AMSA Regulatory Alert (RA 01-22)

To: Members & Affiliates
From: National Office
Date: December 21, 2001
Subject: REQUEST FOR COMMENTS ON EPA's PROPOSED ELECTRONIC REPORTING AND RECORD RULE
Reference: RA 01-22

Action Please By:
January 21, 2002

On August 31, 2001, the U.S. Environmental Protection Agency's (EPA's) Office of Environmental Information proposed a set of conditions to guide the submission of electronic reports and the maintenance of electronic records by regulated entities to satisfy Agency reporting and recordkeeping requirements. If implemented as proposed, these conditions would significantly impact the way AMSA members maintain information electronically. The Cross-Media Electronic Reporting and Records Rule (CROMERRR) is designed to implement provisions of the Government Paperwork Elimination Act (GPEA) of 1998. A copy of the proposed CROMERRR requirements can be obtained at: http://www.epa.gov/fedrgstr/EPA-GENERAL/2001/August/Day-31/g21810.htm.

Among other things, the GPEA requires federal agencies to accommodate electronic reporting and recordkeeping for their regulatory programs by October 21, 2003. Unfortunately, as proposed, CROMERRR offers few, if any efficiency gains to members of the regulated community who may seek to streamline old, paper-based systems. As proposed, the new requirements may serve to drive regulated entities including publicly owned treatment works (POTWs) away from electronic means of managing their regulatory compliance information.

AMSA Requests Member Input
AMSA is closely examining the impact of these requirements. We encourage all agencies that generate or maintain information electronically to evaluate the impact of this proposal. If you are interested in providing comments to AMSA for incorporation into the Association's letter to EPA, please submit any feedback by January 21, 2002 to Chris Hornback, AMSA at chornback@amsa-cleanwater.org.

The impacts of this proposal will vary significantly from POTW to POTW depending upon how reliant a particular agency is on electronic records and to what degree an agency has invested in information management systems. Your staff responsible for maintaining electronic information or managing your information systems should be able to assess the impact of these requirements on existing information systems and provide an estimate of the costs associated with complying. EPA has already acknowledged that it may have underestimated the costs associated with implementing these provisions and it is critical that we provide the Agency with real-world implementation costs.

Although CROMERRR will also impact electronic reporting by expanding the options available for electronic submission, most of the concern with this rulemaking surrounds the burdensome record maintenance requirements. If your agency relies on electronic report submission or plans to do so in the future, please also review those portions of the proposal.

Though AMSA plans to submit comments on this proposal, individual agency comments detailing specific impacts including costs will also be critical. If your agency plans to prepare its own comments on this proposal, please contact Chris Hornback, AMSA at 202/833-9106 or chornback@amsa-cleanwater.org. The deadline for submitting comments directly to EPA is January 28, 2002.

AMSA's Preliminary Concerns with the Proposed CROMERRR
CROMERRR is inherently voluntary as it does not require regulated entities to report or maintain records electronically. However, if finalized as written, members of the regulated community that currently maintain electronic records and that wish to continue to do so after the rule takes effect must meet the proposed recordkeeping requirements. The proposed standards seek to prevent fraud and preserve the authenticity and integrity of the information, and to demonstrate that electronic records are reliable and generally equivalent to paper records in satisfying regulatory requirements. The Office of Management and Budget's (OMB's) guidance on implementing the GPEA instructs agencies to evaluate each type of recordkeeping requirement to assess how likely it is that fraud will occur and the consequences of such fraud. OMB also directs agencies to evaluate the cost of particular security measures and adopt the appropriate level of protection based on the risk. However, despite this direction from OMB, it appears that EPA selected a very conservative approach without conducting a thorough assessment of the costs to comply.

The new electronic record requirements include:

• Audit trails. Record-retention systems must use secure, computer-generated, time-stamped audit trails to automatically record the date and time of operator entries and actions that create, modify, or delete electronic records.

• Electronic Signatures. Any record bearing an electronic signature must contain the name of the signatory, the date and time of signature, and any information that explains the meaning affixed to the signature. Electronic signatures must be protected so that any signature that has been affixed to a record cannot be detached, copied, or otherwise compromised.

• Archiving. The records must be stored in an electronic form that preserves the context in which the document was prepared, the associated metadata, and the audit trail.

• Migration. If a facility ever migrates an electronic record from one medium or format to another, EPA expects each record, plus all of its metadata to be transferred from the original to the new format so that the entire body of the information is moved without modification. Error checking functionality would be required to verify that this occurred.

The tremendous scope of CROMERRR is evident upon examination of the applicability requirements. The new provisions essentially apply to all "electronic records," defined as "any combination of text, graphics, data, audio, pictorial, or other information represented in digital form that is created, modified, maintained, archived, retrieved or distributed by a computer system." In other words, if a piece of information passes through a computer or other electronic device at any stage, from data generation to archival and retrieval, it is an electronic record and subject to the new requirements.

Much of the information used on a daily basis in the operation of a POTW passes through a computer at some point, and hence would be considered an electronic record. While POTWs with large information management systems would certainly be subject to these requirements, the scope extends well beyond these specialized systems. Any agency simply maintaining permit data on a computer spreadsheet would be subject to the CROMERRR record requirements.