Public records law and technology systems
How public records obligations shape system design, from retention to search to redaction.
Articles
Government & Compliance
Every reference article on hqt.org in Government & Compliance, written for agency procurement, technology, and program staff.
Open meeting laws and technology projects
How public meeting requirements affect approvals, timelines, and the technology used to run meetings.
Fiscal year cycles and technology project timing
How annual budgets, encumbrances, and grant periods determine when agencies can start and pay for projects.
Cybersecurity grant programs for local government
The federal and state programs that fund local cybersecurity improvements, and how agencies use them.
Vendor security questionnaires: what agencies ask and how vendors should answer
The purpose of security questionnaires, common questions, and how to make the process useful for both sides.
Digital service standards: what good public services look like online
Principles that governments have adopted for designing online services, and how agencies can apply them.
HIPAA for public agencies: who is covered and what it requires
When the health privacy rules apply to government entities and what the security rule expects of their systems.
Election technology security: what county IT should know
The systems involved in administering elections and the security practices that protect them.
Prevailing wage and public works rules in technology contracts
When technology work crosses into public works territory, and the prevailing wage, certified payroll, and bonding rules that follow.
Buying with federal funds: procurement thresholds and required clauses
How federal procurement standards apply to grant-funded purchases: methods, documentation, and the contract provisions the award must carry.
Surplus IT equipment: disposal, data sanitization, and records
How agencies declare IT equipment surplus, sanitize the data on it, and close out records, licenses, and inventory.
Data breach notification: what agencies must do after an incident
How state breach notification laws generally work for public entities: what triggers notice, what it must say, who else is told, and what vendor contracts need to say.
Cyber insurance for public agencies: coverage, exclusions, and controls
What a cyber policy covers and excludes, how the underwriting questionnaire became a control checklist, and who an agency may call.
Data classification and handling rules for agency records
How to build a short data classification scheme, map it to the records agencies actually hold, and attach handling rules at each level.
Checking a vendor's accessibility claims: VPATs and real testing
How to read a vendor's VPAT or Accessibility Conformance Report, verify the claims yourself during evaluation, and set contract terms.
Open source software in agencies: policy, licenses, and support
How agencies handle open source licenses, bills of materials, support and indemnification, approvals, and publishing their own code.
Interagency data sharing agreements: what to put in writing
The clauses that make an interagency data sharing agreement workable, from legal authority and field lists to breach notice and termination.
Records retention schedules and the systems that hold the records
How an approved retention schedule maps onto databases, email, SaaS, and backups, covering disposition, legal holds, and vendor limits
Deidentification and suppression before releasing agency data
How agencies remove identifiers, aggregate, and suppress small cells so a public data release can be defended and repeated.
Open data licensing and terms of use for agency datasets
What license and terms to attach when an agency publishes a dataset or map service, and why public records status is not a license.
AI prompts and chat logs as public records: retention and disclosure
How prompts, uploads, and AI chat histories interact with state public records law, and what to log, keep, and disclose.
Automated decision systems: notice, explanation, and appeal rights
What makes a system an automated decision system, and the notice, explanation, human review, and documentation duties that follow.
AI screening tools in public sector hiring: what to check first
What agency HR and IT should check before an AI resume screener or scored assessment touches a hiring process.
IT chargeback and cost allocation between agency departments
How general fund support, cost allocation plans, internal service funds, and direct chargeback change what agency departments do.
E-rate: how schools and libraries fund broadband and network equipment
How the federal E-rate program discounts broadband and network equipment for schools and libraries, and what it requires.
Fund accounting, encumbrances, and budgetary control in a government ERP
How governmental ERP accounting differs from commercial packages: funds, budgetary control, encumbrances, and fund balance.
Subrecipient monitoring under Uniform Guidance: risk, reviews, records
How pass-through agencies meet 2 CFR 200 subrecipient monitoring duties: subaward data, risk tiers, invoice review, and audit-ready files.
Segregation of Duties and Access Reviews in a Financial System
How agencies spot conflicting role pairs in a financial system, apply compensating controls, and run user access reviews.
GASB 96 SBITAs and GASB 87 leases: getting the data out of your contracts
How to inventory SBITAs and leases, decide what is in scope, pull terms from contracts, and produce GASB 96 and 87 disclosures each year.
Turning MOU language into HR system rules: seniority, bidding, premiums
How to translate bargaining agreement language into HR and payroll system rules you can cite, test, and keep current.
Overtime, callback, and FLSA 7(k) rules in agency timekeeping systems
How public agency timekeeping systems should handle FLSA 7(k) work periods, regular rate, callback minimums, and comp time.
