ensure that non-record materials remain separate from federal records and are destroyed when no longer needed for reference.
+An ERKS may be either a distinct system designed specifically to provide recordkeeping functionality, or it may be a module within, or a part of, another system (such as an application system or an electronic document management system).
+.1.2.4. Access to Records
+.2.2. Universal ERM requirements
+HHS records must be maintained (e.g., captured and organized) to ensure timely search and retrieval for internal Agency use, as well as for responses to outside inquiries. Sensitive records (e.g., sensitive personally identifiable information (SPII) and other Controlled Unclassified Information (CUI)) must be maintained with restricted access in accordance with statutory and regulatory requirements.
+.2.2.1 Universal ERM requirements identify high level business needs for managing electronic records. They are baseline ERM program requirements derived from existing NARA regulations, policy, and guidance. ERM requirements are a starting point for OpDivs and StaffDivs to use when developing recordkeeping and record management system requirements. These requirements contain six sections based on the lifecycle of electronic records management:
+.1.2.4.1. Controlled Unclassified Information (CUI)
+. Capture
+. Maintenance and Use
+. Disposal
+. Transfer
+. Metadata
+. Reporting
+CUI is information that federal agencies routinely generate, use, store, and share information that, while not meeting the threshold for classification as national security or atomic energy information, requires some level of protection from unauthorized access and release.
+. The requirements are either "program" requirements, relating to the design and implementation of an agency's ERM policies and procedures, or "system" requirements, providing technical guidance to vendors in creating ERM tools and specifications for agencies to consider when procuring them.
+. The requirements are then either mandatory ("Must Have") or preferred ("Should Have"). These designations help vendors determine what functions their tools must perform, as opposed to those that are ideal. "Must Have" and "Should Have" requirements also help agencies prioritize procurement of these ERM tools according to their needs and financial priorities.
+The CUI program established by E.O. 13556 establishes a uniform policy for agencies on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI, self-inspection and oversight requirements, and other facets of the program.
+.2.3. Cloud services
+All CUI documents must be protected according to applicable laws, regulations, Government-wide policies, and HHS policies. Specific procedures for marking and labeling are outlined in the CUI Guidelines. For more information about HHS CUI policies and guidance, contact your OpDiv or StaffDiv CUI Point of Contact.
+.2.3.1. Cloud services refer to federal records that reside in a cloud environment hosted by a third party service provider. HHS OpDivs and StaffDivs must create standards and policies for managing records created, used, or stored in cloud computing environments:
+.1.2.5. Agency's Responsibility Working with Contractors
+. Include the agency records management officer and/or staff in the planning, development, deployment, and use of cloud computing solutions.
+. Define which copy of records will be declared as the agency's record copy and manage these in accordance with 36 CFR Part 1222.[9]() The value of records in the cloud may be greater than the value of any other set because of indexing or other reasons. In such instances, this added value may require designation of the copies as records.
+. Include instructions for determining if federal records in a cloud environment are covered under an existing records retention schedule.
+. Include instructions on how all records will be captured, managed, retained, made available to authorized users, and retention periods applied.
+. Include instructions on conducting a records analysis, developing and submitting records retention schedules to NARA for unscheduled records in a cloud environment. These instructions should include scheduling system documentation, metadata, and related records.
+. Include instructions to periodically test transfers of federal records to other environments, including agency servers, to ensure the records remain portable.
+. Include instructions on how data will be migrated to new formats, operating systems, etc., so that records are readable throughout their entire life cycles. Include in your migration planning provisions for transferring permanent records in the cloud to NARA.
+. Resolve portability and accessibility issues through good records management policies and other data governance practices. Data governance typically addresses interoperability of computing systems, portability of data (able to move from one system to another), and information security and access. However, such policies by themselves will not address an agency's compliance with the Federal Records Act and NARA regulations.
+HHS OpDivs and StaffDivs must ensure that the laws, regulations, and policies applicable to records and information used and maintained by HHS also apply to records and information maintained and used by HHS contractors on behalf of HHS. All records created by HHS contractors on behalf of HHS must remain the property of HHS and cannot be used or disposed of except as explicitly authorized in writing by HHS.
+An OpDiv and StaffDiv maintains responsibility for managing its records whether the records reside in a contracted environment or under agency physical custody (see 36 C.F.R. Part 1222.32).[8]() When working with a contractor, a Contracting Officer must include a records management clause in any contract or similar agreement. At a minimum, the records management clause must ensure that the federal agency and the contractor are aware of their statutory records management responsibilities. (NARA Guidance on Records Management for Contracts) [9]()
+A template of a general records management clause for use in contracts or similar agreements can be found in Appendix D
+.1.3. Records Disposition
+The FRA requires federal agencies to ensure proper disposition of records at the end of the records lifecycle. Records eligible for disposition are those that are no longer required to be maintained by applicable laws and approved record schedules. After temporary records have fulfilled their NARA-approved retention periods they are destroyed or deleted, while permanent records are transferred to the legal custody of the National Archives.
+Each OpDiv and StaffDiv must implement proper methods to preserve permanent records and lawfully and efficiently destroy temporary records at the end of the records lifecycle. Disposition of records must occur on a systematic and routine basis. No disposition action must take place without the assurance that the record is no longer required, and that no litigation, investigation, audit, or other matter is currently pending that requires holding the record longer as evidence.
+.1.3.1. Records Holds
+A records hold is temporary suspension of normal disposition practices with respect to certain agency records or documentary materials until further notice. This means that records or documentary materials, regardless of their physical location, must be kept for as long as a hold is in place. Records holds are commonly implemented due to actual or anticipated investigations, audits, litigation, or other similar occurrences and expire when such circumstances no longer exist.
+One example of a hold that would require retention of a record beyond the end of the records lifecycle is a litigation hold. A litigation hold is a notification to employees and covered recipients to retain potentially relevant information in the agency's possession, custody, or control when the Department has reasonable anticipation of litigation or litigation has commenced. Please reference the Department of Health and Human Services Policy for Litigation Holds for further information on HHS's litigation hold policy.
+### 6.2 Electronic Records Management
+Electronic records include any information that is recorded in a form that only a computer can process and that satisfies the definition of a federal record under the Federal Records Act (36 C.F.R. 1220.18).[10]() The requirements for appropriately maintaining electronic records and for maintaining records in electronic form to the fullest extent possible include the following:
+. All information meeting the definition of an electronic record must be preserved in accordance with a NARA-approved records schedules regardless of records locations (e.g., social media sites, shared drives, internet and intranet sites, cloud environments).
+. All electronic records must be managed in an electronic information system (EIS) or HHS-approved electronic records management system that incorporates functionalities to enable preservation of the federal record with integrity throughout the record lifecycle, for example correspondence management systems.
+. OpDivs and StaffDivs are encouraged to create and organize records electronically and maintain them electronically throughout their lifecycle, to the fullest extent possible.
+. Passwords or other forms of file level encryption must be removed or cleared prior to transferring permanent records to NARA.
+. Digital and electronic signatures, in support of electronic content, are acceptable for maintaining and preserving the authenticity of electronic records.
+. Metadata must meet both NARA requirements as defined in NARA Bulletin 2015-04 [11](), and agency business needs.
+.2.1. Metadata
+HHS must ensure that metadata elements as specified in 36 C.F.R. § 1236.54 [12]() are captured in a recordkeeping system or embedded in each file. HHS must also ensure that the metadata remains accurate and consistent regardless of where it is stored.
+Metadata elements provide administrative, descriptive, and technical information that describe the structure and content of electronic records. Metadata elements also provide contextual information that explains how electronic records were created, used, managed, and maintained prior to their transfer to NARA, and how they are related to other records. This information enables NARA to appropriately manage, preserve, and provide access to electronic records for as long as they are needed.
+.2.1.1. Categories of Metadata
+Metadata can describe almost any aspect of an electronic record. For convenience, individual metadata elements that work together to describe a particular aspect of a record can be referred to as belonging to categories. As a result, metadata is often organized into schemas that define what labels mean and how they should be used.
+. Administrative Metadata is used to manage collections of records. Examples include the Transfer Request (TR) Number, the Record Group, the name of the person authorized to transfer custody, etc.
+. Descriptive Metadata identifies and describes records. Examples include a photograph's caption, the title of a book, or the composer of a song.
+. Preservation Metadata is the specialized set of information required to preserve and provide access to electronic records. Examples include the file format used to encode a file, the software necessary to view it, or an action taken to maintain it such as the results of a virus scan.
+. Technical Metadata describes aspects of electronic records important to their proper interpretation, rendering, or playback. The type of compression used with a digital image, the audio codec contained in a digital video, or the encryption algorithm used to digitally sign an email are all examples of technical metadata. Technical metadata is frequently included as Preservation metadata as it is necessary for the maintenance of electronic records.
+. Use Metadata includes information that describes how records can be accessed or circulated. Metadata identifying copyright status or security classification are examples of use metadata.
+.2.2. Electronic Messaging Records
+According to the Federal Records Act, as defined in 44 U.S.C. § 2911(c)(1) [13](), electronic messages refer to "electronic mail and other electronic messaging systems that are used for purposes of communicating between individuals." This includes email, text messages, instant messages, social media, or other similar forms of communication.
+In accordance with federal records management laws and regulations, OpDivs and StaffDivs shall:
+. Preserve and retain email messages, text, and instant messages that meet the definition of a federal record sent or received from the HHS email server or government furnished devices per NARA-approved records schedules.
+. Have the capability to produce various forms of electronic messages i.e., email, text, instant messages, etc. that are responsive to FOIA requests, litigation holds, or other document production requests such as Congressional inquiries.
+. Prohibit the use of personal email and messaging accounts to conduct agency business and transmit any HHS information. In the event HHS authorizes the use of personal accounts, such as in emergency situations when federal accounts are not accessible or when an employee is initially contacted through a personal account, HHS employees must ensure that a complete copy of any federal records sent or received on personal account systems are captured and forwarded to their official HHS email account no later than 20 calendar days after the original creation or transmission of the record.
+Regardless of how many federal email accounts individuals use to conduct official business, agencies must ensure that all accounts are managed, accessible and identifiable according to federal recordkeeping requirements.
+.2.3. Email and Other Electronic Messages Managed under the Capstone Approach
+HHS has adopted the Capstone approach (GRS 6.1). Under the Capstone approach, HHS manages the disposition of email records and attachments, calendar appointments, tasks, instant messages, text messages, and chat messages that serve a similar purpose as email to facilitate communication and information sharing based on the role of the account user rather than the content of each record. (NOTE: Records under a preservation obligation, such as a litigation hold, must be managed based on record content, so are precluded from being managed under the Capstone approach.)
