Colleen,

I am also grappling with




which I can then use to audit these 3rd party vendors every so often. Mind you, I don't have much faith that I can control what vendors do with our information that lives on their servers, for example whether they create and scatter copies of our information. But I can try to 'audit' them with phone calls and/or email questions/surveys every so often. That way if litigation arises I can point to the contract language and my auditing efforts.


Of course every contract is different because every vendor service is unique and so a joint effort is needed to insert retention language into contracts if needed, for high risk vendor contracts (leaglly high risk information); joint effort between the records manager, the lawyers who write the contract, procurement (who churn out templated contracts), and the business unit who manages the vendor relationship. I think this is the hard part: the workflow and cooperation. I can't catch every contract on my own. Ideally disaster recovery and privacy requirements are already inserted by the people in those dedicated departments. 

My 'ideal' records retention templated language which must be further edited for appropriateness for most contracts, would look like this (and I'm not stating if/how/where I have ever used this in reality, this is just a concept):


Vendor/Consultant will maintain data created by or received by XXX during performance of Services in the course of performing Services not longer than: (contact Maureen Cusack in Records Management, for specific retention periods). Within 30 days following termination of this Agreement or at the end the specified retention period above, Vendor/Consultant will, upon receipt of XXX/Company written instruction either (1) return (Company) data, including an index of the data indicating file and/or folder names, volumes and any useful organizing principles, or (2) destroy such property, without retaining any copies, extracts or other reproductions in whole or in part, and provide (Company) with a certification of destruction that specifies the volume and type of data that was destroyed and method of destruction.

Auditing clause:
Upon written request by XXX/Company, Vendor/Consultant shall provide: (i) copies of any XXX/Company records, or (ii) documentation signed by senior Vendor/Consultant executives describing recordkeeping systems or processes involving (Company) records including, but not limited to, a) volume of records stored on Vendor/Consutlant systems, b) storage media and file formats used in system processes. 



Maureen Cusack
San Francisco, CA





> Date: Wed, 16 Jul 2008 11:10:00 -0500
> From: [log in to unmask]
> Subject: Re: [RM] Boilerplate Contract Language for Outsourced Records
> To: [log in to unmask]
>
> Hi Larry,
>
> A clarification. I am not outsourcing a service I provide to my clients,
> let's say for example that the company I work for decides to outsource the
> payroll department. I need to make sure the vendor follows my requirements,
> including all the items you mention in your email. What I am trying to
> formulate, in a paragraph, is some basic language that I can start
> incorporating into contracts to cover record retention issues.
>
>
>
_________________________________________________________________
Keep your kids safer online with Windows Live Family Safety.
http://www.windowslive.com/family_safety/overview.html?ocid=TXT_TAGLM_WL_family_safety_072008

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]