Use and Maintenance of Electronic Records and Electronic Signatures

Number: 
34-0317
Date Issued: 
03/02/2017
Updated: 
04/04/2017

Education Law Section 5002(2)(a) requires that “every school licensed pursuant to this article shall maintain adequate and accurate records” for seven years “at its principal place of business within this state . . . in a manner and form prescribed by the commissioner and shall be made available to the department . . . upon request.”

Education Law Section 5002(2)(d) provides that student permanent records shall be maintained for twenty years.

Education Law Section 5002(2)(c) further provides that schools “shall provide upon request of the department any and all records necessary to review compliance with the provisions of [Article 101 of the Education Law].

Education Law Section 5001(8), finally, provides that schools discontinuing their operations or surrendering their licenses must notify the commissioner in writing at least 30 days before doing so, and provide the Commissioner with a “plan for maintenance of safekeeping” of the school’s records. These requirements are supplemented by the Commissioner’s regulations at 8 NYCRR §§ 126.11(c) and (d), which require that a school’s records plan upon discontinuance or closure include provision for the Commissioner’s taking custody of a school’s required records.

Commissioner’s regulation at 8 NYCRR § 126.11 sets forth itemized lists of “records and files of a school” required to be maintained for seven years, and “student permanent records” required to be maintained for twenty years. Commissioner’s regulation at 8 NYCRR § 126.11(d) further specifically provides for the Commissioner’s approval of the maintenance by schools of student permanent records in electronic form, and Commissioner’s regulation at 8 NYCRR § 126.11(a) permits “specific disposition” of “records and files of a school” to be “authorized by the Commissioner[.]

Commissioner’s regulation at 8 NYCRR § 126.10(j)(8) similarly contains an itemized list of records and files of English as a Second Language (ESL) schools, which are required to be “maintained for three years at the location of the school or other principal place of business in New York State, unless specific disposition is authorized by the commissioner[.]”

Lastly, Commissioner’s regulation at 8 NYCRR § 126.10(j)(1)(iv) provides that “Upon request by the department, [ESL] schools shall provide any and all records necessary to review compliance with the requirements of this subdivision.”

This Policy Guideline will set forth provisional principles and standards of the Bureau of Proprietary School Supervision (BPSS) for schools that wish to use and maintain electronic records and signatures. It will set forth the parameters within which a licensed private career school or ESL school may maintain electronic records and/or use electronic signatures (“electronic records” will hereafter refer to both electronic records and electronic signatures, except where signatures are specifically referenced). Schools may maintain such records as follows until further notice.

Schools should be mindful of the provisional nature of this guideline, and that BPSS may reasonably condition a school’s continued use of electronic records, in whole or in part, on its compliance with the following, as well as on any adjustments to any electronic record, or electronic record-keeping system, that BPSS may reasonably believe are necessary to ensure the integrity of the records that schools regulated by BPSS are required to maintain.

BPSS has identified the following general principles of electronic records usage which it currently believes are indispensable to ensuring that records maintained by schools in electronic form have the same integrity as records maintained on paper or in other hard-copy form.

  • electronic records must exist in an original form, which must be appropriately marked and identified as such
  • electronic records must be capable of being audited for inaccuracies, and to prevent and detect fraud
  • reasonable measures must be taken, which are reasonably consistent with currently available "state-of-the-art" computer security protocols, to ensure that electronic records are tamper-proof, that they may not be altered except in a manner consistent with the proper entry of information into the record, and its preservation within the record thereafter, which the record exists to accurately reflect, and that student privacy and other confidential or personally identifiable information contained in electronic records are protected
  • electronic records must be ready for inspection by BPSS on demand in their original form
  • if a school closes or discontinues operations, electronic records must be producible to BPSS as required by Education Law § 5001(8), and Commissioner’s regulations at 8 NYCRR § 126.11(c) and (d) (or, in the case of ESL schools, 8 NYCRR § 126.10(j)(1)(iv))
  • electronic records must otherwise be equivalent to, and as complete as, in all respects other than their electronic form, records maintained on paper or in other hard-copy form

As a provisional means of implementing these principles, licensed private career and ESL schools may maintain electronic records as follows:

