41. Electronic communications

Electronic communication of documents, forms, notices and requests (information) includes email, web-based communication or any other form of electronic communications specified by the provider [Administration Guidelines part 8], as long as the method of electronic communication assures that the integrity of information is maintained [ETA section 11].

41.1 - What can be communicated electronically

Information required or permitted under HESA to be given between the student and the provider, may be communicated electronically or online using an information system. This includes:

requests for Commonwealth assistance [part 9]
requests for the correction of a notice [part 10.4]
notification, by a student, of their TFN or the provision of a Certificate of application for a TFN [part 34]
notification, by a student, that he or she does not wish to be Commonwealth supported for a unit of study [part 20]; and
the CAN [part 10]

Information technology requirements

The information system used for providing or receiving electronic communications must be accessible by students. To be accessible, the provider must have:

informed students by direct communication, or by way of the provider’s publications, that communication will occur by electronic means using the information system; and
given the students authority to use the information system

Any information system used to send or receive electronic communications must also be able to store the information so that the student can readily access it, and available for subsequent reference and printing.

Online access to electronic CANs

For units of study where the provider is required to initially issue a CAN [HESA subsection 169-5(1)], providers must ensure that a student enrolled in that unit can access an electronic CAN. The provider’s obligation to provide online access to the CAN ceases when the person is no longer enrolled in the relevant unit of study; for example, when they complete the unit.

Each time the person enrols in further units of study for which the provider must issue a new CAN, the provider has a new and separate obligation to provide online access to that CAN.

41.2 - Requirements for electronic communication of information from a student to a provider

Where providers receive information from students electronically, they will need to comply with the provisions of the ETA and part 8 of the Administration Guidelines. This includes:

requests for Commonwealth assistance [part 9]
a request for the correction of a notice [part 9.5]
notification by a student of their TFN, or applied Certificate of application for a TFN [part 34]; and
notification by a student that he or she does not wish to be Commonwealth supported for a unit of study [part 20.3]

The requirement for this information to be given in writing by the student is met if the student gives the information to the provider by means of electronic communications and all of the following circumstances prevail:

The information system used for providing the information is
- compliant with the information technology requirements in [part 41.1]
- secure, with appropriate security and back-up measures in place; and
- able to generate a printable receipt for the student
When giving information to the provider, the student follows instructions the provider has given. For example, the provider may require a notice from a student to be sent to a particular email address.
The student is able to verify the provider has received the information in accordance with any requirements for verification the provider may have. A provider should inform students of the procedures they will need to follow regarding the electronic submission of information. For example, a provider should inform a student what they should do if they do not receive a confirmation of receipt of the information within the specified period.
Where a document must be signed, a method is used to identify the person and indicate the person’s approval of the information [ETA sections 9 – 11 and Administration Guidelines part 8].

41.3 - Electronic submission of documents that require signature

For documents that students are required to sign, such as the electronic Commonwealth Assistance Form (eCAF) [part 9.4], students must use a unique identifier, issued by their provider, to identify themselves and indicate their approval of the conditions and requirements set out in the eCAF or other document [ETA section 10; Administration Guidelines part 8]. When submitting a Government eCAF, the ‘submission transaction’ serves as the student’s electronic signature, and the student receives a PDF copy via email for their records.

41.4 - Issuing unique identifiers to students

A provider must have a method in place that the student can use to uniquely identify themselves in the communication and indicate approval of information in it. A unique identifier can be in the form of a personal identification number (PIN), a username and password combination, or in a form as determined by the provider.

CHESSNs cannot be used as identifiers. In issuing the unique identifier, the provider must ensure it uses a reliable method of verifying a person’s identity [ETA subsection 10(1)]. The provider must:

verify the identity of the person to whom the identifier is to be issued
take all reasonable precautions to ensure there is no unauthorised access to, or use of, the identifier; and
ensure the student is advised that, apart from the provider’s obligations under paragraphs a) and b), the student is personally responsible for protecting the identifier.

A provider may issue the student a unique identifier that can be multi-functional. That is, a student can use the identifier to submit an eCAF and for other enrolment processes.

41.5 - Verifying a student’s identity

The unique identifier and other details should be immediately matched with other data on the provider’s system to validate the name and the identifier. If the information provided by the student does not match the data on the provider’s system, the form should be rejected, and a message provided to the student stating that there is an error and advising of any follow-up action required.

