Outsourcing Information Systems

1. Outsourcing Information Systems ECURE 1:30-2:30, October 10, 2002 Richard Rainsberger Consultant, Education Records Law and Privacy

2. Outsourcing • An institution's hiring of an agent to perform an ongoing process/task that the institution would normally perform itself.

3. Subcontracting • An arrangement between the college and consultants for one-time projects.

4. By outsourcing, you are establishing an agency relationship: • Agent: An organization, company, or bureau that provides some service for another; a company having a franchise to represent another.

5. Student Services Outsourced • Printing of diplomas/certificates • Printing of class schedules, catalogs • International credential evaluation • Transcript ordering • Admission (the whole magilla; or one part it) • Enrollment certification • Grade reporting • Registration

6. Reasons to Consider Outsourcing • Need to reduce cost • Reduce capital investment • Staffing constraints • Desire to enhance service • Response to student demand • Access to technology • Manage periodic service demands • Facilitate organizational change • Generate revenue • Keep up with the competition

7. AACRAO Outsourcing Survey 2001 (based on 400 responses to random survey of members) Reasons for considering outsourcing: Over 80% of the respondents identified the following as being Extremely or Very Important: • Budget constraints • Staffing constraints • Enhanced services • Access to technology • Response to student demand

8. AACRAO Outsourcing Survey 2001 Reasons for considering outsourcing: Over 70% of the respondents identified the following as being Somewhat or Not Important: • Keeping up with Competition • Generating Revenue

9. Outsourcing Journal, April 2002 Interest in outsourcing based on: • Improving core business results……….. 39% • Cost savings……………………………… 36% • Upgrade current service levels…………….. 9% • Inability to staff appropriately……………... 7% • Implementation of large scale initiatives...… 5% • Avoiding needed investment…………….… 4%

10. Outsourcing Fears • Misuse of information • Loss of control • Poor service tarnishes name • Staff morale • Institutional brand name dilution • Vendor goes out of business

11. Where to Start? • Develop a goal statement/identify a desired outcome • Why do you think outsourcing will benefit your institution? • What are your expectations for outsourcing? • What is the state of your current service? • Who is affected by this service? How do they currently evaluate the service?

12. Where to Start? • Develop a goal statement/identify a desired outcome To establish an on-line, integrated, real time information system that provides customer access 24/7 and permits customers to process any administrative transactions via web based processing.

13. Where to Start? 2. Why do you think outsourcing will benefit your institution? Outsourcing will benefit the institution by providing a customer-friendly environment for accessing accounts, processing administrative transactions, and providing state-of-the-art technology at a lower cost.

14. Where to Start? 3. What are your expectations for outsourcing? • More favorable satisfaction ratings from our customers after the system has been implemented for one year • Improved security for administrative transactions • Decrease in number of errors to research • An “audit trail” of all transactions made to the system • Automatic scheduled backups with ease of information retrieval

15. Where to Start? 4. What is the state of your current service? • Is the service delivered in a timely manner? • Is service of the desired quality? • Are service expectations being met? • Are new features desired? • Is staffing a problem?

16. Where to Start? 5. Who is affected by this service? How do they currently evaluate the service? • Students • Faculty • Staff and administrators • Boards, Legislators, and Regulating Bodies • Alumni

17. Basis for Evaluating the Outsourcing Vendor Reference Checks • Request list of current users • Request list of cancelled/former users • Contact references and verify vendor performance in critical areas

18. Basis for Evaluating the Outsourcing Vendor Quality of Service • Speed and convenience of delivery • Accuracy and completeness • Standards of professional practice • Error rate/need of repeat service • Service downtime • Response to user-identified problems • Quality of vendor communication

19. Basis for Evaluating Outsourcing Vendor Cost of Service “…the cost of providing the service through a vendor should be compared to the cost of performing the function internally.” _________________ AACRAO 2001 Outsourcing Survey

20. Basis for Evaluating Outsourcing Vendor Cost of Service • Include all institutional costs • Determine whether cost shifts occur • Identify hidden costs • Vendor support costs • Image/reputational cost • Termination cost

21. Privacy Issues • FERPA regulates what, who and how • Vendor must act as agent to handle confidential records • Current and future data disposal • Confidentiality and intergrity of data • Ultimate accountability remains with the institution

22. So What Does FERPA Say?

23. 34 CFR 99 FERPA Regulations (Appendix 2 of AACRAO FERPA Guide) • § 99.31 Under what conditions is priorconsent (of a student) not required to disclose information?

