Ohio Administrative Code › Title 3364 - University of Toledo › Chapter 3364-15 - HIPAA Organizational Structure; Fraud, Waste and Abuse; Compliance and Confidentiality of Patient Information › Section 3364-15-16 - Electronic signatures

Current through all regulations passed and filed through July 1, 2024
(A)
								Policy
			 statement
Electronic transactions conducted in
				accordance with this rule shall have the same legal effect as paper-based
				transactions. The university of Toledo ("UT") through its office of information
				security shall establish procedures to provide authentication, non-repudiation
				and integrity to the extent reasonable for each electronic
				transaction.
(B)
								Purpose of policy
Prior to using or accepting electronic
				signatures, Ohio law requires that the university establish security procedures
				that govern the use of electronic signatures and ensure the authenticity,
				integrity, and non-repudiation of such signatures. The use of electronic
				signatures, as directed by this rule, can potentially facilitate the timely
				execution of activities across the university, including personnel actions,
				contract approvals, and other activities requiring confirmation of
				acceptance.
(C)
								Scope
This policy applies to all electronic
				transactions entered into on behalf of the university.
(D)
								Definitions
(1)
									Authenticity -
			 the assurance that the electronic signature is that of the person purporting to
			 sign a record or otherwise conducting an electronic
			 transaction.
(2)
									Domain - a category of persons based on the nature of
			 the identity of the person. For purposes of this policy, electronic
			 transactions may belong to one of the following domains:
(a)
										Citizen
			 domain
(i)
											The
			 citizen domain consists of individuals acting on their own behalf or on the
			 behalf of any other individual under a power of attorney.
(ii)
											The citizen
			 domain includes only those individuals who choose to interact electronically
			 with the state of Ohio.
(iii)
											The citizen domain also includes state web and
			 application servers that interact with citizens.
(b)
										Business
			 domain
(i)
											The
			 business domain consists of corporations, business trusts, partnerships,
			 limited liability companies, associations, joint ventures or any other
			 commercial, charitable or legal entity that interacts electronically with state
			 agencies.
(ii)
											This domain also includes web and application servers
			 that interact with businesses.
(c)
										State internal
			 domain
(i)
											The
			 state internal domain consists of state employees acting on behalf of the
			 state, and any other agent of the state; network components; and web and
			 application servers that use electronic transaction-enabled applications to
			 conduct internal state business.
(ii)
											The state
			 internal domain also applies to local government representatives for electronic
			 transactions with state government agencies.
(3)
									Electronic record - as defined by Chapter 1306. of the
			 Revised Code is a record created, generated, sent, communicated, received, or
			 stored by electronic means.
(4)
									Electronic
			 signature - An electronic sound, symbol, or process attached to or logically
			 associated with a record and executed or adopted by a person with the intent to
			 sign the record.
(5)
									Electronic transactions - An action or set of actions,
			 like an exchange of an electronic record and electronic signature between the
			 university and an individual relating to the conduct of such business as:
(a)
										Consent to
			 release information;
(b)
										Purchase, sell or lease goods, services or
			 construction;
(c)
										Transfer funds;
(d)
										Facilitate the
			 submission of an electronic record with an electronic signature required or
			 accepted by the UT; or
(e)
										Create records formally issued under a signature and
			 upon which the university or any other person will reasonably rely including
			 but not limited to formal communication, letters, notices, directives,
			 policies, guidelines and any other record.
(6)
									Integrity - the
			 assurance that the electronic record is not modified from what the signatory
			 adopted.
(7)
									Non-repudiation - proof that the signatory adopted or
			 assented to the electronic record or electronic transaction.
(8)
									Scanned signature
			 - a photocopy, fax, pdf or other copy of a document signed electronically or by
			 hand.
(9)
									Security procedure - a procedure employed for the
			 purpose of verifying that an electronic signature, record, or performance is
			 that of a specific person or from detecting changes and errors in a procedure
			 requiring the use of codes or algorithms;
(a)
										Identifying words
			 or numbers;
(b)
										Encryption
(c)
										Call back
			 or
(d)
										Other acknowledgement procedures.