+. Email and Other Electronic Messages of Capstone Officials -
+. Email Records of Non-Capstone Officials -
+.2.3.1. Text and Instant Messaging Records
+Multimedia Messaging Service (MMS) and Short Message Service (SMS) or similar formats are used on mobile devices to communicate in a peer-to-peer fashion. Text or instant messages when created or received in the course of agency business on government furnished mobile devices are federal records that must be captured and managed in compliance with federal records management laws, regulations, and policies. All such text or instant messages are subject to FOIA requests, and some of the messages may be subject to litigation holds and other preservation holds. These records must be managed in accordance with GRS 6.1 or any other NARA-approved disposition authority.
+Transmission of HHS information via personal mobile devices is prohibited unless HHS authorizes the use of personal mobile devices to conduct agency business in the event of emergency situations when federal accounts are not accessible or when an employee is initially contacted through a personal mobile device. In those limited instances, staff must continue to save and manage any text or instant message records related to their work, by sending a copy to their HHS email account at the time of transmission or forwarding that record to their HHS email account within 20 calendar days of creation or transmission.
+.2.4. Digitization
+Transitioning to an electronic environment enables HHS to work with and leverage information in a way that analog record formats do not always allow. Analog records exist in a static state which limits information from being easily searched, updated or transferred without manual intervention. Additional guidance on digitization standards can be found in Appendix B.
+.2.4.1. Digitizing Temporary Federal Records
+If an OpDiv or StaffDiv intends to digitally reproduce (digitize) records in order to designate the digitized version as the recordkeeping copy and destroy the original source records, that OpDiv or StaffDiv must:
+. Digitize the record to the standards in 36 C.F.R. § 1236.32.[14]()
+. Validate the digitization according to 36 C.F.R. § 1236.34.
+.2.4.2. Digitizing Permanent Federal Records
+Agencies must create digital documentation when digitizing permanent source records. The agency must retain this documentation alongside the digitized records until the digitized records have been transferred to NARA and NARA has notified the agency that the accessioning process is complete. For requirements and processes for digitization of permanent federal records, see 36 C.F.R. § 1236, Subpart E.
 ### 6.3 Essential Records
+.3.1. Each OpDiv and StaffDiv is responsible for establishing, in consultation with continuity of operations (COOP) points of contact, an Essential Records program to select and safeguard records that would be required to ensure continuity of essential functions during and following a national disaster.
+The Essential Records Program identifies, protects, and provides ready access to vital records necessary to ensure continuity of essential HHS activities in the event of a national, regional, or local disaster or emergency.
+.3.1. Each OpDiv and StaffDiv is required to identify and protect the records and information necessary to continue key operations; protect the legal and financial rights of HHS, its employees, or the public; and protect the records deemed critical for the continuity and/or resumption of mission-essential functions. For more information about the HHS Essential Records Program, please contact the OpDiv or StaffDiv designated Continuity of Operations Plan (COOP) Coordinator or the Administration for Strategic Preparedness and Response (ASPR).
 ### 6.4 Social Media Records
+The use of social media and instant messaging may create federal records that must be captured and managed in compliance with federal records management laws, regulations, and policies. OpDivs and StaffDivs must identify these federal records and determine how they will be managed. If the OpDiv and StaffDiv has identified social media content as federal records, they must determine whether an existing disposition authority applies, including the General Records Schedule (GRS). If an existing authority does not cover the content, a new schedule must be developed. OpDivs and StaffDivs should develop new records schedules if social media and instant messaging users enhance the content by adding comments, metadata or other information that becomes part of the complete record. (NARA Bulletin 2014-02: Guidance on Managing Social Media Records (2014))
+The use of social media may create federal records that must be captured and managed in compliance with federal records management laws, regulations, and policies. The maintenance of these records is the responsibility of the office or agency originating the content. All personnel authorized by the Assistant Secretary for Public Affairs (ASPA) approval to use social media on behalf of HHS must identify these federal records and consult with their designated records management staff to determine how the records will be managed. For more information about HHS social media policies, please visit [www.hhs.gov/web/social-media/policies/index.html](http://www.hhs.gov/web/social-media/policies/index.html).
+### 6.5 Text Messaging Records
+### 6.5 Freedom of Information Act (FOIA)
+The use of text messaging may create federal records that must be captured and managed in compliance with federal records management laws, regulations, and policies. OpDivs and StaffDivs must identify these federal records and determine how they will be managed. If the OpDiv and StaffDiv has identified text messaging content as federal records, it must determine whether an existing disposition authority applies, including the General Records Schedule (GRS). If an existing authority does not cover the content, a new schedule must be developed. OpDivs and StaffDivs should develop new records schedules if text messaging users enhance the content by adding comments, metadata or other information that becomes part of the complete record. (NARA Bulletin 2015-02: Guidance on Managing Electronic Messages (2015))
+FOIA is a disclosure statute that promotes open government (the public's right to know) by letting the public have access to most records that are in the custody of or otherwise under the control of a federal agency, except to the extent protected from disclosure by nine mostly discretionary exemptions. Because FOIA is a disclosure statute, not a records management statute, the records that are subject to FOIA even include, in some cases, records that would not be considered "records" for records management purposes under 44 U.S.C. § 3301.[15]()
+All records received, created, or maintained by HHS staff, regardless of physical location and physical format, must be assumed to be subject to FOIA. Records locations include but are not limited to electronic information systems, electronic back-up sites, e-mail servers, headquarters, field offices, Federal Records Centers (FRC), individual and central office spaces, agency-specific storage locations, contractor offices, and HHS Continuity of Operations \[COOP\] sites. For additional guidance on HHS FOIA procedures, please contact an HHS FOIA Office.[16]()
 ### 6.6 Control and Custody of Records
+Agency records are the property of the federal government, not the property of individual employees, and must not be removed from the Department without proper authority. Chain of custody refers to the chronological documentation or paper trail, showing custody, control, transfer, and disposition of federal records for departing or transferring employees. (44 U.S.C. Chapter 31)[10]()
+Agency records are the property of the federal government, not the property of individual employees, and must not be removed from the Department without proper authorization. Removal of documentary materials must be approved in accordance with the provisions of this _Policy_ to ensure HHS's ownership and ability to protect agency information and fulfill requests such as litigation holds and FOIA.
+All records created or received by an official, employee or contractor of HHS while conducting federal government business are the property of HHS, wherever the record resides. No person attains a proprietary interest in any record that the person may create, provide input into, or acquire custody or possession of, by virtue of the person's position as an official, employee, or contractor.
+### 6.7 Transferring and Departing Staff Records
+Departing HHS employees, contractors, detailees, and interns must manage their records in accordance with federal records management laws, regulations, and policies.
+. Federal records that have not met disposal dates must be left with the OpDiv or StaffDiv from which the employee is departing. Departing staff must formally identify record locations and ensure those are accessible to the appropriate managers and supervisors or other designated Division staff.
+. Federal records responsive to active FOIA requests or subject to litigation or other preservation holds must be identified and remain in the custody or control of the OpDiv or StaffDiv.
+. Employees transferring within the Department may retain copies of federal records in rare cases only after review and approval of their designated Records Officer. The Records Officer's approval must be based on a documented business need for the records to be retained by the employee in their new role, and the retention must be relevant to the organization they are transferring to in accordance with the following requirements:
+\. The original record must be maintained by the Division from which the employee is leaving.
+\. Transferring employees may retain copies only if transferring to another HHS OpDiv or StaffDiv with responsibilities that are inherently the same.
+\. Transferring employees may request to have selected personal email and documents transferred to their new accounts. Items such as their own Performance Management Appraisal Plans (PMAPs) and email contacts are examples of such personal documentation.
+. Employees separating or retiring from HHS may not take copies of records or other work-related, non-record materials unless approved by their designated Records Officer or legal counsel. When determining whether to permit departing employees to remove extra copies, the agency must also consider the extent to which such removal could affect the agency's ability to invoke various legal privileges and must consider the use of nondisclosure agreements in appropriate cases.
+\. Copies of records that are national security classified must remain under the control of the agency and not be allowed to be removed.
+\. Copies of records that are otherwise restricted (e.g., as privileged or subject to the Privacy Act) must be maintained in accordance with the appropriate agency requirements and not be allowed to be removed.
+\. Approval to remove extra copies should be granted only if the removal would be at no cost to the agency.
+\. Contracting Officer Representatives (CORs) are responsible for ensuring that departing contractors do not remove any HHS records.
+.7.1. Chain of Custody
+Chain of custody refers to the chronological documentation or paper trail, showing custody, control, transfer, and disposition of federal records for departing or transferring employees. (44 U.S.C. Chapter 31) [17]()
 All departing employees must:
+. Identify and separate all employee federal Records from Non-Record Materials and Personal Papers.
+. Purge non-record materials, personal papers and extra copies.
+. Identify and separate all employee federal records from non-record materials and personal papers.
+. Complete a chain of custody or records transfer document certifying that all federal records created and maintained during their employment have been turned over to their successor, supervisor, or appropriate official.
 All supervisors or appropriate officials must:
+. Ensure that the chain of custody document has been completed and signed before the employee departs the agency
+. Ensure that departing employee's federal records have been identified and properly disposed of in accordance with approved records disposition schedules before the employee's departure.
+. Ensure that the departing employee's federal records have been turned over to the appropriate successor or official to permit continued preservation of the Department federal records.
+. Ensure that the chain of custody or records transfer document has been completed and signed before the employee departs the agency.
+. Ensure that departing employee's federal records have been identified and turned over to the appropriate successor or official to permit the continued preservation of HHS federal records.
+### 6.7 Unlawful or Accidental Removal or Destruction of Records
+### 6.8 Unlawful or Accidental Removal or Destruction of Records
+Official records must be protected against loss, unauthorized destruction or alteration, and illegal removal from HHS in order to ensure adequate documentation of organization, functions, policies, decisions, procedures, and essential business transactions. The unauthorized removal, concealment, falsification, mutilation, and/or disposition of official records is prohibited by law and is subject to penalty. The penalties for the unlawful or accidental removal, defacing, alteration, or destruction of federal records or the attempt to do so, include a fine, imprisonment, or both. (18 U.S.C. §§ 641 and 2071)[11]()
+Official records must be protected against loss, unauthorized destruction or alteration, and illegal removal from HHS to ensure adequate documentation of organization, functions, policies, decisions, procedures, and essential business transactions. The unauthorized removal, concealment, falsification, mutilation, and/or disposition of official records is prohibited by law and is subject to penalty. The penalties for the unlawful or accidental removal, defacing, alteration, or destruction of federal records, or the attempt to do so include a fine, imprisonment, or both. (18 U.S.C. §§ 641 and 2071)[18]()
+### 6.8 Formal Evaluations
+HHS reports actual and potential threats to records (e.g., removal, alteration, or deliberate and accidental destruction), to NARA, as required by 36 C.F.R. 1230.14[19]() and may report same to the HHS Office of the Inspector General.
