In Reply to Parent Post by alexberm
I suppose I need to consider both process and physical requirements
Yes, with special consideration to any medical device specific requirements.
Essentially ISO 9001 requires you to identify appropriate records and ensure they are appropriately stored / maintained. From ISO9001:2000:
4.2.4 Control of Records
Records shall be established and maintained to provide evidence of conformity to requirements and of the effective operation of the quality management system. Records shall remain legible, readily identifiable and retrievable. A documented procedure shall be established to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of records.
The key here is you need a documented procedure. The other requirements should be 'obvious'. Don't store paper records in a damp or wet basement room, for example. Store them in a way where if you need a record you can find it, which may involve just labeling boxes as to their contents.
Pay special attention to "...retention time and disposition..." You have to have a mechanism to trigger disposition at the end of retention time. However, you can circumvent that by having your procedure give you latitude, such as disposal (shredding or what ever) within 10 years of the end of retention time. BUT - Be careful of something like this because some companies and some industries REQUIRE records to be destroyed after a certain period of time (usually to limit liability problems).
Make your procedure simple, and don't paint yourself into a corner with overly proscriptive details.