PART 1066 ONLINE ONLY ADULT DRIVER EDUCATION COURSE PROVIDER CERTIFICATION : Sections Listing

TITLE 92: TRANSPORTATION
CHAPTER II: SECRETARY OF STATE
PART 1066 ONLINE ONLY ADULT DRIVER EDUCATION COURSE PROVIDER CERTIFICATION


AUTHORITY: Implementing and authorized by Section 6-107.5 of the Illinois Driver Licensing Law [625 ILCS 5/6-107.5].

SOURCE: Adopted at 38 Ill. Reg. 12582, effective July 1, 2014; amended at 46 Ill. Reg. 6718, effective April 11, 2022.

 

Section 1066.5  Definitions

 

Unless otherwise noted, the following definitions shall apply to this Part:

 

"Applicant" − an entity applying for certification as an online only adult driver education course provider.  Every officer, owner, director, partner and/or manager is subject to this Part. 

 

"Certification" – a document issued by the Department that authorizes the entity named in the document to offer an online only adult driver education course. 

 

"Consumer Information" − name, address, date of birth, gender, email address and payment information, including credit card and  bank account numbers or electronic payment data of students who are enrolled in or have completed an adult driver education course. 

 

"Department" − the Commercial Driving Training School Division within the Department of Driver Services within the Office of the Secretary of State.

 

"Fraudulent Activity" – any action calculated to deceive, whether it be a single act or combination of circumstances, whether the suppression of the truth or the suggestion of what is false, whether it be by direct falsehood or by innuendo, by speech or by silence.

 

"Illinois Vehicle Code" or "Vehicle Code" or "IVC" − 625 ILCS 5.

 

"Online Only Adult Driver Education Course Provider"  or "Provider" − an entity or person certified by the Secretary of State to provide an adult driver education course solely online. 

 

"Secretary of State" or "Secretary" − the Secretary of State of the State of Illinois. 

 

Section 1066.10 Certification Required

 

a)         No person, firm, association, partnership or corporation shall operate as a provider or engage in the business of providing an online only adult driver education course unless a certification has been issued by the Secretary.

 

b)         No provider may remain in operation if its certification to operate as a provider is suspended, revoked, canceled or not renewed.

 

Section 1066.20  Requirements for Online Only Adult Education Course Providers

 

a)         The Secretary of State shall not issue, or shall deny, cancel, suspend or revoke, an online only adult education course provider certification:

 

1)         Unless the applicant/provider is of good moral character. In making a determination of good moral character, the Department is not limited to, but may consider, the following:

 

A)        Whether the applicant/provider has been convicted of a felony or a misdemeanor.  The Department shall consider:

 

i)          The relationship of any crime of which the applicant/provider has been convicted to the ability to operate an online only adult driver education course;

 

ii)         The length of time that has elapsed since the applicant's/provider's last criminal conviction;

 

iii)        Whether the applicant/provider successfully completed any sentence imposed with the convictions;

 

iv)        Whether the applicant/provider has multiple convictions for felony or misdemeanor offenses.

 

B)        If the person has been indicted, formally charged or otherwise charged with a felony or a misdemeanor, the certification shall be either denied or cancelled.

 

i)          If the person whose certification has been denied or cancelled under this Part is adjudicated "guilty" by the court, the denial or cancellation previously entered on his/her record in accordance with this Section shall stand.  This action does not preclude further suspension and/or revocation of the certification under another Section of this Part or the IVC.

 

ii)         If the person whose certification has been denied or cancelled under this Part is adjudicated "not guilty" by the court, the denial or cancellation previously entered on his/her record in accordance with this Section shall be rescinded.  This action does not preclude further suspension and/or revocation of the certification under another Section of this Part or the IVC.

 

iii)        If the person whose certification has been denied or cancelled under this Part is granted a disposition of "court supervision" by the court, the denial or cancellation previously entered on his/her record in accordance this with this Section shall be rescinded.  This action does not preclude further suspension and/or revocation of the certification under another Section of this Part or the IVC.

 

2)         To any owner or employee who, during the course of interaction with students:

 

A)        Engaged in activity that puts the student in danger; or

 

B)        Engaged in reckless behavior; or

 

C)        Failed to maintain a professional relationship with students at all times.

