Uncategorized

New York’s not-for-profit organizations — from neighborhood community groups to large regional hospitals and educational institutions — are subject to a distinct set of records retention requirements that reflect their unique governance structure, regulatory environment, and accountability obligations. New York nonprofit records retention requirements under the Not-for-Profit Corporation Law (N-PCL), the Internal Revenue Code, and […]

New York employers face some of the most comprehensive labor law record retention requirements in the United States. Under a combination of federal and New York state laws, businesses must retain payroll records, personnel files, wage and hour documentation, and other employment-related records for periods that range from one year to six or more years.

FINRA member firms — broker-dealers, investment firms, and associated registered representatives — operate under one of the most detailed records retention frameworks in the financial services industry. Before a firm can legally shred paper files, compliance officers and records managers must confirm that the records have been held for the full required retention period, that

For broker-dealers registered with the Securities and Exchange Commission, records retention is not just a good business practice — it is a strictly enforced regulatory obligation. SEC Rule 17a-4, issued under the Securities Exchange Act of 1934, specifies in precise detail how long broker-dealers must retain different categories of books and records, how those records

The Sarbanes-Oxley Act of 2002 (SOX) fundamentally changed how public companies manage, retain, and destroy corporate records. While SOX’s core provisions target public companies directly, its document destruction requirements have significant implications for subsidiaries — operating companies, wholly owned entities, and other corporate affiliates that operate under the umbrella of a publicly traded parent. A

In many healthcare settings, the journey of a patient record does not end at the electronic health record system — it continues onto paper. Encounter summaries, referral letters, prescription printouts, lab result printouts, and billing statements are all forms of printed protected health information (PHI) that flow through medical offices, hospitals, and other healthcare facilities

If your healthcare organization, medical practice, or other HIPAA-covered entity works with a shredding vendor to destroy protected health information (PHI), you need to understand the role of the Business Associate Agreement in your compliance program. A HIPAA shredding vendor business associate agreement is a legally required contract that governs how your shredding company may

Every year, millions of employers across the United States run background checks, credit reports, and consumer reports as part of their hiring process. Under the Fair and Accurate Credit Transactions Act (FACTA), businesses that use these consumer reports have a legal obligation to dispose of them properly when they are no longer needed. The FACTA

Insurance agencies across New York handle volumes of sensitive customer information every day — applications, policy documents, claims files, medical histories, and financial records. Under the Gramm-Leach-Bliley Act (GLBA), financial institutions — including many insurance companies and agencies — are required to protect this information throughout its lifecycle, including at the point of disposal. GLBA

When most financial firms think about New York’s Department of Financial Services (DFS) Cybersecurity Regulation — officially 23 NYCRR 500 — they focus on firewalls, encryption, and multi-factor authentication. But the regulation’s requirements extend beyond digital assets. If your firm maintains nonpublic information (NPI) in paper format — client account statements, loan documents, insurance applications,