  1. An electronic record must be readily convertible to PDF format without technical difficulty, and must legibly reflect the same information contained within the original record after conversion (if conversion is necessary).
  2. Electronic records must be capable of being provided to BPSS on demand by uploading such records to a BPSS server, the location of and access to which BPSS will provide as appropriate, or provided to BPSS by other means appropriate under the circumstances.
  3. An electronic record must be marked as an original record. In addition, the marking of any record as an original must correspond to the form in which the record was originally created. Thus, for example, if an attendance register is created electronically, the electronic version of the register must be marked as the original record. If, on the other hand, the register is originally created on paper, then the paper version must be marked as the original. If an original record is created on paper, it may be scanned as a PDF document and the original paper record destroyed, provided that the PDF is then marked as having been scanned from an original paper record, and is an exact duplicate thereof.
  4. Every person who is able to enter or alter information in an electronic record must be identifiable by name or another specific identification marker in the school’s computer system or network that will enable BPSS, if necessary, to determine such person’s identity and relationship to the school. This may be accomplished by means of an electronic signature, subject to item 6. below. A school may be required to provide to BPSS on demand a complete history of persons accessing a record, which shows each person who accessed the record, and the date and time of access, in chronological order, that directly connects such persons to their access to the record via a specific password or other similar identifying marker.
  5. An electronic record must be password-protected. A school must designate one or more staff persons, identifiable to BPSS upon request, who know each record’s password, whose access to the records for which they have a password can be audited, as provided above, who are responsible for the custody and safe-keeping of the passwords, and the records to which the passwords apply, and for not disclosing passwords to persons whom the school does not specifically designate to know them. Persons whom a school does not designate to know a record’s password should not be permitted to access that record.  Schools need not password-protect each individual electronic record with its own password, so long as there is some password barrier between the record that is being accessed, and use of the password may be linked to access of the record, and to the person who accessed it. For example, an electronic record may be maintained within a part of a computer network which also contains other electronic records. A password may apply to this part of the network as a whole, so long as the person accessing a record within this part of the network using the password may be identified when the record is accessed.
  6. Schools may use electronic signatures in connection with their use of electronic records in accordance with Article 3 of the New York State Technology Law (the “Electronic Signatures and Records Act”), and regulations and guidelines of the New York State Office of Information Technology Services (https://its.ny.gov/).  However, in the case of enrollment agreements, in addition to complying with the Commissioner’s regulations governing enrollment agreements and BPSS Policy Guideline 29-1011, electronic signatures may only be used if a student, after signing the agreement, and before instruction begins, meets the agent who enrolled him or her in person, is presented with the agent’s valid certificate, and is informed by the agent of the purpose of this interaction, and the agent’s electronic signature is placed on the enrollment agreement.*
  7. A school must maintain all student personally identifiable information in confidence and in accordance with all applicable privacy laws and regulations.
  8. If a given record is subject to one or more laws or regulations, a school using such a record in an electronic form must comply with any such laws or regulations applicable to that record, as if it were not in electronic form, or as required by such laws or regulations if they apply to the record in its electronic form.

If, at any time, BPSS reasonably determines that a school’s use of an electronic record may jeopardize the integrity of the information that the record is supposed to preserve, it may require the school to alter the manner in which it maintains the record, or to cease maintaining the record electronically and convert it to paper form.

If a school uses an original electronic record yet is unwilling or unable to provide BPSS with that record on demand, BPSS may determine that the school has constructively denied BPSS access to a record required to be maintained by the school and made available to BPSS under Education Law §§ 5002(2)(a) and 5002(2)(c), in violation of such law (or, in the case of ESL schools, 8 NYCRR § 126.10(j)(1)(iv)).

Given the technical complexity of electronic records, the sheer number of different computer applications and systems in which they may be kept, and the constant evolution of computer technology, it is anticipated that this guidance may be modified or superseded as it may become appropriate. BPSS will review this Policy Guideline in one year and, if necessary, make updates and corrections.

*For exclusively online schools, a video-chat link service, such as Skype, Google Chat, etc., may be used to have this meeting, provided that a record of the interaction is kept according to the requirements of this guideline.