Cloud I-9: Should You Take Your IRCA Compliance Virtual?
By James O'Brien Founding Member, O'Brien Law LLC | March 14, 2021
The proliferation of HR software "solutions" on the market often promise also to take your Form I-9 employment verification compliance system out of the paper age, and into a virtual space. Sometimes these electronic I-9 products are found as one of several "modules" which are offered within an integrated package of comprehensive HRM software.
The allure of virtual management of your I-9 employment verification compliance is nearly irresistible, and is also a natural extension of the decision to take many of your other HR processes recordkeeping functions online. Federal law under the Immigration Reform and Control Act (IRCA) governing I-9 compliance even explicitly covers for the electronic creation and retention of Form I-9.
Simple enough. Or is it? Even when promoted by software vendors as a module of a comprehensive HRM system, electronic I-9 systems often seem to be something of an afterthought. But that can lead a Hotel into inadvertent violations of the law just when it is beginning to rely on HRM systems to enhance compliance. As seems invariably true for government regulations, those which outline the law's requirements for electronic I-9 management are lengthy, and very detailed. The list of specifications which these regulations cover include:
- There are specified standards for capturing electronic signatures on the I-9, which if not met will be interpreted by the government as you not having properly completed the I-9.
- An electronic creation or storage system for Form I-9 must have "reasonable controls" to ensure the system's integrity, accuracy and reliability.
- It must also have "reasonable controls" to prevent and detect unauthorized use, and accidental deletion.
- It must have regular evaluations which demonstrate inspection and quality assurance;
- It must have an indexed retrieval system.
- The Hotel must be able to reproduce hardcopies from the system, so that in the event of a government audit of your I-9 Forms, paper copies can be provided upon request.
- Also in the event of a government audit, the Hotel must provide to the government upon request "resources" – hardware, software, and personnel – to enable it to access your electronic I-9 system.
- Documentation must be provided to the government upon request which provide "complete descriptions" of your electronic I-9 system and its indexing system, as well as documentation of the "business processes" used to create, modify and store the I-9 Forms, establish their authenticity and integrity, and create audit trails.
- Security protocols must be in place to restrict access, provide for backup and recovery, and create audit trails for creating and modifying I-9 records, which include the identity of the person accessing the records.
A Hotel's failure to comply with these electronic documentation requirements, failure to adequately prevent unauthorized access resulting in a loss of electronic I-9 records, or failure to follow the electronic signature specifications, can be held, in and of themselves, to be violations by an employer of IRCA. Thus, an electronic IRCA compliance system introduces new, additional points of potential exposure to violations of the law, while at the same time the Hotel which elects to take its I-9 compliance virtual remains subject to all the same requirements and potential penalties which are present when using a paper I-9 compliance system.
Does this mean as an HR professional you should recommend against taking your Hotel's I-9 compliance virtual? Not necessarily. But it does mean that HR and/or outside counsel must be extremely meticulous in vetting the electronic I-9 system being considered, and, once it's been deployed, HR must be highly vigilant in making sure that the HR professionals using the system do not forget their training, and lapse into unquestioning reliance on the electronic system alone.