 

3)         Unless the applicant/provider files and maintains with the Department a continuous surety bond in the principal sum of $50,000, underwritten by a company authorized to do business in the State of Illinois, for the protection of the contractual rights of students. However, the aggregate liability of the surety for all breaches of the condition of the bond in no event shall exceed the principal sum of $50,000. The surety on any bond may cancel the bond on giving 30 days notice in writing to the Secretary of State and shall be relieved of liability for any breach of any conditions of the bond that occurs after the effective date of cancellation. All bonds filed pursuant to this provision shall be in substantially the following form:

 

Know All Persons by These Presents, That We,

, of

,

hereinafter referred to as Principal and

, a

 

corporation organized and existing to do business in the State of Illinois, for the use and benefit of all persons who may be damaged by breach of this bond, as Obligees, in the penal sum of $50,000, lawful money of the United States of America, for the payment of which sum, well and truly to be made, we bind ourselves, our executors, administrators, successors and assigns, firmly by these presents.  The condition of this obligation is such that the principal has made application to the Illinois Secretary of State for certification for the purpose of exercising the vocation of an online only adult education course provider.  If the Principal faithfully complies with the Illinois Vehicle Code and all rules and regulations that have been or may hereafter be in force concerning the license or permit, and shall save and keep harmless the Obligees from all loss or damage that may be sustained as a result of the issuance of the license or permit to the Principal, this obligation shall be void; otherwise, this obligation shall remain in full force and effect.  The bond will expire but may be continued by renewal certificate signed by Principal and Surety.  The Surety may at any time terminate its liability by giving 30 days written notice to the Commercial Driver Training Section of the Department, 650 Roppolo Drive, Elk Grove Village, Illinois 60007, and the Surety shall not be liable for any default after that 30 day notice period, except for defaults occurring prior thereto.

 

Signed, Sealed and Dated this

day of

, 20__

Principal

Surety

By

Attorney-in-fact

 

4)         Unless the Secretary is satisfied that the applicant/provider has established adequate procedures for verifying the identity of the student taking the course and ensuring that the student completes the course in its entirety.

 

5)         Unless the applicant submits a copy of its course content, conforming with Section 1066.45, to the Department for review and approval, including the questions and answers on the quizzes and final examination.

 

6)         If a provider fails to immediately report to the Department any unauthorized access to consumer information, including computer breaches, or fails to comply with the Illinois Personal Information Protection Act [815 ILCS 530/5].

 

7)         If the applicant/provider is an Illinois corporation, unless the corporation is in good standing with the Illinois Secretary of State, Department of Business Services.

 

8)         If the applicant/provider is a foreign corporation, unless the corporation is authorized to transact business in Illinois, as evidenced by submission of an Application for Authority to Transact Business in Illinois and acceptance of the same by the Illinois Secretary of State, Department of Business Services.

 

9)         If the applicant/provider is a foreign limited liability company, unless the limited liability company is authorized to transact business in Illinois, as evidenced by submission of an Application for Admission to Transact Business and acceptance of that application by the Illinois Secretary of State, Department of Business Services. 

 

10)         If the owner or any employee of the applicant/provider is a current salaried or contractual employee of the Secretary of State.

 

11)         If an applicant/provider, owner or manager engages in fraudulent activity as defined in Section 1066.5.

 

12)         If an applicant, owner or employee has been declared to have engaged in fraudulent activity within the 5 years prior to making application for certification.

 

13)         If an applicant/provider or owner owes outstanding fees to the Secretary of State.

 

14)         If an applicant/provider sells or discloses any consumer information or fails to post a statement indicating consumer information will not be sold or disclosed on its website.

 

15)         If an applicant/provider requests the social security number of students.

 

16)         If a provider fails to immediately report to the Department any unauthorized access to consumer information, including computer breaches. 

 

17)         Unless the provider/applicant maintains a staffed customer service telephone number or live agent online support local Illinois time between 9:00 a.m. and 9:00 p.m. CST Monday through Friday and between 9:00 a.m. and 7:00 p.m. Saturday and also maintains an email address or voice mail or answering service 24 hours a day, 7 days a week.  All inquiries must be resolved within 48 hours after first contact. 

 

18)         Unless the provider/applicant provides the Department with a detailed description of each position involved in every facet of the adult driver education course, with contact information for each employee.  The provider must report any staffing changes to the Department within 72 hours after the change. 

