The Basics

Core 13(d) requires that the organization implement a system for the "storage, maintenance, and destruction" of information.  This is not a pure IT-department standard, as it includes not only electronic information but also paper-stored information.  

IT employees need to know the company's policies for all information, in case the reviewer should ask, even though this is not only an IT issue.  

Management Tips

Consider developing a comprehensive P&P dealing just with the issue of storage, maintenance, and destruction of information, making sure that it is inclusive of all information.  Such a P&P therefore would address not only such things as hard drives, disk drives, and back-up media, but paper shredding, policies about documentation retention, and the like.  

URAC Accreditation Tips

This is a primary element of a mandatory standard, and is a bit tricky if you are not paying attention. The most straightforward aspect of the subsection is expressed in this paragraph of the “Points to Remember”:

A plan for storage, maintenance, and destruction would include where information would be stored, how it could be retrieved, who is responsible for stored information, who could have access or approves access, how long information would be maintained before it is destroyed (if it is ever to be destroyed), and how it would be destroyed.

The trickier, and more frequently missed understanding of the standard is in the very next paragraph of the program guide:

Note storage, maintenance and destruction of information applies to both electronic and paper documentation.

I guess that this is overlooked most frequently because compliance with Core 13 is usually turned over to the IT folks, who typically don’t pay an awful lot of attention to paper. URAC is very clear, though, not only in the Program Guide, but also in interpretation by its reviewers, that your policies and procedures must specifically address storage, maintenance, and destruction of print data, as well as electronic data.