For Maryland schools, managing student records doesn’t end when a school year is over. Student information may need to be retained for years—or in some cases, permanently—depending on the type of record.
That creates an important records management question: When is a student record actually ready to be destroyed, and what needs to happen when it is?
Schools, school districts, colleges, and universities manage a wide range of sensitive information, including student records, attendance data, assessment results, health information, special education records, disciplinary records, employee files, and administrative documents. Much of that information contains personally identifiable or otherwise confidential information that requires careful handling throughout its lifecycle.
Request a Free Quote
Need secure document shredding, hard drive destruction, records management, or IT asset disposal services?
Or, complete our short form and we'll respond within 24 hours.
Maryland’s student records requirements recognize that not all records can be treated the same way. Some information must be retained permanently, while other records may be kept until a student reaches a certain age, for a specified number of years, or until another event occurs.
Secure data destruction is the final step in that lifecycle. Once a record has met its applicable retention requirements and is approved for disposition, schools need to make sure the information is destroyed in a way that protects it from unauthorized access or reconstruction.
That applies to more than paper files. Student information may also reside on computers, hard drives, USB drives, backup media, and other electronic devices. Simply deleting a file or reformatting a device does not necessarily mean the underlying information has been securely destroyed.
For Maryland schools, understanding what to keep, when it can be destroyed, and how to securely destroy it is an important part of responsible records management.
Maryland Schools Have More Sensitive Data Than You Might Think
Think about everything a school handles during a single academic year. Student records. Grades and attendance information. Health and medical information. Special education records. Testing and assessment results. Discipline records. Parent and guardian information. Employee files. Financial information. Administrative documents.
The Maryland Student Records System Manual establishes statewide minimum standards for a wide range of student records maintained by Maryland public schools. Those records include personal data, attendance data, academic performance, graduation requirements, assessment results, health screenings and evaluations, immunization records, and Maryland Student Exit Records.
Maryland regulations also define student records broadly as records that are directly related to a student and maintained by an educational agency or institution. Much of this information contains personally identifiable or otherwise sensitive information that shouldn’t simply be placed in a trash or recycling bin when it is no longer needed.
Before You Destroy Anything, Know the Retention Requirement
One of the biggest mistakes an organization can make with records management is assuming that something can be destroyed simply because it is old, outdated, or no longer useful to the person who created it.
Maryland’s rules make clear that student records are subject to specific retention and disposition requirements. Under COMAR 13A.08.02.06, the Maryland Student Records System Manual establishes the standards for retention and disposition of student records. Records that aren’t otherwise specifically regulated may be destroyed when they no longer serve a legitimate educational purpose—but there are important exceptions.
For example, a school system cannot destroy a student record when there is an outstanding request to inspect and review it. Records under dispute also must be retained until the dispute is resolved.
In other words, “old” doesn’t automatically mean “ready to destroy.”
The Maryland Student Records System Manual also shows just how different retention periods can be from one record type to another. For example, the current manual lists:
-
- Student Personal Data: Permanent
- Student School Attendance Data: Permanent
- Annual Early Childhood School Performance: Until the student reaches age 21
- Annual Middle School Performance: Until the student reaches age 21
- Maryland High School Assessment Results: Until the student reaches age 21
- Maryland State Assessment Results: Until the student reaches age 21
- Health Screenings, Examinations, and Evaluations: Until the student reaches age 21
- Immunization Records: Five years or age 21, whichever is later
- Maryland Student Exit Record: Three years
- Discipline Records: Graduation or completion of high school program, or age 21
- IEP/IFSP records and certain other records for students with disabilities: Six years
That’s a pretty wide range—from three years to permanent retention. But, the takeaway is simple: Maryland schools shouldn’t treat every old record the same way.
Before destroying a record, schools should identify the applicable record series, confirm that the required retention period has expired, and follow the appropriate records retention and disposition schedule.
A New School Year Is a Good Time to Review Records
The start of a new school year isn’t just a time to prepare classrooms, technology, and staff for what’s ahead. It’s also a natural checkpoint for reviewing records from the previous academic year.
For many schools, the transition between school years provides an opportunity to review what records are being maintained, identify records that may have reached the end of their retention period, and make sure eligible records are properly prepared for disposition. But that doesn’t mean every record from last year should be destroyed.
Some Maryland student records are permanent. Others must be retained until a student reaches a certain age or completes a particular stage of education. And records subject to a pending request or dispute may need to be retained even if they otherwise appear eligible for destruction.
The end of the school year is a good time to review records—not a reason to automatically destroy them.
Maryland’s Retention Requirements Apply to Electronic Records, Too
Another important detail in Maryland’s Student Records System Manual is that retention requirements apply regardless of whether a record is maintained on paper or electronically.
That matters because today’s school records can exist in many different forms. A file cabinet may contain paper student records. A teacher’s computer may contain years of electronic documents. A retired laptop may still contain locally stored information. A hard drive may contain data that was supposedly deleted years ago. USB drives, backup media, and other electronic devices can also contain sensitive information.
The format may change, but the record doesn’t necessarily become less important simply because it is digital. Maryland guidance specifically addresses the need for electronic records to remain readable and accessible throughout their lifecycle. The Maryland State Archives also notes that electronic documentation is a record just as paper documentation is, and that the content and function of a record—not simply its format—help determine how it should be managed.
So when a school replaces a computer, retires a hard drive, or cleans out an old storage area, the question shouldn’t simply be:
“Did we delete the files?”