+OpDivs and StaffDivs will conduct a formal evaluation on two of their records management programs annually. The goal of the evaluations is to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations. Formal evaluations are intended to provide agencies with information they may use to measure compliance and target resources within areas requiring improvement.
+All HHS employees and contractors are responsible for immediately notifying their respective Records Manager or OpDiv Records Officer of any actual, impending, or threatened unlawful removal, defacing, alteration, or destruction of records in the custody of HHS staff in a timely manner.
+### 6.9 Training
+. The OpDiv Records Officer will perform initial inquiries to determine if there is a potential records loss and, if required, will proceed with notification to NARA. Notification will include a brief description of the records potentially lost. The Department Records Officer should be copied on the initial notification to NARA.
+. The OpDiv Records Officer will work with the program office to conduct a thorough investigation of what led to the potential records loss. The investigation must determine to the best extent possible the information required for the final report to NARA.
+. The OpDiv Records Officer will work with the program office to recover any lost or destroyed records to the extent possible.
+. The OpDiv Records Officer will draft and submit the final Unauthorized Destruction of Records Report to NARA based on the completed investigation that includes:
+\. A complete description of the records with volume and inclusive dates.
+\. The OpDiv or StaffDiv maintaining the records.
+\. A statement of the exact circumstances surrounding the removal, defacing, alteration, or destruction of records.
+\. A statement of the safeguards established to prevent further loss of documentation.
+\. When appropriate, details of the actions taken to salvage, retrieve, or reconstruct the records.
+. The OpDiv Records Officer will work with the program office to develop and implement corrective measures based upon the results of the final Unauthorized Destruction of Records Report. NARA may respond with additional corrective measures that the OpDiv Records Officer will also need to address.
+Each HHS OpDiv and StaffDiv must provide records management training to all staff to ensure they are aware of their responsibilities to maintain and safeguard department records, including the obligations under this Policy. (OMB/NARA Directive M-19-21, Transition to Electronic Records)[12]()
+### 6.9 Formal Evaluations
+. Annually inform all agency personnel of their records management responsibilities in law, regulation, and policy, and provide training specific to the practices and policies of the organization.
+OpDivs and StaffDivs must aim to conduct a formal evaluation on a specific program area of their records management programs annually. The goal of the evaluation is to measure the effectiveness of records management programs and practices and to ensure that they comply with NARA regulations. Formal evaluations are intended to provide agencies with information they may use to measure compliance and target resources within areas requiring improvement. Additional guidance and procedures on formal evaluations can be found in Appendix A.
+.9.1. All contract employees who have access to (1) HHS federal information or a federal information system or (2) personally identifiable information, must complete the applicable OpDiv and StaffDiv Records Management training before performing any work under their contract. Thereafter, the employees must complete annual Records Management training throughout the life of the contract. The contractor must also ensure subcontractor compliance with this training requirement.
+### 6.10 Training
+To ensure that the HHS Records Management Program remains dynamic and effective, all
+HHS employees and contractors must be aware of the program and have adequate training to perform their records management responsibilities as required to maintain and safeguard HHS records.
+Each HHS OpDiv and StaffDiv must annually inform all agency personnel of their records management responsibilities in law, regulation, and policy, and provide training specific to the practices and policies of the organization. (OMB/NARA Directive M-19-21, Transition to Electronic Records)[20]()
+.10.1. Records Management Training for Federal Employees
+. New Employee Orientation
+. Annual Training
+. Senior Officials Records Management Awareness Training
+. Incoming Senior Officials entering federal service shall receive training on specific recordkeeping requirements and the importance of appropriately managing records under their immediate control.
+. Departing Senior Officials shall receive exit briefings prior to separation on the appropriate disposition of the records under their immediate control.
+.10.2. Records Management Training for Contractors
+All contractors who have access to (1) HHS federal information or a federal information system or (2) personally identifiable information, must complete the applicable OpDiv and StaffDiv records management training within 30 days before performing any work under their contract. Thereafter the following year, contractors must complete annual records management training by December 31st of each calendar year throughout the life of the contract. The contractor must also ensure subcontractor compliance with this training requirement.
 ## 7\. Roles and Responsibilities
 ### 7.1 HHS Secretary
 The responsibilities of the HHS Secretary include, but are not limited to, the following:
+. Notifying the Archivist of the United States of any actual, impending, or threatened unlawful removal, defacing, alteration, corruption, deletion, erasure, or other destruction of records in the custody of the agency.
+. Ensuring the creation and preservation of records that adequately and properly document the organization, functions, policies, decisions, procedures, and essential transactions of HHS.
+. Designating a Senior Agency Official for Records Management (SAORM) to oversee the HHS Records Management Program and have direct responsibility for ensuring HHS efficiently and appropriately complies with all applicable records management statutes, regulations, NARA policies, and requirements of the OMB/NARA Directive M-19-21, Transition to Electronic Records.
+. Preventing the unlawful or accidental removal, defacing, alteration, or destruction of records and direct that any unauthorized removal, defacing, alteration, or destruction be reported to NARA.
+. Taking adequate measures to inform all employees and contractors of the provisions of the law relating to unauthorized destruction, removal, alteration, or defacement of records.
 ### 7.2 HHS Assistant Secretary for Administration (ASA)
 The responsibilities of the HHS Assistant Secretary for Administration (ASA) include, but are not limited to, the following:
 . Serving as the Senior Agency Official for Records Management (SAORM). Delegates oversight responsibility for the Department-wide records management program to the Chief Information Officer (CIO).
+. Has direct responsibility for ensuring that the department or agency efficiently and appropriately complies with all applicable records management statutes, regulations, NARA Policy, and Presidential Directives.
+. At the Assistant Secretary level or equivalent, has direct responsibility for ensuring that the agency efficiently and appropriately complies with all applicable records management statutes, regulations, and policies.
+. Acting on behalf of the agency head to ensure that the department or agency efficiently and appropriately complies with all applicable records management statutes, regulations, NARA Policy, and Presidential Directives.
+. Bridging the gap between the agency head and the Agency Records Officer in order to provide strategic direction for the agency's records management program.
+### 7.3 HHS Chief Information Office (CIO)
+### 7.3 HHS Chief Information Officer (CIO)
 The responsibilities of the HHS CIO include, but are not limited to, the following:
+. Appointing the HHS Records Management Officer to guide and coordinate the HHS Records Management Program. The HHS Records Management Officer collaborates with HHS OpDivs and NARA to execute the HHS Records Management Program in accordance with this instruction.
+. Integrating records management procedures and activities into HHS Chief Information Officer (CIO) policy and planning.
+. Reviewing and making recommendations on requests for funding and acquisition of electronic recordkeeping systems in accordance with information technology capital planning, and investment control procedures.
+. Overseeing the Department-wide records management program.
+. Appointing the HHS Records Officer, certified to NARA standards, to assist with implementation, evaluation and administration issues regarding the Federal Records Act and applicable legislation.
+. Ensuring a Departmental Records Management Program is developed, documented, implemented, and promoted to support records management activities for all information systems, networks and data that support Departmental operations.
+. Maintaining a central policy-making role in the agency's development and evaluation of records management issues.
+. Integrating records management procedures and activities into HHS Chief Information Officer (CIO) policy and planning.
+. Reviewing and making recommendations on requests for funding and acquisition of electronic recordkeeping systems in accordance with information technology capital planning, and investment control procedures.
+### 7.4 Agency Records Management Officer (ARO)
+### 7.4 HHS Chief Data Officer (CDO)
+The responsibilities of the HHS CDO include, but are not limited to, the following:
+. Standardizing and streamlining existing federated enterprise-wide data management in order to better leverage the information.
+. Managing data assets, including data inventories, which identify the sources of data, where the datasets are being maintained, their content, and how they are being used.
+. Turning data into information by creating a data-driven culture where data and metrics can be used to make better decisions.
+. Establishing a data stewardship framework.
+. Consulting with the HHS Records Management Program during the development of policies and standards in alignment with federal records management laws and regulations.
+### 7.5 HHS Chief Information Security Officer (CISO)
+The responsibilities of the HHS Chief Information Security Officer (CISO) include, but are not limited to, the following:
+. Establishing and maintaining HHS vision and strategy to ensure information assets and technologies are adequately protected.
+. Ensuring HHS oversight and compliance with Federal Information Security Management Act (FISMA) to include the development and maintenance of the overall security of HHS IT systems and system inventory.
+. Ensuring that records are maintained in a manner that prevents loss, theft, misuse, or unauthorized access or alteration throughout the record lifecycle.
+. Establishing assessment standards and processes for records management-related cybersecurity controls.
+. Consulting with the HHS Records Management Program during the development of policies and standards in alignment with federal records management laws and regulations.
+### 7.6 Agency Records Officer (ARO)
 The responsibilities of the HHS ARO include, but are not limited to, the following:
 . Serving as the Department's representative with NARA, other federal agencies, and external organizations on matters pertaining to records management.
 . Providing leadership and guidance to ensure uniformity in records management activities throughout the Department.
 . Conducting periodic compliance evaluations of records management programs.
+. Developing policies, standards, and procedures for records management.
+. Ensuring all HHS employees, including senior officials and contractors are aware of their programmatic and individual records management responsibilities.
+. Coordinating records management issues with other federal and regulatory agencies, including NARA, OMB, GSA, GAO, and OPM.
+. Providing records management expertise and participating in the review and development of proposed electronic records management systems.
+. Coordinating the development and implementation of the HHS records program.
+. Providing guidance and operational support for the implementation of litigation holds and other types of legally required holds on records and other documentary materials.
+. Providing guidance to the OpDiv ROs to ensure compliance with Records Management principles and policies in all phases of the Enterprise Performance Life Cycle (EPLC) process.
+. Completing requirements for a NARA certificate of Federal Records Management Training. New incumbents must obtain the certificate within one year of assuming the position of Departmental ARO.
+. Advising the CIO and OpDivs on records management issues and developing Department-wide records management policies, procedures, guidance, and training materials.
+. Establishing and disseminating standards to ensure that OpDivs clearly identify staff responsibilities to comply with the agency's records management program.
+. Coordinating records management issues with other federal and regulatory agencies, including NARA, OMB, General Services Administration (GSA), and Government Accountability Office (GAO).
+. Providing guidance and operational support for the implementation of litigation holds and other types of legally required holds on records and other documentary materials.
+. Providing guidance to the OpDiv Records Officers (RO) to ensure compliance with Records Management principles and policies in all phases of the Enterprise Performance Life Cycle (EPLC) process.
+. Completing requirements for a NARA certificate of Federal Records Management Training. New incumbents must obtain the certificate within one year of assuming the position of Departmental ARO.