41.6 - Requirements for non-government eCAFs

Students who are requesting Commonwealth assistance need to complete and submit an eCAF [HESA Division 174]. Providers may choose to use their own, purpose-built non-government eCAFs, or they may choose to use the Government eCAF, which is available for all approved providers. Providers who elect to use their own eCAF systems must meet the requirements in the ETA and part 8 of the Administration Guidelines to ensure that their non-government eCAF is an ‘approved form’.

An approved form comprises all the information contained in the Government eCAF. This includes every element, section, and text – the exceptions are the eCAF video and eCAF quiz, and the TFN and USI verification tool.

The department provides access to the Government eCAF as the point of reference that providers must use to develop their provider eCAFs. The Government eCAF is updated and approved annually. Additional policy and/or legislation changes throughout the year sometimes require that the Government eCAFs approved by the Minister to be updated. If this occurs, it is communicated to providers by the Department.

The information contained in the Government eCAF represents the minimum mandatory information required for a provider eCAF to be valid.

Collecting mandatory information via another source, such as through the enrolment process, does not exempt a non-Government eCAF from being required to have this information. For example, a student’s enrolment form may have their full name, email, and date of birth, but their eCAF must also have this information as well.

If a provider’s non-government eCAF is not compliant, it is not an approved form for a student to request Commonwealth assistance, deeming the student ineligible for the CSP and/or HELP loan they are requesting.

Providers can ‘personalise’ the form as they require, provided the minimum requirements are met.

Accessing the Government eCAF

Providers can request access to the Government eCAF training environment and the Government live eCAF environment by contacting the department.

For higher education providers, please email HEenquiries@education.gov.au
For VET Providers, please visit www.dewr.gov.au/vet-student-loans.

Other key requirements for non-government eCAFs

In addition to the minimum mandatory information, providers must fulfil the below key requirements in relation to eCAFs.

Inclusion of an automatically generated date field

Students who complete an electronic form are not required to date the form. A provider must include a date field that is automatically generated by the system when the student submits the form.

Assistance in submitting, and correcting and submitting the form

A provider must ensure that students have reasonable access to the relevant HELP information booklet [part 9.2], to assist students when completing their eCAF/s. A provider should give students the opportunity to re-read the information they have provided online and correct any errors if necessary. This is why the department encourages providers to issue students with a copy of their submitted eCAF.

If the provider is satisfied that the student has made an error in completing the form, the student should be provided with an opportunity to correctly complete and resubmit the form [HESA section 169-10].

In circumstances where the error does not impact a students eligibility, these errors can be fixed up to 6 weeks after the students census date. For example, an incorrectly spelt name, wrong DOB, or incorrect course name.

If the error does impact a student’s eligibility, a provider may fix these errors before the census date. If the census date has passed, providers must contact the department regarding next steps – HEenquiries@education.gov.au.

Issue of a receipt

Any information system that students use to submit an eCAF must be able to generate a printable receipt for the student. A provider may determine the format of this receipt. However, the student’s TFN must not be printed on the receipt issued to the student.

41.7 - Retrieval of information

A provider must store all electronic forms, notices, documents, and other information in such a way that they can be reproduced and retrieved. A provider must be able to produce a copy of a student’s eCAF to the student or the department for the time specified in State/Territory record keeping legislation.

41.8 - Storage of data

The information system must store the information so that the student can readily access it and so that it can be made available for subsequent reference.

A provider must store the data in a dataset. Information provided by students, in particular TFNs, must be recorded in a secure database. The storage and security of TFNs must comply with the Privacy (Tax File Number) Rule 2015.

Security and back-up measures

A provider must ensure a student’s information can only be accessed by a person authorised by the provider to access that information.

A provider should ensure that back-up measures are in place to cater for situations where computer malfunctions occur.

Privacy

Where personal information of a student is stored on an information system, the provider must comply with the Privacy Act 1988 and HESA Division 179 [part 41.1].

41.9 - Requirements for electronic communication of information from a provider to a student

Where providers are sending any written information, documents, forms, requests and notices (‘information’) required or allowed by HESA to students electronically, they will need to comply with the provisions of the ETA and part 8 of the Administration Guidelines. The information that is likely to be sent would include a CAN.

In accordance with section 9 of the ETA and part 8 of the Administration Guidelines, the requirement for a provider to give a student a CAN, or other information in writing, is met if the information is provided by means of electronic communications and all of the following circumstances prevail:

The information system used for providing the information electronically must be compliant with the information system requirements in [part 40.1].
The student consents to receiving the CAN electronically [ETA paragraphs 9(1)(d), 11(1)(e) and 11(2)(e)]. It is up to providers to determine the means by which they obtain the student’s consent. A provider may wish to obtain the student’s consent through enrolment documentation.