It should be:
“Can the information still be recovered?”
Maryland Requires an Approved Process for Destroying Public Records
For Maryland public agencies, records destruction isn’t simply a matter of deciding that a file is no longer useful. The Maryland State Archives states that before a public record can be destroyed, the agency must have an approved Records Retention and Disposition Schedule authorizing the destruction.
When records are destroyed according to an approved schedule, the agency must also submit a Certificate of Records Disposition, also called a disposal certificate, to the Maryland State Archives.
The certificate documents important details about the destruction, including what records were destroyed, the dates and volume involved, how and when the records were destroyed, and the retention schedule that authorized the destruction. Only records officers or their appointed designees can submit disposal certificates.
This creates an important distinction: A record reaching the end of its retention period is one step in the process. Properly documenting its destruction is another.
Schools and school systems should follow their applicable records-management procedures and make sure required documentation is completed as part of the disposition process.
What About Confidential Student Records?
Student records are confidential by nature, and Maryland regulations require schools to protect the confidentiality of student information. COMAR 13A.08.02.04 states that individual student records maintained by school personnel are confidential and that, with certain exceptions, records should be destroyed when they no longer serve legitimate and recognized educational purposes.
That means schools need to think about how records are destroyed, not simply whether they have reached the end of their retention period.
For paper records containing sensitive student information, secure document destruction provides a way to prevent those records from being reconstructed or accessed after they leave the school.
For electronic information, simply deleting a file isn’t necessarily enough. Schools should use an appropriate method for securely destroying the information or the media on which it is stored.
Secure Destruction Should Account for the Entire Chain of Custody
Once records are approved for destruction, schools also need to consider what happens between the time records leave their storage location and the time they are actually destroyed. That can include:
-
- Secure collection
- Locked or secure destruction containers
- Controlled transportation
- Documented chain of custody
- Secure document shredding
- Hard drive or electronic media destruction
- Documentation of final destruction
The goal is to prevent sensitive information from becoming exposed during the destruction process. For Maryland public records, the Maryland State Archives emphasizes that records must be safeguarded throughout their lifecycle and that non-permanent records should be disposed of in a prompt, orderly, and documented manner once retention requirements have been met.
Secure Destruction Is the Final Step
Secure destruction is the final step in the information lifecycle. For Maryland schools, that means first determining what records can be destroyed and when, following the applicable retention schedule and disposition requirements, and then using an appropriate method to permanently destroy information once it is eligible for destruction. For paper records containing sensitive student or personal information, that may mean secure document shredding.
For electronic records and retired equipment, it may require appropriate hard drive destruction or physical destruction of storage media.
For schools and school systems that use an outside destruction provider, the process should provide accountability from the moment records leave the school until their final destruction. Secure containers, controlled transportation, documented chain of custody, and Certificates of Destruction can help schools maintain that accountability.
Rover provides secure data destruction for schools, school districts, colleges, and universities, helping educational institutions securely destroy sensitive paper records and electronic media with secure collection, documented chain of custody, and Certificates of Destruction.
When a record is ready to be destroyed, the last step matters.
Looking for Virginia school records requirements?
Maryland isn’t the only state with specific requirements for managing and disposing of student records. If you’re a Virginia school or school division, see our guide to Virginia school records retention and secure data destruction.
FAQs
How long do Maryland schools have to keep student records?
There is no single retention period for every student record. Maryland's Student Records System Manual establishes different retention requirements depending on the type of record. Some records, including certain student personal data and attendance data, are retained permanently. Other records may be retained until a student reaches age 21, for a specific number of years, or until another specified event occurs.
Before destroying a student record, schools should identify the applicable record type and confirm that its required retention period has expired.
Can Maryland schools destroy student records after the retention period expires?
Not necessarily. Reaching the end of a retention period is an important step, but schools must also follow the applicable records retention and disposition requirements. Maryland regulations provide additional protections for records that are subject to an outstanding request to inspect and review or are involved in a dispute.
Schools should confirm that a record is eligible for destruction and follow the appropriate disposition process before destroying it.
Do Maryland retention requirements apply to electronic records?
Yes. Maryland's student records requirements apply regardless of whether a record is maintained on paper or electronically. Schools need to manage electronic records according to the same applicable retention requirements as other student records.
This is especially important when schools replace computers, retire hard drives, or dispose of other electronic media that may contain sensitive student information.
Can schools simply delete electronic student records?
Deleting a file does not necessarily mean that the underlying information has been securely destroyed. Depending on the device and the method used to delete the information, data may remain recoverable.
When electronic records or storage media are eligible for destruction, schools should use an appropriate method of secure data destruction rather than relying solely on deleting files or reformatting a device.
What should schools do with old student files?
Schools should first determine what type of record they have, identify the applicable retention requirement, and confirm that the record is eligible for destruction. Records that have not reached the end of their retention period should continue to be maintained appropriately.
Once records are eligible for destruction, sensitive paper records should be securely destroyed rather than placed in ordinary trash or recycling. Electronic records and storage media should also be destroyed using an appropriate secure method.
Do Maryland schools need documentation when records are destroyed?
Maryland public agencies are required to follow an approved Records Retention and Disposition Schedule when destroying public records. The Maryland State Archives also requires documentation of records disposition through a disposal certificate.
Schools should follow their applicable records-management procedures and maintain documentation showing that records were destroyed according to the appropriate retention and disposition requirements. A professional destruction provider can also provide documentation of the physical destruction of records, such as a Certificate of Destruction.