+### 7.5 OpDiv Chief Information Officers (CIOs)
+### 7.7 OpDiv and StaffDiv Heads
+The responsibilities of the OpDiv Chief Information Officers (CIOs) or OpDiv designated authority include, but are not limited to, the following:
+The responsibilities of the OpDiv Heads include, but are not limited to, the following:
+. Designating OpDiv ROs to oversee the records management program. Recommend designation of Records Managers (RMs) to support the OpDiv ROs in the implementation of recordkeeping requirements for major programmatic and administrative records.
+. Ensuring the OpDiv ROs and RMs have adequate skills, training, resources, time, and appropriate authority to execute duties assigned.
+. Ensuring the implementation of a records management program within their areas of responsibility to accomplish the objectives identified in federal regulations and HHS policies and procedures.
+. Ensuring OpDiv ROs incorporate records management principles and policies in all phases of the EPLC process.
+. Ensuring proper recordkeeping of Authorization to Operate (ATO) approved systems.
+. Requesting funds for records storage costs.
+. Ensuring OpDiv ROs are adequately trained and remain current on email policies and procedures.
+. Advocating for records management in their organization.
+. Demonstrating the importance of records management and ensuring their organization is aware of the importance of and processes for managing records.
+. Demonstrating their commitment to the proper management of records in their organization through appropriate means (e.g., sending out messages, participating in events dedicated to records clean-up activities, encouraging managers and staff to take records training).
+### 7.6 HHS Chief Information Security Officer (CISO)
+### 7.8 OpDiv Chief Information Officers (CIOs)
+The responsibilities of the HHS Chief Information Security Officer (CISO) include, but are not limited to, the following:
+The responsibilities of the OpDiv Chief Information Officers (CIOs) or OpDiv designated authority include, but are not limited to, the following:
+. Ensuring HHS oversight and compliance with Federal Information Security Management Act (FISMA) to include the development and maintenance of the overall security of HHS IT systems and system inventory.
+. Using information from the System Inventory in the various reporting and oversight requirements.
+. Designating the OpDiv RO to oversee the records management program. Recommend designation of Records Managers (RMs) to support the OpDiv RO in the implementation of recordkeeping requirements for major programmatic and administrative records.
+. Ensuring the OpDiv RO completes requirements for a NARA certificate of Federal Records Management Training within one year of assuming the position of OpDiv RO.
+. Supporting the implementation of a records management program within their areas of responsibility to accomplish the objectives identified in federal regulations and HHS policies and procedures.
+. Integrating records management procedures and activities into OpDiv Chief Information Officer (CIO) policy and planning.
+. Ensuring records management and records archival functions are addressed in the requirements development phase for the design, development, and implementation of new or significantly revised information systems.
+. Reviewing and making recommendations on requests for funding and acquisition of electronic recordkeeping systems within their areas of responsibility in accordance with information technology capital planning, and investment control procedures.
+### 7.7 OpDiv Chief Information Security Officers (CISOs)
+### 7.9 OpDiv Chief Information Security Officers (CISOs)
 The responsibilities of the OpDiv Chief Information Security Officers (CISOs) include, but are not limited to, the following:
 . Ensuring the technical security of the OpDiv electronic data records according to HHS and OpDiv standards.
+. Establishing assessment standards and processes for records management-related cybersecurity controls within their areas of responsibility.
+. Consulting with the OpDiv Records Management Program during the development of policies and standards in alignment with federal records management laws and regulations.
+### 7.8 OpDiv Records Management Officers (ROs)
+### 7.10 OpDiv Records Officers (ROs)
+The responsibilities of the OpDiv Records Management Officers (ROs) include, but are not limited to, the following:
+The responsibilities of the OpDiv Records Officers (ROs) include, but are not limited to, the following:
+. Serving as the primary contacts responsible for overseeing the OpDiv's records management program and ensure the OpDiv has up-to-date records management guidelines.
+. Coordinating the development of OpDiv records schedules with the National Archives and Records Administration (NARA).
+. Ensuring that recordkeeping requirements are established, implemented, and periodically updated for all offices.
+. Ensuring that HHS employees and contractors complete the annual records management training.
+. Serving as the primary contact for overseeing the OpDiv's records management program.
+. Developing and disseminating instructions and operating procedures, as needed to supplement Agency-wide policy to meet the unique records management needs in support of the records management program within their OpDiv.
+. Collaborating with HHS ARO and key stakeholders on records management activities and actions such as the Records Management Self-Assessment, NARA Inspections, Unauthorized Destruction of Records Reports to NARA, etc.
+. Coordinating OpDiv records management issues with other federal and regulatory agencies, including NARA, OMB, General Services Administration (GSA), and Government Accountability Office (GAO).
+. Coordinating periodic review, development, and maintenance of current records disposition schedules for all OpDiv program records or when notified of program changes resulting in:
+\. Establishing new types of records.
+\. An increase or decrease in the retention time of the records.
+\. New or revised electronic systems.
+. Providing records management expertise and participating in the review and development of proposed electronic records management systems.
+. Ensuring that OpDiv employees and contractors complete the mandatory annual records management training.
+. Ensuring permanent records are periodically transferred to NARA for permanent preservation and temporary records are promptly destroyed, according to NARA-approved records disposition schedules, unless subject to litigation hold or other preservation requirements.
+. Reporting to NARA any alleged or actualized incidents of unauthorized destruction, manipulation, alteration, or removal of records through accidental or intentional means.
+. Maintaining and updating an official list of agency Capstone positions in accordance with NARA requirements.
+. Ensuring periodic evaluations of the records management program to monitor compliance with applicable laws and NARA, Department, and OpDiv regulations, policies, standards, and procedures.
+. Completing requirements for a NARA certificate of Federal Records Management Training within one year of assuming the OpDiv RO position.
+### 7.9 OpDiv and StaffDiv Records Managers (RMs) and Records Liaisons (RLs)
+### 7.11 OpDiv and StaffDiv Records Managers (RMs) and Records Liaisons (RLs)
 The responsibilities of the OpDiv and StaffDiv Records Managers (RMs) and Record Liaisons (RLs) include, but are not limited to, the following:
+. Coordinating modifications to the office file plans and agency records schedules.
+. Assisting HHS OpDiv RO with implementing the agency records management program in their work areas.
+. Managing prompt disposal of temporary records stored in Federal Record Centers and the timely transfer of permanent records to NARA.
+. Identifying and periodically update recordkeeping requirements for program and administrative records.
+. Serving as the first point of contact for an entire program office regarding records management activities.
+. Developing records management administrative roles i.e., Records Custodians and communication networks with all program units including field offices and other facilities, as appropriate, to ensure that the records management program is implemented at all sites under their program areas.
+. Developing official comprehensive file plans to simplify access to information within their work areas, and periodically review file plans and procedures to ensure they are current and complete.
+. Assisting OpDiv RO, under management approval, with implementing the agency records management program in their work areas.
+. Drafting and updating records schedules, in conjunction with the OpDiv RO, for records created and maintained by their program office.
+. Coordinating with the OpDiv RO the periodic transfer of permanent records to NARA and timely destruction of temporary records according to NARA-approved records disposition schedules, unless subject to litigation hold or other preservation requirements.
+. Reporting to the OpDiv RO any alleged or actualized incidents of unauthorized destruction, manipulation, alteration, or removal of records through accidental or intentional means.
+. Identifying areas of weakness within the program or office and work collaboratively with the OpDiv RO to provide records management briefings, workshops, and recommendations to resolve identified areas of weakness.
+. Providing records management briefings and training to staff within their program office.
+### 7.10 OpDiv and StaffDiv Records Custodians (RCs)
+### 7.12 OpDiv and StaffDiv Records Custodians (RCs)
 The responsibilities of the OpDiv and StaffDiv Records Custodians (RCs) include, but are not limited to, the following:
+. Recordkeeping within a particular program.
+. Ensuring office records are accurately listed and detailed in the office file plan.
+. Ensuring proper disposition of office records.
+. Cooperating with the Records Manager/Records Liaison and the OpDiv Records Management Officer in periodic evaluations of office records.
+. Serving as the first point of contact within a particular division or branch office regarding records management activities.
+. Supporting and maintaining the file plan and accountability for active and inactive records.
+. Assisting with the proper destruction of eligible temporary program and administrative records and the transfer of permanent records to the legal custody of NARA in accordance with NARA-approved records schedules.
+. Cooperating with the Records Manager/Records Liaison and the OpDiv Records Officer in periodic evaluations of office records.
+### 7.11 Managers and Supervisors
+### 7.13 Managers and Supervisors
 The responsibilities of Managers and Supervisors include, but are not limited to, the following:
+. Ensuring federal employees, contractors, interns, and fellows are aware of and adhere to HHS records management policies.
+. Ensuring federal employees, contractors, interns, and fellows complete initial and annual records management training.
+. Ensuring a departing employee's record materials, including email records, have been reviewed prior to the employee's departure.
+. Ensuring a departing employee complies with policies and procedures regarding preservation, transfer, and deleting of records.
+. When notified that an employee, contractor, intern, or fellow is transferring or leaving the Department, consult with departing employees to follow litigation records management procedures.
+. Ensuring that their staff, including contractors, are informed about and understand their responsibility for preserving and appropriately managing their records in all formats, including electronic messaging applications such as email, text messaging, instant messaging, chat, voicemail, social media, or mobile device applications.
+. Designating a Records Manager/Records Liaison and Records Custodians for the program office as appropriate.
+. Working with their designated Records Manager/Records Liaison and Records Custodians to approve and transfer permanent records to the NARA in accordance with NARA-approved records schedules.
+. Ensuring that their staff complete mandatory annual records management training and any other related records management training.
+. Ensuring a departing employee's record materials, including email and text records, have been reviewed prior to the employee's departure.
+. Ensuring a departing employee complies with policies and procedures regarding:
+\. The preservation and transfer of records to their successor.
+\. Specified location of employee's records.
+\. Notification of departure to OGC if employee has been identified as a potential custodian in a litigation hold.
+### 7.12 Contracting Officers (COs) and Contracting Officer Representatives (CORs)
+### 7.14 Contracting Officers (COs) and Contracting Officer Representatives (CORs)
 The responsibilities of Contracting Officers and Contracting Officer Representatives include, but are not limited to, the following:
+. Inserting a records management clause in contracts ensuring contractors are aware of and adhere to HHS records management policies.
+. Ensuring contractors complete initial and annual records management training.
+. Ensuring a departing contractor's record materials, including email records, have been reviewed prior to the contractor's departure.
+. Ensuring a departing contractor complies with policies and procedures regarding preservation, transfer, and deleting of records.
+. When notified that a contractor is transferring or leaving the Department, consult with departing contractors to follow litigation records management procedures.
+. Inserting a records management clause in contracts ensuring clarity of records scope, contractor requirements, and adherence to HHS records management policies.
+. Ensuring contractor compliance with records management requirements during contract performance.
+. Ensuring contractors complete mandatory annual records management training.
+. Ensuring a departing contractor complies with policies and procedures regarding:
+\. The preservation, transfer, and delivery of records.
