Use of Electronic Signatures & Records : B-095

Policy/Guideline

1. References
   1. T.C.A. § 47-10-101, et.seq. – Tennessee Uniform Electronic Transactions Act
   2. T.C.A. § 10-7-101, et.seq. – Tennessee Public Records Act
   3. TBR Guideline G-070 – Disposal of Records-RDA 2161
   4. TBR Policy 1:08:00:00 – Information Technology Resources
2. Scope
   1. This guideline applies to the TBR Central Office and all TBR Institutions, and applies to all forms of electronic signatures and electronic records used to conduct the official business of the TBR and its institutions.
   2. Such business shall include, but not be limited to electronic communications, transactions, procurements, contracts, grant applications and other official purposes.
3. Use of Electronic Signature
   1. Mutual agreement by the parties
      1. This guideline applies only to transactions between parties each of which has agreed to conduct transactions by electronic means.
      2. Whether the parties agreed to conduct a transaction by electronic means is determined from the context and surrounding circumstances, including the parties’ conduct.
   2. Signature required by TBR or Institutional policy
      1. When a TBR or Institutional policy requires that a record have the signature of an authorized person, that requirement is met when the electronic record has associated with it an electronic signature using an approved electronic signature method.
      2. When a TBR or Institutional policy requires a written signature on a document, that requirement is met when an electronic document has associated with it an electronic signature using an approved electronic signature method.
   3. Signature required by law
      1. When there is a legal requirement, in addition to TBR or Institutional guideline, that a record have the signature of an authorized person, that signature requirement is met when the electronic record has associated with it an electronic signature using an approved electronic signature method which complies with applicable TBR/institutional policy, Tennessee law, and federal law.
      2. When a legal requirement, in addition to TBR or Institutional policy, requires a written signature on a document, that requirement is met when an electronic document has associated with it an electronic signature using an approved electronic signature method, which complies with applicable TBR/institutional policy, Tennessee law, and federal law.
   4. The signing of a record using an approved electronic signature method does not mean that the record has been signed by a person authorized to sign or approve that record. Appropriate procedures must be used to confirm that the person signing the record has the appropriate authority and intent to sign the record.
   5. If parties have agreed to conduct a transaction by electronic means and a law requires a person to provide, send, or deliver a signed document to another person, the requirement is satisfied if the information is provided, sent, or delivered, as the case may be, in an electronic record capable of retention by the recipient at the time of receipt.
      1. An electronic record is not capable of retention by the recipient if the sender or its information processing system inhibits the ability of the recipient to permanently retain the electronic record containing the signature.
4. Approval of Electronic Signature Methods by the Approval Authority
   1. The final approval of any electronic signature method will be by the approval authority.
      1. In determining whether to approve an electronic signature method, consideration will be given to the systems and procedures associated with using that electronic signature, and whether the use of the electronic signature is at least as reliable as the existing method being used.
      2. This determination will be made after a review of the electronic signature method by the appropriate authorities.
   2. If approved electronic signature methods require the use of encryption technology that uses public or private key infrastructure and/or certificates, the Information Technology Department at the Institution will be responsible for the administration of such public or private keys and certificates, and information will be provided to TBR’s Information Technology Department.
   3. An approved electronic signature method may limit the use of that method to particular electronic records, particular classes of electronic records, or particular TBR or institutional departments.
      1. An electronic signature used outside of its defined parameters will not be considered valid by TBR or the Institution.
   4. In the event that it is determined that a previously approved electronic signature method is no longer trustworthy, the approval authority must revoke the approval of that electronic signature method.
      1. If there is an on-going need for electronic signatures, which were made by the revoked method, the approval authority will take steps to see that appropriate electronic signatures are obtained by an approved electronic signature method.
   5. An inventory of all approved electronic signature methods shall be maintained by the TBR Office of Information Technology.
5. Rules and Procedures
   1. With respect to the use of electronic signatures or electronic transactions, the following requirements pertain to approved electronic signature methods:
      1. Specific transactions that may be conducted by electronic means must be identified;
      2. Specific transactions that may not be conducted by electronic means must be identified;
      3. The manner and format in which electronic records must be created, generated, sent, communicated, received, and stored, and the systems established for those purposes must be specified;
      4. The method must:
         1. Comply with any law or regulation that requires electronic records which must be signed by electronic means;
         2. Specify the type of electronic signature required, the manner and format in which the electronic signature must be affixed to the electronic record, and the identity of, or criteria that must be met, by any third party used by a person filing a document to facilitate the process;
      5. Control processes and procedures must be developed to ensure adequate preservation, disposition, integrity, security, confidentiality, and auditability of electronic records;
      6. Control processes and procedures must be developed for any other required attributes for electronic records that are specified for corresponding non-electronic records or that are reasonably necessary under the circumstances;
      7. An inventory of all approved electronic signature methods must be maintained; and
      8. Approval of an electronic signature method must be obtained as follows:
         1. An analysis of the nature of a transaction or process to determine the level of protection needed and the level of risk that can be tolerated. The analysis shall include:
            1. The full range of technological options and follow commercial trends where appropriate
            2. Identifying and documenting any potential costs, quantifiable and unquantifiable, direct and indirect, in performing a cost/benefit analysis;
            3.  Developing a comprehensive plan for converting a traditional process to an electronic one; and
            4. Identifying all information relevant to the process.
         2. Comply with G-070 for the records produced by electronic processes, including long-term retention where necessary. Consider retaining an electronic document in paper-based form for important or sensitive contexts;
         3. Request legal review to verify that the electronic signature method complies with applicable laws governing the creation and use of electronic signatures;
         4. Outline the steps of the electronic signature method so that you can demonstrate the reliability of your process;
         5. Submit to the approval authority;
         6. Implement upon approval; and
         7. Provide implemented method to the TBR System Office.
6. Sample Procedures
   1. Procedure to Authorize and Implement Electronic Signature Methods (Exhibit 1)
   2. Procedure for Email Transactions - Personal/Professional Service Contracts (Exhibit 2)
   3. Procedure for SciQuest Transactions (Exhibit 3)
   4. Procedure for Web Time Entry Transactions (Exhibit 4) 
7. Sanctions
   1. Any individual or party that makes inappropriate or illegal use of electronic signatures, transactions and/or records is subject to sanctions up to and including dismissal, suspension, and criminal prosecution as specified in published TBR and institutional policies, Tennessee and federal laws.