Electronic I-9s: Standards for Electronic Retention and Electronic Signatures

Many employers, seeking to reduce costs and improve efficiency, are moving increasingly toward the paperless office. Recognizing this trend, Congress passed a law in October 2004 permitting employers to use electronic signature technology on the Employment Eligibility Verification Form (I-9) and to retain I-9s in electronic format.

The law became effective in April 2005, but Immigrations and Customs Enforcement (ICE) did not provide any guidance on the rule until June 16, 2006, when ICE set out basic standards for electronic recordkeeping and electronic signatures in an interim rule published in the Federal Register. The new standards are based on existing IRS standards for electronic recordkeeping, so that employers who already have electronic recordkeeping systems in place that comply with IRS standards may expand those systems to include employment verification records. As long as the system is IRS compliant, it will satisfy ICE's standards as well.

The interim rule was effective immediately, and a final rule has not yet been issued. The interim rule's key requirements are as follows.

Electronic Retention Systems

Systems used to store electronic I-9s must control access, protect data, and provide quick access to records. Simply scanning the forms into PDF format will not be sufficient to satisfy the rule. Specifically, electronic retention systems must meet the following requirements:

• Eligibility Verification Procedure: The system must not alter the employment eligibility verification procedure. Specifically, the name of the I-9, its content, sequence of data elements, and instructions may not be changed, and no additional data elements or language may be added to it.
  
• Security controls: The system must include effective security controls that ensure only authorized personnel have access to the records. The system must also be able to prevent and detect unauthorized or accidental creation, alteration, or deletion of records. An audit trail must be produced on each record, showing who has accessed the system, when it was accessed, and what actions were performed. The rule also requires that the employees using the system undergo training to minimize the risk of unauthorized or accidental creation, alteration, or deletion.
  
• Quality assurance and system documentation: The system must include an inspection and quality insurance program that includes regular evaluations of the system. It must perform period checks of the electronically stored I-9s, along with the associated electronic signatures. It must also be protected by a backup and recovery program. The employer must maintain documentation on the system, including a complete description of the system and procedures for its use.
  
• Inspection Requirements: The system must facilitate inspection of the I-9s by federal agencies. It must permit searches of the database by any data element. For example, it must be able to retrieve records for all employees who identified themselves on the I-9 as U.S. citizens, or for all employees who used a particular document to establish employment eligibility. In addition, the electronic I-9 must be highly legible and readable in both electronic and hard copy format.

At the time of an audit, the employer must produce only the records requested by the agency in the format requested, along with the associated audit trails. In addition, the employer must, if requested, provide the agency with all documentation and hardware necessary for the agency to retrieve the information on its own. Therefore, the system must be accessible and must not be subject to any agreement that would limit or restrict access to and use of the system by any federal agency.

Electronic Signature

Systems used to capture electronic signatures must be able to verify the authenticity of the signature and must support the integrity of the attestations on the I-9. In addition, as noted above, electronic signatures must be covered by security and quality assurance requirements for electronic retention systems.

• Attestations and Signature Verification: Electronic signatures must be attached to or logically associated with an electronically completed I-9. The signature must be immediately affixed to the form, and a printed confirmation must be provided to the employee. The system must also create and preserve a record verifying the identity of the employee signer. It must include a method to acknowledge that the employee has read the attestation regarding the consequences for false statements or use of false documents, and that the employer representative has read the attestation regarding the review and evaluation of the employee's eligibility to work.
  
• Security: Employers must be able to demonstrate that the electronic signature system is properly maintained and protects electronic signatures from unauthorized tampering, and any unauthorized access must be detected. In addition, the quality insurance programs required for electronic retention systems must cover evaluation and periodic checks of electronic signatures.
  
• Technology: The rule itself does not specify acceptable technologies. The comments published with the interim rule list electronic signature pads, PINs, biometrics, and "click to accept" dialog boxes as possible options, but states that employers are not limited to this list.