Scanned documents: the intake pile that never gets cleaned

Picture a small office with one shared multifunction scanner in the hallway. Every day someone feeds it a driver's license, a signed form, a stack of statements. The scanner sends each result to a shared folder called "Scans," or emails it to whoever pressed the button. Months later, that folder has thousands of files named "Scan_0412" and no one can say which are still needed. The scan pile is a retention problem, a privacy problem, and a findability problem all at once.

How the pile grows

Scanners almost always deliver in one of two ways, and each leaves its own residue.

• Scan-to-folder. The device writes files to a network share or a folder on someone's computer. Everyone who can reach the share can open every scan, including the ID of a client who has nothing to do with their role. Files get auto-named by date and counter, so nobody knows what is inside without opening it.
• Scan-to-email. The scan arrives as an attachment in a mailbox. The attachment gets saved to a client folder (good), but the email and the copy in the Downloads folder stay behind (not good). If the scanner emails through a shared address, the whole team can see everything that passes through.
• Shared scanner storage. Some devices keep a copy of recent jobs or an address book on their own internal storage. Ask your IT provider or check the manufacturer's documentation about whether yours does and how to clear it, especially before the device is returned, sold, or recycled.

Name it, file it, then remove the scan

A scan is a working copy in transit, not a place to store a record. Give every scan a short life cycle:

1. Scan to a single intake folder that only the staff who do intake can open.
2. Rename right away using a consistent pattern, for example client surname, document type, and date: Rivera_DriversLicense_2026-10-12.pdf. If the name is not obvious from the file, it will be impossible to review later.
3. Move it to the permanent client record (the practice system or the client folder), where access is controlled and the retention schedule applies.
4. Delete the scan from the intake folder and clear any matching email attachment or Downloads copy.

Make this a habit. A simple rule, "the intake folder is empty by end of day Friday," works for many offices.

Where do the paper originals go?

It is tempting to shred the paper as soon as it is scanned, but check first. Some documents need to be returned to the client, and some must be kept in a particular form under a rule or contract. Whether the scan can stand in for the original varies by record type and regulator, so ask your attorney, your CPA, or the regulator before adopting a shred-after-scan practice. Then write the answer down in your retention schedule. For anything that is returned, hand it back the same day. For anything that is shredded, use a cross-cut shredder or a shredding service, and log when it happens.

Images, PDFs, and what a scan check can and cannot tell you

Most scans are saved either as PDFs or as pictures. Here is where an important limitation applies. A PDF made from a scanner is often an image of a page, with no underlying text. MyVaultMate reads text-based PDFs. MyVaultMate does not read image-only PDFs or image files such as JPEG or PNG. A photographed form saved as a JPEG or PNG is listed as “Not scanned” with a risk score of 70, and so is a scanned PDF that is only a picture of each page, so neither drops out of sight. iPhone photos saved as HEIC are treated the same way.

Treat that list as a to-do: open the scans, move or quarantine the ones that hold personal information, and mark the rest as ignored. A clean result is not proof that the scan folder is free of sensitive information. If your office does a lot of intake scanning, treat the scan folders as sensitive by default, regardless of what any tool reports. Review them by hand, restrict access, and apply the cleanup routine above. Do not rely on any scan report to say a scan folder is empty. Detection is also rule-based, so an unusual layout can be missed or something harmless can be flagged.

A setup checklist

• Create one intake folder with restricted access, and point the scanner at it.
• Turn off scan-to-email to shared or group addresses where possible.
• Adopt a naming pattern and post it next to the scanner.
• Name an owner for the intake folder and the weekly emptying.
• Decide, with advice from your attorney or CPA, what happens to the paper originals.
• Ask your IT provider whether the scanner stores jobs or addresses internally, and how to clear it.
• Add scan folders, Downloads, and email attachments to the quarterly cleanup in your retention schedule.

For a broader look at the schedule that decides what can go, see A practical retention schedule for a ten-person office.