Policy 3-006: Use of Electronic Signatures and Records

1. Use of an Electronic Signature
2. Approval of Electronic Signature Methods by the Vice President for Administrative Services
3. Rules and Procedures
4. Sanctions

1. Purpose.
   
   This policy establishes when an electronic signature may replace a written signature and when an electronic record may replace a paper document in official University activities.

2. Scope.
   
   This policy applies to all members of the University of Utah community, and governs all uses of electronic signatures and electronic records used to conduct the official business of the University of Utah. Such business shall include, but not be limited to electronic communications, transactions, contracts, grant applications and other official purposes.

Definitions

The following definitions apply for the limited purposes of this policy and any associated regulations.

1. An "electronic signature" is an electronic sound, symbol, or process, attached to or logically associated with an electronic record and executed or adopted by a person with the intent to sign a record.

2. An "electronic record" is a record created, generated, sent, communicated, received, or stored by electronic means.

3. A "record" is information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form. Financial and other documents or forms are records.

4. An "electronic transaction" is a transaction conducted or performed, in whole or in part, by electronic means or electronic records.

5. "Electronic" relates to technology having electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities.

6. An approved electronic signature method is one that has been approved by the Vice President for Administrative Services, in accordance with this policy and all applicable state and federal laws, and which specifies the form of the electronic signature, the systems and Procedures used with the electronic signature, and the significance of the use of the electronic signature.

7. A "certificate" is an electronic document used to identify an individual, server, a company, or some other entity and to associate that identity with a public key. A certificate provides generally recognized proof of a person's identity.

8. "Public-key" infrastructure (PKI) is a form of information encryption that uses certificates to prevent individuals from impersonating those who are authorized to electronically sign an electronic document. A "public key" is a value provided by some designated authority as a key that, combined with a "private key" derived from the public key, can be used to effectively encrypt messages and digital signatures.

9. A "private key" is an encryption/decryption key known only to the party or parties that exchange messages. In traditional private key cryptography, a key is shared by the communicators so that each can encrypt and decrypt messages.

Policy‌

1. Use of an Electronic Signature‌

   1. Signature required by University policy

      1. Where a University policy requires that a record have the signature of a responsible person, that requirement is met when the electronic record has associated with it an electronic signature using an approved electronic signature method.

      2. Where a University policy requires a written document, that requirement is met when an electronic record has associated with it an electronic signature using an approved electronic signature method.

   2. Signature required by law

      1. Where there is a legal requirement, beyond University policy, that a record have the signature of a responsible person, that signature requirement is met when the electronic record has associated with it an electronic signature using an approved electronic signature method which complies with Utah state law or Federal law.

      2. Where a legal requirement, beyond University policy, requires a written document, that requirement is met when an electronic record has associated with it an electronic signature using an approved electronic signature method, which complies with Utah state law or Federal law.

   3. The signing of a record using an approved electronic signature method does not mean that the record has been signed by a person authorized to sign or approve that record. Appropriate Procedures must be used to confirm that the person signing the record has the appropriate authority.

   4. This policy applies only to transactions between parties each of which has agreed to conduct transactions by electronic means.

   5. If parties have agreed to conduct a transaction by electronic means and a law requires a person to provide, send, or deliver information in writing to another person, the requirement is satisfied if the information is provided, sent, or delivered, as the case may be, in an electronic record capable of retention by the recipient at the time of receipt. An electronic record is not capable of retention by the recipient if the sender or its information processing system inhibits the ability of the recipient to print or store the electronic record.

2. Approval of Electronic Signature Methods by the Vice President for Administrative Services‌

   1. The final approval of any electronic signature method will be by the Vice President for Administrative Services, with the recommendation of the cognizant vice president. In determining whether to approve an electronic signature method, consideration will be given to the systems and Procedures associated with using that electronic signature, and whether the use of the electronic signature is at least as reliable as the existing method being used. This determination will be made after a review of the electronic signature method by the Office of Information Technology, the Institutional Security Office, and University Legal Council.

   2. If approved electronic signature methods require the use of encryption technology that uses public or private key infrastructure and/or certificates, the Office of Information Technology will be responsible for the administration of such public or private keys and certificates.

   3. The approval of an electronic signature method can limit the use of that method to particular electronic records, particular classes of electronic records, or particular University organizations. An electronic signature used outside of its limitations will not be considered valid by the University.

   4. All approval of electronic signature methods will be available in electronic form to the University community and the public and will be deemed to be appendices to this policy.

   5. In the event that it is determined that an approved electronic signature method is no longer trustworthy, the Vice President for Administrative Services must revoke the approval of that electronic signature method. If there is continued significance for the electronic signatures, which used the revoked method, the Vice President for Administrative Services will take steps to see that any valid records signed with the revoked electronic signature method are signed again with an approved electronic signature method.

3. Rules and Procedures‌

   1. The University of Utah may make rules that:

      1. Identify specific transactions that the University is willing to conduct by electronic means;

      2. Identify specific transactions that the University will never conduct by electronic means;

      3. Specify the manner and format in which electronic records must be created, generated, sent, communicated, received, and stored, and the systems established for those purposes;

      4. If law or rule requires that the electronic records must be signed by electronic means, specify the type of electronic signature required, the manner and format in which the electronic signature must be affixed to the electronic record, and the identity of, or criteria that must be met, by any third party used by a person filing a document to facilitate the process;

      5. Specify control processes and Procedures as appropriate to ensure adequate preservation, disposition, integrity, security, confidentiality, and auditability of electronic records; and

      6. Identify any other required attributes for electronic records that are specified for corresponding non-electronic records or that are reasonably necessary under the circumstances.

4. Sanctions‌

   1. Any individual or party that makes inappropriate or illegal use of electronic signatures and/or records is subject to sanctions up to and including dismissal, suspension, and criminal prosecution as specified in published University policies and State laws, whether or not they are referenced in this policy.

      ---

      Sections IV- VII are for user information and are not subject to the approval of the Academic Senate or the Board of Trustees. The Institutional Policy Committee, the Policy Owner, or the Policy Officer may update these sections at any time.

      ---

Policies/ Rules, Procedures, Guidelines, Forms and other Related Resources‌

1. Policies/ Rules. [reserved]

2. Procedures, Guidelines, and Forms. [reserved]

3. Other Related Resources. [reserved]

References‌

1. Utah Code Title 46, Chapter 4, Uniform Electronic Transactions Act

2. 18 U.S.C. Section 2510 Electronic Communication Privacy Act

3. Utah Code Section 76-6-703

4. Utah Code Section 76-10-1801

5. Utah Code Title 63G, Chapter 3, Government Records Access and Management Act

6. Policy 4-002: Information Resources Policy

7. Policy 1-009: University Archives

8. Policy 4-001: Institutional Data Management

Contacts‌

The designated contact officials for this regulation are

1. Policy Owner(s) (primary contact person for questions and advice): Controller

2. Policy Officer(s): Chief Financial Officer

   See Rule 1-001 for information about the roles and authority of policy owners and policy officers.

History‌

1. Current version. Revision 1

   1. Effective November 3, 2014.

      1. Editorial Revisions

         1. Editorially revised September 2, 2022 to move to current template.

         2. Reformatted, Renumbered, Owner and Officer updated 7/15/11

2. Previous versions.

   1. Revision 0: Effective May 20, 2002

3. Renumbering

   1. Renumbered from Policy and Procedures Manual 1-17.