# Presentation: 467238

## HHS Records Management Integrated Project Team Meeting

**January 27, 2009**

## AGENDA

**AGENDA**

- Introduction
- Terry Nicolosi – Director,  Office of Resource Management
- 2008 RM Assessment Highlights
- Larry Gray– Department HHS Records Officer
- RM Segment Progress
- Mary Forbes – HHS Lead Architect

## HHS 2008 RM Assessment Highlights

**Oversight/support:  (Pages 30-31)RM **Integrated Project Team Kick-Off (Oct/2008), RM performance measures established for Senior Executive Service (SES) employees effective in 2009 (Nov/2008), Records Management Council and RM Bulletins, segment architecture for RM (May/2008).
**Specific Written Guidance:  (Pages 31-32) **HHS Policy for RM (2007-004.001); HHS Policy for RM for E-Mails (2208-002.001); RM Procedures Manual (updated from 1977); Guideline for Electronic RM (interim guidance); Training Brochures;
**E-Records: (Pages 33-34) **Developed set of instructions for Records Officer to use with creation of electronic folders; Worked with Web Communications Team on RM standards for information residing on Web;  Established EA team to address RM Business Case  based on OMB Federal Enterprise Architecture standards;

## HHS 2008 RM Assessment Highlights

**Training: (Pages 34-36) **;Over 560 employees trained in basic records management; RM Overview on website; OS Records Coordinator, Records Managers and Liaisons appointed by ASAM to support the 21 OS offices; Working with HR on departing and incoming employees with training and revised forms and brochures.
**Responsibilities: (Pages 6-29) **Record Officer Review and Evaluation for all operating divisions and OS included in assessment. 2008 Assessment posted communicated to all OCIO and RM Community on Jan. 7, 2009 and in queue for intranet.
**Risk and Self-Assessment: (Pages 36-42) **Risk Analysis conducted in 2007 and 2008 assessments with addressed actions; 2008 Self-Assessment Survey conducted in both 2007 and 2008 with addressed actions;

**HHS 2008 RM Assessment Highlights**

## RM SEGMENT PROGRESS

- RM Segment work completed to date
- High-level segment diagram
- RM Segment - Current state
- Business Process Analysis (Exercise)
- 		- BREAK -
- Records Officers Observations
- EA Team Observations
- Opportunities moving forward
- FEA RM Profile
- Short term tasks
- Timeline

- Mary Forbes - HHS Lead Architect

## Why are we doing the RM segment architecture

- Segment architecture is a structured process to develop value-added plans for improved mission delivery
- Facilitates and enables enterprise-wide thinking and informed decisions about HHS’s business processes and investments to better support HHS’s mission.
- Identifies needed investments
- Identifies opportunities to eliminate redundancy of processes, data, applications and technology
- Prevents investment dollars from being expended on duplicate data, processes, applications or technology
- Identifies business functions and investments not aligned with HHS’s mission goals and objectives and introduces discipline to both prevent and mitigate discrepancies

## Information about current RM business processes has been collected from multiple sources:
OPDIVs interviews
RM Assessment and RM Survey
Existing documents, policies, guidance
OPDIVs websites
Available business process models (e.g., CMS diagrams)
Process models were aligned to high level NARA required processes
Information was captured in the HHS EA repository**
Gaps in business processes were identified and documented 

- OPDIVs interviews
- RM Assessment and RM Survey
- Existing documents, policies, guidance
- OPDIVs websites
- Available business process models (e.g., CMS diagrams)
- Process models were aligned to high level NARA required processes
- Information was captured in the HHS EA repository**
- Gaps in business processes were identified and documented

**RM Segment* Work Completed to Date**

**Notes:**
*A segment is a subset of the HHS enterprise, described as a set of related business functions, processes, and/or services. Using the business-based definition of a segment, HHS segments are mutually exclusive – that is, each segment belongs to one and only one business area.

** The HHS Enterprise Architecture Repository is a centralized database that contains information about why, how, and with what resources HHS operates.

We would like to take this opportunity to thank you for the contributions you have made to the RM Segment Architecture effort. Your efforts have assisted us greatly in documenting the RM Segment and Program.