 

19)         If the provider uses voice recognition as a method of verification, unless the provider furnishes a toll free number for the purposes of providing the required voice exemplars. 

 

b)       Only one provider certification shall be issued to any individual, group, association, partnership or corporation, and the Department shall deny an application for certification as a provider if any of the applicants are unqualified, are already certified or have made application as another provider.

 

c)       Upon receipt of a properly executed application for certification, the Department shall investigate the qualifications of the applicant to determine whether the application should be granted or denied.

 

d)         Certifications may only be issued by the Department.

 

e)         An entity whose certification has been denied, cancelled, suspended or revoked pursuant to this Part may request an administrative hearing pursuant to 92 Ill. Adm. Code 1001.

 

f)         All monies required to be remitted by a provider to the Department must be submitted in United States currency. 

 

Section 1066.30  Online Only Adult Driver Education Course Provider Names

 

a)         No provider shall adopt, use or conduct any business under a name that is not distinguishable upon the records of the Department from a name used by another provider, as distinguishable is defined in 14 Ill. Adm. Code 150.440.

 

b)         No provider shall incorporate under its own or another name unless the name of the proposed corporation is submitted to the Department of Business Services of the Office of the Secretary of State for a final determination of the availability of the name, along with the fee required by Section 15.10 of the Business Corporation Act of 1983 [805 ILCS 5/15.10].

 

c)         No provider name shall contain, separate and apart from any other word or abbreviation in the name, the word "corporation", "company", "incorporated" or limited", or an abbreviation of one of these words, unless so licensed by the Secretary of State.

 

d)         No provider shall operate under an assumed name, unless the provider complies with all provisions of the Assumed Business Name Act [805 ILCS 405]. 

 

e)         No provider shall change its name unless 30 days prior written notice is given to the Department stating the change of name. Upon receipt of notice of name change, the Department shall, without an application fee, require the provider to complete an amended application for certification in the form and manner prescribed for original applicants.

 

Section 1066.40  Online Only Adult Driver Education Course Required Instruction

 

a)         Providers must provide 6 hours of online driver education instruction in accordance with the course content set forth in Section 1066.45.

 

1)         A minimum of 360 minutes of instruction must be provided.

 

2)         Each student must complete the instruction within 30 days after commencement of instruction.

 

3)         The material presented in the course shall be edited for grammar, punctuation and spelling and be of such quality that it does not detract from the subject matter.

 

4)         Advertisement of goods and services shall not appear during instructional time. Material not related to the topic being presented shall not appear during instructional time.

 

5)         To demonstrate that the course contains a minimum of 360 minutes of instruction, the following calculations shall be used:

 

A)        For written material that is read by the student, count the total number of words in the written sections of the course. Divide the word count by 180, the average number of words that a typical student reads per minute. The result equals the time associated with the material for the written sections.  

 

B)        For multimedia presentation, including simulators, video and animation, calculate the total amount of time it takes for all multimedia presentations to play, which shall not exceed 120 minutes.

 

C)        Assign one minute for each chart or graph.

 

D)        If the sum of the time associated with written course material, multimedia presentations, and graphs equals or exceeds 360 minutes, the course has met the minimum content time.

 

b)         In lieu of the time calculation method set forth in subsection (a)(5) a provider may submit alternate methodology to demonstrate that the course contains a minimum of 360 minutes of instruction.

 

c)         All material appearing on screen to be read by the student shall also be spoken aloud to the student, unless this function is manually disabled by the student. 

 

d)         Providers must monitor the Illinois General Assembly and update their course content to include any new laws regarding the rules of the road or operation of motor vehicles. This update shall be submitted to the Department for review and approval within 60 days after the effective date of the law change. 

 

e)         Criteria for passing the course, in accordance with Section 1066.70, shall be provided to the student prior to the commencement of the course.

 

f)         The course must be designed and well suited for students with minimal keyboarding and/or computer skills. 

 

g)         Prior to certification, each applicant shall provide the Department with all necessary information to allow the Department to participate in a complete online adult driver education course, without fee to the Department, so that the Department may determine if the course satisfies the requirements of this Part.  If the proposed course content meets the requirements of this Part, it will be approved by the Department.

 

h)         Providers must follow the online course content submitted to and approved by the Department at the time of application for certification.  To determine compliance with this provision, the provider shall provide the Department with all necessary information to allow the Department to participate in a complete online adult driver education course, without fee to the Department.

