Cyber Risk: West Virginia OIC Plans to Dispose of Older Workers’ Comp Files

August 22, 2024

The West Virginia insurance commissioner’s office has adopted a new policy: It will soon begin destroying workers’ compensation claim files that are 10 years old or older.

“Given increasing cybersecurity concerns and the type of information contained in the closed claim files, the OIC has deemed the risk of continued electronic storage of closed claim files beyond the agency’s approved retention and disposal schedule to outweigh the benefit of continued retention,” Commissioner Allen McVey said in a bulletin this month.

State regulations require that most “essential” state records be kept in perpetuity. But the office’s adopted retention schedule, approved by the State Records Administration, allows its workers’ comp files to be disposed of after a decade, the bulletin notes. Workers’ compensation records contain personal identification and health information about claimants, are exempt from open-records laws, and are considered to be non-essential, the office explained.

“Most of these claims have been closed for several years and continued storage of these claim files has become increasingly complex,” the OIC said.

The bulletin acknowledged that in the past, the office has not been consistent about destroying older computerized claim records. But with the growing threat of cyberattacks, the office is now undertaking more thorough housekeeping. The notice was posted to alert claimants, private insurers, self-insured employers and other stakeholders.

The OIC inherited volumes of electronic records in 2005, when West Virginia’s state-run monopoly workers’ compensation system was switched over to market-based insurers and the previous Workers’ Compensation Commission was abolished as a state agency, the office explained.

The office does not plan to dispose of final orders entered by the former WCC, OIC, Board of Review, or the former Office of Judges, as those have separate retention requirements under the retention schedule. “Likewise, briefs or other filings made to the Board of Review have separate retention requirements under the RDS,” the bulletin said.

Topics Cyber Workers' Compensation Virginia West Virginia

Was this article valuable?

Here are more articles you may enjoy.