Businesses hold the key to destroying sensitive documents

The same information that helps screen job candidates, track customers and keep the wheels turning can be a huge liability.

Businesses are shouldering a growing burden when it comes to keeping personally identifiable and sensitive information out of the wrong hands. Failure to properly handle that responsibility can be a lawsuit in the making.

It’s a big enough issue that, “we even have an internal team with our firm, not of attorneys, but document-retention experts who help out our clients,” said Paul Satterwhite, a labor and employment attorney at Blackwell Sanders LLP.

Although businesses are increasingly turning to computerized record storage, which shifts security issues to cyberspace and the digital realm, the question remains: How should companies handle the reams of sensitive information they still have on paper?

Often, they turn to companies like Springfield-based Edco Document Solutions and Secure Shred to make sure records are properly secured and, ultimately, destroyed.

Assessing risk

The first step to address document security is to do an exposure audit, said marketing professional Julie Short, a spokeswoman for Edco Document Solutions. That means looking at all company departments that deal with sensitive documents and reviewing how those documents are accessed, stored, secured and destroyed.

Federal and state laws mandate that businesses retain scores of records related to hiring, firing, disciplining, training, paying, taxing and providing benefits for employees. Likewise, most businesses keep documentation of their own financial dealings, as well as sensitive or proprietary information on clients and customers. Financial services providers, attorneys and health care professionals deal with general privacy rules as well as those specific to their professions.

Meanwhile, identity theft, which accounted for 246,035 consumer complaints to the Federal Trade Commission in 2006, makes personal information an even greater liability than in the past.

Retain and secure

Once a company determines its risks, it should institute policies and procedures limiting access to sensitive information. In a computerized system, that means passwords and firewalls; on paper, that may mean locked filing cabinets, a locked document room and/or a secure depository for records to be destroyed.

“One of the things that we do as a law firm is we have a locked shredder box,” Satterwhite said, nothing that the box is always locked, and a slot to insert documents is the only opening.

Eric Pool, owner of mobile-document-destruction company Secure Shred, offers such locked shredding containers for his clients. Removing temptation, he said, helps keep honest people honest.

For firms that must retain large quantities of records for an extended period, Edco provides a menu of services that includes converting paper or film records to electronic data; secure, archival storage in its underground SecureStore facility; and destruction of clients’ obsolete records, Short said.

Medical providers make up a large segment of Edco’s customers, so Edco has to be certain it complies with the privacy provisions of the Health Insurance Portability and Accountability Act, or HIPAA.

The firm does background checks on all its employees, Short said, and staff must sign confidentiality agreements. The gated SecureStore facility is under constant security surveillance and employees must go through security and sign in and out of the facility.

Similar policies and procedures can be effective for companies that store their own documents, she added.

Destroy

“Destruction has actually become more and more important over the last couple of years,” Satterwhite said.

For example, the Fair and Accurate Credit Transactions Act, which requires employers to confidentially maintain employee background checks, also mandates how the information should be destroyed, and not surprisingly, simply throwing it away or putting it in the recycling box is not adequate.

Secure Shred, like Edco, is not only able to shred paper, but hard drives, CDs and DVDs.

As Satterwhite noted, a company’s legal exposure can go beyond privacy laws and identity theft.

He mentioned a client in a labor dispute a few years ago that was not especially careful in how it disposed of its documents.

“One of the union officers had actually gone into the dumpster outside the company and found a stack of documents related to the issue at hand and submitted them to the National Labor Relations Board as evidence against the employer,” Satterwhite said.

Related News: Piling It On: Businesses' responsibility for record security