CMS Business Process Models were reviewed for RM Best Practices.
 CMS has highly defined and documented business process models for all of their Records Management (RM) business processes.
 These processes were used as a template to assist in the discussions with the OPTIVs throughout CMS regarding their Records Management activities.

OPDIVs throughout HHS were interviewed about their Records Management business processes.
 Representatives were contacted regarding their Records Management activities.
 These activities were used in documenting the RM activities and their commonalities/differences.

## Slide 8

**Notes:**
The above graphic provides an overview of the external drivers to HHS and how those drivers influence the adoption of HHS RM policy. 
	- The second portion of the graphic details the core function RM processes. 
These processes represent the core functions performed at each of the HHS OPDIVs. The 3 dimensions show the applicability to all OPDIVs/STAFDIVs 
	- Adjacent to the core function RM processes is a list of operational processes. 
Operational processes support the execution of the core function RM processes.
  - The bottom portion of the slide refers to IT resources. 
These resources consist of IT resources that support the core RM functional processes and the program management processes (the processes adjacent to core RM processes in the diagram). It is further supported through the use of specific technologies, which enable the processes to be automated.

There are currently no RM IT systems or Program Supporting IT systems. If the HHS EA repository will be used to support the program it will part of the program support IT systems
No technologies have yet being identified.

We need to talk about outlook and the PSD files and if this should be modeled as part of the segment in the IT resources.

* The difference between an Electronic Record Keeping System and any IT System is that.....
IT System: Storage and dissemination of information – It is not a Electronic Record Keeping System unless it meets DoD 5015.2-STD certified Records Management Application (RMA) requirements or equivalent.
Electronic Record Keeping System: 

## RM Segment  - Current State

**RM Segment  - Current State**

- RM strategic Drivers/Policies/Requirements

- See business process analysis

- Supporting IT investment:  0*

- Databases:  0
- Data needs are being identified.

- System services:  0
- Electronic Record Keeping System: 0*
- 142 Scheduled IT systems

- Supporting IT Technologies:  0

- Training needs – 07/08 RM Assessment ***

- Catalog HHS Record Centers – TBD – NARA 2005 inventory validation

- No department-wide or OPDIV-wide Electronic Record Keeping System approved by NARA**

**Security & Privacy**

**Performance**

- Security and privacy needs - TBD

- Performance – 07/08 RM Assessment
- Milestones

**Notes:**
* There are some investments that map to Knowledge Management or Correspondence that could be included in this segment.
* We have no IT systems that meets the DoD 5015.2-STD certified Records Management Application (RMA) requirements or equivalent but we are still doing RM by using manual processes.
* We want to turn this 0 to a 1 a hybrid solution with that addresses all requirements using latest technologies available.

** NARA approved: NARA has endorsed DOD 5015.2-STD to set the requirements for an Electronic Record Keeping System 
*** Working with HR (see assessment) initially for SES next step for all employees

## Strategic Impact

**Strategic Impact**

**Records are the life blood of the US government**
- Kshemendra Paul,
- Chief Architect, Office of E-Government and Information Technology
- Stated at the **HHS RM Segment Kickoff **in October 2008

**Civil and criminal  prosecution impact which will cost the agency both dollars and personal confinement.**

**Lose the ability to manage effectively and efficiently. **

**Decrease our efficiency of implementing the mission of the department.**

**Legal requirements**

**Sound business requirements**

**As stewards of the public trust**

**Notes:**
Legal requirements : Mandates drive the way in which records are created, maintained and disposition instructions applied.  They also mandate responsibilities and outline the minimal requirements.
Impact: The impact of not complying with federal requirements (FOIA, Privacy, Records) has both civil and criminal  prosecution impact which will cost the agency both dollars and personal confinement.

 Freedom of Information Act (FOIA)
 Federal Privacy and Data Protection Policy Act
 Circular A-130
 E-Government Act of 2002
 Government Paperwork Elimination Act
 Paper Reduction Act of 1995
 Government Performance Results Act (GPRA)

Sound business requirements relating to the normal operations of any organization require that organizations be accountable for the actions they take during the conduct of business.  A records of these actions must be made and maintained for as long as needed.