+\. Specified location of contractor's records.
+\. Notification of departure to OGC if contractor has been identified as a potential custodian in a litigation hold.
+### 7.13 HHS Employees, Contractors, Interns, and Fellows
+Additional guidance on HHS contractor requirements can be found in Appendix C. A template of a general records management clause for use in contracts or similar agreements can be found in Appendix D. Additional guidance and templates can also be found in the HHS Acquisition Regulations (HHSAR).
+The responsibilities of all HHS employees, contractors, interns, and fellows include, but are not limited to, the following:
+### 7.15 HHS Employees, Contractors, Detailees, Interns, and Fellows
+. Identifying federal records that were used to conduct agency business.
+. Coordinating with OpDiv and StaffDiv RMs and RLs regarding all aspects of records management.
+. Organizing files for efficient and effective retrieval.
+. Completing annual records management training.
+. If transferring or leaving the Department, consult with supervisor and office records staff and follow records management procedures.
+. Providing copies of responsive federal records to the appropriate Freedom of Information Act Official when requested by the public.
+The responsibilities of all HHS employees, contractors, detailees, interns, and fellows include, but are not limited to, the following:
+### 7.14 Freedom of Information Act (FOIA) Official:
+. Creating, receiving, and maintaining records that reflect decisions and actions that document activities for which they are responsible.
+. Organizing files for safe storage, efficient, and effective retrieval.
+. Maintaining personal papers and non-record materials separately from official agency records.
+. Capturing and preserving in the HHS's email system any electronic messaging records that are not being managed centrally by their servicing OCIO.
+. Managing and safeguarding records in accordance with the guidance provided by their designated OpDiv RO, records management staff, and approved records schedules, including while teleworking or working remotely.
+. Safeguarding records until they are authorized for disposition and reporting any apparent instances of unauthorized disposition to the individual's supervisor and designated records management staff.
+. Destroying records only in accordance with approved records disposition schedules, and never removing records or non-related materials from the Department without obtaining prior authorization.
+. Completing mandatory annual records management training. any other related training and participating in records management activities such as records clean-up days.
+. If transferring or leaving the Department, consult with supervisor and designated records management staff and follow records management procedures regarding:
+\. The preservation and transfer of records to the custody of their manager, supervisor, or successor.
+\. Identifying the location of their records.
+\. Notification of departure to OGC if identified as a potential custodian in a litigation hold.
+. Providing copies of responsive federal records to the appropriate Freedom of Information Act Official when requested by the public.
+### 7.16 Freedom of Information Act (FOIA) Official
 The responsibilities of the Freedom of Information Act (FOIA) Official include, but are not limited to, the following:
+. Reviewing responsive federal records provided by HHS employees, contractors, interns, and fellows for release to the public under the FOIA.
+. Routing incoming FOIA requests to the appropriate offices identified as having responsive records.
+. Assisting the responding program offices to clearly ascertain the records requested under the FOIA.
+. Reviewing federal records provided by responding program offices for release to the public under the FOIA.
+### 7.15 Office of the General Counsel (OGC)
+### 7.17 OpDiv and StaffDiv Controlled Unclassified Information (CUI) Points of Contact
+The responsibilities of the OpDiv and StaffDiv CUI Points of Contacts, include, but are not limited to, the following:
+. Directing and overseeing the OpDiv and StaffDiv CUI Program.
+. Ensuring compliance with the CUI policy and subsequent procedures, standards, and guidelines.
+### 7.18 Office of the General Counsel (OGC)
 The responsibilities of the Office of the General Counsel (OGC) include, but are not limited to, the following:
+. Reviewing disposition schedules for official records for legal sufficiency and provides instructions for implementing litigation holds required to comply with legal requirements.
+. Providing legal advice and counseling on records management issues as well as assist in determining the retention of Agency records that may be needed for legal purposes.
+. Notifying OpDivs when suspension on records disposition is needed for litigation holds or other legal matters, the scope of the requests, and when such holds are lifted.
+. Reviewing records disposition schedules for legal sufficiency before submission to NARA.
+### 7.16 Office of Inspector General (OIG)
+### 7.19 Office of Inspector General (OIG)
 The responsibilities of the Office of Inspector General (OIG) include, but are not limited to, the following:
+. Assisting in investigating the unauthorized removal of records or the actual and potential threats to records (e.g., removal, alteration, or deliberate or accidental destruction).
+. Assisting in investigating the unauthorized removal or destruction of records or the actual and potential threats to records (e.g., removal, alteration, or deliberate or accidental destruction).
+### 7.17 IT Infrastructure and Operations and System Managers
+### 7.20 IT Infrastructure and Operations and System Managers
 The responsibilities of IT Infrastructure and Operations and System Managers include, but are not limited to, the following:
+. Working with the OpDiv RO to establish and update records schedules for electronic system.
+. Working with the OpDiv RO to establish and update records schedules for electronic systems.
 . Ensuring that all phases of the EPLC process comply with HHS Records Management principles and policies.
 . Ensuring that information systems intended to carry out electronic records management align with NARA's and HHS's requirements for records stored in an electronic recordkeeping system.
 . Ensuring proper recordkeeping of Authorization to Operate (ATO) approved systems.
+. Maintaining electronic information systems in accordance with approved records schedules and NARA requirements.
+. Working with the OpDiv ROs to transfer permanent systems to the National Archives in accordance with approved records schedules and NARA requirements.
+. Ensuring that social media content containing official records are maintained in accordance with HHS recordkeeping requirements.
+. Maintaining electronic information systems, including capturing metadata in accordance with approved records schedules and NARA requirements.
+. Ensuring system updates and revisions to information systems incorporate NARA and HHS records management requirements.
+. Coordinating the commissioning and decommissioning activities of information systems with the OpDiv RO to ensure preservation of permanent and long-term temporary records in compliance with NARA regulations.
+. Working with the OpDiv ROs to transfer permanent electronic records stored in information systems to the National Archives in accordance with approved records schedules and NARA requirements.
+. Ensuring that HHS internet, intranet, and social media postings containing official records are maintained in accordance with HHS recordkeeping requirements.
+. Conducting system-wide email searches in addition to identifying, collecting, and producing electronically stored information as part of an internal or external investigation, FOIA request, or in response to an access request as needed upon approval of OGC or OCIO.
+. Maintaining an inventory of HHS electronic systems and associated records schedules.
+. Consulting with the HHS Records Management Program during the development of policies and standards in alignment with federal records management laws and regulations.
 ## 8\. Information and Assistance
+HHS Privacy Information Management (PIM) is responsible for the development and management of this _Policy_. Questions, comments, suggestions, and requests for information about this _Policy_ should be directed to [HHSRecordsManagement@hhs.gov](mailto:HHSRecordsManagement@hhs.gov).
+The Office of the HHS Chief Data Officer (OCDO) is responsible for the development and management of this _Policy_. Questions, comments, suggestions, and requests for information about this _Policy_ should be directed to [HHSRecordsManagement@hhs.gov](mailto:HHSRecordsManagement@hhs.gov).
 ## 9\. Effective Date and Implementation
+The effective date of this _Policy_ is the date on which the policy is approved. This _Policy_ must be reviewed, at a minimum, every three (3) years from the approval date.
+The effective date of this _Policy_ is the date on which the policy is approved. This _Policy_ must be reviewed, at a minimum, every three (3) years from the approval date. HHS will explicitly follow any new NARA laws and regulations that become in effect before the next update of this _Policy_.
+The HHS CIO has the authority to grant a one (1) year extension of this _Policy_. To archive this Policy, approval must be granted, in writing, by the HHS CIO.
+The HHS CIO has the authority to grant a one (1) year extension of this _Policy_. To archive this _Policy_, approval must be granted, in writing, by the HHS CIO.
 ## 10\. Approval
 /S/
+Jose Arrieta, Chief Information Officer (CIO)
+Jennifer Wendel, Acting HHS Chief Information Officer (CIO)
+May 28, 2020
+February 1, 2024
+## 11\. Concurrence
+## Appendix A: Procedures
+/S/
+_Please note that this appendix is subject to change at any time. The current version of this Policy will always reside in the OCIO Policy Library._
+Scott W. Rowell, Assistant Secretary for Administration (ASA)
+The following procedures are associated with this _Policy_ for section(s):
+June 12, 2020
+. Page 20, Section 6.9. Formal Evaluations
+     Procedures to Conduct a Formal Evaluation:
+) Make a preliminary assessment of the status of their records management program.
+) Identify major records management problems or challenges within the program area.
+) Set priorities for program improvements in compliance with relevant federal records management regulations and NARA guidance.
+) Analyze findings to identify successes and challenges related to the assessment topic.
+) Prepare and submit a comprehensive report to the HHS Records Management Program summarizing the assessment topic, outlining findings and recommendations, as well as highlighting any best practices from participating offices.
+## Appendix A: Procedures
+           Examples of Evaluation Topics and Questions:
+_Please note that this appendix is subject to change at any time. The current version of this Policy will always reside in the OCIO Policy Library._
+. Program Organization -
+. Has the program office formally designated a Records Manager or Records Liaison with responsibility for carrying out a records management program?
+. Does the Records Manager or Records Liaison periodically communicates with the OpDiv Records Officer on the status of records management practices and activities within the program area?
+. In the event of a program office realignment, is the Records Manager or Records Liaison involved to provide records management guidance on the maintenance and possible transfer of program records?
+. Guidance and Training -
+. Does the Records Manager or Records Liaison brief incoming and departing employees including senior officials on their records management responsibilities?
+. Does the Records Manager or Records Liaison provide guidance as required to all employees within the program area on the definition of federal records and non-record materials, including those created using office automation (i.e., email or text messages), and guidance on how the records must be managed and maintained?
+. Is the Records Manager or Records Liaison aware of regular records management duties on proper records maintenance, filing procedures, and records dispositions?
+. Records Maintenance and Accessibility -
+. Has the program office established standards and procedures for classifying, indexing, filing, and retrieving electronic records and made them accessible and retrievable to all program employees?
+. Does the program office have a current file plan indicating records series, description, disposition authority, format, location (name of electronic system), and custodian of the records within the program? Is the file plan updated periodically to reflect new records series or electronic information systems, changes in recordkeeping practices, or changes in programs resulting from legislative or regulatory changes?
+. Are permanent records identified and maintained separately from temporary records?
+. Records Disposition -
+. Have existing records disposition schedules been approved 10 years or earlier?
+. Do records disposition schedules instructions include provisions for:
+        a) Cutoffs,
+        b) Transfer instructions for all records proposed for permanent retention to NARA,
+        c) Specific retention periods before final disposition of all permanent or temporary records within the program area?
+. Is the program office following disposition instructions for electronic records that require the transfer to NARA of permanent electronic records? Is the program office following disposition instructions for temporary records, regardless of format?
