Where a Public Agency Owes a Signature: Federal Tax Data, CJIS Contractors, and Proving the Policy Reached Staff

A county government runs a benefits office that receives federal tax information from the IRS. It also contracts a records vendor handling criminal justice information, runs a health clinic and administers a community college. The clinic, the college and the other 2 belong to one organization and one policy library. If you maintain that library, you are asked the same question about every new policy. Do the staff covered by it have to sign it?

The answer changes 4 times across that single county, because the obligation follows the data, and the employer is incidental to it. Agencies in government and public sector commonly adopt one read-and-sign practice across the whole workforce. As a matter of internal policy that is entirely defensible. It becomes awkward the moment somebody asks which rule requires it.

An agency that writes one acknowledgment form for everybody will over-collect from most staff and still miss the 2 populations where a signature is required. The question behind that form is which rule attaches to which data. Each of the 4 wants a different kind of evidence behind it.

The Rule Follows the Data

Which rule attaches to which data is the question that organizes everything below. The data types differ enough that one workforce-wide practice overshoots in some places. In others it leaves a gap the agency cannot see until an auditor asks for the evidence behind a particular obligation and nothing in the file answers it.

The practice most agencies land on is one acknowledgment form signed by everybody. A signed acknowledgment is required for federal tax information under IRS Publication 1075, and from private contractors under the CJIS Security Policy. 45 CFR 164.530 and 164.308 name training and documentation, and neither section contains any word in the signature family.

Why an Agency Ends Up With One Practice

A county adopts a single read-and-sign process because maintaining one of them is a great deal simpler than maintaining 4 of them across a workforce of several thousand people. The strictest requirement also makes a defensible default for everything else.

That reasoning works until somebody asks for the evidence behind a particular obligation. At that point the agency needs to know which rule it is answering, and for which population. The same difficulty appears wherever several bodies coordinate one policy set, which is what multi-agency training rollouts run into for other reasons. The clearest of the 4 requirements is the one attached to federal tax information.

Federal Tax Information Requires a Signature

That first data type is the clearest case of the 4. IRS Publication 1075 names the signature, the moment it becomes due, the frequency at which it repeats, and the contractors it covers beyond the agency's own payroll. Little is left for the agency itself to decide.

The publication requires employees with access to federal tax information to receive disclosure awareness training and sign a confidentiality statement. Both are due prior to initial access and annually thereafter. The same provisions extend to any contractors and sub-contractors with authorized access.

That access is also where the mechanics start, for the first signature and for every one after it:

• Before initial access to or use of federal tax information, the person receives disclosure awareness training and signs a confidentiality statement.
• For the initial certification and each annual recertification thereafter, the employee, contractor, or sub-contractor signs, with ink or an electronic signature, a confidentiality statement certifying their understanding of the penalty provisions and the security requirements.
• The training given before the initial certification and annually thereafter covers the incident response policy and the procedure for reporting unauthorized disclosures and data breaches.

The Part That Outlives the Employment

A further requirement changes what the conversation around the statement has to include. Agencies must make employees, contractors and sub-contractors aware that the disclosure restrictions and penalties continue to apply after the employment or the contract has ended. A benefits office whose staff sign on arrival and never hear that point again has a signature on file and an incomplete briefing behind it.

That combination gives the county a specific evidence set for one office. The next data type divides the same workforce along a different line. Where federal tax information treats everyone with access alike, the rules below separate 2 duties and hand them to 2 different populations inside the same building.

That evidence set for one office comes together in 4 steps:

• List the staff and contractors with authorized access to the data.
• Deliver the disclosure awareness training before access begins.
• Capture the signed confidentiality statement on the same day.
• Repeat both at the annual recertification.

Criminal Justice Information Splits Staff from Contractors

Criminal justice information divides a workforce in a way federal tax information does not. The training duty and the signature duty attach to different groups of people. An agency that collects both from everybody has answered neither question precisely.

Control AT-2 of the CJIS Security Policy requires security and privacy literacy training for system users, including managers, senior executives and contractors. It is given as initial training before a new user accesses criminal justice information, and annually after that. A further round falls within 30 days of any security incident, for the individuals involved in it.