As stewards of the public trust Federal agencies are accountable to the public for our actions.  Audit trails documenting key roles are essential. Records provide who, how, and when an action was taken.

## RM Performance

- Performance is relevant at multiple levels of Records Management:
- Records Officers
- Senior Executive Service employees
- All employees
- Overall RM program
- Gaps have been identified in the annual assessments and progress measured in the subsequent year.
- “In 2008 records management performance measures were crafted, approved and implemented for the Senior Executive Service employees. It is anticipated that this initiative will initiate the development of performance measures for all HHS employees.”

## Current State of HHS Implementation to Compliance with NARA CFR 36 due by September 30, 2009

- List of #142 NARA scheduled IT systems for HHS (See handout).
- EA is conducting an all IT systems inventory (Deadline: 02/10/09).
- Records Officers work with EA/Systems Owners to make sure all IT systems have been reviewed and scheduled.
- Non-scheduled systems have to follow the processed outlined in CFR 36.
- Submit report to NARA by September 2009

## IT System Scheduling process (CFR 36) 

- Op Div Records Officer
- Prepare SF-115 with all required data
- Submit to Department Records Officer
- Department HHS Records Officer
- Reviews SF-115 for completion and potential duplication with already scheduled IT systems with NARA
- Coordinate with Records Officer any changes
- Obtains approval/signature from OGC
- HHS Records Officer signs SF-115 and sends official request to NARA for approval
- Coordinates with NARA any requested changes
- NARA sends approval to the Records Officer with copy to Department Records Officer

## RM Organizational Structure

**Notes:**
NARA:
OMB:
GSA: Storage and IT

## RM Segment in the HHS EA Repository 

**RM Segment in the HHS EA Repository **

- The information gathered through the assessment, interviews, and analysis of the information posted on your websites was used to create the current state of the RM segment in the HHS EA repository.

- Reports about RM segment are located on the EA portal.

- Detailed business process models

## RM Segment in the HHS EA Repository 

## Review of RM Business Processes

- EA Team interviewed 7 OPDIVs/STAFFDIVs (CMS, NIH, OS, ACF, FDA, IHS, AoA )
- The CMS processes* were determined to be the closest documented processes to the NARA business model therefore they were used during the interviews with the OPDIVs.
- Other OPDIVs are capturing their processes to retain the knowledge of how thing are done.**
- Identify business process changes that can be used to reengineer processes and documenting current constraints such as FTEs dedicated to the RM target.
- A collaborative approach will help with different kinds of resources limitations.
- All documented processes from the OPDIVs were mapped to the high level NARA processes to complete the following business process matrix.

**Notes:**
* The Centers for Medicare and Medicaid Services (CMS) RM office has worked closely with the CMS EA Team to extensively document their current and future RM business processes.
 These models provide detailed, pictorial descriptions of how CMS executes its records management responsibilities

CMS Business Process Models were reviewed to determine the scale and scope of a HHS Organization with very detailed, highly involved RM business processes.
 They were used to measure and attain an understanding of how HHS ODIVS execute their work across multiple processes.
 These processes provide a very detailed view of a highly complex organization. Through examining these processes, it is possible to gain an understanding of the processes that all OPDIVs perform. 
 CMS’ highly developed business processes provide an opportunity for the other OPDIVs to document how the function and provide ideas for process improvement. 

** NIH is using ContextWhere to capture their processes

## High Level RM Core Functions                                                                      (Business Processes)

**High Level RM Core Functions****                                                                      **(Business Processes)

**Is it a record?**

**Create Records**

**Schedule Record with NARA**

**Maintain Records**

**Disposition**

**Program Evaluation**

**Training**

**Supporting Operational Processes**

**Notes:**
This diagram represents the high level HHS business model for RM. 

## Business Process Analysis

**Business Process Analysis**

**Notes:**
The spreadsheet was created by using the RM assessment, stakeholders interviews, and completed by HHS inferring some of the information from previews datacalls.

