Public records readiness checklist for agency technology systems

Reference article · 9 min read

In most states the definition of a public record turns on the content of the material rather than on the medium that holds it, so the systems an agency runs hold records in the same way a filing cabinet does. Those records have to be kept for the period the retention schedule sets, located when someone requests them, produced in a usable form unless an exemption applies, and destroyed only when the schedule allows. Use this checklist on a system under evaluation, where the answers become solicitation requirements, and on a system already in service, where they become a remediation list.

Work through it with a records officer and a system administrator together, because many of the items need one person who knows the law and one who knows the configuration. Finish each line in one of three ways: answered yes with the evidence noted, marked not applicable with a written reason, or assigned an owner and a date. Public records statutes, retention periods, and exemptions differ by state and by record series, so confirm the specifics with your records officer and your counsel.

Records, retention, and disposition

• A written list exists of what the system holds. Walk the system with an administrator and list every place content lives: the main records, attachments, free-text notes, comment threads, and copies that integrations push into other systems. If no list exists, build one before working through the rest of this checklist, because every item below depends on knowing what is in scope.
• Every record series in the system maps to an approved retention schedule item. Put the list beside the schedule and write the schedule item next to each series. If a series has no match, note it and ask the records officer whether an existing general item covers it or the schedule needs an amendment.
• The system can apply a retention period by record type. Ask the administrator to show where a retention rule is configured and confirm the rules in place match the schedule. If the system cannot do this, write a manual review and destruction procedure, name the person who runs it, and set the frequency in writing.
• Destruction is recorded. Check whether disposition creates an entry naming the record, the schedule item, the date, and who approved it. If nothing is recorded, keep a destruction log outside the system and require it to be completed before anything is deleted.
• A legal hold can be applied and released. Ask the administrator to place a hold on a test record, attempt to delete it, then release the hold. If no hold function exists, define a substitute such as removing deletion rights or copying the affected records to a held location, and record the gap for the next contract amendment.
• Automatic deletion and disappearing-content features are accounted for. List every setting that removes content on a timer, including message expiration, trash emptying, and log rotation, and turn off the ones that would destroy records before their retention period ends. If a setting cannot be turned off, get the vendor's description of it in writing and have the records officer decide whether the affected content is a record.

Search and retrieval

• Records staff can run their own searches. Have a records staff member log in and run a search without help from IT or the vendor. If they cannot, ask the vendor in writing for a role that allows it, and track the request until it is answered.
• Search reaches inside content, not only titles and dates. Pick a phrase that appears only in the body of a document, one that appears only inside an attachment, and one inside a scanned image, then search for each. If any of the three fails, plan to export the content and search it in another tool, and add that time to your estimate for responding to requests.
• A search can be scoped, saved, and repeated. Confirm that staff can filter by date range, author, and custodian, and can record the terms used. If the system does not save searches, keep a manual search log with the terms, the scope, the date, and who ran the search, so the same search can be run again and explained later.
• A records role can reach all user content without full administrative rights. Test with an account configured the way records staff accounts are configured, and look for a record owned by a user in another department. If the permission model offers only too little access or full administrative rights, ask the vendor whether a records role exists or can be added, and document the interim arrangement and who holds it.
• Content a user has archived or deleted is still findable while it is inside its retention period. Delete a test record as an ordinary user, then search for it from the records role. If it cannot be found, ask the vendor in writing where deleted content is held, for how long, and how staff retrieve it, and keep the written answer with this checklist.

Production, redaction, and the audit trail

• Records export in formats a requester can open. Export a sample of each record type and open the files without using the source system. If the only available format is proprietary, ask the vendor for a standard format with a price and a date, and build a conversion step into the request workflow until that exists.
• Bulk export works without a vendor services engagement. Ask the administrator to export a large set covering a date range and time how long it takes. If bulk export requires the vendor, get the cost, the turnaround, and the format in writing before a large request or a system transition arrives.
• Exports contain the metadata counsel treats as part of the record. Decide with counsel which fields belong, then open an exported file and inspect the fields it actually carries rather than relying on what the interface displays. If fields are missing, ask whether they can be added to the export and write down the ones that cannot.
• Redaction removes the underlying text rather than covering it. Redact a test document, open the released copy, try to select the text under the marking, and search the file for a word you redacted. If either attempt turns up the redacted content, flatten released files before release and repeat the test.
• Each redaction records the exemption it rests on, and the unredacted original is preserved. Check whether the tool stores a reason on each marking and writes a separate release copy rather than altering the original. If it does neither, log the exemptions separately by page and location, and perform redaction on a duplicate so the original stays intact.
• The system logs who viewed, changed, exported, and deleted records. Ask for a sample log covering one day and check which of those four actions appear in it. Logging is often off by default, so turn on what is available; if a category cannot be logged, record that and decide with the records officer whether a manual sign-out procedure is needed. Check the log retention period as well, and extend it if it is shorter than the period in which a dispute about these records could arise.
• Every account belongs to one named person, and administrator actions are visible to someone else. Pull the user list and look for shared or generic logins, then check whether deletions and configuration changes can be reviewed by someone other than the administrator who made them. Replace any shared account with individual accounts; if administrator actions are not reviewable in the system, schedule a periodic export of the log to a second reviewer.

Contract terms and ongoing change

• The contract states that the agency owns its data. Read the agreement and confirm the ownership language covers content, metadata, and configuration. If it is silent or reserves rights to the vendor, tell the contract owner now and put the change on the list of conditions for the next renewal.
• Export rights continue after the contract ends. Look for language naming the export format, the window in which the export is available, the assistance the vendor provides, and whether the export is available during a payment or performance dispute. If any of those is missing, draft the language and raise it at renewal.
• The vendor is obligated to assist with public records requests. Look for a clause requiring the vendor to locate data the agency cannot reach on its own and to describe in writing how and where records are stored. If there is no such clause, request one and plan longer response times for requests that depend on vendor assistance.
• Vendor retention and deletion practices are documented. Ask what the vendor deletes on its own schedule, including backups and logs, and what evidence of deletion it provides at the end of the contract. If the practices are undocumented, request them in writing and file the response with the contract.
• New features are reviewed before anyone turns them on. Confirm that a named person reads vendor release notes and decides whether a new feature creates records. Chat channels, comment threads, and artificial intelligence features can all generate content, and prompts, outputs, and the logs of both may themselves be records. If no review step exists, add one to the change process and name the reviewer.

What to do with the results

Sort the answers into three lists. The first is what the agency can fix by configuration: retention rules, logging settings, account cleanup, and access roles. The second is what the vendor has to fix or commit to, which belongs in a contract amendment or in the next solicitation rather than in an email. The third is what the agency knowingly accepts, with each entry paired with a manual procedure that compensates for the gap and a named owner.

Then set a date to run the checklist again. Features get enabled, schedules get amended, and staff change, so the answers describe the system as it was configured on the day the work was done. HQT provides independent assessment of records retention configuration, search and export capability, and redaction workflows in agency systems.

Frequently asked questions