The signature has a narrower audience than the training does. The policy provides that all private contractors who perform criminal justice functions sign the Certification page of the CJIS Security Addendum. So the 2 duties divide the workforce differently:

• Everyone with access to criminal justice information receives the literacy training, before access and annually.
• Private contractors performing criminal justice functions also sign the Certification page.

The Addendum is a uniform agreement between the government agency and the private contractor. It is approved by the Director of the FBI acting for the Attorney General, which is what makes its wording the same at every agency that uses it. 28 CFR 20.33(a)(7) is where it is referenced.

For the county's records vendor this produces a sequence the agency has to evidence from 2 systems at once. The vendor's people appear in the agency's training records under AT-2. They appear again in a signed certification held against a named individual under the Addendum, which is a document the agency's own training system has never seen.

4 data types, 4 populations, 4 kinds of evidence.

Those 4 populations and the evidence behind them are managed the same way:

• Tag each policy with the data type it governs.
• Derive the population from that tag, which a department list cannot give you.
• Hold the attestation against the named person and the date.
• Re-run the attestation whenever the policy version changes.

Health Records and Education Records Ask for Something Else

That pattern of a signature attached to a named individual has no counterpart in the 2 remaining data types. Those rules name training and documentation instead. Any signature they do require belongs to somebody outside the workforce.

What the HIPAA Sections Name

45 CFR 164.530(b)(1) requires a covered entity to train all members of its workforce on its policies and procedures for protected health information. The training is what is necessary and appropriate for those members to carry out their functions. 45 CFR 164.308(a)(5) requires the entity to implement a security awareness and training program for all members of its workforce, including management.

Both sections were retrieved in full, amounting to 18,497 characters between them, and searched with word boundaries for signature, signed, signing, and acknowledgment. Neither of those 2 sections returned a single match. The duties those 2 provisions create are training and documentation, and an agency reading a signature into them is reading something that is not there.

Where FERPA Puts the Signature

34 CFR Part 99 does require signatures, and every one of them runs from the parent or the eligible student. Under 99.30(a) the parent or eligible student provides a signed and dated written consent before the institution discloses personally identifiable information from an education record.

99.30(d) permits that consent to be a record and signature in electronic form, where it identifies and authenticates the person giving it. Under 99.12(b)(3) a waiver of the right of access to confidential recommendations is valid where it is made in writing and signed by the student. The age of the student does not change that requirement.

The community college collects signatures continuously, and every one belongs to a parent or a student signing about their own records. An agency that reads Part 99 as a signature regime and applies it to its own workforce has borrowed a requirement written for somebody else. The evidence it gathers answers no provision in it. For the 2 data types where no signature is named, the agency still owes documentation.

Proving the Policy Reached Staff Where No Signature Is Named

Documentation is where an agency has room to choose its own method. 45 CFR 164.530(j) marks the outer edge of that room. It is short, and 3 requirements come out of it.

The section requires a covered entity to maintain its policies and procedures in written or electronic form. Where an action, activity, or designation is required to be documented, it must maintain a written or electronic record of that action, activity or designation. 3 things follow from those words:

• The policy exists in written or electronic form, in the version that applied at the time.
• A record shows the training happened, for the people the policy covers.
• The record survives a change of system, because 164.530(j)(2) requires it to be retained for 6 years from its creation or the date it was last in effect, whichever is later.

Neither section names the form that record has to take. A signed acknowledgment satisfies it, as does a completion record from a learning system or a dated attendance sheet. Each has to identify the person and the date. The discipline behind that choice is set out in this guide to documentation that survives an inspection.

The county now has 4 answers for 4 data types. What remains is the question of how to hold them. That is where setting the system up begins.

How a County Would Set This Up

Setting this up for a county starts from one observation, that the policy library is one thing while the evidence behind it is 4 things, and the library is the easier half. The best policy management software for an agency is the one that holds both halves, so the attestation is never a separate spreadsheet.