+No additional procedural steps are required to implement this policy.
 ## Appendix B: Standards
 _Please note that this appendix is subject to change at any time. The current version of this Policy will always reside in the OCIO Policy Library._
+No additional standards are required to implement this policy.
+The following standards are associated with this _Policy_ for section(s):
+. Page 15, Section 6.2.4. Digitization
+. Digitization Standards -
+    OpDivs and StaffDivs must meet the following standards when digitizing temporary records:
+. Capture all information contained in the original source records.
+. Include all the pages or parts from the original source records.
+. Ensure the agency can use the digitized versions for all the purposes the original source records serve, including the ability to attest to transactions and activities.
+. Protect against unauthorized deletions, additions, or alterations to the digitized versions. Ensure the agency can locate, retrieve, access, and use the digitized versions for the records' entire retention period.
+. Digitization Validation Process -
+    OpDivs and StaffDivs must perform the following processes:
+. Validate that the digitized versions are of suitable quality to replace original source records.
+. Establish their own validation process or make use of third-party processes to validate that the digitized versions comply with 36 C.F.R. § 1236.32. The process may be project-based or agency-wide policy.
+. Document the validation process and retain that documentation for the life of the process or the life of any records digitized using that process, whichever is longer.
+. NARA may review validation documentation as needed.
+. Disposing of Original Source Records -
+\. Upon validation that digitized versions meet the standards in 36 C.F.R. § 1236.32, the original source records may be destroyed pursuant to GRS 4.5, Item 010 (Digitizing Records-Source Records) or an agency-specific records schedule that addresses disposition after digitization, subject to any pending legal constraint on the agency, such as a litigation hold.
+\. Digitized versions, now the recordkeeping versions, must be treated the same way as the original source records. The OpDiv or StaffDiv must retain the digitized versions for the remaining portion of any retention period established by the applicable records schedule.
+\. OpDivs and StafDivs do not need to obtain NARA approval to destroy scheduled temporary original source records they have digitized according to this part.
 ## Appendix C: Guidance
+_Please note that this appendix is subject to change at any time. The current version of this Policy will always reside in the OCIO Policy Library_.
+_Please note that this appendix is subject to change at any time. The current version of this Policy will always reside in the OCIO Policy Library._
+No additional guidance is required to implement this policy.
+The following guidance is associated with this _Policy_ for section(s):
+. Page 28, Section 7.13. Roles and Responsibilities - Contracting Officers (COs) and Contracting Officer Representatives (CORs)
+    CONTRACTOR REQUIREMENTS
+    This list of Contractor Requirements (CR) establishes the requirements for HHS contractors who create, use, maintain, receive, disseminate, or dispose of HHS records in connection with the performance of HHS-funded tasks or activities. Regardless of the performer of the work, the contractor is responsible for complying with the CR list. The contractor is responsible for the requirements of the document flowing down to sub-contractors at any tier, to the extent necessary to ensure contractor compliance with the requirements.
+. Completion of mandatory annual records management training to contractor employees to ensure awareness and proper management of HHS records in accordance with applicable records management requirements.
+. Manage all data created, received, and maintained for the Government by contractors in accordance with the Federal Records Act, the FOIA, and the Privacy Act of 1974.
+. Establish record keeping requirements that reflect adequate and proper documentation of the contractor's work on behalf of HHS.
+. Maintain up-to-date inventories or systems that provide for the identification, location, and retrieval of all categories of records created and received during official business.
+. Preserve records beyond their approved retention periods when they have been placed under a disposition moratorium for purposes of litigation holds and similar obligations. A disposition moratorium shall be lifted only by the OGC.
+. Work with the appropriate contracting official and designated records management staff to ensure federal records are identified for turnover and/or delivery at the completion or termination of the contract.
+. Provide sufficient technical documentation to ensure access to all electronic deliverables or turnovers throughout the records lifecycle.
 ## Appendix D: Forms and Templates
 _Please note that this appendix is subject to change at any time. The current version of this Policy will always reside in the OCIO Policy Library._
+The following template is associated with the _Policy_:
+The following template is associated with this _Policy_ for section(s):
+. Page 8, Section 6.1.2 Agency's responsibility working with contractors
+. Page 10, Section 6.1.2.5: Agency's responsibility working with contractors
+. Page 28, Section 7.13: Roles and Responsibilities - Contracting Officers (COs) and Contracting Officer Representatives (CORs)
+    The following is a general clause that an agency can modify to fit the planned type of service and specific agency records management needs. Additional contract language can be found on NARA's web publication, Records Management for Contracts at [https://www.archives.gov/records-mgmt/policy/records-mgmt-language](https://www.archives.gov/records-mgmt/policy/records-mgmt-language).
+    The following general clause can be used as a template that agencies can modify to fit the planned type of service and specific agency records management needs. Additional contract language can be found in the HHSAR and on NARA's web publication, Records Management for Contracts at [https://www.archives.gov/records-mgmt/policy/records-mgmt-language](https://www.archives.gov/records-mgmt/policy/records-mgmt-language).
+    Use of contractor's site and services may require management of Federal records. If the contractor holds Federal records, the contractor must manage Federal records in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters 21, 29, 31, 33), and regulations of the National Archives and Records Administration (NARA) at 36 CFR Chapter XII Subchapter B). Managing the records includes, but is not limited to, secure storage, retrievability, and proper disposition of all federal records, including transfer of permanently valuable records to NARA in a format and manner acceptable to NARA at the time of transfer. The agency also remains responsible under the laws and regulations cited above for ensuring that applicable records management laws and regulations are complied with through the life and termination of the contract.
+    General Clause:
+    If an agency decides to create or join a private or community cloud, it will still need to meet records management responsibilities. The agencies may describe these responsibilities in agreements among the participating offices or agencies. If a cloud provider ceases to provide services, an agency must continue to meet its records management obligations. Agencies should plan for this contingency. (NARA Bulletin 2010-05: Guidance on Managing Records in Cloud Computing Environments (2010))
+    Use of contractor's site and services may require management of federal records. If the contractor holds federal records, the contractor must manage federal records in accordance with all applicable records management laws and regulations, including but not limited to the Federal Records Act (44 U.S.C. Chapters 21, 29, 31, 33), regulations of the National Archives and Records Administration (NARA) at 36 C.F.R. Chapter XII Subchapter B), and this policy. Managing the records includes, but is not limited to, secure storage, retrievability, and proper disposition of all federal records, including transfer of permanently valuable records to NARA in a format and manner acceptable to NARA at the time of transfer. The agency also remains responsible under the laws and regulations cited above for ensuring that applicable records management laws and regulations are complied with through the life and termination of the contract.
+    If an agency decides to create or join a private or community cloud, it will still need to meet records management responsibilities. The agencies may describe these responsibilities in agreements among the participating offices or agencies. If a cloud provider ceases to provide services, an agency must continue to meet its records management obligations. Agencies should plan for this contingency. (NARA Bulletin 2010-05: Guidance on Managing Records in Cloud Computing Environments)[21]()
 ## Glossary and Acronyms
+The following is a list of key terms and acronyms used commonly in records management operations. These are not formal definitions, but rather an explanation of the terms as generally
+used pertaining to HHS records management. The list is not exhaustive. For additional definitions, please see NARA Records Management Key Terms and Acronyms.[22]()
 ### Definitions:
+This includes, but is not limited to, magnetic media, such as tapes and disks, and optical disks. Unless otherwise noted, these requirements apply to all electronic records systems, whether on microcomputers, minicomputers, or mainframe computers, regardless of storage media, in the network or stand-alone configurations.
+- **Access** - The availability of, or permission to consult, records.
+- **Accession** - The act and procedures involved in a transfer of legal title and the taking of records into the physical custody of the National Archives.
+- **Active Records** - Records that continue to be used with sufficient frequency to justify keeping them in the office of creation; current records.
+- **Administrative Records** - Documents that are preserved because they facilitate the operations and management of an agency, but do not relate directly to programs that help the agency achieve its mission. These include such documents as the agency budget, personnel, supplies, travel, and training. They are found in every agency, and often (but not always) their dispositions are covered by the General Records Schedules (GRS).
 - **Alienation** - Losing care and custody. Not protecting from loss or unauthorized access.
+- **Control and Custody of Records** - HHS records and materials are the property of the Federal government, not the property of individual employees or contractors acting as an agent of the Government, and may not be removed from the Department without proper authority. All employees and contractors must maintain records and non-record documentary materials separately from one another.
+- **Cloud Computing** - The National Institute of Standards and Technology (NIST) defines cloud computing as "a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.
+- **Control and Custody of Records** - HHS records and materials are the property of the federal government, not the property of individual employees or contractors acting as an agent of the Government and may not be removed from the Department without proper authority. All employees and contractors must maintain records and non-record documentary materials separately from one another.
+- **Custody** - Care and control of records, including both physical possession (physical custody) and legal responsibility (legal custody), unless one or the other is specified.
 - **Database** - A set of data, consisting of a least one data file, that is sufficient for a given purpose.
+- **Disposal** - The action taken regarding temporary records after their retention periods expire and usually consisting of destruction or occasionally of donation. Also, when specified, "disposal" refers to the actions taken regarding non-record materials when no longer needed, especially their destruction. (See NARA, "A Federal Records Management Glossary.")
+- **Disposition** - The action taken concerning records following their appraisal by NARA. The actions include transfer to agency storage facilities or Federal records center; transfer from one federal agency to another; transfer of permanent records to the National Archives; and disposal of temporary records. "Disposition" is also the action taken regarding non-records materials when no longer needed, including screening and destruction (NARA, "A Federal Records Management Glossary").
+- **Electronic Records** - Any information that is recorded in a form that only a computer can process, and that satisfies the definition of a federal record (44 U.S.C. § 3301).[13]() Electronic records include numeric, graphic and text information, which may be recorded on any medium capable of being read by a computer and which satisfies the definition of a record.
+- **Deletion** - The removal or erasure of information from electronic devices and storage media.
+- **Destruction** - The disposal of documents of no further value by incineration, maceration, pulping, or shredding.
+- **Digitizing** - The process of converting physical records into digital format.
+- **Disposal** - The action taken regarding temporary records after their retention periods expire and usually consisting of destruction or occasionally of donation. Also, when specified, "disposal" refers to the actions taken regarding non-record materials when no longer needed, especially their destruction.
+- **Disposition** - The action taken concerning records following their appraisal by NARA. The actions include transfer to agency storage facilities or Federal Records Centers; transfer from one federal agency to another; transfer of permanent records to the National Archives; and disposal of temporary records. "Disposition" is also the action taken regarding non-records materials when no longer needed, including screening and destruction.
+- **Electronic Information System (EIS)** - An electronic information system is the organized collection, processing, transmission, and dissemination of information according to defined procedures. EIS includes three categories of information: (1) inputs, (2) the information on the electronic media, and (3) outputs.
