This manual chapter establishes the policies, procedures, and guidelines related to the creation, maintenance, and disposition of Federal records. This policy complies with the requirements established by the Federal Records Act (FRA), and applicable statutes, regulations, and existing policy.

Proper maintenance of Federal records promotes open government and supports the principals of transparency in government by providing an adequate audit trail and history of the intent of public policy.

The policy in this chapter applies to all National Institutes of Health (NIH) Institutes, Centers, and Offices within the Office of the Director (ICOs), and all personnel, including employees, contractors, volunteers, fellows, trainees and interns (referred to here as “staff”), involved in the creation, maintenance, and disposition of NIH’s Federal records.

The FRA, as amended, requires all Federal agencies to create and preserve records that adequately and properly document the agency’s organization, functions, policies, decisions, procedures, and essential transactions. Federal records serve as the agency’s memory. Effective and efficient management of records provides the foundation for decision-making at all levels, including mission planning and operations, personnel services, legal inquiries, business continuity, and preservation of U.S. history.

Recordkeeping by Federal agencies is controlled by laws and regulations (see references below) and that require:

1. Government records be kept only for authorized periods of time;
2. No government records may be destroyed, mutilated or removed from government custody without authorization;
3. Records which are valuable enough to be preserved permanently must be kept intact and transferred to the National Archives and Records Administration (NARA) as appropriate; and
4. Records which are not in active use, but which cannot be destroyed for some time, will be transferred to a Federal Records Center (FRC), stored appropriately in agency occupied/owned space both physical or digital, or transferred to a NARA- approved commercial storage facility.

The FRA also requires agencies to establish a records management program, defined as a planned, coordinated set of policies, procedures, and activities needed to manage their recorded information. Major elements include periodically issuing up-to-date records management directives, properly training those responsible for implementation and carefully evaluating the results to ensure adequacy, effectiveness, and efficiency.

It is the policy of the NIH, as an Operating Division of the U.S. Department of Health and Human Services (HHS), to create, maintain, and dispose of Federal records in compliance with the FRA, as amended and applicable statutes, regulations, and existing policy. This policy applies to all NIH Federal records, regardless of format or media.

1. Creating and Capturing Federal Records

A Federal record is defined in 44 U.S.C 3301 as:

“All recorded information, regardless of form or characteristics, made or received by a Federal agency under Federal law or in connection with the transaction of public business and preserved as appropriate for preservation by that agency or its legitimate successor as evidence of the organization, functions, policies, decisions, procedures, operations, or other activities of the United States Government or because of the informational value of data in them, excluding library and museum material made or acquired and preserved solely for reference or exhibition purposes; or duplicate copies of records preserved only for convenience.”

Federal Records capture NIH's institutional memory and preserve important historical information. They are of critical importance in ensuring that ICOs continue to function effectively and efficiently. Records serve several purposes including:

• Planning for administrative, program and mission related needs;
• Providing evidence of NIH activities;
• Protecting legal and financial rights;
• Enabling oversight by Congress and other authorized agencies;
• Documenting NIH's history; and,
• Continuing key functions and activities in the event of an emergency or disaster.

Federal Records contain the information that documents how NIH fulfills its mission. Records typically contain information that is:

• Created during NIH business;
• Received for action;
• Needed to document NIH's activities and decisions;
• Required to support NIH's financial and other obligations and legal claims; or,
• Communicated to assert NIH requirements or guidance.

2. Records Lifecycle

All NIH Federal records must be managed throughout the records lifecycle, which includes creation or receipt, maintenance and use, and disposition. NIH Federal records must be managed in accordance with record schedules approved by the Archivist of the United States. Unscheduled records must not be destroyed. Approved NIH schedules can be found in the NIH Record Schedule System (RSS). The following requirements must be addressed and met for managing NIH Federal records throughout their lifecycle:

