In 2004, Congress passed a law allowing employers to obtain electronic signatures on and electronically store I-9 forms. The rules are codified and explained at http://tinyurl.com/2d7p8u4. Employers now have the choice to store I-9 forms in hardcopy, electronically, or both. The law is designed to alleviate the burden of storing hardcopy I-9 forms and contains very specific requirements for employers' transition to electronic storage. In order to ensure compliance with the statute in the event of an audit by U.S. Immigration and Customs Enforcement, employers should be mindful of the following provisions and requirements:
- Employers may convert existing hardcopy I-9 forms into electronic files by scanning and storing legible copies of the forms. The system for storing electronic I-9 forms must be able to produce legible paper copies of the forms and must include reasonable controls to ensure the integrity, accuracy, and reliability of the stored documents. The storage system also must contain inspection procedures, as well as reasonable controls to prevent (and detect) the unauthorized or accidental creation, alteration, or deletion of electronically stored I-9 forms. Finally, the storage system must have an indexing system. Employers utilizing an electronic storage system for I-9 forms must maintain a description (or descriptions) of their storage, form-generation, and indexing systems (and procedures for using such systems).
- With respect to security protocol, access to an employer's electronic storage system must be limited to authorized, trained personnel. The system must include backup and recovery features to prevent data loss. Finally, the electronic storage system should contain an “audit trail,” which logs a “secure and permanent record” of everyone who creates, completes, updates, modifies, alters, or corrects the stored I-9 forms. Failure to maintain adequate security features may result in a violation in the event that data is lost or altered.
- The regulation also permits employees to sign I-9 forms electronically (http://www.uscis.gov/files/form/i-9.pdf). Electronic signatures must be accompanied by a form of attestation (so long as the attestation makes clear the employee has read it before signing) and must record the time, date, and signatory. Employers may use a PIN number system or “click to accept” feature for employees to access and sign their I-9 forms, and must document (and produce to auditors, upon request) which of these features is used.
- Employers must document, and auditors may compel production of, their business processes that create electronically stored I-9 forms, modify and maintain the forms, and establish the authenticity and integrity of the forms. Insufficient documentation of these three processes is a violation of the statute.