+- **Electronic Mail (E-mail)** - A document created or received on an electronic mail system including brief notes, more formal or substantive narrative documents, and any attachments, such as word-processing and other electronic documents, which may be transmitted with the message.
+- **Electronic Records** - Any information that is recorded in a form that only a computer can process, and that satisfies the definition of a federal record (44 U.S.C. § 3301).[23]() Electronic records include numeric, graphic and text information, which may be recorded on any medium capable of being read by a computer and which satisfies the definition of a record.
+    This includes, but is not limited to, magnetic media, such as tapes and disks, and optical disks. Unless otherwise noted, these requirements apply to all electronic records systems, whether on microcomputers, minicomputers, or mainframe computers, regardless of storage media, in the network or stand-alone configurations.
+- **Electronic Records Management System (ERMS)** - ERMS, often referred to as a records management application (RMA), is an electronic management system in which any agency records, regardless of format (paper, electronic, microform, etc.), are collected, organized, and categorized to facilitate their preservation, retrieval, use, and disposition. An ERMS:
+. Provides document content, context, and structure.
+. Ensures authenticity, integrity, and reliability - i.e., contains unchanged, redundant information (prevents unauthorized alternation, modification, concealment, or deletion).
+. Provides for compliance and disposition - i.e., meets regulations and complies with agency records schedules.
 - **Enterprise Performance Life Cycle (EPLC)** - A methodology that establishes a project management and accountability environment for HHS IT projects to achieve consistently successful outcomes that maximize alignment with Department-wide and individual OPDIV goals and objectives. Implementation of the EPLC methodology allows HHS to improve the quality of project planning and execution, reducing overall project risk.
+- **Essential Records** - Essential records are any records, documents, files or information database in any form or format containing information essential to the operations and survival of an organization. They are needed to conduct essential functions and supporting activities. Essential records are divided into two major categories: (1) Emergency Operating Records are records and databases essential to the continued functioning or the reconstitution of an organization during and after continuity activation. (2) Rights and Interests Records are records critical to carrying out an organization's essential legal and financial functions and vital to the protection of the legal and financial rights of individuals who are directly affected by that organization's activities.
+- **Essential Records** - Essential records are any records, documents, files or information database in any form or format containing information essential to the operations and survival of an organization. They are needed to conduct essential functions and supporting activities. Essential records are divided into two major categories: (1) **Emergency Operating Records** are records and databases essential to the continued functioning or the reconstitution of an organization during and after continuity activation. (2) **Rights and Interests Records** are records critical to carrying out an organization's essential legal and financial functions and vital to the protection of the legal and financial rights of individuals who are directly affected by that organization's activities.
+- **Evaluation** - An assessment designed to focus on the real-life experiences and practices agencies have with a specific assessment topic.
 - **File** - A collection of related documents or papers arranged so that they can be consulted easily.
+- **File Plan** - A listing of all files in a container (regardless of the media), office or organization.
+- **Hold** - An agency's temporary suspension of disposition action(s) and notification to its employees to retain records and other documentary materials in the agency's possession, custody or control, typically because of litigation (including administrative cases), audit, or investigative needs. Under a Hold, documentary materials, regardless of record status, format, and of physical location, are required to be retained and not destroyed or otherwise disposed of for as long as a Hold is in place.
+- **File Plan** - A list designating the physical and/or electronic location(s) at which an agency's files are to be maintained, the specific types of files to be maintained there, and the organizational element(s) having custodial responsibility. Also: A document containing the identifying number, title or description, and disposition authority of files held in an office.
+- **General Records Schedules (GRS)** - GRS are issued by the Archivist of the United States under the authority of 44 U.S.C 3303a(d)[24]() to provide disposition authority for records common to several or all federal agencies. The GRS cover records documenting administrative functions rather than program functions. Agencies must apply the GRS to the greatest extent possible.
+- HHS Records - For purposes of this _Policy_, HHS records include not only records that belong to HHS, but records that HHS manages for another federal agency when acting as that agency's service provider or agent.
+- **Hold** - An agency's temporary suspension of disposition action(s) and notification to its employees to retain records and other documentary materials in the agency's possession, custody, or control, typically because of litigation or other independent preservation holds. Under a Hold, documentary materials, regardless of record status, format, and of physical location, are required to be retained and not destroyed or otherwise disposed of for as long as a Hold is in place.
 - **Information System** - Is defined by the Office of Management and Budget (OMB) in Circular No. A-130 "...the organized collection, processing, transmission and dissemination of information in accordance with defined procedures, whether automated or manual."
+- **Mandatory Records Schedules** - All records of HHS must be listed and described in an approved records schedule and must be disposed of only as authorized by that schedule. Schedules must be reviewed annually. Agencies should update their records schedules when there are program changes that will result in the establishment of new types of records, the transfer or termination of records no longer required, or an increase or decrease in the retention time of the records, to ensure the schedules accurately reflect current records and the functions they document (36 CFR 1225).[14]() Whenever possible, HHS should apply the NARA generated General Records Schedules (GRS) for routine administrative records. As required by regulation, HHS must ask NARA for a variance when not following the retention periods outlined by these schedules (36 CFR 1227).[15]()
+- **Non-Record Materials** - are federally-owned informational materials that do not meet the statutory definition of records (44 U.S.C. § 3301),[16]() or that have been excluded from coverage by the definition. Excluded materials are extra copies of documents kept only for reference, stocks of publications and processed documents, and library or museum materials intended solely for reference or exhibit (36 CFR 1220.18).[17]()
+- **Office of the Secretary (OS)** - is referenced in this _Policy_ as the OpDivs and includes the StaffDivs and the Offices of the Regions.
+- **OMB Exhibit 300- Capital Asset Plan and Business Case Summary** - As prescribed and described in OMB's Circular A-11, Preparation, Submission and Execution of the Budget.
+- **Lifecycle** - The management concept that records pass through three stages: creation, maintenance and use, and disposition.
+- **Metadata** - Data describing stored data: that is, data describing the structure, data elements, interrelationships, and other characteristics of electronic records.
+- **Migration** - A set of organized tasks designed to achieve periodic transfer of digital materials from one hardware/software configuration to another, or from one generation of computer technology to a subsequent generation.
+- **Non-Government Employee** - Any individual, entity, or affiliate who is not an official HHS employee but contributes to the mission of HHS with their services. Examples of non-government employees include vendors, consultants, and freelancers.
+- **Non-Record Materials** - Non-record materials are documentary materials excluded from the legal definition of records. The United States Code defines "non-record materials" to include material such as unofficial copies of documents kept only for convenience or reference, stocks of publications and near-print documents, and library or museum material intended solely for reference or exhibition.
+- **Office of the Secretary (OS)** - is referenced in this Policy as an OpDiv and includes the StaffDivs and the Offices of the Regions. For records management purposes, the Office of Inspector General is considered a StaffDiv.
 - **OMB Circular A-130-Management of Federal Information Resources** - Establishes policy for the management of federal information resources. OMB includes procedural and analytic guidelines for implementing specific aspects of these policies. The policies in this Circular apply to the information activities of all agencies of the executive branch of the federal government.
+- **Operating Division (OpDiv)** - An entity of HHS that is an independent agency.
+- **OS Operating Division (OpDiv)** - The OpDiv includes the Inspector General, as well as the Office of the Secretary and its StaffDivs as a combined, single entity.
+- **Personal Papers** - Documentary materials belonging to an individual that are not used to conduct agency business. Personal papers are excluded from the definition of Federal records and are not owned by the Government.
+- **Operating Division (OpDiv)** - A component of HHS that administers a wide variety of health and human services. The Office of the Secretary (OS) is an OpDiv.
+- **Permanent Records** - Record appraised by NARA as having sufficient historical or other value to warrant continued preservation by the federal government beyond the time it is needed for administrative, legal, or fiscal purposes.
+- **Personal Papers** - Documentary materials belonging to an individual that are not used to conduct agency business. Personal papers are excluded from the definition of federal records and are not owned by the Government.
+- **Program Records** - Those records created by each federal agency in performing the unique functions that stem from the distinctive mission of the agency. The agency's mission is defined in enabling legislation and further delineated in formal regulations.
 - **Records** - Includes all recorded information, regardless of form or characteristics, made or received by a federal agency under federal law or in connection with the transaction of public business and preserved or appropriate for preservation by that agency or its legitimate successor as evidence of the organization, function, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them.
+    Library and museum material made or acquired and preserved solely for reference or exhibition purposes or duplicate copies of records preserved only for convenience are not included (44 U.S.C. § 3301).[18]()
+    Library and museum material made or acquired and preserved solely for reference or exhibition purposes or duplicate copies of records preserved only for convenience are not included (44 U.S.C. § 3301).[25]()
 - **Records Disposition Schedule** - A document, approved by NARA, which provides authority for the final disposition of temporary or permanent records. Records must not be destroyed except as authorized by an approved records schedule.
+- **Records Management** - The planning, controlling, directing, organizing, training, promoting, and other managerial activities involved with respect to records creation, records maintenance and use, and records disposition in order to achieve adequate and proper documentation of the policies and transactions of the federal government and effective and economical management of agency operations (44 U.S.C. § 2901).[19]()
+- **Records Schedule** - A records schedule is a document providing mandatory instructions for what to do with records no longer needed for current Government business, with the provision of authority for the final disposition of recurring or nonrecurring records.
+- **Records Management** - The planning, controlling, directing, organizing, training, promoting, and other managerial activities involved with respect to records creation, records maintenance and use, and records disposition in order to achieve adequate and proper documentation of the policies and transactions of the federal government and effective and economical management of agency operations (44 U.S.C. § 2901).[26]()
+- **Records Retention Schedule** - A records retention schedule is a document providing mandatory instructions for what to do with records no longer needed for current Government business, with the provision of authority for the final disposition of recurring or nonrecurring records.
 - **Reference Material** - Must be clearly marked and maintained separately from the records of the office.
+- **Scheduled Records** - Records whose final disposition has been approved by NARA.
+- **Social Media** - Social media tools use Internet and web-based technologies (often called Web 2.0 technologies) to integrate technology, social interaction, and content creation. Social media use the "wisdom of crowds" to connect information in a collaborative manner online. Through social media, individuals or collaborations of individuals create web content, organize content, edit or comment on content, combine content, and share content.
 - **Staff Division (StaffDiv)** - Sub-components of the Office of the Secretary Operating Division (OS OpDiv).
+- **Temporary Records** - Record approved by NARA for disposal after a specified retention period.
+- **Transfer** - The process of moving records from one location to another, especially from office space to off-site storage facilities, from one agency to another, or from an agency office to a Federal Records Center or to NARA.
