17.04

Responsibilities for the Use of Digital IDs

POLICY OVERVIEW

The use of networked electronic resources to securely transact business and exchange information among known parties often requires that the identities of individuals be strongly authenticated and that certain information exchanges be strongly encrypted. Digital IDs that are each uniquely associated with and solely controlled by a specific individual are a corner stone in the provision of secure, trusted services among networked resources. Digital IDs permit users to:

• create a digital signature that uniquely authenticates his or her identity affixed to a specific electronic document or transaction and ensures the integrity of the signed item,
• encrypt information that can be accessed only by the intended confidants, and
• access restricted resources requiring strong authentication prior to authorization.

In 1997, the 75th Legislature enacted several laws to facilitate and promote electronic commerce (EC) and to make government more accessible to Texas citizens. To establish acceptable digital signature technologies for the authentication of written electronic communications sent to state agencies, the Texas Department of Information Resource (DIR) adopted Texas Government Code, 2054.060 section 201.14 Digital Signatures. Digital signatures that comply with the (DIR) rules will have the same legal effect as a handwritten signature. As a result, many transactions that required paper documents in the past may now be completed electronically.

All patient information, some student and human resource information is classified as confidential at the UTHSC-H and must be digitally signed and encrypted for transmission using a digital ID to ensure that the message is sent and received only by intended confidants and cannot be altered or viewed during transmission. This policy applies to all confidential electronic communications that are sent over the Internet or other electronic network that is acceptable to UTHSC-H, for which the identity of the sender or the contents of the message must be authenticated.

PROCEDURE

UTHSC-H faculty, student, staff or contractors are required to obtain a digital ID if they transmit or receive confidential information across the internal UTHSC-H network or public network, must digitally sign electronic documents, and/or require access to restricted resources requiring strong authentication. A digital ID consists of a private/public key pair in which the public key is certified by a UTHSC-H approved certification authority (CA).

Digital ID Obligations:

• A digital signature created using a digital ID is the user's legal signature, therefore, users are legally responsible for its use.
• The digital ID password must never be written down and must not be the same password as those used to gain access to other information resources.
• The digital ID password MUST NOT be forgotten. Consequences of forgetting the digital ID password:
  • the user's digital ID is lost forever;
  • anything encrypted by a lost digital ID can NEVER be accessed again;
  • the user can no longer access restricted resources requiring their digital IDs; and
  • the user must obtain a new UTHSC-H digital ID.
• Faculty and staff having encrypted information must decrypt information in order to satisfy statutory obligations under the provisions of the Texas Public Information Act (TPIA). Failure to comply with this requirement will result in disciplinary action and/or criminal sanctions.
• See 17.05 Email and Internet Usage Policy for other obligations.

Prerequisites to Obtaining a Digital ID:

• An individual must be a registered student, faculty, or staff member of UTHSC-H.
• An E-mail address of an individual must be of the form name@uth.tmc.edu.
• An individual must have a UTHSC-H identification badge.
• An individual must have a government issued picture ID (i.e., Texas drivers license, U.S. passport, etc.)
• An individual must have a personal computer connected to the Internet as well as a web browser - either Netscape 4.5 or later; or Microsoft Internet Explorer 5.0 or later.

To obtain a digital ID, access http://www.uth.tmc.edu/oac_docs/trust/id-get.html.

Storage and Transfer of Digital IDs Digital IDs are stored on your personal computer in your "Personal Security Environment (PSE)" and/or on a smart card. You must export your certified key set onto a flexible disk or other storage device to ensure backup of the key set.

Using Digital IDs:

• Digital IDs must be used to digitally sign and encrypt e-mail messages that transmit confidential information.
• Digital IDs can be used to access restricted resources if access management is implemented on the resource.
• Digital IDs can be used when entering information into web forms online.

Created 4/01

| HOOP Home Page | Chapter 17 Table of Contents |

Report broken links, etc.