| Increasingly, the need for a written, highly | | | | Procedure would require lawyers representing |
| structured document and data management policy | | | | parties in litigation to discuss document |
| is becoming vital to any private company. While | | | | management systems of their clients prior to any |
| the recently enacted Sarbanes-Oxley (SOX) rules | | | | legal proceedings. Another proposed amendment |
| promulgated by the Securities and Exchange | | | | to the federal Rules of Civil Procedure would |
| Commission require such a written policy for public | | | | provide a safe harbor for companies that lose |
| companies, there are ample reasons for private | | | | information but have otherwise acted in good |
| companies to also adopt a written document and | | | | faith, precluding any sanctions for such information |
| data management policy.Various statutes now | | | | loss. Certain state laws, such as the California |
| require most companies, whether public, non-profit | | | | Online Privacy Protection Act of 2003, require |
| or private, to securely maintain written records in | | | | website disclosure of privacy policies in regard to |
| regard to certain aspects of their personnel | | | | personally identifiable information (such as name, |
| information and business operations. Under the | | | | address, credit card number, social security |
| Health Insurance Portability and Accountability Act | | | | number, email address, etc.), which should include |
| (HIPAA), for example, companies may be sued if | | | | a statement about the security procedures in |
| a security breach or other mishap results in the | | | | place to protect such information.Prudence also |
| unauthorized disclosure of medical records. The | | | | dictates that written records be maintained in the |
| controversial Patriot Act requires disclosure to the | | | | event of employee claims or litigation involving the |
| federal government of certain customer data and | | | | company. Companies should also be vigilant in |
| can subject the disclosing company to a lawsuit if | | | | documenting incidents involving any inappropriate |
| the customer was not sufficiently advised of the | | | | or improper behavior by an employee. Emails and |
| possibility of such disclosure. A proposed | | | | instant messages are now often crucial in |
| amendment to the federal Rules of Civil | | | | determining court cases. |