Tag every policy you hold with the data type it governs before deciding who signs anything, because that tag settles the rest of the question. Do it once, at the point the policy is written. A policy touching federal tax information then needs an annual signed certification and a training record.

Criminal justice information needs a training record for everyone with access, and a signed Certification page for contractor personnel. One covering protected health information or education records needs a training record and a documented distribution. The form of that documentation is the agency's to choose, provided it can produce it.

KC Docs versions each policy and targets it to the population its data type defines. The attestation is held against the named person, with the date it was given. An agency answering a question about federal tax information can then produce the annual certification without searching the records that hold its clinic training history.

One question is worth putting to your own county this afternoon. Which of those 4 evidence sets could you produce today, for a named individual, on a named date? The answer is usually 1 of them, and it is usually the one somebody signs.

Frequently Asked Questions

1. Does HIPAA require a signed policy acknowledgment?

No provision in 45 CFR 164.530 or 45 CFR 164.308 names a signature. 164.530(b)(1) requires a covered entity to train all members of its workforce on the policies and procedures with respect to protected health information, and 164.308(a)(5) requires a security awareness and training program for all workforce members including management. 164.530(j) then requires a written or electronic record of any activity the subpart requires to be documented, and the form of that record is left to the entity.

2. What does IRS Publication 1075 require an employee to sign?

A confidentiality statement. Employees with access to or use of federal tax information must receive disclosure awareness training and sign that statement prior to initial access, as well as annually thereafter. For the initial certification and each annual recertification, the employee, contractor, or sub-contractor signs with ink or an electronic signature, certifying their understanding of the penalty provisions and the security requirements.

3. Who signs the CJIS Security Addendum?

Private contractors who perform criminal justice functions. The CJIS Security Policy provides that all such contractors shall acknowledge compliance with all aspects of the Addendum by signing its Certification page. The Addendum itself is a uniform addendum between the government agency and the private contractor, approved by the Director of the FBI acting for the Attorney General and referenced in 28 CFR 20.33(a)(7). Training under control AT-2 applies more widely, covering everyone with access to criminal justice information.

4. Does FERPA require staff to sign a policy?

34 CFR Part 99 contains signature requirements, and they run from the parent or the eligible student, and staff appear in none of them. Under 99.30(a) a signed and dated written consent is required before an educational agency discloses personally identifiable information from education records, 99.30(d) allows that consent in electronic form, and 99.12(b)(3) requires a waiver of the right of access to be in writing and signed by the student. No provision asks a staff member to sign a policy acknowledgment.

5. How can an agency prove a policy reached staff where no signature is required?

45 CFR 164.530(j) requires the policies and procedures to be maintained in written or electronic form, and requires a written or electronic record of any action, activity, or designation the subpart requires to be documented. Training is such an activity under 164.530(b). The section leaves the form of the record open, so a signed acknowledgment, a completion record from a learning system, or a dated attendance record can each satisfy it, provided the record identifies the person and the date.

References

1. Internal Revenue Service. "Publication 1075, Tax Information Security Guidelines for Federal, State and Local Agencies, signed confidentiality statement before initial access and at annual recertification.". irs.gov.
2. Internal Revenue Service. "Publication 1075, disclosure awareness training content and the continuation of restrictions after employment ends.". irs.gov.
3. Federal Bureau of Investigation. "CJIS Security Policy version 6.1, signing of the CJIS Security Addendum Certification page by private contractors.". le.fbi.gov.
4. Federal Bureau of Investigation. "CJIS Security Policy version 6.1, control AT-2, literacy training and awareness.". le.fbi.gov.
5. Code of Federal Regulations. "45 CFR 164.530(b), training, and 164.530(j), documentation.". ecfr.gov. (1)).
6. Code of Federal Regulations. "45 CFR 164.308(a)(5), security awareness and training.". ecfr.gov. (5)).
7. Code of Federal Regulations. "34 CFR 99.30(a) and 99.30(d), signed and dated written consent.". ecfr.gov. ).
8. Code of Federal Regulations. "34 CFR 99.12(b)(3), waiver in writing and signed by the student.". ecfr.gov. (3)).