What should you ask a collection agency about your data at contract end?

Contract end is the wrong time to negotiate any of this. By then the agency holds your files, your consumers' histories and years of call recordings, and you have little left to bargain with.

Why an agency can't delete everything on day one

A collection agency has to keep some of your data after the contract ends. Regulation F requires a debt collector to keep records that are evidence of compliance "until three years after the debt collector's last collection activity on the debt" (12 CFR 1006.100(a)). Recorded calls have their own clock: 3 years after the date of each call (12 CFR 1006.100(b)).

So a clause that says "destroy all data on termination" can't be met in full. A better clause names what's kept for compliance, how it's protected while it's kept, and when it's destroyed.

Other rules shape the same clause:

• For healthcare clients, a HIPAA business associate contract must require the vendor, at termination and "if feasible," to "return or destroy all protected health information" and "retain no copies." Where that isn't feasible, the contract's protections extend to what's kept, and its use is limited to the reasons it couldn't be returned or destroyed (45 CFR 164.504(e)(2)(ii)(J)).
• Businesses covered by the FTC's Safeguards Rule need procedures to dispose of customer information "no later than two years after the last date the information is used" to serve the customer, unless it's needed for business operations or other legitimate business purposes, or the law requires keeping it (16 CFR 314.4(c)(6)(i)). The same rule has them require safeguards from their service providers by contract (16 CFR 314.4(f)(2)).
• When a bank or other financial institution shares data with an agency under a Regulation P exception, the agency may use and disclose it only "in the ordinary course of business to carry out the activity covered by the exception under which it received the information" (12 CFR 1016.11(c)(3)). That limit doesn't lapse when the contract does.

The 7 questions, and what a good answer looks like

How TSI handles client data at contract end

TSI treats client data as the client's. It acts as a processor and uses the data only to deliver the contracted services.

Each client's data sits under its own client code on TSI's collection platform. That's what lets retention and purge rules be set client by client.

At off-boarding, TSI returns data in the format the client originally supplied, or as flat batch files, with collection history in a matching format. An exit plan covers knowledge transfer, documentation, a phased transfer of work and a check that data-handling requirements were met.

Retention follows the contract and the law. Payment transaction records are kept for 3 years, with the latest 6 months in the active database and older records in an archive TSI's Help Desk can retrieve. Once the retention period ends and accounts have been returned, TSI purges the client's information from its systems.

When a client sets its own purge requirements, TSI builds them in wherever that's technically and legally possible. The legal limit is usually the Regulation F retention period above.

Destruction runs on 2 tracks:

• Paper is shredded daily in cross-cut shredders, and a shredding vendor collects it for final destruction.
• Computers, drives and other storage media are sanitized or destroyed by an IT asset disposal vendor using NIST SP 800-88 methods: degaussing, secure erasure or physical destruction.

Both vendors issue certificates of destruction, which clients can see. Destruction activity is logged and tracked in TSI's compliance management system.

What to write into the contract

• A retention schedule by record type, with the legal basis for each
• Return deliverables: format, fields, delivery date and a reconciliation to your inventory
• The destruction method and standard, with timing that includes backups
• Flow-down of the same terms to every subcontractor, with proof from each
• What a certificate of destruction must contain
• Use limits and safeguards for anything kept, until it's destroyed
• Your right to audit all of the above

The data you place also shapes what's collected and kept along the way. How an account moves from placement to close shows every record a placement creates, and how collection calls are monitored covers recordings. Healthcare buyers will find business associate questions in the early-out and bad-debt RFP kit.

Next step: the trust center

TSI's trust center carries certification scope and audit dates, data locations, disaster recovery, breach notice, offshore work and subcontracting, with a security pack available under NDA. All 7 questions above are also in the collection services RFP kit and its scoring template.