ID Issuance and Use Procedure
This document outlines policies and practices recommended by Zonar to its Customers, for issuance and use of Zonar ID Cards and User IDs to electronically sign commercial vehicle inspection and repair records in the EVIR® (Electronic Verification Inspection Report) system. Zonar recommends that its Customers consistently follow careful procedures in the issuance and use of ID Cards and User ID’s that create electronic signatures on vehicle inspection records and repair certifications, in order to enhance the accuracy of those records and the accountability of Operators and Motor Carriers for the records they create.
Under the federal law, an “electronic signature” is “an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.” The EVIR system associates a unique Operator ID or User ID with each record created or modified in the system, thereby allowing system users to electronically sign inspection and repair records.
- The Electronic Signature Process in the EVIR System
The EVIR system provides a process to accomplish the three signature steps necessary for complete management of vehicle inspection and repair records under the requirements of FMCSA regulations (CFR 396.11 and 396.13). The Operator electronically signs each inspection record, the Motor Carrier or its agent (the “Certifier”) electronically signs a repair certification, and the Operator signs an acknowledgement of the review of the repair certification.
The EVIR system uses two types of identity credentials to electronically sign records. All Operators use an ID Card to uniquely identify themselves in the system. All Certifiers use a User ID, in the form a of unique login name protected by a secret password.
Each Operator receives an ID Card containing a data chip that stores a unique ID number for the individual Operator to whom the card is issued. Whenever an Operator uses the EVIR system to conduct a vehicle inspection, the Zonar Handheld Device (the “Device”) reads the ID Card to login the Operator to the Device, to create an inspection record. The Device automatically stores the Operator’s unique ID number with each record created by the Operator.
When the Operator has used the Device to complete all required actions for an inspection report, the Device will ask the Operator to certify as follows: “I certify the report submitted is true and accurate.” The Operator provides their signature on the certification by using the Device’s “Yes” command, and the Device stores all inspection data entered by the Operator as a completed non-alterable inspection record, including the Operator’s unique ID number. The complete, electronically-signed inspection record is then ready for upload from the Device to Zonar’s computer-based record management system: Ground Traffic Control (“GTC”) (part of the EVIR system).
Whenever an Operator creates a record that lists a defect or deficiency that would affect the safety of operation of the vehicle or result in its mechanical breakdown, the record is then accessed by the Certifier who is responsible for assuring that proper corrective action is taken on behalf of the Motor Carrier. Once corrective action is completed, the Certifier accesses GTC using a unique login name that serves as a User ID for signing the certification record. The Certifier must enter the login name, and an associated secret password created by the Certifier, to enter GTC and make a repair certification. Privileges associated with a User ID may include the ability to enter a repair certification, but not allow the Certifier to modify any of the content of the original inspection record submitted by the Operator. After accessing a repair record, the Certifier’s name is automatically entered in a non-editable field in the “Corrective Action” section of the record, so that it cannot be modified. The Certifier then certifies either “Above defects corrected” or “Above defects need not be corrected for safe operation of the vehicle”. (Other repair notes may be entered by the Certifier, as well as additional comments regarding the corrective action. The entries mentioned here are those that constitute a completed repair certification under CFR 396.13.) The repair certification is stored as a permanent, non-alterable record containing the name of the Certifier.
Using the Device, the Operator reviews the last vehicle inspection record together with the repair certification. Whenever an Operator conducts a vehicle inspection on a vehicle for which the last inspection noted a defect or deficiency, the Device will ask the Operator for an acknowledgement that, “I have reviewed the previous report and accept the certification of repairs.” If the Operator provides this acknowledgement, using the “Yes” command on the Device, the record of the acknowledgement is stored in the “Corrective Action” section of the last inspection report, including an electronic signature by the Operator using the unique ID number from the Operator’s ID card.
