* Several examples of archiving lapses and their consequences
As mentioned in a previous newsletter, Osterman Research and Contoural have teamed to produce a guide that helps organizations understand e-mail and instant messaging archiving and policies. The consequences of a failure to archive properly can be significant, as shown by the following examples:
* In March, Bank of America was fined $10 million by the Securities and Exchange Commission (SEC) because it did not keep certain e-mail records for the appropriate length of time, because BoA did not comply with the SEC in a timely manner, and because it deleted some of the records that were requested.
* A very high-profile case involving e-mail preservation involves Credit Suisse First Boston (CSFB) investment banker Frank Quattrone. Quattrone’s troubles started not with e-mail per se, but rather with how e-mail was archived at CSFB. Quattrone’s Investment Banking division had adopted a selective deletion policy that required the staff to purge e-mail and instant messages on a periodic basis. Since this had been a long-running policy, Quattrone’s request to his staff in December 2000 to purge their e-mail seemed reasonable. However, Quattrone was aware that a few days earlier, CSFB had received a grand jury subpoena; the purging was viewed by the courts as destruction of evidence and it eventually led to Quattrone’s conviction. Quattrone is now serving an 18-month sentence.
* In August, Richard Gibson pled guilty to obtaining the name and other personal information from a cancer patient and then using this information to sign up for four credit cards in that patient’s name. Not only was this a case of identity fraud, it also violated the Health Insurance Portability and Accountability Act (HIPAA) security guidelines that went into effect in April 2003. The Seattle Cancer Care Alliance, Gibson’s former employer, was the source of the breached information. Gibson faces up to 16 months in federal prison.
Clearly, much of the focus on archiving and policy management focuses on the financial services industry because of rules imposed by the SEC, the National Association of Securities Dealers and the like. However, rules like HIPAA expand the potential liability of thousands of employers because they focus on the health information of employees. Consequently, any company that provides health benefits, collects health-related information from its employees, deals with benefits administrators, etc. and that transmits any of this information via a messaging system, will need to get serious about archival and policy management practices to avoid being a future example of what not to do.
