On 7/5/07, Tom Owens <[log in to unmask]> wrote:
>
> We are attempting to get our arms around all of the off-site records
> storage and do a single contract for the US.


I've seen more and more firms interested in this and personally, I have to
wonder why there is a "push" for this?  Is it to get to a one invoice,
single quantity pricing structure, or is there some other reason behind it?
There are a limited number of vendors available to provide this, and
depending on where your locations are, there may only be one that could
offer it... and then not really close to your offices.  And that's not to
say you need to have your storage firm next door to you, but if you're
storing semi-active records, you typically want them within an hour or so
during the high traffic times of the day.

I've personally found that the independent service providers that don't
operate on a national level are generally the ones that are willing to go
the extra mile for their clients.  This is not only true in terms of
services provided, but in terms of the levels of protection afforded to your
information assets.  In some cases because they are dealing in smaller
volumes, they can afford to offer legitimately protected media vaulting
services in REAL MEDIA VAULTS, not sheetrocked rooms with sprinkler systems
and fire doors.  Many times, they are able to offer contiguous storage of
your paper-based records as well, instead of spreading them out across a
warehouse... and they also seem to have less employee turnover, something
that counts a lot towards "peace of mind" when it comes to managing your
assets.

They are also less likely to run cavernous warehouses, and will be much more
prone to attempting to meet the requirements of NFPA 232, the "Standard for
the Protection of Records" because they will either have volumes NOT
requiring the use of firewalls, or will have facilities small enough they
don't need to make excuses for not constructing them where needed.

But I digress....

One of many items to surface is bonding of the records storage
> employees.  My minimal research indicates that bonding is usually to protect
> against dishonest actions such as larceny, theft, embezzlement, forgery,
> misappropriation, wrongful abstraction, willful misapplication or other
> fraudlent or dishonest acts committed by an eployee.


This is true to a degree and most providers do background checks on their
employees and make sure they're either bonded or "bondable", because it
limits their liability.  It's always a fair question to ask your service
provider, and you can make it a condition of your RFP.

One thing I'd DEFINITELY suggest you ensure you get is a "Business
Associate's Agreement", especially if you store anything covered by HIPAA.
Here's a link to a simple form that you can purchase:
http://www.medlawplus.com/forminfo/hipaaprivacyagreement.htm   and here's an
article that discusses WHY you would want this
http://jada.ada.org/cgi/reprint/134/1/114.pdf

You also need to ensure you have similar protection if you're storing PII
with a third party provider. This would include financial and personal
information you are placing in storage that contains any identifiable
information about your employees or clients.  While this article is dated
(issued in 2002), it gives some good information for consideration regarding
this subject.
http://whitepapers.techrepublic.com.com/casestudy.aspx?docid=148861

Do any of the listserve lurkers do a national records storage contract?


As stated above, depending on what you're trying to accomplish, placing your
eggs in one basket may not be in your best interests.  Here's another
example... if one division or office of your organization has a large volume
of media and or electronic format information that is written to tape and
stored in that manner, you may want to see a provider in their general area
that is best suited to providing protection specifically for those types of
assets.  If others have primarily paper based records, find a provider in
their locations that stores just that and doesn't offer protection for
media.  If others yet have a mix, then try to find providers in their areas
that can provide adequate protection for both. The cost for constructing,
operating, maintaining, and managing facilities... those factors that go
into establishing rates for storage, are all based on how the facility is
designed and operated.  You may find you're able to not only gain greater
and more appropriate protection for your various forms of information
assets, but a lower overall price by having multiple providers.

Do you require bonding for the vendors employees or is it enough for the
> vendor to show proof of insurance?


If the firm is willing to state they have bonded employees and can show
proof of protection, that is typically sufficient.  Most firms want to
minimize their liability, so they will do what is necessary to ensure they
employ people who can be bonded.

What insurance requirements do you require?  General Liability Coverage?


General liability is a minimum.  Keep in mind, you're not as concerned about
the protection they provide for the assets of ALL OF THEIR clients... just
yours!  Make sure they have sufficient coverage to compensate YOU in the
event of a loss.   When you tour the facility, try to gauge the volume of
all of the assets in storage and consider what level of protection is
offered in the contract.  In most cases, a service provider ensures that if
they suffer a total loss, clients will receive between $1 and $3 per box in
storage... which doesn't even pay to replace the box and the same volume of
blank paper.  If they carry $1,000,000 of GL coverage and store 2,000,000
boxes... how do you think this will work? =)

Proper insurance coverage in the event of disaster?


If you look at some of the major losses in the past, you'll only find ONE
CASE where proper coverage was provided to  clients assets, and that was
because of a jury award some 4 years after a total loss event, it had
nothing to do with insurance.   A couple of major events in New Jersey,
another in Chicago, and the recent one in London didn't give the clients
enough to resurrect their information.  In fact, in the of three of those,
the court records were sealed and no one EVER heard what the clients were
awarded.

 Warehouseman's legal liability coverage?  or something else?


WLL covers the vendor themselves. It actually results in DECREASED coverage
for clients.  This type of coverage is fine for storage of commodities that
can easily be replaced, but you're talking about INFORMATIONAL ASSETS here,
something that your organization is storing because of a business need
and/or to be in compliance with laws, statutes, or regulations.

The concern should focus on what will you tell these regulators in the event
of you not being able to produce the records if they were lost in a
catastrophic event while in storage?  Did you exercise due diligence when
you sent them offsite to ensure the service provider was equipped to
adequately protect them while they were in storage, or was you primary
concern for reducing cost by establishing a national contract that was
easier to manage?

 What about proper vehicle insurance for delivery vehicles?


Not just insurance, but alarms and fire protection equipment, proper
environmental controls (if they are transporting media), someone to stay
with the delivery vehicle while someone else makes pickups and deliveries to
protect it from being broken into, GPS tracking, etc.   I think something
that provides this extra level of protection would have been appreciated by
Time Warner or IBM in the past year when their service providers lost assets
while in transport.

What about those companies that are self insured?


Well, unless they set aside a huge bucketload of money and it's to cover
client's assets in storage, not the facility, their employees, their loses
of equipment, etc.  it wouldn't be enough for me.  Most companies have
shareholders, and that's who their first obligations are to. Remember that
2,000,000 box example and the $1 of coverage per box?  Like I said, a
BUCKETLOAD...

And just what exactly does that mean?


http://en.wikipedia.org/wiki/Self_insurance

Anyway any insight into this would be most enlightening.


I'd strongly suggest you purchase a copy of NFPA232, and ask any prospective
providers if their facilities are in compliance with it.  If you have a risk
manager, you may want to have them tag along when you inspect the facility,
and ask to find out the last time a fire engineer inspected it.  And also
consider searching the ARMA Bookstore to see what's available on Record
Center Operations.... and if you're storing anything with a third party that
is necessary for business continuity or that your organization considers
vital to operations, take a look on what's available for vital records also.


Good luck in your search.

Larry
-- 
Larry Medina
Danville, CA
RIM Professional since 1972

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]