Records management at RRU

Private information takes two forms:

• It links a person's name to information about that person (personal information).
• It contains legal or business data.

When an institution receives private information from an employee, student, or business partner, there is an expectation that the information will remain private. 

Most of the time, records are protected by the university's security systems. These systems present a barrier to unauthorized access, and include measures such as locked filing cabinets and firewalls. As an employee, you'll want to be on the alert for record-handling processes that place records outside these protective barriers. 

Speak to your supervisor if you notice that a record containing private information is:

• placed on a thumb drive
• printed and taken off campus
• placed in the garbage or recycling without being shredded
• uploaded to a public or semi-public online platform
• emailed as an attachment (rather than as an internal link)

The situation is urgent if the record contains:

• a large volume of personal information
• highly sensitive personal information (such as medical, financial, psychological or legal information)
• legal information protected by solicitor-client privilege
• sensitive business information

If you notice that records are not protected, consider the following corrective actions:

• Replace thumb drives with encrypted thumb drives.
• Consult IT Services to explore file transfer alternatives.
• Establish procedures and checklists to mitigate human error.
• Redesign processes to exclude the unsafe task.