The chaotic confusion that follows a fire, flood or other disaster is harrowing for an education institution. Once the danger to human life is controlled, however, the focus must center on recovery. Emergency-management plans serve as the main guide to prepare for, respond to and recover from a disaster that may affect any number of crucial functions. Having an emergency-management plan in place ensures that a school or university will be able to sustain losses stemming from a crisis and recover in an expedient manner.
One of the first steps in emergency-management planning is vital records protection (VRP). Records are critical to education, and installing a process for storing and retrieving data is considered to be a basic operational requirement for all education organizations. If a vital record is lost, damaged or otherwise rendered unavailable, that loss becomes a disaster-within-a-disaster.
Most emergency planning is designed primarily to ensure life safety. VRP is about mitigating loss and limiting property damage. These are two different concepts that need to be viewed from different perspectives.
Defining a vital record
In an education institution, student records are considered vital. But they are not the only categories of stored information that may be deemed as vital in the education environment. Some typical examples:
-
Critical data relating to written curriculums.
-
Contracts and agreements that prove ownership of property, equipment, vehicles and products.
-
Operational records, such as budgets, accounting and tax records, personnel and payroll records.
-
Assessing strategies
Standard operating procedures (SOPs).
-
Reports, audits, test scores and summaries.
-
Software source codes (both licensed programs and systems, and custom-developed applications).
This list should be considered a starting point. Although a specific category of records may not be considered vital, the data still may be worth protecting. Each category of record should be analyzed to determine the amount of protection it should receive. Non-vital (but valuable) records may be tiered as such:
-
Important records: records that are replaceable, but reproducing them could be expensive, time-consuming and labor-intensive.
-
Useful records: records that, if lost, will cause some inconvenience, but could be replaced readily.
-
Non-essential records: records that are in line for routine destruction.
In order to validate the classifications, those responsible for emergency planning should interview the managers and personnel who create and manage the organization's records.
If VRP is the first step in the emergency-planning process, then the first step in developing a VRP strategy is to assess the threats to vital records. Identify specific risks, such as fire; flooding of storage areas; earthquakes that could cause a building collapse; and periodic storms or tornados that could endanger digitally stored vital records. With electronic data, poor care or storage can cause problems — simple things such as spilled coffee or inappropriate handling.
VRP describes both the process and the tools deployed to prevent the loss or destruction of vital records that are essential to an organization's continued operation. The basic action that VRP drives is storing vital records and documents in UL-rated fireproof files and safes. The National Fire Protection Association, Standard 232, “Protection of Records” recommends storing vital records in a fire-resistant file cabinet or vault that has been tested and rated by Underwriters Laboratories when keeping them on-site.
Some of the worst damage to vital records from a fire actually can occur from the water used to extinguish the flames. Sprinkler systems and fire hoses can cause irreparable harm to documents that are not protected properly. It is, however, impossible for a VRP product to be fireproof, as well as waterproof. When a fireproof cabinet is exposed to extreme temperatures in a fire, it expands by design, making it more difficult for water entry; however, when sprayed with a fire hose or submerged, no fireproof filing cabinet will be able to keep contents completely dry.
In order for a filing cabinet to be completely waterproof, it must be designed to withstand complete submersion in water; leaving little to no damage to internal documents. A cabinet that is water-resistant will be able to endure the effects of fire-suppression systems, such as sprinkler systems, as well as high-pressure fire hoses, sustaining minimal water entry during the process.
Some organizations, especially larger districts and university systems, may choose to outsource vital records protection, mainly to off-site storage facilities. This may work for archived records; however, for current information (such as student records) storing all vital records off-site requires such a high degree of discipline and coordination that it will become too expensive and time-consuming for most organizations. So, education institutions must ensure vital records are secure while they remain onsite.
Other drivers of VRP
In addition to smart disaster-recovery planning, several regulations, laws and best practice policies drive VRP. For instance, the Oklahoma State Department of Education requires student records to be in fireproof file cabinets. In New Jersey, when a public district is involved in litigation, the records must be retained and accessible for 20 years after the final settlement. The New York State Office of Elementary, Middle, Secondary and Continuing Education provides a School Safety Audit Checklist that clearly states: “School files and records are maintained in locked, vandal-proof, fireproof containers or vaults.”
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C.-1232g; 34 CFR Part 99) is a federal law enacted in 1974 that protects the privacy of student education records. Under FERPA, schools are required to keep personally identifiable information secure and limit access to it. The law applies to all schools that receive funds from the U.S. Department of Education. If a school is found to be in violation of the act, it risks losing federal financial assistance.
The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes regulations for the use and disclosure of Protected Health Information (PHI). A school or school system is covered under HIPAA if it has a healthcare provider (school nurse) who transmits health information electronically in connection with a HIPAA transaction.
More recently, the No Child Left Behind Act requires schools to maintain and report large volumes of student data.
As the number of school-age children continues to rise, the need for K-12 and university systems to better manage vital records will increase.
Carlisle is president/CEO of FireKing Security Group, a security and loss-prevention company headquartered in New Albany, Ind.
Records survive disaster
In 2005, floods ravaged the Gulf Coast in the wake of Hurricanes Katrina and Rita. The Pass Christian School District in Pass Christian, Miss., was hit with a 30-foot storm surge that swamped the entire region — as far as 15 miles inland in some places.
Pass Christian High School was submerged under 18 feet of water, and the district's middle school and one of its elementary schools were destroyed. The school district reopened several weeks after the storm on October 17, 2005. Once the recovery process began, staff members especially were concerned about the district payroll.
“The district central office was at one point under 30 feet of water, and when I returned to Pass Christian immediately after Hurricane Katrina, the only thing still standing inside was the district's UL-rated fireproof file cabinets,” says Patty Myriek, a specialist in the district's human resources department.
“All the schools' payroll records were kept safely inside the specially designed cabinets, so we were able to get our payroll system back online right away and get our people paid. As you can imagine, getting funds to our employees — who were in many cases drastically affected by the flood — was a very important factor in the overall recovery process.”
WEB 101
For more articles on security, life safety, disaster planning, access control and more, visit our Security Resource Center at www.asumag.com/security.