 

i)          If a provider wishes to substantially change the course content, a copy of the proposed revisions must be sent to the Department for approval.  The provider shall also provide the Department with all necessary information to allow the Department to participate in a complete adult driver education course, with the proposed revisions included in the course.  After review, the Department will send a letter to the provider either approving or rejecting the proposed changes. 

 

j)          Within 2 business days after successful completion of an adult driver education course, providers shall electronically transmit to the Secretary the student's full name (first, middle and last), address, date of birth, gender and email address, accompanied by the statutory fee of $5.

 

Section 1066.45  Online Only Adult Driver Education Course Content

 

a)         Course Objectives. The educational objectives of adult driver education shall include, but not be limited to, promoting respect for and encouraging observance of traffic laws and traffic safety responsibilities of drivers and citizens, reducing traffic violations, reducing traffic-related injuries, deaths and economic losses, and motivating continuing development of traffic related competencies through education, including, but not limited to, Illinois traffic law, risk management, driver attitudes and courtesy skills, and informing participants about the effects of alcohol and other drugs on driving ability.

 

b)         Course Content

At a minimum, course content must include:

 

1)         Familiarization with the process of obtaining an instruction permit and driver's license and the obligations and responsibilities that exist with holding a license;

 

2)         Instruction on traffic laws;

 

3)         Highway signs;

 

4)         Signals and markings that regulate, warn or direct traffic, including traffic signs and lane markings;

 

5)         Issues commonly associated with motor vehicle accidents, including poor decision making, risk taking, distractions, speed, failure to use a safety belt, driving at night, failure to yield the right-of-way, texting while driving and using wireless communication devices;

 

6)         How to respond to emergency vehicles;

 

7)         Turning, passing and yielding;

 

8)         Construction and school zones;

 

9)         Stopping distance;

 

10)        Blind spots;

 

11)        Strategy for driving using:

 

A)        Smith System;

 

B)        IPDE Process;

 

C)        Zone Control;

 

D)        Any other recognized process for identifying problems, predicting outcomes, deciding action and executing decisions;

 

12)         Right-of-way for pedestrians, emergency vehicles and school buses;

 

13)        Sharing the road with pedestrians, bicyclists, motorcyclists, trucks and recreational vehicles;

 

14)         Road hazards, including visibility, weather and traction;

 

15)        Mental conditions, including alertness, awareness and emotion;

 

16)         Alcohol and other drugs, including effects, responsibilities, driving under the influence, zero tolerance, and implied consent laws;

 

17)         Differences in urban and rural driving, including driving on highways and Interstate driving;

 

18)         Organ donor;

 

19)         Illinois Secretary of State emergency contact database; and

 

20)         Instruction concerning law enforcement procedures for traffic stops, including a demonstration of the proper actions to be taken during a traffic stop and appropriate interactions with law enforcement.

 

c)         Providers shall group course content into modules or sections to allow for quizzes in accordance with Section 1066.70.

 

(Source:  Amended at 46 Ill. Reg. 6718, effective April 11, 2022)

 

Section 1066.50  Online Only Adult Driver Education Course Student Instruction Record

 

a)         A provider shall provide for the creation and maintenance of the records documenting student enrollment, the verification of the student's identity, and testing of the student's mastery of the course material. The provider shall also ensure that the student record is readily, securely, and reliably available for inspection by a representative of the Secretary of State. The records shall be maintained for a minimum of 3 years. The student records shall contain the following information:

 

1)         the student's first, middle and last name;

 

2)         the student's residence and email addresses;

 

3)         the student's date of birth and gender;

 

4)         a record of all questions asked and the student's responses;

 

5)         a record of the date and time the student spent in each section and the total instructional time the student spent in the course; and

 

6)         a record of all verification of the student's identity (i.e., if voice biometrics are used, a copy of each voice recording must be maintained).

 

b)         Failure to maintain the required student instruction records, and/or the maintenance of incomplete records, shall be prima facie evidence that the required instruction was not administered. 

 

Section 1066.60  Online Only Adult Driver Education Course Student Contracts

 

a)         Each student shall be informed, prior to the time instruction begins and the collection of any fees, of the amount of any and all fees or charges relative to the adult driver education course, including but not limited to enrollment, tuition, equipment, textbooks and instructional manuals. The provider shall not require mandatory installation or purchase of the provider's proprietary software or shareware, unless this fee was expressly included in the disclosure of fees made prior to enrollment in the course.