## Realizing the RM Segment Vision 

- Gaps

## Records Officers observations

- Many Records Officers are also responsible for other tasks.
- OPDIV RMs are not able to focus their full attention to the task of RM.
- Find balance between available resources and work related requirements.
- Lack of coordination and interface of RM liaisons with Records Offices and management within their own offices.
- Would like to automate the paper process department-wide
- Would like more training on RM functions
- Need of enterprise-wide or hybrid* RM IT System solution
- RM processes should be integrated with other enterprise processes such HR, security, acquisition, and operations.

**Notes:**
The Federal Enterprise Architecture Records Management Profile lists ideas/option with regards to IT systems supporting the RM segment:

“the RM Profile includes three scenarios that demonstrate hypothetical applications of some of the FEA reference model/records management-related questions. As listed below, these scenarios
represent two distinct tracks that agencies might choose, and a third option that represents a hybrid approach combining elements of the first two :
  An agency can opt for a DoD 5015.2-STD certified Records Management Application (RMA) that provides records management functionality for capturing, managing, accessing,
storing, and dispositioning records.
  Another option is to explore a component-based architecture (CBA) that uses records management service components (RMSCs) to accomplish similar functionality.
  A third option is to develop RMSCs as part of mission applications and link them to RMAs already being used by the agency.

## EA Team observation

- NARA and OMB* recommend that RM should be integrated with the IT System development process. HHS promulgated in 2008 the Enterprise Performance Life Cycle (EPLC)* which is a framework for IT investments management.
- Audit processes for ensuring that Federal Record Centers are certified in accordance with NARA requirements.
- Once audit processes are established, processes detailing when, how, and when these centers should be audited need to be addressed.

**Notes:**
* See Federal Enterprise Architecture Records Management Profile v1

**  The CPIC process is evolving to support HHS system development life cycle (EPLC). The EPLC is a solid project management methodology that incorporates best government and commercial practices through a consistent and repeatable process, and provides a standard structure for planning, managing and overseeing IT projects over their entire life cycle. The EPLC framework consists of ten life cycle phases.  Within each phase, activities, responsibilities, reviews, and deliverables are defined.  Exit criteria are established for each phase and Stage Gate reviews are conducted through the IT governance process to ensure that the project’s management quality, soundness, and technical feasibility remain adequate and the project is ready to move forward to the next phase. The EPLC framework provides a guide to Project Managers, Business Owners, IT governance executives and other stakeholders throughout the life of the project.

## Federal Enterprise Architecture RM profile

- Three FEA scenarios for Records Management that demonstrate hypothetical applications of a Electronic Record Keeping System are described below:
- An agency can opt for a DoD 5015.2-STD certified Records Management Application (RMA) that provides records management functionality for capturing, managing, accessing, storing, and dispositioning records.
- Another option is to explore a component-based architecture (CBA) that uses records management service components (RMSCs) to accomplish similar functionality.
- A third option is to develop RMSCs as part of mission applications and link them to RMAs already being used by the agency.

**Notes:**
The RM Profile identifies the following objectives:

Use the FEA as the common Government-wide framework for identifying records management requirements.
Identify records management issues and requirements and link them to their implementing technologies and business processes.
Build records management requirements into agency information technology (IT) governance processes for capital planning, enterprise architecture, business process design, and the systems development life cycle.
Establish a concise and coherent body of records management resources that places this information in the proper context within the FEA.

Reference: Federal Enterprise Architecture Records Management Profile v1, page III - IV

## Opportunities moving forward

**RM Transition Plan**

**Business Case for program development**

**Opportunities moving forward**

- Standardized core RM processes across HHS:
- Enable automation to improve processes and reduce workload
- Reduce paperwork
- Storage cost
- Improved resource efficiency
- Access to records when needed
- Reduce complexity while addressing uniqueness of each OPDIV
- Should ensure compliance with:
- Policies
- Procedures (Processes)
- Ability to leverage best practices, tools, training across HHS
- Will help HHS carry out its mission
- Analysis will drive high-level requirements for potential  or hybrid* solution enterprise-wide RM information system
- Incorporate and integrate RM needs in enterprise processes such as EPLC

## Highlights RM Current State

- RM processes across HHS are not standardized.
- There are no department-wide or OPDIV-wide electronic record keeping systems.
- All IT Systems have to be reviewed and scheduled.