24. § 99.31 Under what conditions is priorconsent not required to discloseinformation? • (a)An ... institution may disclose personally identifiable information from an education record of a student...if the disclosure meets one or more of the following conditions: • (1)The disclosure is to other school officials whom the …institution has determined to have legitimate educational interests.

25. § 99.33 What limitations apply to theredisclosure of information? • (a)(1) An ... institution may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the student…. • (e) If this Office (FPCO) determines that a third party improperly rediscloses personally identifiable information from education records ..., the ... institution may not allow that third party access to personally identifiable information from education records for at least five years.

26. § 99.7 What must an educational … institution include in itsannual notification? • (a)(3)(iii) If the ... institution has a policy of disclosing education records under §99.31(a)(1), a specification of criteria for determining who constitutes aschool officialand what constitutes alegitimate educational interest(must be included in the annual notification).

27. Model Annual Notification of Rights under FERPA for Post Secondary Institutions • The Family Educational Rights and Privacy Act (FERPA) affords students certain rights with respect to their education records. They are…. (3) The right to consent to disclosures of personally identifiable information contained in the student's education records, except to the extent that FERPA authorizes disclosure without consent. One exception which permits disclosure without consent is disclosure to school officials with legitimate educational interests. A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. • A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility…. • Available for download at www.ed.gov/offices/OM/fpco.html

28. And what does LeRoy say? • “…nothing in FERPA prevents an educational institution from contracting with a person or entity outside the institution to perform services that the institution would otherwise provide for itself.” (Letter from LeRoy Rooker to Daniel Boehmer, April 19,1993 found in McDonald, Steven J., The Family Educational Rights and Privacy Act: A Legal Compendium, NACUA, 1999, pp. 221-223.)

29. Key FERPA Terms for Outsourcing • School Officials • Legitimate Educational Interest • Annual FERPA Notification to Students

30. Balancing Risks • Identify data and level of confidentiality • Assess impact if confidentiality compromised • Release no unessential data • Assess vendor training • Assess vendor data security • Assess vendor attitude toward exclusivity of data or service—does it impact other operations?

31. Balancing Risks • Assess long term impact of decision on institution • Does institution have the resources to manage the contract? If “yes,” who is assigned that responsibility?

32. Outsourcing Agreement • State responsibility of both parties • Specify ownership and control of data rests with the institution • Include non-disclosure agreement • Specify compliance with FERPA • Prohibit unauthorized data usage • Consider indemnity clause; “hold harmless” • Explicitly name vendor as agent of the institution

33. Outsourcing Agreement (cont’d) • Establish dispute resolution procedure • Specify any usage of school name and logo • Establish performance measures • Limit length of initial agreement • Specify termination notice requirements • Limit exclusivity • Provide for periodic review and upgrades

34. Sample Terms • Non-directory information is to be stored in an encoded format. • Non-directory information is not to be viewed by, displayed to or available to employees at any time. • The vendor may not sell, distribute, release or disclose personally identifiable or directory information without the express written consent of the institution.

35. Sample Terms (cont’d) • The vendor has the right to use the name of the institution only in connection with rendering the service. • The institution appoints the vendor as its agent for the purpose of rendering the service. The agent is subject to and must comply with all state education codes and with the Family Educational Rights and Privacy Act of 1974 (as amended) (FERPA)

36. Sample Terms (cont’d) • Nothing in the contract shall be construed as limiting the activities of the institution for which it has been traditionally and ultimately responsible. • All fees are as specified in the contract and are for the period of the contract. Fees may only be changed with the consent of the institution.

37. Sample Terms (cont’d) • Upon termination of the contract for any reason, the vendor will return all information provided by the institution and will provide a certificate attesting that all information on the vendor systems and storage files provided by the institution has been destroyed.

38. Managing the Agreement • Successful agreement will benefit both school and vendor • Regular communication between vendor and school • Institution in client complaint loop • Regular reports on volume, turnaround time, service downtime, and service errors

39. What happens if things go awry? Develop a plan for continuing service if vendor relationship is severed

40. References AACRAO, Outsourcing Survey and Results (2001).http://www.aacrao.org/pro_development/outsource.htm Contact AACRAO Office, 202-293-9161. Fleming, M. Emerging Business Affiliation Models for E-COMMERCE. In Continuing Legal Education (eds.) E Commerce (Section III). St. Paul: Minnesota State Bar Association, 2000. Kaganoff, Tessa.Collaboration, Technology, and Outsourcing Initiatives in Higher Education: A Literature Review. Washington DC:Rand Corp., 1998.

41. To Contact Me… Richard A. Rainsberger, Ph.D. Consultant Education Records Law and Privacy msrrar@peoplepc.com 434-385-6228