On Wed, Mar 4, 2015 at 6:42 AM, Tansey, Eira (tanseyem) <
[log in to unmask]> wrote:

> Hi all,
>
> I am going to be meeting soon with a team at my institution involved with
> rolling out box.com<http://box.com> to our university. I've heard that
> Box is introducing retention capabilities to the system, and have read a
> few things on this, including
> https://www.box.com/blog/boxworks-update-manage-the-full-content-lifecycle-from-creation-to-disposition/
> and
> https://www.box.com/blog/the-products-that-power-box-for-financial-services/
>
> It seems that this feature may still be in beta, but if anyone is using
> the retention capabilities within Box -- Can anyone speak to whether
> retention is only in the "Box for Financial Services" package? Is it an
> add-on for any enterprise system? Do the users declare the record, or is
> this automatically done in the background? Maybe the answer is "it depends
> on the configuration." I'd appreciate hearing anything about what the
> set-up looks like.
>

As with many things, the answer is "It Depends".

Few are using Box as a storage cloud, but more as a collaborative cloud- a
place to put content in workspaces that others can have access to, for
review markup, re-review, etc.

And while Box for Enterprise can be configured to have a lot of protection
for content, such as limiting access, encryption, etc... as an educational
institution, are you SURE you would want to use a cloud for long term
storage of financial records that may be subject to future audits and all?

If they are locally stored (once they become static) it would be much
easier to pull items together to allow an auditor to review a selection of
records... and it would facilitate your ability to ultimately 'archive' and
disposition any of those financial records.

Personally, I'd be reluctant to put PHI, PFI and PII into a system such as
this for long term storage.  Maybe during an admissions cycle or for some
other specific purpose... but not long term.  Keep in mind, cloud
repositories like this are replicated and backed up to tape, which is great
for ensuring the content remains persistently accessible (but you would do
this yourself, right?) but NOT AS GREAT when you consider that other
clients will ALSO have their content handled in the same manner and the
more client and the greater the volume, the greater the risk of commingling
of data and potential exposure.

The way I'd approach it is from the perspective of "we are having an
e-discovery" or "we are having an audit", and ask- "can you show me an ESI
data map of WHERE my information is? In live state, in replicated state.
and in backup at rest?"


-- 
Larry
[log in to unmask]



*----Lawrence J. MedinaDanville, CARIM Professional since 1972*

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]