1. Permanent Federal Records: Permanent records must be created, maintained, and stored in media and formats that allows for their complete and organized accessioning, or transfer of physical and legal custody, to NARA. To initiate an accession of permanent Federal records to NARA, contact the appropriate ICO Record Liaison (RL) or [email protected].
2. Temporary Federal Records: Temporary records stored on-site that have met their retention period must be managed and destroyed in accordance with a NARA-approved Records Schedule. NIH temporary records that are stored at an FRC must be disposed of in accordance with NIH Manual Chapter 1742-Transfer, Withdrawal and Destruction of Records at the Washington National Records Center. NIH records stored offsite outside of an FRC can only be transferred to NARA-approved commercial storage facilities that meets the requirements established in 36 CFR 1234.
3. Record Storage: All ICOs must have internal procedures for tracking records stored at FRCs and NARA-approved commercial storage facilities. If an ICO Records Liaison chooses to store inactive Federal records outside of an FRC, the records can only be stored at commercial storage facilities that meet the requirements. Use of a commercial storage facility must be coordinated through the NIH Records Management Program in advance of any records being sent to a commercial storage facility for storage. Contact [email protected] to initiate the process. The National Archives maintains a list of NARA-approved Commercial Records Storage Facilities by State.
4. Enterprise Performance Life Cycle Framework (EPLC): NIH has adopted the HHS Enterprise Performance Life Cycle (EPLC) framework for planning, managing, and overseeing Information Technology (IT) projects over their entire life cycle. The HHS EPLC framework requires that project management plans for IT projects take into consideration records management requirements in the planning and disposition phase

3. Type of Record

1. Essential Federal Records: All ICOs are required to certify their Essential Records Inventories annually. ICOs must ensure that their respective emergency operating records and legal and financial rights records vital to the continuity of essential NIH activities are properly identified, as described in NIH Manual Chapter 1744: NIH Vital Records Program.
2. Personal Papers/Non-records: Personal papers must be clearly designated and maintained separately from all Federal records. If information about private matters and agency business appears in the same document, the document is considered a Federal record.
3. Electronic Federal Records: Electronic records are data or information that has been captured and fixed for storage and manipulation in an automated computer system; these records require the use of the system to render it intelligible by a person. All permanent electronic records must be managed and maintained in an electronic format for eventual accession to NARA. Permanent electronic records shall be transferred in a NARA-approved format as outlined in NARA Bulletin 2014-04, Format Guidance for the Transfer of Permanent Electronic Records Appendix A: Tables of File Formats and must be accompanied by the minimum metadata elements as specified by NARA Bulletin 2015-04, Metadata Guidance for the Transfer of Electronic Records.
4. Email Messages: NIH’s email messages must be managed in accordance with NIH Manual Chapter 1743-1: Email Records Management.

4. Record Organization

1. NARA Universal Electronic Records Management (ERM) Requirements The Universal ERM Requirements serve as the baseline when developing system requirements for any electronic records management system at NIH.
2. Office File Plans: Each ICO must maintain a centralized file plan within the RSS. The RSS is a system for searching and identifying NIH record schedules and serves as a repository for ICO file plans. A file plan is a comprehensive listing that identifies the types of records created and maintained by an office. The file plan should include detailed information specific to each office, such as the disposition date, records owner or creator, and location of the records. For assistance developing an office file plan, contact the ICO Records Liaison or [email protected]. All ICOs are required to certify their file plans on an annual basis.
3. Record Organization: Records must be maintained so that they are easily retrievable. Records must be organized and indexed in a manner that permits the access and retrieval of the records in an effective and efficient manner.
4. Record Retention Schedules: All ICOs must retain and dispose of records in accordance with the NARA- approved Records Retention Schedules as outlined in the RSS.
5. Unscheduled Records: Unscheduled records are records not covered by a NARA-approved records retention schedule. Unscheduled records must not be destroyed and treated as permanent until a final disposition is approved. Proposed records retention schedules for unscheduled records should be submitted to [email protected] for further action.