**Notes:**
Definitions

## Quarterly deliverables

- Gaps

**1****st**** Qtr ****(Oct08 – Dec08)** – Current Records Management Business Process
**2****nd**** Qtr ****(Jan09 – March09)** – Gap Analysis
**3****rd**** Qtr ****(April09 – June09)** – Target Records Management Business Process
**4****th**** Qtr ****(July 2009 – September 2009)** – Transition Plan

**Transition strategy: Baseline to target**

##  Short term tasks

- HHS RM Interim Transition Plan – Milestones
- Work with CPIC to integrate RM into the EPLC*
- Records Officers validate the identified records IT systems per the September 2009 NARA requirement (36 CFR 1228 Subpart K)
- Use the HHS EA repository to support the categorization of records IT system**
- Develop guidance for enterprise architects on how to address RM in other segment development efforts.

**Notes:**
*  The CPIC process is evolving to support HHS system development life cycle (EPLC). The EPLC is a project management methodology that incorporates best government and commercial practices through a consistent and repeatable process, and provides a standard structure for planning, managing and overseeing IT projects over their entire life cycle. The EPLC framework consists of ten life cycle phases.  Within each phase, activities, responsibilities, reviews, and deliverables are defined.  Exit criteria are established for each phase and Stage Gate reviews are conducted through the IT governance process to ensure that the project’s management quality, soundness, and technical feasibility remain adequate and the project is ready to move forward to the next phase. The EPLC framework provides a guide to Project Managers, Business Owners, IT governance executives and other stakeholders throughout the life of the project.

** The EA program is in the process of collection the full inventory of IT systems and consolidating it across CPIC and Security.  RM will leverage the consolidated list to support the submission to NARA in September 2009.

## RM Records Schedules – Current State

**RM Records Schedules – Current State**

- Records Groups

- OPDIVs/STAFFDIVs

- Department

- _Decentralized_ Inventory of Record Schedules

- HHS Records Manager

**RECORDS DISPOSITION SCHEDULES**

**File Plans**

**Dept-wide RECORDS DISPOSITION SCHEDULES/File Plans**

**Notes:**
Currently HHS does has a decentralized inventory of record schedules.  HHS is in the process of collecting all the Records Schedules that are submitted to HHS in multiple formats: Excel, Word, PDF, and paper copies

## Use of HHS EA Repository for IT Systems alignment with Records Schedule

**Short term solution ****– Map Information Systems to records schedule**

**OPDIV/STAFFDIV RECORDS DISPOSITION SCHEDULES**
- (Unique schedules)

- Job Function

- Job Function

- Job Function

**HHS**

**OPDIVs **

**Federated Information ownership**

**IT Systems Owner***

- System

- System

- System

- System

- System

- System

- System

- System

- System

- System

- System

- System

- System

- System

- Job Function

- Job Function

- Job Function

- Job Function

- Job Function

- Job Function

**Notes:**
*  In target RM segment, the integration with the Enterprise Performance Life Cycle (EPLC) process will allow and require IT System owners to map the IT system being developed to a Job Function related to the information created by this system.

## Timeline for the coming months

**RM Interim Transition Plan**

**RM Transition Plan**

- Apr.

- May

- June

- July

- Aug.

- Sept.

- Oct.

- Nov.

- Dec.

- Jan.

- Feb.

- Mar.

- RM Training Sessions

- RM council address 2008 RM assessment findings

- Completion of file plan validation by Records Offices

- RM Month

- IPT Meeting
- 01/27/09

- IPT Meeting
- 04/07/09

- IPT Meeting
- 07/14/09

- IPT Meeting
- 10/20/09

- Compliance deadline
- E-Gov Act 2002
- Form F115

- End-year
- Assessment

- SES Performance Plan RM element