Pension reporting interfaces between payroll and retirement systems
How payroll data reaches a public retirement system each cycle, and how to keep compensation, service credit, and contributions reconciled.
Leave management: FMLA, workers' comp, and intermittent leave tracking
What a public agency leave system must do beyond subtracting hours: entitlement math, intermittent tracking, workers' comp, and notices.
How long to keep surveillance video: retention schedules and litigation holds
How agencies set camera retention periods, place litigation holds, and document auto-overwrite as an approved records disposition.
Capital asset registers: capitalization thresholds, depreciation, and reconciliation
How agencies decide what to capitalize, how to handle construction in progress and infrastructure, and how to reconcile the asset register.
Publishing 311 data without exposing residents' personal information
How to scrub names, free text, photos, and exact addresses from 311 service requests before publishing them as open data.
Texting residents: 10DLC registration, consent, and opt-out rules
How agencies set up resident text messaging: 10DLC brand and campaign registration, consent records, STOP handling, and vendor terms.
Convenience fees and surcharges on online government payments
How agencies decide who pays card processing costs online, and the brand rules, statutes, refund rules and accounting effects.
Choosing which languages to support and what to translate first
How agencies pick supported languages, rank vital documents for translation first, and keep translated content accurate over time.
CCWIS: federal requirements for a child welfare information system
What the federal CCWIS rule requires of a child welfare system replacement, and where agencies most often fall short.
AFCARS and NCANDS: federal child welfare data reporting
How title IV-E agencies meet AFCARS and NCANDS federal reporting, from element-to-screen mapping through error correction and resubmission.
42 CFR Part 2: consent and redisclosure for substance use records
How 42 CFR Part 2 differs from HIPAA on consent, redisclosure, and court orders for substance use disorder records.
CEQA document management and the administrative record
How to organize CEQA studies, notices, appendices, and comment responses so the administrative record can be certified without a scramble.
Tracking mitigation measures and conditions of approval
How agencies turn adopted mitigation measures and conditions of approval into tracked records with owners, triggers, and evidence.
Data behind the housing element and general plan annual progress report
Where annual progress report numbers come from in permit and entitlement records, and how to instrument systems so the report is a query.
Hazardous materials business plans, CUPA inspections, and CERS reporting
How CUPA systems handle facility records, chemical inventories, tanks, inspections, violations, fees, and state portal reporting.
Floodplain records: elevation certificates, LOMAs, and CRS credit
How local floodplain administrators organize elevation certificates, map changes, and damage determinations for CRS credit.
A coordinated vulnerability disclosure policy for a public agency
What a public agency's coordinated vulnerability disclosure policy should contain, who approves it, and how reports get routed and released.
Ransomware negotiation and payment policy: decide before the incident
How state and local agencies should set ransom payment decision rights, sanctions screening, insurance, and disclosure in advance.
Insider risk in a public agency: separation of duties and monitoring
Where separation of duties belongs in a small agency, what monitoring is lawful and proportionate, and how offboarding closes the risk.
Data retention in analytics platforms is not your records schedule
How to set retention for warehouse tables, BI caches, extracts, and logs without confusing them with your legal records schedule.
Small number suppression in recurring public reports and dashboards
How to set a minimum cell size, apply complementary suppression, and keep the rule consistent across recurring public dashboards.
Vendor AI disclosure: what to require about AI inside products you already own
How agencies can require vendors to disclose AI features added to software they already own, and act on the answers.
How a technology policy gets adopted by a council or board
How an IT policy moves from draft to adopted instrument: review chain, staff report, delegation language, and review cadence.
Surveillance technology ordinances: what they require of staff
How CCOPS-style surveillance technology ordinances define covered systems, and what staff must do before and after a purchase.
Bring your own device: stipends, enrollment, and records risk
How agencies should weigh issued phones, stipends with enrollment, and unmanaged personal devices against labor and records duties.
Text messages and chat apps as agency records
Why Teams chats, Slack messages, and staff texts are agency records, and what capture, retention, and holds actually take.
Comment moderation on agency social media: what the law allows
How agency comment sections work as limited public forums, and what deleting, filtering, blocking, and logging the law allows.
Social media governance: account ownership, archiving, and handoff
How agencies decide who may open social media accounts, archive posts and comments, and hand accounts off cleanly.
Website privacy notices, analytics, and third-party trackers
How agencies audit analytics tags, embeds, chatbots, and pixels, then write a privacy notice and contract terms that match.