Network Drives Cleanup The Project With No End Date ARMA Spring Conference April 8, 2015 June 2013 Patricia Zimmerman, CRM Senior Director, Enterprise Records & Information Management UnitedHealth Group Legal, Compliance & Regulatory Affairs
UnitedHealth Group at a glance UnitedHealth Group is a Fortune 14 diversified health care company headquartered in Minnesota, serving the markets for health benefits through UnitedHealthcare and the growing markets for health services through Optum. UnitedHealthcare serves: State Medicaid and community programs; Employer sponsored and individual health benefits plans; All major senior health benefit product categories; Military personnel and their families; and The international health care marketplace. Optum is: A leader in population health management serving the physical, mental and financial needs of individuals and organizations; One of the largest health information, technology, services and consulting companies in the world; and A pharmacy benefit management leader in service, affordability and clinical quality. Together UnitedHealthcare and Optum serve more than 85 million individuals worldwide with a total workforce of more than 165,000 people, and serve members in all fifty states of the US and more than 125 other countries. 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 2
ERIM Program organizational objective Enterprise Records & Information Management (ERIM) provides a framework for implementing enterprise-wide recordkeeping best practices. The program s purpose is to clarify individual and organizational records management accountabilities, support legal, regulatory and audit requirements, and mitigate risk. Reduce Risk Retain the right information for the minimum period of time to meet contractual and regulatory obligations Ensure that critical information is stored in a shared location accessible to authorized users Require retention and disposition activities to be routinely applied Reduce Cost Clean-up records that no longer have value and have exceeded retention requirements Apply retention controls in all storage locations to manage growth Limit the volume of records preserved for legal holds through automation Emphasize Accountability Utilize the ERIM Governance Board to engage senior leadership Increase awareness of the program through training and leadership support Provide tools and rules to enable business areas to identify areas of risk and develop action plans to prioritize and resolve issues 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 3
ERIM Program our journey ERIM Policy & Governance Board 2007-2009 Functional Retention Schedule ERIM & You Training Manage In Place Strategy Tools & Rules 2009-2015 Define requirements & select technology Proof of Concept / Technology Pilots / User Pilots Change management, communications, training Email Email Policy, Archive & Automated Retention Controls SharePoint Governance Policy & Automated Retention Controls Network Drives Cleanup Strategy & Technology Assisted Retention Rules 2010 thru 2014 2013 thru 2015 2012 thru 2016 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 4
Network Drives Cleanup: diagnose the problem Diagraphephobia: 1. The fear of deletion; fear of being deleted. Believing that you are living inside a video game or computer, and being afraid that you are going to be deleted from existence. 2. Also applies to the fear of having your important documents, photos, or other files deleted. Andy keeps five copies of his files in three physical locations. He s such a diagraphephope! Urban Dictionary Recognizing your fear is the first step to recovery! 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 5
Network Drives Cleanup: what s important to note The overarching ERIM policy states that everything is a record; it s either a Business Record or an Administrative Record Network drives include shared drives (department use) and home drives (personal use) The environment grows at an annual rate of 40% Departments are charged for the space they consume The backup process produces two more versions of the data; restores are available for 90-days We could identify employees on legal hold and avoid taking action on their content 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 6
Network Drives Cleanup: our goals and principles G O A L S P R I N C I P L E S Delete 40% of the target environment in year one Control growth by implementing retention controls Emphasize risk mitigation as our driver to gain leadership support Reduce chargeback to business by deleting obsolete and low value content Be consistent Simplify Focus on risk Retention philosophy should be consistent across platforms and areas of the business Emphasize accountability Training and communication plan should focus on the same key messages Minimize the number of retention rules Limit user choices Design a simple, scalable processes Avoid expending large effort on small issues Focus on high value Business Records and high volume Administrative Records Accept solutions that address the most important issues 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 7
Network Drives Cleanup: what we had on our side Governance Board established in 2007 is comprised of senior leaders that are very engaged ERIM & You is a mandatory training lesson Consumption reduction was identified as a key initiative by our IT organization when we started our work The tool we would use for our initiative was already in-house Company culture recognizes not all data is equal from a risk perspective 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 8
Network Drives Cleanup: what we knew from the start We needed friends that were not at an executive level and a lot of them We would live or die by the ability of our employees to understand and apply the records retention schedule to their information Positive IT collaboration was critical to our success The timeline would slip maybe by a lot Any approach we introduced needed to acknowledge the user perspective this is a low priority and we get that We needed our own data analyst 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 9
Network Drives Cleanup: the challenges Anticipated Quantifiable benefits would be tough to calculate since growth would overpower deletion even if we hit our targets Qualitative benefits are deemed important but are not the primary driver The IT team that does the care and feeding would hesitate to take bold actions The Legal team that championed risk mitigation would hesitate to take bold actions At times there would be competing priorities 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 10
