COVID Data Retention and Disposal

In accordance with the Audit and Compliance Services Report findings (Report No Audit WFU-2204) the COVID Data Retention working group was established to develop a plan for addressing the proliferation of Google documents and email widely used to store and share information about test results, vaccination and other personal information collected as part of the campus protocols for managing the COVID pandemic. 

The scope of these recommendations is all property, information technology systems, software, databases, applications, and network resources needed by WFU to conduct its business.  These recommendations apply to all electronic and physical data obtained as part of data collection related to WFU’s response to the COVID Public Health Emergency during the period from  March 1, 2020 – May 31, 2023 (e.g., medical documentation, spreadsheets, memos, meeting minutes, policies, etc.).

DATA RETENTION AND DESTRUCTION PLAN

Each department and/or unit is asked to designate a person or persons with knowledge of any COVID-related information gathered during the identified period.  The designated departmental representative is responsible for reviewing the elements of the policy below. Each representative is required to respond by no later than May 21, 2024, using this form to acknowledge the review and provide information related to the departmental use of IICHI and ACHI during the period from March 1, 2020 – to May 30, 2023. 

If necessary, each departmental representative will be contacted directly by the COVID Data Retention and Disposal Committee with instructions for how to manage any data retained by your department falling into the above-named categories. When instructed to do so, paper documents should be destroyed via an institutionally contracted shredding process only. Questions regarding the location and emptying of official shredding should be directed to Marla McNear. Digital shredding should be destroyed in accordance with the university Record Retention and Destruction Policy.

DEFINITIONS

Individually identifiable COVID-related Health Information (IICHI)

Any COVID-related data or information wherein specific persons are named in relation to their perceived or established risk for, testing for, diagnosis of, treatment of, immunization for, or reporting of any of the COVID-19 viruses.

Aggregate COVID-related Health Information (ACHI)

Any COVID-related data or information wherein no specific persons are named in relation to their perceived or established risk for, testing for, diagnosis of, treatment of, immunization for, or reporting of any of the COVID-19 viruses.

Categories of documents that do not need to be retained should be destroyed in accordance with this policy by no later than June 30, 2024. Destruction of documents should be documented by unit managers via memo to the committee. These types of documents include:

• Student-affiliated IICHI gathered and held outside of the official Deacon Health (formerly student health service) student electronic health record
• Employee-affiliated IICHI gathered and housed outside of the official Human Resources personnel record and/or related accommodation documentation
• Guest or contractor affiliated IICHI gathered and held outside of the official Human Resources contractor-related files repository

Categories of documents that need to be retained for some period of time according to the schedule associated with the Record Retention and Destruction Policy should be documented and retained for the prescribed period of time. If that information is currently housed outside of the designated and appropriate collection venue, that documentation should be forwarded to the committee no later than May 21, 2024

• IICHI in an official student electronic health record
• IICHI in an official personnel record required as part of a formal accommodation process
• Aggregate data that contributes to a historical account of the impact of the Public Health Emergency on university operations (such as # of employees unable to work per day or # of students unable to attend class per day)

Health Records containing confidential information should be labeled and stored in a manner that appropriately limits access to those with an institutional need to know at Deacon Health (students) or Human Resources (faculty/staff).