Records Management

Retention Schedules

The Wright State Office of Records Management, as required by ORC 149.33, provides guidance and support to help university offices comply with state and federal laws governing the proper management of university records in all formats. The office develops records retention schedules that help identify the types of records created or received by the university, how long they must be kept, and the appropriate method of retention and disposal. These retention policies establish clear, consistent rules for collecting, organizing, maintaining, and disposing of public records—supporting the university’s legal and operational obligations while also making information easier to find and use. The program also offers services to help the university meet its record-keeping responsibilities, including the development of standards that improve efficiency and reduce risk in the management of information. The university’s Records Management and Retention policy defines which records must be retained long term, explains the role of the university archives as the official repository for permanent records, and outlines the university’s responsibilities related to public records requests, as further detailed in the Public Records policy.

General and Department Schedules

Official departmental retention schedules are the primary compliance tool provided for university offices for the proper management of their information resources. They establish clear, approved requirements for how long records must be retained and the specific conditions for their maintenance, transfer, and authorized disposition. By ensuring consistent treatment of records across all departments and formats, retention schedules help the university meet legal and regulatory obligations, support defensible record-keeping practices, and reduce risk from retaining records too long or disposing of them improperly. In addition to departmental schedules, the Office of Records Management also provides the University General Retention Schedule, which provides guidelines for how long to keep common types of records of a more routine nature that are found in most offices and typically retained longer than needed. Instructions for accessing and searching university retention schedules are below.

The current Wright State University approved General Records Retention Schedule and departmental records retention schedules can be accessed at Versatile Web Retention. For information about retention codes, please see the Default Retention Abbreviations list.

Research

The Research function allows users to research whether there are laws or regulations that could affect the retention and disposition of certain types of records. This citation database can be used as a starting point to see if records are affected by regulations or if regulations surrounding the retention of records have changed since the schedules were last updated. Not every record series has laws driving its retention period, and, there are additional factors that are used when setting retention schedules. Citations will be formally attached to retention schedules when units work with the University Records Management on updates; contact us for assistance.

Disposal of University Records

The Records Management Office provides approval for university offices to dispose of university records or transfer them to the archives. A Certificate of Records Disposal (PDF), approved by the university records manager, is required prior to the disposal or transfer of university records listed on department records retention schedules. Records listed in the general schedule (and not your department schedule) do not require a CRD.

Retention Guidelines for Protected Data

University data is protected by state and federal law and university policies and procedures including FERPA and HIPAA regulations. Descriptions, classification examples, and retention schedule recommendations of types of university's protected data follow below.

• FERPA: Privacy and Release of Student Educational Records
• HIPAA Regulations: Uses and Disclosure of Protected Health Information

Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act of 1999 relates to the protection of personal financial information held by financial institutions. The GLB Act broadly defines “financial institution” as any institution engaged in financial activities on behalf of consumers. Higher education institutions that process student loans are considered financial institutions under the Act. Protected information goes beyond financial aid records. It includes personal financial information collected by the university, faculty, students, staff, and others. Protected financial information includes financial aid records, credit card and personal check information, salary information and tax records. University offices that maintain protected financial information are required to identify themselves to the Computing and Telecommunications Services, Information Security Officer.

Examples:

• Credit card numbers with/without expiration dates
• Bank account information
• Purchasing card numbers
• Social Security or taxpayer ID numbers
• Contract information (between Wright State and third parties)

GLB does not impose a specific retention requirement for protected financial records. Retention schedules vary depending on type of record. For specific retention requirements, refer to departmental records retention schedules or the University General Schedule. Examples include:

• Accounts Receivable: Records related to amounts due on open accounts for goods and services provided. Retain while active plus 4 years.
• Accounting Journals/Ledgers: Records used to transfer charges between accounts and for summarizing all transactions. Retain while active plus 4 years.
• Donor files: Includes information on major donors, donor giving history, copies of checks, and correspondence. Retain indefinitely.
• Financial aid records: Files on financial aid recipients. Maintain while active plus 6 years.
• GLB documentation: Records that demonstrate compliance efforts of the institution and its individual units. Maintain for 2 years and until audited.
• Personnel Files: Employment records of part time and full-time employees. May contain applications, copies of driver’s licenses, social security numbers, birth certificate, payroll and salary info, annual contracts, OPERS forms, etc. Retain while active plus 6 years. Long term information maintained by Human Resources.

Other Protected Information

Advancement Information

• Name 
• Graduation class and degree(s) 
• Credit card numbers 
• Bank account numbers 
• Social Security Numbers 
• Amount / what donated 
• Telephone/fax numbers 
• E-mail, URLs 
• Employment information 
• Family information (spouse(s) / children / grandchildren) 
• Medical history 

Research Information

• Funding/sponsoriship information
• Human subject information
• Lab animal care information

Employee Information

• Social Security Number (including partials) 
• Date of Birth 
• Home address or personal contact information 
• Benefits information 
• Performance reviews 
• Worker's compensation or disability claims 

Management Data

• Detailed monthly expenditures statements 
• Detailed annual budget information 
• Faculty annual conflict of interest disclosures 
• University's investment information 
• Evaluations

Every university employee is responsible for safeguarding the confidentiality, integrity, and accuracy of protected data. University employees should know what kind of data is protected and what security measures protected data require.