Network Drives Cleanup: the challenges and Not Anticipated There would be competing priorities all of the time IT teams would take actions we didn t know about that would cause setbacks IT Finance would change their position that cost avoidance associated with buying more disk was no longer a driver 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 11
Network Drives Cleanup: the reality of it all ERIM Perception It s COMPANY property We re all responsible to do this Users will understand our message Users will see the benefit immediately Users will make this a priority versus end user perception It s MY document My way is better This is too much work I can save it as long as I want to My business is unique 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 12
Plan A: Leverage Technology 2012 Utilize an application that scans content to do as much as possible without user engagement Identify content owners Align content to record codes on the records retention schedule Tag content with meaningful metadata to drive deletion decisions Don t get caught up in automated identification of the source of truth Don t focus on identifying duplicates 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 13
Plan A: Leverage Technology 2012 What Worked Proof of concept to align content to the record codes tested well The reports of deletion opportunity were easy to understand The departments didn t have to be knowledgeable about the retention schedule itself just the deletion rules A lot of the important information was organized - which was good What Didn t Work The infrastructure required to support this was expensive The care and feeding component was expensive and resource intensive Duplicates were a significant deletion opportunity Didn t adhere to our principle of FOCUS ON RISK 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 14
Plan B: Leverage ERIM Expertise 2012-13 Engage users to focus on the Administrative Records and have ERIM focus on the Business Records Let technology cleanup everything that doesn t require user action ( auto-deletes ) Provide employees and departments that own a lot of content with reports to enable them to easily review and delete and don t check their work Use the application to make a first pass at aligning content to record categories and ask business areas to revise if necessary 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 15
Plan B: Leverage ERIM Expertise 2012-13 What Worked The auto-delete scripts are effective The report designed to allow users to review and delete content matured as we progressed and we could track and report results The initial pilot group provided great feedback regarding the resources we provided What Didn t Work Very low participation rate by employees to delete their information including our team Departments questioned the accuracy of the tool to classify on their behalf Didn t adhere to our principle of BE CONSISTENT 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 16
Plan C: Leverage Business Expertise 2013-14 Engage users to focus on the Business Records and have ERIM focus on the Administrative Records Let technology cleanup everything that doesn t require user action ( auto-deletes ) Engage employees to identify their Business Records by incorporating the record code Provide employees and departments that own a lot of content with reports to enable them to easily review and delete Provide the business with estimates of chargeback reductions if their employees participate 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 17
Plan C: Leverage Business Expertise 2013-14 What Worked Business Records are the smaller volume Ability to estimate chargeback savings encouraged participation Users understood that records are not equally weighted from a value perspective It was difficult for users to dispute that there was a lot of obsolete information Course changes required would be achievable What Didn t Work Identifying the record code in the folder hierarchy Overcoming an IT driven global change in the content owner identifier Developing a new method to identify owners Retaining the ability to estimate chargeback savings 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 18
Plan D: Leverage Appropriate Use Standards 2014-16 Develop, communicate, and enforce rules for appropriate use of network drives Standard network drives are for Administrative Records only Fixed retention limit of three years enforced by technology Registered network drives are for Business Records only. Appropriate retention applied. Audit user behavior. Have users request space for Business Records and provide basic metadata: owner, record code, key descriptors Use technology to align record code to retention period for Business Records. Apply periodically. 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 19
Plan D: Leverage Appropriate Use Standards 2014-16 What Worked Governance Board approved approach (Focus on Risk) Easier for users to understand (Simplify) Simplifies the application of technology (Simplify) Legal likes the approach (Be Consistent) We ve had great success with initial clean-up! What didn t work Using reduced chargeback as incentives too much work for too little return Difficult to incorporate acquisitions Stay tuned. 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 20
Network Drives Cleanup: lessons learned from the business Lead with what is practical versus hitting users on the head with the policy Take cost savings off the table if you can t achieve the ROI The more we could align our objectives with information security the more likely we would move up on the priority list For leaders the most important principle is to FOCUS ON RISK For users the most important principle is to SIMPLIFY For our legal and compliance sponsors the most important principle is to BE CONSISTENT 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 21
Network Drives Cleanup: lessons we learned by ourselves Get something done early to have a positive result to point to It s okay to set a goal of good enough versus best in class Any change in user behavior is a measure of success Treat all user efforts as home runs even if they aren t Introduce departments that don t get it to departments that do If there isn t a carrot and stick option have an orange stick Plan D can be as equally defensible as Plan A 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 22
Network Drives Cleanup: where we re headed Shorten ERIM & You our mandatory training Emphasize Administrative Records vs Business Records Reach more audiences - US based employees, international employees, acquired companies and contractors Continue enforcement of 3 year limit for more file types Begin process of adopting Registered Network Drives for Business Records Pilot with test group(s) Incorporate lessons learned and expand roll out Rinse and repeat 2012 UnitedHealth Group. Any use, copying or distribution without written permission from UnitedHealth Group is prohibited. 23