+- **Unauthorized Disposal** - The improper removal of records without NARA approval or the willful or accidental destruction of records without regard to a NARA approved records schedule. Unauthorized disposition of federal records is against the law and punishable by up to $250,000 in fines and imprisonment. (44 U.S.C. 3106 and 18 U.S.C. 2071)[27]()
+- **Unscheduled Records** - Records whose final disposition has not been approved by NARA. Unscheduled records may not be destroyed or deleted.
 ### Acronyms
 - **ARO** - Agency Records Management Officer
 - **ASA** - Assistant Secretary for Administration
 - **CFR** - Code of Federal Regulations
 - **RMA** - Records Management Application
 - **RO** - Records Management Officer
 - **SAORM** - Senior Agency Official for Records Management
 - **StaffDiv** - Staff Division
 - **U.S.C.** - United States Code
+\. Definition of Records, 44 U.S.C. § 3301 (a)(1)(A)-(B) (2008). Available at: [https://www.archives.gov/about/laws/disposal-of-records.html](https://www.archives.gov/about/laws/disposal-of-records.html).- [back to note 1]()
+\. For further information, please see: HHS OCIO. (2017, June 26). _HHS Security and Privacy Language for Information and Information Technology Procurements, Version 2.0._ Available at: https://intranet.hhs.gov/sites/default/files/s3fs-public/s3fs-public/2019-06/security-privacy-language\_1.pdf.- [back to note 2]()
+\. Records Management by Federal Agencies, 44 U.S.C. §2901(2) (2011). Available at: [https://www.archives.gov/about/laws/records-management.html](https://www.archives.gov/about/laws/records-management.html).- [back to note 3]()
+\. Agency Recordkeeping Requirements, 36 CFR Part 1222.32 (b)) (2012). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 4]()
+\. NARA Guidance on Records Management for Contracts (2019). Available at: [https://www.archives.gov/records-mgmt/policy/records-mgmt-language](https://www.archives.gov/records-mgmt/policy/records-mgmt-language).- [back to note 5]()
+\. Records Disposition Programs, 36 CFR 1224.10(c) (2011). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 6]()
+\. Creation and Maintenance of Federal Records: How Must Agencies Create Records, 36 CFR Part 1222.34 (2012). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 7]()
+\. Inspection of Records, 36 CFR 1220.18 (2002). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 8]()
+\. Creation and Maintenance of Federal Records, 36 CFR Part 1222 (2012). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 9]()
+\. Records Management by Federal Agencies, 44 U.S.C. Chapter 31 (2011). Available at: [https://www.archives.gov/about/laws/fed-agencies.html](https://www.archives.gov/about/laws/fed-agencies.html).- [back to note 10]()
+\. Public Money, Property or Records, 18 U.S.C. § 641 (2011). Available at: [https://www.law.cornell.edu/uscode/text/18/641](https://www.law.cornell.edu/uscode/text/18/641); see also Concealment, Removal, or Mutilation Generally, 18 U.S.C. § 2071 (2011). Available at: [https://www.law.cornell.edu/uscode/text/18/2071](https://www.law.cornell.edu/uscode/text/18/2071).- [back to note 11]()
+\. OMB/NARA Directive M-19-21, Transition to Electronic Records (2019). Available at: [https://www.archives.gov/files/records-mgmt/policy/m-19-21-transition-to-federal-records.pdf](https://www.archives.gov/files/records-mgmt/policy/m-19-21-transition-to-federal-records.pdf).- [back to note 12]()
+\. Definition of Records, 44 U.S.C. § 3301 (2008). Available at: [https://www.archives.gov/about/laws/disposal-of-records.html](https://www.archives.gov/about/laws/disposal-of-records.html).- [back to note 13]()
+\. Scheduling Records, 36 CFR Part 1225 (2012). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 14]()
+\. General Records Schedules, 36 CFR Part 1227 (2011). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 15]()
+\. Definition of Records, 44 U.S.C. § 3301 (2008). Available at: [https://www.archives.gov/about/laws/disposal-of-records.html](https://www.archives.gov/about/laws/disposal-of-records.html).- [back to note 16]()
+\. Federal Records: What Definitions Apply to the Regulations in Subchapter B, 36 CFR 1220.18 (2011). Available at: [https://www.archives.gov/about/regulations/regulations.html](https://www.archives.gov/about/regulations/regulations.html).- [back to note 17]()
+\. Definition of Records, 44 U.S.C. § 3301 (2008). Available at: [https://www.archives.gov/about/laws/disposal-of-records.html](https://www.archives.gov/about/laws/disposal-of-records.html).- [back to note 18]()
+\. Records Management by the Archivist of the United States and by the Administrator of General Services: Definitions, 44 U.S.C. § 2901 (2011). Available at: [https://www.archives.gov/about/laws/fed-agencies.html](https://www.archives.gov/about/laws/fed-agencies.html).- [back to note 19]()
+- * *
+### Endnotes
+[1]() Definition of Records, 44 U.S.C. § 3301(a)(1)(A) and (B), available at: [https://www.law.cornell.edu/uscode/text/44/3301#:~:text=For%20purposes%20of%20paragraph%20(1,in%20digital](https://www.law.cornell.edu/uscode/text/44/3301).
+[2]() Paper Reduction Act (PRA), 5 C.F.R. Part 1320.3(d): For purposes of this Policy, a federal grant recipient's collection or maintenance of information or use or operation of an information system will be considered to be "on behalf of" the Department only if such activity is at the specific request of the Department or if the terms and conditions of the grant require specific approval by the Department of the activity or the procedures for same.
+[3]() For further information, please see: HHS Policy for Information and Information Technology Procurements - Security and Privacy Language, Version 3.3, available at: https://intranet.hhs.gov/policy/hhs-policy-information-technology-procurements-security-and-privacy-language.
+[4]() Creation and Maintenance of Federal Records: How are Non-record Materials Managed, 36 C.F.R. Part 1222.16, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222).
+[5]() Creation and Maintenance of Federal Records: How are Personal Files Defined and Managed, 36 C.F.R. Part 1222.20, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222).
+[6]() HHS Agency Records Retention Schedules - NARA Website, available at: [https://www.archives.gov/records-mgmt/rcs/schedules/index.html?dir=/departments/department-of-health-and-human-services](https://www.archives.gov/records-mgmt/rcs/schedules/index.html).
+[7]() Records Disposition Programs, 36 C.F.R. Part 1224.10, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1224/section-1224.10](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1224/section-1224.10).
+[8]() Agency Recordkeeping Requirements: How Do Agencies Manage Records Created or Received by Contractors, 36 C.F.R. Part 1222.32, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222/subpart-B/section-1222.32.](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1222/subpart-B/section-1222.32)
+[9]() NARA Guidance on Records Management for Contracts, available at: [https://www.archives.gov/records-mgmt/policy/records-mgmt-language](https://www.archives.gov/records-mgmt/policy/records-mgmt-language).
+[10]() Federal Records: General, 36 C.F.R. Part 1220.18, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1220](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1220).
+[11]() NARA Bulletin 2015-04, available at: [https://www.archives.gov/records-mgmt/bulletins/2015/2015-04.html](https://www.archives.gov/records-mgmt/bulletins/2015/2015-04.html).
+[12]() Metadata Requirements, 36 C.F.R. Part 1236.54, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236/subpart-E/section-1236.54](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236/subpart-E/section-1236.54).
+[13]() Federal Records Act, as defined in 44 U.S.C. § 2911(c)(1), available at: [https://www.archives.gov/about/laws/records-management.html#2911](https://www.archives.gov/about/laws/records-management.html).
+[14]() Electronic Records Management, 36 C.F.R. Part 1236.2 - 1236.58, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1236).
+[15]() Definition of Records, 44 U.S.C. § 3301, available at: [https://www.law.cornell.edu/uscode/text/44/3301#:~:text=duplicate%20copies%20of%20records%20preserved%20only%20for%20convenience.&text=For%20purposes%20of%20paragraph%20(1,in%20digital%20or%20electronic%20form](https://www.law.cornell.edu/uscode/text/44/3301).
+[16]() HHS FOIA Offices and Contact Information, available at: [https://www.hhs.gov/foia/contacts/index.html](https://www.hhs.gov/foia/contacts/index.html).
+[17]() Records Management by Federal Agencies, 44 U.S.C. Chapter 31, available at: [https://www.archives.gov/about/laws/fed-agencies.html](https://www.archives.gov/about/laws/fed-agencies.html).
+[18]() Public Money, Property or Records, 18 U.S.C. § 641, available at: [https://www.law.cornell.edu/uscode/text/18/641](https://www.law.cornell.edu/uscode/text/18/641); see also Concealment, Removal, or Mutilation Generally, 18 U.S.C. § 2071, available at: [https://www.law.cornell.edu/uscode/text/18/2071](https://www.law.cornell.edu/uscode/text/18/2071).
+[19]() Unlawful or Accidental Removal, Defacing, Alteration, or Destruction of Records, 36 C.F.R. Part 1230.14, available at: [https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1230](https://www.ecfr.gov/current/title-36/chapter-XII/subchapter-B/part-1230).
+[20]() OMB/NARA Directive M-19-21, Transition to Electronic Records, available at: [https://www.whitehouse.gov/wp-content/uploads/2019/08/M-19-21-new-2.pdf](https://www.whitehouse.gov/wp-content/uploads/2019/08/M-19-21-new-2.pdf).
+[21]() NARA Bulletin 2010-05, available at: [https://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html](https://www.archives.gov/records-mgmt/bulletins/2010/2010-05.html).
+[22]() NARA Records Management Key Terms and Acronyms, available at: [https://www.archives.gov/files/records-mgmt/rm-glossary-of-terms.pdf](https://www.archives.gov/files/records-mgmt/rm-glossary-of-terms.pdf).
+[23]() Definition of Records, 44 U.S.C. § 3301, available at: [https://www.archives.gov/about/laws/disposal-of-records.html](https://www.archives.gov/about/laws/disposal-of-records.html).
+[24]() Disposal of Records, 44 U.S.C. § 3303a(d), available at: [https://www.archives.gov/about/laws/disposal-of-records.html](https://www.archives.gov/about/laws/disposal-of-records.html).
+[25]() Definition of Records, 44 U.S.C. § 3301, available at: [https://www.archives.gov/about/laws/disposal-of-records.html](https://www.archives.gov/about/laws/disposal-of-records.html).
+[26]() Records Management by the Archivist of the United States: Definitions, 44 U.S.C. § 2901, available at: [https://www.archives.gov/about/laws/fed-agencies.html](https://www.archives.gov/about/laws/fed-agencies.html).
+[27]() Concealment, Removal, or Mutilation Generally, 18 U.S.C. § 2071, available at: [https://www.govinfo.gov/content/pkg/USCODE-2021-title18/pdf/USCODE-2021-title18-partI-chap101-sec2071.pdf](https://www.govinfo.gov/content/pkg/USCODE-2021-title18/pdf/USCODE-2021-title18-partI-chap101-sec2071.pdf).