5. Administrative Management of Records

1. Records Management Program Reviews: Annually, the NIH Records Management Program, within the Office of Management Assessment (OMA) will conduct a formal review of two ICO records management programs. The goal of the reviews is to evaluate the effectiveness of records management programs and practices and ensure that they comply with NARA regulations and NIH policies. Formal evaluations are intended to provide the ICO records management programs with information to be used to measure compliance and identify opportunities for improvement. Records Management Program reviews are initiated by the request of the ICO.
2. Records Management Training: NIH staff are required to complete annual records management training to understand what constitutes a record, and how to manage records in accordance with NIH’s recordkeeping requirements and Federal laws and regulations. Additional NIH records management training is available for staff via the HHS Learning Management System (LMS). New NIH staff must complete the Information Management for New Hires training within the first 30 days of their employment start date, or prior to on-boarding.
3. Records Ownership: NIH records are the property of the Federal government, not the property of individuals employees or contractors acting as an agent for the government and must not be removed without proper authority.
4. Safeguarding Records: Records collected, created, or maintained shall be safeguarded to avoid disruption or loss of access to or use of information, the unauthorized disclosure of information, and the unauthorized modification or destruction of information in accordance with the security categorizations set forth in Federal Information Processing Standards  (FIPS) Publication 199, Standards for Security Categorization of Federal Information and Information System (Feb. 2004). Safeguards shall be adopted to provide protection for information that is restricted from disclosure by the Privacy Act of 1974, the Computer Security Act, the Federal Information Security Modernization Act of 2014 (FISMA 2014), or other statutes, regulations, Executive Orders, or authorities. In addition, ICOs shall incorporate all applicable NIH information security policies and measures in their records management activities. Confidential and privacy-protected records shall be managed and safeguarded in accordance with any applicable Federal laws and regulations requiring access to, protection of, or restrictions on the disclosure of these records as well as NIH requirements governing access to and protection for the lifecycle of the records.
   1. Safeguarding Records containing Sensitive and Personally Identifiable Information (PII). Each ICO has a duty to appropriately safeguard PII in its possession and to prevent its compromise. Due to the nature of work, NIH generates sensitive information. Each ICO must understand how to identify, handle, and protect its records. More information on safeguarding PII, is available on the NIH Office of the Senior Official for Privacy (OSOP) web page and NIH Privacy Frequently Asked Questions document.
   2. Safeguarding Controlled Unclassified Information (CUI). Controlled Unclassified Information (CUI) must always be safeguarded in a manner that minimizes the risk of unauthorized disclosure while allowing timely access. NIH authorized holders shall take reasonable precautions to guard against unauthorized disclosure of, or access to, CUI in both physical and electronic environments. Physical safeguards may include establishing and using controlled environments, such as keeping CUI under the NIH Authorized Holder's direct control or protecting CUI with a physical barrier. More information about safeguarding CUI, including specific handling guidelines, are available in 32 CFR 2002.14 Safeguarding Records containing Sensitive and Personally Identifiable Information (PII).

6. Transfer of Records

1. Record Transfers: Inactive records, records that are not frequently referenced, but must be kept until their disposition date, are candidates for transfer to either an FRC or NARA- approved commercial storage facility. Record transfers must be coordinated through the ICO RL. ICOs must have processes in place to effectively manage and track records transferred to FRC and NARA-approved commercial storage facilities. NIH records stored at an FRC must be managed in accordance with NIH Manual Chapter 1742-Transfer, Withdrawal and Destruction of Records at the Washington National Records Center. NIH records stored at a NARA-approved commercial storage facilities must meet the requirements.
2. Records Removal and Departing Staff: Departing staff must not remove Federal records, including email messages and attachments, from NIH custody. NIH staff must request and receive prior approval in order to remove copies of records, including copies of unpublished research records or data, from NIH custody. For additional information, see Appendix 5: Process for Departing Staff Requesting to Remove Records.
3. Unlawful or Accidental Removal or Destruction of Records: NIH reports actual and potential threats to records (e.g. removal, alteration, or deliberate and accidental destruction), to NARA, and may report to the HHS Office of the Inspector General. NARA may contact the United States Attorney General for recovery of any unlawfully removed records.