 

b)         All contracts or agreements between any provider and any individual or group for the sale, purchase, barter or exchange of any driver education instruction, must contain the following:

 

1)         A statement that the agreement constitutes the entire contract between the provider and the student and that no verbal assurances or promises not contained in the agreement shall bind the provider or the student.

 

2)         A statement indicating that all disputes under this Section shall be directed to the Secretary of State.

 

c)         The term "no refund" and a no refund policy concerning student payments are not permitted in any online adult driver education course contract. A provider may use the phrase: "The provider will not refund any fees if the provider is capable and willing to perform its part of the contract."

 

d)         No provider may sell, transfer, assign, exchange, trade or otherwise dispose of any contract or part of a contract, agreement or obligation between any provider and any student, unless the provider has obtained the written consent of the student.

 

e)         If a provider fails to comply with the provisions of a contract or agreement by or between the provider and any of its students, the provider shall refund all monies paid by the student as consideration for performance of the contract or agreement by the provider, unless the student violates the provisions of the contract or agreement. No provider is required to issue a refund to a student who has successfully completed the provider's course and for whom a certificate of completion has been issued.

 

Section 1066.70  Online Only Adult Driver Education Course Provider Verification of Student Identity and Course Completion

 

a)         Prior to certification, providers must submit procedures for verifying the identity of the student taking the course to the Secretary of State, which may include, but are not limited to, the following:

 

1)         Keystroke analysis or unique typing style;

 

2)         Voice verification;

 

3)         Fingerprint comparison;

 

4)         Web Video Recording;

 

5)         Challenge questions based on third party data (i.e., information obtained from credit bureaus or information brokers). Sample challenge questions must be submitted to the Department as part of provider certification;

 

6)         Web video conference proctor with screen monitoring with live certified proctors.

 

b)         If the method of verification is keystroke analysis or unique typing style, in addition to the initial keystroke analysis, additional analyses must be conducted at least once per hour during the course at random intervals. Students shall have 60 seconds to provide a keystroke sample. Students who fail to provide a sample or to do so within this specified time period shall be returned to the place in the course where the student last successfully passed a verification. A student, who, for the second time, fails to provide a sample, or fails to do so within this specified time period shall be deemed to have failed the course. If the sample does not match the sample provided by the student at the start of the course, the student shall be required to provide another sample. If the second sample does not match the sample provided by the student at the start of the course, the student shall be required to provide a third sample. If the third sample does not match the sample provided by the student at the start of the course, the student shall be prevented from completing the course and shall be deemed to have failed the course.

 

c)         If the method of verification is voice verification, in addition to the initial voice exemplar, the student shall be required to call at least one time per hour, during each hour of the course, during random intervals. Students shall have only 60 seconds to provide a voice exemplar. Students who fail to provide an exemplar or to do so within this specified time period shall be returned to the place in the course where the student last successfully passed a verification. A student, who, for a second time, fails to provide an exemplar or fails to do so within this specified time period shall be deemed to have failed the course. If the voice exemplar does not match the exemplar provided by the student at the start of the course, the student shall be required to provide another exemplar. If the second exemplar does not match the exemplar provided by the student at the start of  the course, the student shall be required to provide a third sample. If the third sample does not match the sample provided by the student at the start of the course, the student shall be prevented from completing the course and shall be deemed to have failed the course.

 

d)         If the method of verification is challenge questions, the student must be asked a minimum of two questions per hour, during each hour of the course, during random intervals. Students shall have only 60 seconds to respond. Students who fail to respond to the question or who fail to respond within the specified time period shall be returned to the place in the course where the student last successfully passed a verification. A student who, for a second time, fails to responds to a challenge question or who fails to respond within the specified time period shall be deemed to have failed the course. If a student answers a question incorrectly, another challenge question shall be asked. If the student correctly answers the challenge question, the student may proceed with the course. If the student incorrectly answers a third challenge question, the student is deemed to have failed the course.

