Digital Signatures vs Electronic Signatures
There is a difference between the two terms. In fact for those of you that work in a regulated environment (i.e. 21 CRF Part 11) it is very important that you understand the difference.
The terms themselves are not carved in stone. However, the difference in concepts are. Digital signatures are a legally binding representation of a individuals signature. It can be held up in a court of law. Public Key Infrastructure (PKI) is one option provided by many vendors that allows a user to digitally sign an object. The PKI service issues a digital certificate which requires the user to provide certain forms of identification to prove to the vendor the person is who they say they are (a.k.a. non-repudiation).
Electronic signatures in theory are not a true legally binding signature. Instead, anyone can create electronic signatures and are usually referred to as a hybrid. This can be in the form of a user supplying a password or some other form of personal information that only they know that results in a personal "stamp" being applied to the object they are approving. The hybrid signature is only valid within the system of which the signature was designed for. For instance, many in the corporate world use hybrid signatures when approving electronic documents within an electronic document management system. Those approvals stamp information onto the electronic document. Within the control of the system the signature means everything. Take the document outside of the system and it can not be validated. Meaning, without a proper SOP or knowledgeable individuals about the system and document and the document approval is not valid. Also, if the document is shared external to the system and/or company, they have no way of validating the approval.
When it comes to sharing information with a regulatory authority (i.e. pharma industry) those reviewing the documents do not care about validating the signatures. They already accept the documents as being valid because the company must have filed with the regulatory authority that any documents submitted on behalf of the company are representative of the company and accurate to the best of the company's knowledge. The CEO or designated officials within the company have to submit this with their legal signature before any information can be shared with a regulatory authority.
Perhaps one day, the regulatory authorities will require signatures on all documents be submitted so that they can validate them. This can be easily completed, however, some coordination is required with both sides of the communication (company and accepting authority).
In summary, the exact terms used to describe the above details are sometimes misleading. Be careful what you call what when communicating the details. Make sure you are clear about the concepts and implement the specific technology to meet the need of the business or individual. If not, it could lead to legal issues or other negative impacts to those involved when using this technology.
The terms themselves are not carved in stone. However, the difference in concepts are. Digital signatures are a legally binding representation of a individuals signature. It can be held up in a court of law. Public Key Infrastructure (PKI) is one option provided by many vendors that allows a user to digitally sign an object. The PKI service issues a digital certificate which requires the user to provide certain forms of identification to prove to the vendor the person is who they say they are (a.k.a. non-repudiation).
Electronic signatures in theory are not a true legally binding signature. Instead, anyone can create electronic signatures and are usually referred to as a hybrid. This can be in the form of a user supplying a password or some other form of personal information that only they know that results in a personal "stamp" being applied to the object they are approving. The hybrid signature is only valid within the system of which the signature was designed for. For instance, many in the corporate world use hybrid signatures when approving electronic documents within an electronic document management system. Those approvals stamp information onto the electronic document. Within the control of the system the signature means everything. Take the document outside of the system and it can not be validated. Meaning, without a proper SOP or knowledgeable individuals about the system and document and the document approval is not valid. Also, if the document is shared external to the system and/or company, they have no way of validating the approval.
When it comes to sharing information with a regulatory authority (i.e. pharma industry) those reviewing the documents do not care about validating the signatures. They already accept the documents as being valid because the company must have filed with the regulatory authority that any documents submitted on behalf of the company are representative of the company and accurate to the best of the company's knowledge. The CEO or designated officials within the company have to submit this with their legal signature before any information can be shared with a regulatory authority.
Perhaps one day, the regulatory authorities will require signatures on all documents be submitted so that they can validate them. This can be easily completed, however, some coordination is required with both sides of the communication (company and accepting authority).
In summary, the exact terms used to describe the above details are sometimes misleading. Be careful what you call what when communicating the details. Make sure you are clear about the concepts and implement the specific technology to meet the need of the business or individual. If not, it could lead to legal issues or other negative impacts to those involved when using this technology.
posted by s4mbuc4 at
6:32 PM
|
0 comments
