Policy No. 4:12:00:00

CLEVELAND STATE COMMUNITY COLLEGE Cleveland, TN

Subject: Electronic Signature Policy

Purpose:

This policy establishes when an electronic signature may be used to replace a written signature and when an electronic record may be used to replace a paper document in official business of the College, and establishes procedures for using electronic signatures.

Policy:

  1. General
    Electronic signatures may replace written signatures and electronic records may replace paper documents in official business of Cleveland State Community College unless written signatures or paper documents are specifically required by law.  Such business shall include, but not be limited to, electronic communications, transactions, procurements, contracts, grant applications, and other official purposes.  Electronic signature methods must be in accordance with this policy, TBR policies, and applicable state and federal laws.
  2. Definitions
    1. Electronic Signature
      An electronic sound, symbol, or process, attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record. An electronic signature must be attributable (or traceable) to a person who has the intent to sign the record with the use of adequate security and authentication measures that are contained in the method of capturing the electronic transaction (e.g., use of personal identification number or personal log-in identification username and password), and the recipient of the transaction must be able to permanently retain an electronic record of the transaction at the time of receipt.
    2. Electronic Record
      Any record created, used, or stored in a medium other than paper, such as: information processing systems, computer equipment and programs, electronic data interchange, electronic mail, voice mail, text messages, information in PDAs and similar technologies. To the extent that facsimile, telex, and/or telecopying, and/or former hard copy documents are retained in electronic form, through a scanning process, they are also considered electronic records.
    3. Electronic Transaction
      A transaction conducted or performed, in whole or in part, by electronic means or electronic records.
    4. Authentication
      Verification of the identity of a person providing an electronic signature.
  3. Use of Electronic Signatures
    1. Mutual agreement by the parties
      1. This policy applies only to transactions between parties each of which has agreed to conduct transactions by electronic means.
      2. Whether the parties agreed to conduct a transaction by electronic meansis determined from the context and surrounding circumstances, including the parties’ conduct.
      3. An electronic signature may be accepted in situations if the requirement of a signature/approval is stated or implied.
    2. Signature required by TBR or College policy
      1. When a TBR or College policy requires that a record have the signature of an authorized person, that requirement is met when the electronic record has associated with it an electronic signature using an approved electronic signature method.
      2. When a TBR or College policy requires a written signature on a document, that requirement is met when an electronic document has associated with it an electronic signature using an approved electronic signature method.
    3. Signature required by law
      1. When there is a legal requirement, in addition to TBR or College guideline, that a record have the signature of an authorized person, that signature requirement is met when the electronic record has associated with it an electronic signature using an approved electronic signature method which complies with applicable TBR/College policy, Tennessee law, and federal law.
      2. When a legal requirement, in addition to TBR or College policy, requires a written signature on a document, that requirement is met when an electronic document has associated with it an electronic signature using an approved electronic signature method, which complies with applicable TBR/College policy, Tennessee law, and federal law.
    4. The signing of a record using an approved electronic signature method does not mean that the record has been signed by a person authorized to sign or approve that record. Appropriate procedures must be used to confirm that the person signing the record has the appropriate authority and intent to sign the record.
    5. If parties have agreed to conduct a transaction by electronic means and a law requires a person to provide, send, or deliver a signed document to another person, the requirement is satisfied if the information is provided, sent, or delivered, as the case may be, in an electronic record capable of retention by the recipient at the time of receipt.
      An electronic record is not capable of retention by the recipient if the sender or its information processing system inhibits the ability of the recipient to permanently retain the electronic record containing the signature.
  4. Approval of Electronic Signature Methods by the Approval Authority
    1. The final approval of any electronic signature method will be by the approval authority.
      1. In determining whether to approve an electronic signature method, consideration will be given to the systems and procedures associated with using that electronic signature, and whether the use of the electronic signature is at least as reliable as the existing method being used.
      2. This determination will be made after a review of the electronic signature       method by the appropriate authorities.
    2. An approved electronic signature method may limit the use of that method to particular electronic records, particular classes of electronic records, or particular TBR or College departments.
    3. In the event that it is determined that a previously approved electronic signature method is no longer trustworthy, the approval authority must revoke the approval of that electronic signature method.      If there is an on-going need for electronic signatures, which were made by the revoked method, the approval authority will take steps to see that appropriate electronic signatures are obtained by an approved electronic signature method.

Procedures:

  1. Request for Approval to Authorize and Implement the Use of Electronic Signature Methods
    1. Submit a written request for approval of a proposed process for application of electronic signatures.  The request shall include:
      1. Identification of the specific transaction to be conducted by electronic means.
      2. The form in which the process will take place.  Example transactions/methods include:
        1. Signature approval granted via authenticated (user id/password) to an application system such as Banner
          1. Purchasing using SciQuest
          2. Online registration and bill payment using a Banner account
          3. Admissions application
          4. Transcript request
        2. Signature approval granted via authenticated     (username/password) access to an electronic message
          1. Approval of contracts
          2. Approve waivers for exceptions to admissions policy iii. Status changes in HR
          3. New hires
          4. Terminations
          5. Leave requests, payment requests, travel vouchers, travel approval requests
        3. Faxed or scanned signatures verified by the receiving party. Such means of verification shall include:
          1. The receipt of a faxed signature from a facsimile number verified as belonging to or traceable to the party that signed and transmitted the document.
          2. The receipt of a scanned or emailed signature from an email address verified as belonging to the party that signed and transmitted the document.  Email access being based on unique credentials (username/password) will be accepted as the electronic record for the email and associated attachments from vendors.  The electronic signature will be the scanned document containing the authorized written signature from the vendor/contractor.
      3. Identification of the department(s)/positions(s) which will be authorized to use the proposed electronic process.
      4. Identification of the risks associated with using the proposed electronic process, including a clear description of the control processes and procedures that will ensure adequate preservation, dispensation, integrity, security, confidentiality, and auditability of the electronic records.
      5. A step-by-step procedure for implementation of the process.
  2. Approving Authorities
    Requests for approval of a proposed process for application of electronic signatures shall be approved by the following persons:
    1. The individual making the request
    2. The supervisor of the individual making the request
    3. The Vice President of the functional area
    4. The Director of Information Technology, if applicable
    5. The Vice President of the Finance and Advancement
    6. The President

Revision Responsibility:

Director of Information Technology

Responsible Executive Officer:

Vice President for Finance and Advancement

Source/Reference:

Tennessee Code Annotated § 47-10-101. et.seq. -Tennessee Uniform Electronic Transactions Act
Tennessee Code Annotated § 10-7-101. et.seq. Tennessee Public Records Act
TBR Policy 1:08:00:00 -Information Technology Resources
TBR Policy 4:02:10:00 -Purchasing Policy and Procedures
TBR Guideline B-095 -Use of Electronic Signatures and Records
TBR Guideline G-070 -Disposal of Records-RDA 2161