- Recommended ID Issuance Processes
Operator ID cards and User IDs are issued to individual Operators and Certifiers by the Zonar Customer who owns, operates or is otherwise responsible for assuring proper inspections and repairs for commercial vehicles managed with the EVIR System. The Customer is responsible for assuring that each Operator ID card is issued to the Operator assigned to the card (i.e., that the ID card holding the unique ID number assigned to a particular Operator is received and used only by that designated Operator). Each Operator ID card is imprinted with the ID card number that is embedded in the data chip contained in the card. Likewise, the Customer is responsible for assuring that each User ID is issued to the Certifier whose name is associated with that User ID. Zonar recommends the following issuance process to its Customers:
- Upon or before delivery of an ID Card to an Operator, Customer assigns the ID Card to the Operator by entering into GTC the name of the Operator and the ID card number.
- Upon delivery of the Operator ID card to the Operator, each Operator signs an ID Card User Agreement. The Customer can deliver the ID Card and the User Agreement to the Operator together, so that both the Operator and the Customer can confirm that the Operator has received the ID Card with the ID Card number assigned to that Operator.
- The Customer or the Operator can print the Operator’s name in ink on the ID Card at the time of issuance.
- The Customer assigns a User ID and temporary password to each Certifier. Upon receipt of this login information, the Certifier signs a User ID agreement. The Certifier is instructed, and agrees under the terms of the User ID agreement, to change the temporary password to a secret password of the Certifier’s own choosing, prior to creating any repair certification records in GTC.
- Customer should provide a copy of the Agreement for the Operator or Certifier to retain in his or her own records.
- ID User Agreements
User agreements with the EVIR system are designed to inform Operators and Certifiers of the responsibilities surrounding use of the ID Card or User ID as a signature tool in the EVIR system. The agreements also help Customers establish procedures for careful control of the IDs used for signature processes in the EVIR system.
The ID Card User Agreement records the Operator Name, Operator CDL Number, Operator ID Card Number, Driver PIN (Tablet Users Only), ID Card Issuer, Issuer Phone, and Date of Issuance for each ID Card issued to an Operator. The User ID agreement records similar information for each Certifier. Each agreement also contains a list of acknowledgments and responsibilities undertaken by each Operator or Certifier in using ID Card or User ID. The Customer maintains in its records the signed User Agreements for all Operators and Certifiers to whom IDs are issued.
Zonar recommends that the Customer provide a copy of the User Agreement to each Operator or Certifier at the time of issuance of the ID Card or User ID. This provides the Operator or Certifier with a record of the responsibilities associated with use of the ID, and contact information to assist the Operator or Certifier in obtaining revocation of the ID if it is lost or stolen.
- Safeguarding User Information
Zonar recommends that the Customer store the Users private information in a secure location, including the User Agreement which contains specific information tied to each Operator and their inputting information into Ground Traffic Control.
This becomes especially important in the secure record keeping of and Operators’ Hours of Service records when they are using the 2020 tablet, including each Operator’s driver ID and PIN.
- ID Revocation Procedure
Customers should appoint a person or persons authorized to receive ID Card or User ID revocation requests, to handle revocation of IDs in the EVIR System, and to issue new IDs to Operators and Certifiers, if necessary, after revocation of an old ID. Often, it is expected that this person will be the same person who handles the original issuance of the ID Card or User ID. Enabling prompt revocation and reissuance of IDs will help to assure that Operators and Certifiers can carry out their responsibilities under the User Agreements.
Contact information for the person(s) handling this role may be included in the User Agreement, but Customers may also communicate this information through other normal channels, such as Human Resources, GTC administrator(s), or other persons with whom Operators and Certifiers regularly have contact in connection with their use of the EVIR System.
Customers should also revoke ID Cards and User IDs upon termination of an Operator’s or Certifier’s contractual or employment relationship with the Customer. Revocation of the ID Card or User ID from the EVIR System prevents any further use of the terminated Operator’s or Certifier’s ID for signatures on inspection or repair records, while preserving those records created by the Operator or Certifier that already exist in the system.