Colorado Consulting Group, Inc.

Managing Email

Lack of an explicit policy that is enforced can place an organization out of compliance with statutory/regulatory requirements or at a minimum; expose it to increased risk and costs.

As an organization reviews or creates its email management practices, some considerations should be:

ü      Creating an explicit definition of public vs. non-public information and policies that support each.

ü      Defining a retention period which is both reasonable for the organization and meets the expectations of its constituents. At the moment there is no statutory directive for the retention period.  With a reasonable retention period that is published and communicated, and then consistently practiced, exposure can be limited to data within your stated retention period.

ü      Managing inboxes. Business/operations related emails or their business information should be retained.   Business information should follow standard data retention requirements.

Some organizations achieve this by automatically scheduling deletion of inbox items—requiring staff to save business information to appropriate folders where it can be accessed for business purposes and comply with recognized data retention requirements. 

ü      Developing a method for complying with certain clear statutory/regulatory directives:

(a) Having a standard procedure activated upon notification of potential legal action or records request which traps emails and related information for affected parties from the notification point forward.  The inability to immediately begin trapping requested information can carry significant penalties.

(b) Recognizing and protecting confidential data, (i.e. HIPPA compliance)

(c) Researching and producing emails available, current or archived, where ever they may reside.

Eliminate the risks you can and reduce the high (mostly unrecoverable) cost of research and production by:

ü      Establishing a reasonable practice, training staff and enforcing the practice across the organization.  A policy in an employee handbook that employees never follow will not protect the organization.  The practice should comply with any laws and regulations that dictate the saving of emails, but otherwise emails should be deleted regularly.

ü      Banning the use of instant messaging, especially server based. (an organization will be responsible for managing these messages).

ü      Notifying your organization of your intent to eliminate “ancient” email backups or archives, especially those that cannot be recovered with in house equipment.

ü      Implementing a method for managing inboxes and directing business information to appropriate archiving processes.

The more information available when requested for litigation or open records, the more difficult it is to manage and the effort can paralyze an organization’s technology group.  Electronic tools for managing, archiving and retrieving email information are being heavily marketed and should be considered, especially if you do not manage your retention period.  Currently you are required to produce what you have reasonably determined to have available.   

Stop Postponing that Implementation Review!

It is distressing how few organizations follow up on a major implementation project. Do you know if your time and money was well spent?

Yes, everyone needs a break, but revisting your implementation choices, polishing the procedures and documentation, and evaluating your reporting will add that extra value which may ultimately define the success of the implementation.

Some areas to examine are:
             Entry Functions - how automated are they?
             Web Functions - how often do you update the functionality?
             Processing Functions - are rules and parameters reviewed periodically for accuracy?
             Reporting Functions - have you learned Crystal Reports yet? how's your meta layer?
             Interfaces - are they completely automated?
             Archiving - are procedures in place  for archiving database, applications, data warehouse,  user  directories?
             Information - who's using the data and how?

Give us a call for a further discussion of this invaluable and often overlooked tool.