 

e)         Providers shall incorporate a course content validation process that verifies student participation and comprehension of course material, and course completion, including the following:

 

1)         Built-in timers to ensure that 360 minutes of instruction have been viewed and completed by the student. Timers must prevent the student from scrolling, skipping or advancing through the course without reading the material and must not allow the student to take section quizzes or the final examination without viewing or reading the course content. If a student attempts to take a quiz or the final examination without having spent the minimum time required for a section or the course, the student must be returned to the place in the course where the student last spent the minimum required time.

 

2)         At least one course validation question shall be asked following each multimedia clip that exceeds 60 seconds.

 

A)        For each multimedia presentation that exceeds 60 seconds, at least 4 questions shall be included in the test bank.  

 

B)        Questions may be multiple choice, true/false, or a combination of both. Questions shall be difficult enough that the answer may not be easily determined without having viewed the multimedia clip. 

 

C)        If the student answers the question incorrectly, the correct answer must be provided to the student, after which the student must view the multimedia clip again. A different question from the test bank shall then be asked. A question may not be repeated until all questions from the test bank have been used.

 

3)         Providers shall test the student's course participation and comprehension of the material by asking a minimum of 3 questions at the end of each section or module of the course.

 

A)        Questions may be multiple choice, true/false or a combination of both. Questions shall be of such difficulty that the answers may not be easily determined without having participated in the section/module. 

 

B)        The test bank for course participation questions shall include a minimum of 5 questions from each section or module and shall be randomized.

 

C)        If the student answers two or more questions incorrectly, the student must complete the section/module again. At the completion of the section/module three questions must be asked, using different questions from the test bank. A question may not be repeated until all questions from the test bank have been used.

 

4)         Students must complete a final examination at the end of the course, which shall consist of 20 questions from a test bank of a minimum of 40 questions. Questions may be multiple choice, true/false or a combination of both, and questions shall be randomized. Questions shall be of such difficulty that the answers may not be easily determined without having participated in the entire course. A student must score at least 75% on the final examination. If a student scores less than 75%, the student shall be re-tested, using different questions from the test bank. The student is not required to repeat the course, but may be allowed to review the course prior to retaking the examination. If the student fails the comprehensive final examination 2 times, the student has failed the course.

 

Section 1066.80  Hearings

 

a)         Prior to the denial of a certification of an applicant or existing provider, the Department shall send written notice to the provider.  If a formal hearing is requested in writing in accordance with 92 Ill. Adm. Code 1001.Subpart A and IVC Section 2-118, the denial shall stand pending the outcome of the hearing. The denial of a certification shall contain the specific reasons why the certification has been denied. 

 

b)         Prior to the suspension or revocation of a provider's certification, the Department will conduct a hearing in accordance with 92 Ill. Adm. Code 1001.Subpart A and IVC Section 2-118, in which the Department will present competent evidence to establish violations of any regulations or laws governing providers and seek the appropriate sanctions in accordance with Section 1066.90.

 

Section 1066.90  Denial, Cancellation, Suspension and Revocation of an Online Only Adult Driver Education Course Provider Certification

 

The Secretary of State may deny, cancel, suspend or revoke a certification:

 

a)         For any violation of IVC Section 6-107.5

 

b)         For any violation of this Part.

 

c)         If the provider's certification or licensure to provide any type of driver education has been denied, cancelled, suspended or revoked.

 

Section 1066.100  Online Only Adult Driver Education Course Website and Security Requirements

 

a)         Each provider's website must display the following information on its homepage:

 

1)         the provider's Secretary of State certification number;

 

2)         a statement that complaints regarding the provider may be directed to the Secretary of State's Commercial Driver Training School Section. Contact information for the Commercial Driver Training School Section shall be included with the statement.

 

b)         Each provider must offer the course from a single domain. The course may accept students that are redirected to the online course domain, as long as the provider's certification number appears on the source that redirects the student to the online course domain. The student must be redirected to a webpage that clearly identifies the certified provider offering the course before the student begins the registration process, supplies any information, or pays for the course.

 

c)         Providers are prohibited from selling or disclosing any consumer information provided by the student. A statement to that effect must be posted on the provider's website in a conspicuous location.

 

d)         Providers are prohibited from requesting the social security numbers of students.

 

e)         Providers must take all necessary measures to prevent unauthorized access to consumer information, either in printed or electronic form, and, upon discovery, shall immediately report any unauthorized access to the Department.

 

f)         Provider servers must be located in a secure location, with access restricted to only those employees or persons who have a need to access the server.