1. NIH Records Officer (RO), within the Office of Management Assessment, must:
   1. Promote records management statutes, regulations, memorandums, NARA policy, and Presidential Directives;
   2. Act as the official liaison with NARA and responds to data calls and mandatory reports;
   3. Collaborate with NIH Offices to execute the NIH Records Management Program initiatives;
   4. Coordinate records management issues with other Federal and regulatory agencies, including NARA, the Office of Management and Budget (OMB), the General Services Administration (GSA), the Government Accountability Office (GAO), and the Office of Personnel Management (OPM);
   5. Develop standards, procedures, and guidance for improving records management; ensure NIH ICOs accession permanent records to NARA; and facilitate the segregation and disposal of all records of temporary value;
   6. Integrate records management procedures and activities into NIH Records Management policy and planning;
   7. Maintain, update, and distribute NIH Records Schedules;
   8. Conduct periodic compliance evaluations of ICO records management programs;
   9. Coordinate fiscal year (FY) interagency agreement with NARA and agency budget officials for the storage and servicing of records; and
   10. Report incidents of record removal, alteration, loss, or destruction to NARA.
2. NIH Records Liaisons (RLs): Each ICO is required to have a primary and secondary RL assigned. Each RL is responsible for the following:
   1. Coordinate the records management program activities, including an essential records program, in their respective organizations to ensure compliance with NIH Policy;
   2. Identify program-specific records and ensure they are covered by an NIH Records Schedule;
   3. Ensure that permanent records are preserved, inactive temporary records are transferred to either a NARA FRC or NARA-approved commercial off-site storage, and temporary records that have met disposition are destroyed promptly according to NIH Records Schedules;
   4. Ensure that recordkeeping requirements are established and kept current and that staff is kept abreast of any changes to these recordkeeping requirements;
   5. Ensure that all personnel with records management responsibilities receive appropriate records management training;
   6. Ensure that NIH’s Records Management Program provisions and standards are included in the scope and planning for electronic information systems (see F. Procedures, below);
   7. Ensure the development and implementation of an office file plan and updating the office file plan on an annual basis; 
   8. Receive litigation hold notifications for awareness. RLs must not initiate or approve any destruction of records, including records stored at the NARA FRC, or NARA-approved commercial off-site storage, that are responsive to an active litigation hold; and
   9. Immediately submit reported incidents of record removal, alteration, loss, or destruction to NIH Records Officer.
3. NIH Records Custodians (RCs): The RC is appointed by the RL within each ICO. Each RC is responsible for the following:
   1. Works with the RL and other stakeholders in developing an ICO File Plan. This is the primary instrument for classifying records and is a critical component to any recordkeeping strategy.
   2. Makes decisions about who can access records, in consultation with supervisors, the RL, and the records owners. Each office will have varying needs regarding confidentiality and security. The RC is responsible for determining who should have access to records.
   3. Provides guidance to office personnel in all records related issues. The RC is the "resident expert" on records produced by their office/IC, and the primary source of information on those records. In addition, the RC should provide guidance to ICO personnel who are involved in packing or preparing records for storage.
   4. Reviews material scheduled for disposition at the request of the RL. Quarterly disposition notices will in some instances require the RC to either review the records or confer with the records owner in order to provide a response on if records stored at the FRC can be destroyed.
   5. Attends records management trainings, conference calls, and meetings as appropriated by the RL.
   6. Assists departing staff with transferring custody or disposition of all Federal records before or immediately upon termination, suspension, reassignment, or separation of employment.
   7. Immediately submits reported incidents of record removal, alteration, loss, or destruction to the ICO Records Liaison.
4. NIH Management and Supervisory Officials must:
   1. Ensure staff (this includes employees, contractors, fellows, interns and volunteers) are aware of and adhere to NIH Records Management policies;
   2. Ensure new staff complete initial and annual records management training;
   3. Ensure that departing staff identify and transfer all Federal records in their custody to the designated custodian of the program files, supervisor, RL, or the person assuming responsibility for the work and complete the NIH Records Chain of Custody for Departing Staff Form NIH-2994;
   4. Review departing staff’s record materials, including email records, prior to the staff’s departure (See Appendix 5); 
   5. Ensure departing staff comply with policies and procedures regarding preservation, transfer, and deletion of records; and
   6. Immediately submits reported incidents of record removal, alteration, loss, or destruction to the ICO Records Liaison.
5. All NIH Staff must:
   1. Create and maintain adequate and proper Federal records documentation for the work for which they are responsible; maintain records in a manner that facilitates access and retrieval regardless of format; destroy records only in accordance with NARA-approved records schedules; and not remove copies of Federal record or non-record materials from NIH custody without obtaining authorization from immediate supervisor and ICO designated final approving official.
   2. Complete annual records management awareness training.
   3. Immediately report incidents of record removal, alteration, loss, or destruction to the supervisor or ICO Record Liaison.
   4. Complete: 1) the NIH Records Chain of Custody for Departing Staff Form NIH-2994 and 2) Departing Staff Request to Remove Copies of NIH Records Form NIH-3000 (See Appendix 5) and return to supervisor when departing NIH.
   5. Immediately submits reported incidents of record removal, alteration, loss, or destruction to NIH Management and Supervisory Officials.
6. NIH Freedom of Information Act (FOIA) Official shall:
   1. Provide a copy of Federal records, if appropriate, for release to the general public.
7. NIH Senior Official for Privacy shall:
   1. Ensure the statutory and regulatory requirements pertaining to the Privacy Act, Federal Information Security Modernization Act (FISMA), OMB Memorandum M-17-12, and the E-Government Act, including disclosure prohibitions, access and amendment provisions, and agency recordkeeping requirements.
   2. Ensure the appropriate records schedule is indicated in Privacy Act System of Records Notices (SORNs) and Privacy Impact Assessments (PIAs).
8. HHS Office of the General Counsel (OGC) must:
   1. Notify NIH’s Records Officer when they become aware that a moratorium on records disposition is needed for litigation (see Manual Chapter 1743-2 NIH Litigation Hold Policy), oversight or audit purposes and other legal matters.
   2. Support the submission of NIH’s records disposition schedules by reviewing them for legal sufficiency before submittal.
   3. Provide legal advice on the laws and regulations related to the records and information management program, which includes coordination with the RO to ensure compliance with recordkeeping requirements, determination of retention periods, and implementation of authorized disposition instructions for system data and documentation.
9. NIH Chief Information Officer (CIO) shall:
   1. Ensure that records management requirements are incorporated into the NIH system development life cycle methodology as part of managing the information life cycle.
   2. Ensure that NARA-approved records schedules for electronic information systems and other electronic records, such as email, are properly implemented.
10. NIH Chief Information Security Officer (CISO) shall:
    1. Ensure the technical security of the NIH electronic data records according to NIH standards.
11. NIH IT Infrastructure and System Owners shall:
    1. Notify the information system managers and RO of technology changes that would affect access, retention, or disposition (archiving or disposing) of records in electronic information systems.
    2. Oversee the creation and use of electronic records according to Federal regulations and NIH policy and ensure that recordkeeping functionality is developed for all information systems managing electronic records, which includes coordination with NIH’s RO to ensure compliance with recordkeeping requirements, determine retention periods and implement authorized disposition instructions for system data and documentation.
    3. Work with NIH RO and RLs to collect data required to transfer permanent records systems to the NARA in accordance with approved records schedules and NARA requirements.

