PLANSPONSOR - December/January 2021 - 37

Otherwise, she recommends consulting
with ERISA counsel to ensure the plan
follows best practices when filing e-documents,
even as more employers are
turning to the practice. " If you have any
doubt, call your ERISA counsel or keep
the [paper] document. For any questions,
consult the experts, " she advises.
Stephen Ferszt, an ERISA attorney
and partner at Olshan Frome Wolosky
LLP in New York City, recommends
keeping determination letters, advisory
opinion letters, plan census data, calculations,
participant elections and committee
minutes as paper copies, as well. " Paper
records are very important to have. You
want that redundancy, " he says.
Have a Backup
Employers largely relied on paper documents
in the early days of computers, the
Web and mobile usage-a stark difference
from the widespread embracing
of electronic storage today, especially
during COVID-19.
" There was a period of time when
the IRS required wet signatures on everything,
and the rule was you had to keep
every plan document in paper copy format
until the end of time, " notes Cohen. " The
IRS understands at this point that there is
DocuSign, that there are professional electronic
services, and, especially with the
COVID pandemic, that there are clearly
trustworthy electronic signatures. While
the prior life of plans was that everything
needed to be on paper, that has changed
dramatically over the past five years. "
Still, it is smart to keep paper copies,
should a hard drive be destroyed, a USB
misplaced or a cloud storage system
hacked. In any of those instances, an
ERISA malpractice claim could arise,
Cohen observes.
" It's also important that any type of
electronic retention system be somehow
backed up, retained, not easily lost, " she
adds. " There has to be prudence to how
you're saving the documents, where
you're saving them, and that you have the
ability to retrieve them easily. To post this
out there on a nonsecure site is a problem,
not for record retention issues but for
cybersecurity and identity issues. "
According to Buckmann, consulting
with your company's information technology
(IT) staff about its practices can
ensure privacy and security for sensitive
data. " It's very important to have adequate
security backing, " she says.
Further, have a backup plan for paper
records, says Cohen. Paper copies could be
lost in an unfortunate turn of events such
as a fire, so keep a USB drive to which the
information has been scanned, off-site in a
lockbox, along with other important documentation.
-Amanda Umpierrez
DIGITAL DOCUMENT CHECKLIST
LEGAL sources interviewed for this story identified these five best practices.
■✔Identify and establish the person or persons responsible for organizing
plan documentation. This should also include an information technology
(IT) specialist who will help with electronic security.
■✔Review all guidelines under Sections 107 and 209 of the Employee Retirement
Income Security Act (ERISA), or the Health Insurance Portability and
Accountability Act (HIPAA) if your plan offers an ERISA welfare benefit plan.
■✔Keep all documents for at least six years from the report filing date, or
as long as Section 207 of ERISA requires. To help manage each document
filing deadline, establish a written record retention statement.
■✔Keep a paper copy of the records when in doubt. This includes determination
letters, advisory opinion letters, plan census data, calculations,
participant elections and committee minutes.
■✔Keep a backup. Have a portable USB drive containing the scanned
information, and keep it off-site in a lockbox with other certificates and documentation,
or utilize a secured cloud storage. -AU
HIPAA-Related Guidelines
There are separate electronic storage requirements under the Health Insurance
Portability and Accountability Act (HIPAA) for employers that offer an Employee
Retirement Income Security Act (ERISA) welfare benefit plan. An American Institute
of Certified Public Accountants (AICPA) report highlights specific requirements,
including establishing that the recordkeeping system have reasonable
controls to ensure the integrity, accuracy, authenticity and reliability of the
records kept in electronic form; that the records are maintained in reasonable
order and in a safe and accessible place; that the system has established and
implemented adequate records management practices; and more.
Stephen Ferszt, with Olshan Frome Wolosky LLP, points out that any businesses
partnering with HIPAA-related plans are subject to these requirements.
" If you hire a third-party administrator [TPA], and it now gets Social
Security information and other personal info, it has an obligation to protect
that information, as well. " -AU
PLANSPONSOR.COM December 2020 - January 2021 37
http://www.PLANSPONSOR.COM
PLANSPONSOR - December/January 2021

Table of Contents for the Digital Edition of PLANSPONSOR - December/January 2021
