Electronic I-9 Employment Eligibility Verification: Standards for Electronic Retention and Electronic Signatures

Many employers, seeking to reduce costs and improve efficiency, are moving increasingly toward the paperless office. Recognizing this trend, Congress passed a law in October 2004 permitting employers to use electronic signature technology on the Employment Eligibility Verification Form (I-9) and to retain I-9s in electronic format.

The law became effective in April 2005, but Immigrations and Customs Enforcement (ICE) did not provide any guidance on the rule until June 16, 2006, when ICE set out basic standards for electronic recordkeeping and electronic signatures in an interim rule published in the Federal Register. That rule went into effect in 2006, and it continues to be the primary source of guidance from the federal government. Its standards are based on existing IRS standards for electronic recordkeeping, so employers who already have electronic recordkeeping systems in place that comply with IRS standards may expand those systems to include employment verification records. As long as the system is IRS compliant, it will satisfy ICE's standards as well.

Electronic Retention Systems

Systems used to store electronic I-9s must control access, protect data and provide quick access to records. Simply scanning forms into PDF format is not sufficient to satisfy the rule. Specifically, electronic retention systems must meet the following requirements:

• Eligibility Verification Procedure. The system must not alter the employment eligibility verification procedure. Specifically, the name of the I-9, its content, sequence of data elements and instructions may not be changed, and no additional data elements or language may be added to it.
• Security Controls. The system must include effective security controls that ensure only authorized personnel have access to the records. The system must also be able to prevent and detect unauthorized or accidental creation, alteration or deletion of records. An audit trail must be produced for each record, showing who has accessed the record, when it was accessed, and what actions were performed. The rule also requires that employees using the system undergo training to minimize the risk of unauthorized or accidental creation, alteration or deletion of records and information.
• Quality Assurance and System Documentation. The system must include an inspection and quality assurance program that includes regular evaluations of the system. It must perform periodic checks of the electronically stored I-9s, along with the associated electronic signatures. It must also be protected by a backup and recovery program. The employer must maintain documentation on the system, including a complete description of the system and procedures for its use.
• Inspection Requirements. The system must facilitate inspection of the I-9s by federal agencies. It must permit searches of the database by any data element. For example, it must be able to retrieve records for all employees who identified themselves on the I-9 as U.S. citizens, or for all employees who used a particular document to establish employment eligibility. In addition, the electronic I-9 must be highly legible and readable in both electronic and hard-copy format.

In the event of an audit, the employer must produce only the records requested by the agency in the format requested, along with the associated audit trails. In addition, the employer must, if requested, provide the agency with all documentation and hardware necessary for the agency to retrieve the information on its own. Therefore, the system must be accessible and must not be subject to any agreement that would limit or restrict access to and use of the system by any federal agency.

Electronic Signature

Systems used to capture electronic signatures must be able to verify the authenticity of the signature and must support the integrity of the attestations on the I-9. In addition, as noted above, electronic signatures must be covered by security and quality assurance requirements for electronic retention systems:

• Attestations and Signature Verification. Electronic signatures must be attached to or logically associated with an electronically completed I-9. The signature must be immediately affixed to the form, and a printed confirmation must be provided to the employee. The system must also create and preserve a record verifying the identity of the employee who signed the form. It must include a method to acknowledge that the employee has read the attestation regarding the consequences for false statements or use of false documents, and that the employer's representative has read the attestation regarding the review and evaluation of the employee's eligibility to work.
• Security. Employers must be able to demonstrate that the electronic signature system is properly maintained and protects electronic signatures from unauthorized tampering, and any unauthorized access must be detected. In addition, the quality assurance programs required for electronic retention systems must cover evaluation and periodic checks of electronic signatures.
• Technology. The ICE rule itself does not specify acceptable technologies. The comments published with the interim rule list electronic signature pads, PINs, biometrics and "click to accept" dialog boxes as possible options, but also say that employers are not limited to this list.

New Form I-9 Must Be Incorporated into All Electronic I-9 Systems

The recently revised Employment Eligibility Verification Form I-9 must be used for all employees hired on or after December 26, 2007. Companies that implemented electronic I-9 procedures in the past two years must be sure to incorporate the new I-9 form. The federal regulations implementing the new I-9 form warn that penalties can apply for failure to use the new I-9 after its effective date. No former versions of the I-9 can be used after December 26, 2007. This restriction poses some systems problems and will create an additional cost for companies that had already fully implemented an electronic I-9 system prior to release of the new I-9 form.

The federal government provides a Portable Document Format version of the new Form I-9 at www.uscis.gov that can be filled in online and printed. This link can assist companies to electronically generate and retain I-9 forms. In addition, the U.S. Citizenship and Immigration Services (USCIS) provides further background on electronic I-9s in the November 1, 2007, edition of publication M-274, Handbook for Employers: Instructions for Completing the Form I-9.