Electronic Signatures & File What One Needs to Know

Electronic Signatures & File –

What One Needs to Know

Zachary Gifford, Associate Director Systemwide Risk Manager

&

Daniel Howell, Program Director – CSURMA Alliant Insurance Services

Session Overview

• California Law

• Elements of Enforceable “On-Line” Transactions

• Electronic Signatures – Requirements to Insure Validity • ICSUAM 8100

• Multiple Languages (Waivers / Informed Consent)? • Minors

• Document Retention

California Law

California law gives an electronic signature the same legal

significance as an original signature.

The statutes authorizing and explaining the use of electronic signatures in California can be found in the California Civil Code from Sections

1633.1 to Section 1633.17. Collectively, these sections are referred to as the Uniform Electronic Transactions Act, or UETA. The UETA was enacted in 1999 and applies only to electronic signatures created and used as of January 1, 2000.

California Government Code 16.5 addresses using an electronic signature in written communications with a public entity.

Elements of Enforceable On-Line

Transactions

In short, the basic elements that render electronically signed agreements valid/enforceable, mirror the elements

that are required in “wet” contracts and agreements;

• Offer • Acceptance • Consideration • Competence/Capacity • Mutual Consent • Legality

CA Code of Regulations

Title 2 – Division 7 – Chapter 10; Digital Signatures

• http://www.sos.ca.gov/digsig/digital-signature-regulations.htm

• 22000 Definitions.

• 22001 Digital Signatures Must be Created by an Acceptable Technology. • 22002 Criteria for Determining if a Digital Signature Technology is

Acceptable.

• 22003 List of Acceptable Technologies.

• 22004 Provisions for Adding New Technologies to the List of Acceptable Technologies.

• 22005 Issues to be Addressed by Public Entities When Using Digital Signatures.

What About On-line?

• Notice – disclosure of terms of the agreement • Acknowledgment and receipt of agreement • Identification and authorization

• Consent (the signor needs to know that by clicking they are signing)

• Security (pin/passcode required?) • Ready access and retrieval

Insuring the Validity of Electronic

Signatures (and Acknowledgements)

• Electronic signatures and acknowledgements can only be used if the signature and/or acknowledgement can be authenticated and a copy of the authentication and process can be produced upon request. • The electronic signature or acknowledgement must be stronger than

simply clicking “I Agree”.

• CA Government Code section 16.5 and CA Code of Regulations (Title 2, Division 7, Chapter 10, Sections 22000-22006) set out the requirements for creating a valid electronic signature.

ICSUAM 8100

• 100 Electronic Signatures

• 200 Digital Signatures

• 300 Electronic and Digital Signature

Implementation

100 Electronic Signatures

An electronic signature is an electronic sound (e.g., audio files of a person's voice), symbol (e.g., a graphic

representation of a person in JPEG file), or process (e.g., a procedure that conveys assent), attached to or logically

associated with a record, and executed or adopted by a person with the intent to sign the record.

200 Digital Signatures

• A digital signature is a specific type of electronic

signature that uses cryptographic transformation of data to provide authenticity, message integrity, and

non-repudiation.

• For a digital signature to be valid, it must be created by a technology accepted for use by the State of California and conform to technologies capable of creating digital signatures as set forth in California Government Code Section 16.5

California Government Code Section 16.5

(1) It is unique to the person using it;

(2) It is capable of verification;

(3) It is under the sole control of the person using it;

(4) It is linked to data in such a manner that if the data are changed, the digital signature is invalidated;

(5) It conforms to Title 2, Division 7, Chapter 10, of the California Code of Regulations.

300 Electronic and Digital Signature

Implementation

• Campuses must develop procedures to identify, evaluate, and document where electronic signatures are permitted and digital signatures are required.

• Campus and Chancellor’s Office standards and procedures for electronic signatures must meet CSU electronic and digital

signature standards and may be used for transactions between the CSU and outside parties only when approved by the

campus Vice President for Administration/CFO and when both parties have agreed to conduct transactions by digital means.

400 Acceptable Use

• Simple Electronic Signatures may convey intent of an individual to sign a record and are often easier to

implement. Simple Electronic Signatures may be acceptable and authorized for internal campus or Chancellor’s Office uses involving low risk.

• Digital Signatures may be used where Simple Electronic Signatures are acceptable and authorized for use.

Digital Signatures must be used instead of a Simple Electronic Signature when legally required or when greater risk exists.

ICSUAM –AOA’s Take-away

Parroting CSU’s practices and policies while also

adhering to applicable codes is a good practice.

Multiple Languages (Waivers / Informed

Consent)?

When requiring a waiver/informed consent – can it

be in multiple languages? Ja or Nein?

There is no legal requirement to provide releases in languages other than English. In general, California

courts have held that English-language releases signed by adults who cannot read English are valid.

Minors

What if the participant is a minor?

A parent or guardian must sign the form if the participant is a minor. Because the participant’s parent or guardian signs the release, there is no need to also have the participant sign the release.

May the release for a minor be consented to electronically?

Nothing says “riveting subject matter”

more than “Document Retention”…

• Retention must be consistent with your organization’s retention policy, regardless of electronic or otherwise.

• Releases must be stored for at least three years after an activity ends. Documents signed by a parent or guardian on behalf of a minor must be retained for at least three

years after an activity ends or until the minor turns twenty, whichever is longer.

IT Considerations

• Terminology

–

• User Access – kiosk? Download? E-mail?

• Does IT understand ID/Authentication needs. • Does IT understand how to establish “consent”? • Document retention needs.