Each ICO within NIH must establish and maintain a records management program with the following minimum requirements. These records programs must:

1. Create, receive, and maintain records providing adequate and proper documentation and evidence of NIH’s activities.
2. Manage records in any format (e.g., paper, emails, instant messages (IMs), text messages, electronic documents, spreadsheets, presentations, images, maps, videos, blogs and other social media tools that generate communications) in accordance with applicable statutes, regulations, NIH policy and guidance issued by the NIH RO, including NARA-approved records schedules.
3. Maintain permanent electronic records (e.g., emails, IMs, text messages, electronic documents, spreadsheets, presentations, images, maps, videos, blogs and other social media tools that generate communications) electronically, and if applicable, in an approved electronic records system.
4. Maintain non-email electronic records, in their native format in an organized way on an NIH network drive, SharePoint site or other agency electronic information system.
5. Transfer or migrate records in paper and legacy electronic systems to approved or registered information management systems which are associated with a records schedule for manual management of disposition where practicable and when available.
6. Ensure that non-electronic records are managed appropriately in paper-based official recordkeeping systems which facilitate their preservation, retrieval, use and disposition, if they are not appropriate for digitization.
7. Maintain records so they can be accessed and maintained for the required retention period.
8. Secure records to protect the legal and financial rights of the government and persons affected by government activities.
9. Ensure that instructions for the management and disposition of records as specified in the approved records schedules are followed.