​Author: Nancy Germond 

How long to keep policy information continues to challenge today's insurance agencies and brokerages.

According to Ralph Korn, a risk management consultant in Kentucky, “In today's digital age, scan the policy and keep it in a file, in your cloud storage, or on a disc." Data storage is cheap.

Korn provides a real-life example.

A large southern California newspaper that had been in business for about a hundred years used to discard old printing ink. Printing ink, of the kind they used, turned out to be a carcinogen. Back in the olden days (the 1960's), printers barreled the used ink and sent it to a landfill.

Someone decided to investigate what was in this old landfill, and lo and behold, here were all the old drums of ink, marked with the name of the newspaper. Authorities traced nothing else in the landfill to other depositors, so the Environmental Protection Agency (EPA) sent a bill for cleanup expenses to the newspaper. The paper submitted a claim to their current commercial general liability (CGL) insurer. The CGL carrier promptly denied the claim based on the pollution exclusion. That's where Korn came in.

Korn located the CGL policies from the 1960 period and discovered that the GL policy contained no such exclusion. The carrier wrote the GL policy on an occurrence form. “To their dismay," Korn said, “the old CGL carrier had to pony up the cleanup costs, which almost exceeded the policy limits."

What's the Moral of the Story?

The moral of this story, according to Korn, “Don't discard old casualty policies." With today's storage capacity, some insurance experts recommend maintaining those CGL and liability policies “in perpetuity."

For property policies, keep old policies while there are any outstanding claims open on those, and of course, follow your state statutory guidelines. Copy these to a computer file or a disc, but if the carriers have resolved all claims occurring during the policy period, it is not as critical to retain those policies.

Then, there's the suggestion by the Nonprofit Risk Management Center to retain all but claims-made policies “permanently."

So, the perfect records retention policy is another risk management conundrum best answered by “It depends."

The Difficulty of Record Retention

In this day of cloud storage, why would agents not want to keep liability policies in perpetuity? One of the downsides to storage is the possibility of a cyber hack, which can then expose your agency to liability. Policy data contains a lot of personal information, and this can be a problem.

As one claims expert reminds, “Hold on to as little of the information as necessary to submit a claim down the road. The cyber liability of holding personal data is real."

What is Personally Identifiable Information (PII)?

PII is data identifying a natural person, such as an identification number (think group health), location data, online identifier (even an IP address) or other specific factors. We normally consider PII a Social Security number, driver's license number, bank or other financial accounts, email addresses, login records, passwords, certain addresses, phone numbers, and birth date, but it can broader than these data. PII is a ripe target for hackers, so beware of store housing PII past its normal use.

The Big “I" offers a records retention policy guideline at this link, but it applies only to the Big “I's" retention policy. To add to the uncertainty regarding record retention, the National Association of Insurance Commissioners has a model act for record retention, although it is somewhat dated.

After reviewing your state's requirement for retention, your agency management team should clarify what works for your organization. If you determine you're going to keep records “in perpetuity," ensure that you protect your data from potential cyber hacks. Develop a procedure for an annual “purge" when appropriate and ensure at that time your policy is still consistent with your state's regulations and with current best practices.

The Big “I" website houses several articles on record retention, including the Big “I's" agency documentation retention policy. 

Last Updated: January 6, 2023