Documentation & Record Management Flashcards

A compliance officer discovers that a regulatory body's new rule requires retention of certain transaction records for 7 years, but the organization's existing records retention schedule specifies only 5 years for the same record type. Which action reflects the correct hierarchy of retention obligations?

Answer: Retain records for 7 years, superseding the internal schedule until it is formally updated

When a legal or regulatory retention requirement exceeds the organization's internal schedule, the longer external obligation governs. Organizations must comply with the most stringent applicable requirement. The internal schedule should be updated, but pending that update, the regulatory minimum of 7 years controls. Seeking a waiver is generally not available for mandatory minimum retention rules, and simply noting the discrepancy in a risk register does not eliminate the legal exposure.

Under a litigation hold, a paralegal asks whether she may continue routine purging of emails older than 90 days as specified in the organization's standard email retention policy. What is the legally and ethically correct response?

Answer: Purging must cease only for custodians and record categories within the scope of the litigation hold

A litigation hold suspends normal destruction schedules only for records and custodians within its defined scope. Routine purging of genuinely unrelated records may lawfully continue; however, the scope determination must be made carefully and documented. A blanket cessation organization-wide is operationally disproportionate and not legally required, while shadow-copy archiving is not a recognized substitute for preserving originals in place.

An organization operating under ISO 15489 is designing a metadata schema for its electronic document management system. Which metadata element is MOST critical for establishing the authenticity of a record over time?

Answer: Audit trail capturing creation, modification, and access events with timestamps

Authenticity—a core property under ISO 15489—requires demonstrating that a record is what it purports to be and has not been altered without authorization. An immutable audit trail recording who created, modified, or accessed a record and when directly substantiates that claim. Title and subject support retrieval; department codes support accountability reporting; format specifications support long-term readability—all valuable, but none directly establish the record's authenticity as an unaltered original.

A multinational company subject to both the EU GDPR and U.S. HIPAA discovers that a single patient dataset must be retained for 6 years under HIPAA but must be deleted within 30 days of a verified erasure request under GDPR Article 17. No HIPAA exception explicitly overrides the GDPR request. How should the compliance team proceed?

Answer: Retain the record for 6 years per HIPAA and deny the erasure request, citing the legal obligation exception under GDPR Article 17(3)(b)

GDPR Article 17(3)(b) explicitly exempts controllers from the erasure obligation when processing is necessary for compliance with a legal obligation—including U.S. federal law such as HIPAA. Because HIPAA imposes a mandatory 6-year retention requirement, the organization may lawfully decline the erasure request on that basis, provided it informs the data subject of the applicable legal obligation. Treating one jurisdiction's law as universally supreme ignores the conflict-of-laws framework; physical segregation does not resolve the legal conflict; and pseudonymization is not deletion and could constitute a misleading response to the data subject.

During a records management audit, an auditor finds that a department head has been routinely forwarding finalized compliance reports to her personal cloud storage account 'for convenience.' Which combination of risks does this practice MOST directly implicate?

Answer: Chain-of-custody integrity, data sovereignty/jurisdictional exposure, and unauthorized disclosure risk

Forwarding official compliance records to personal cloud storage breaks the organization's chain of custody (the record is now outside controlled systems with no authoritative audit trail), creates data sovereignty exposure (cloud servers may be located in jurisdictions with conflicting data-protection laws), and introduces unauthorized disclosure risk (personal accounts lack enterprise DLP controls, access management, and breach notification obligations). The other options may have some peripheral relevance but do not capture the primary legal, regulatory, and security risks that shadow-IT record storage creates.

An organization is migrating 15 years of legacy paper records to a digital repository. To ensure the digital copies are legally admissible as business records under the U.S. Federal Rules of Evidence Rule 803(6) and UETA, which element is MOST critical to establish at the time of scanning?

Answer: Attaching a certificate of authenticity signed by the records custodian at the time of digitization, documenting the process used

For digitized copies of paper originals to be admissible as business records under FRE 803(6) and legally equivalent under UETA, the organization must be able to demonstrate the accuracy and trustworthiness of the imaging process. A contemporaneous certificate of authenticity—signed by the custodian and describing the scanning process, equipment, quality-control checks, and disposition of the originals—is the evidentiary cornerstone. While 600 DPI is a common quality standard and PDF/A supports long-term preservation, neither alone establishes the legal foundation for admissibility. Sequential accession numbers support retrieval but not authenticity.