Documentation and Reporting Requirements under FFATA and FERPA

1. Documentation and Reporting Requirements under FFATA and FERPA Brustein & Manasevit, PLLC www.bruman.com Spring Forum 2013 Steven Spillan, Esq. sspillan@bruman.com Brustein & Manasevit, PLLC

2. Overview • Federal reporting requirements under FFATA • Privacy Issues under FERPA • Future Concerns Brustein & Manasevit, PLLC

3. Reporting Under FFATA Brustein & Manasevit, PLLC

4. What is “reporting?” • Accountability measure used by granting agencies to ensure that federal funds are spent appropriately • Information supplied directly by grant recipients • For agencies and Congress, represents an agreement on accountability measure that both believe are neither too lax nor too burdensome Brustein & Manasevit, PLLC

5. Federal Reporting Requirements • Various reporting requirements under EDGAR and specific statutory programs • ARRA reporting • FFATA Brustein & Manasevit, PLLC

6. Federal Funding Accountability and Transparency Act (FFATA) • Enacted 2006 (took effect 2010) • Applies to grants and contracts • Dramatic increase in reporting requirements as part of push for public transparency • Along with ARRA, required development of centralized, web-based data collection and reporting platform Brustein & Manasevit, PLLC

7. FFATA Reporting: Background • Reporting needed to: • Assess grant performance/effectiveness • Provide Public opportunity to review • Increase in scope/amount of data means: • Need for better risk management • New technologies • Reported information available on single, searchable website open to public: www.usaspending.gov Brustein & Manasevit, PLLC

8. FFATA Reporting: Prime Recipients • “Prime Recipients” receive a grant or contract directly from federal government Brustein & Manasevit, PLLC

9. FFATA Reporting: Prime Recipients • Beginning with grants and contracts awarded to prime recipients after October 1, 2010 • Report on mandatory and discretionary grants and contracts • New layer of reporting: prime recipients must report data on first-tier subawards and executive compensation • Subawards include both subgrants and subcontracts Brustein & Manasevit, PLLC

10. FFATA Reporting: Prime Recipients • Applies to initial awards of $25,000 or more: • Prime recipients must report first-tier subawards of $25,000 or more, and executive compensation if conditions are met • If initial award is below $25,000, FFATA does not generally apply, but: • If subsequent grant modifications push grant over threshold, FFATA will apply • If modifications reduce grant below threshold, FFATA continues to apply Brustein & Manasevit, PLLC

11. FFATA Reporting: Exempt from Reporting • Expenditures including contracts, purchase agreements, vendor agreements and consultant agreements for supplies, equipment, and services • Grants under ARRA • Federal awards to individuals • Federal awards to entities with gross income of less than $300,000 • Classified information Brustein & Manasevit, PLLC

12. FFATA Reporting: Prime Recipients • Prime recipients that receive federal grants must register with two systems: • FFATA Subaward Reporting System (FSRS) • Accessible to federal reporting and prime recipients • Information available on www.usaspending.gov • Central Contractor Registration System (CCR) • Entities that do business with federal government • Links to Dun and Bradstreet (DUNS) Brustein & Manasevit, PLLC

13. FFATA Reporting: Subawards • First tier subawards • A grant or contract from a prime recipient to a subgrantee or subcontractor • Second tier subawards • A subsequent subgrant or subcontract between the subawardee and another entity Brustein & Manasevit, PLLC

14. FFATA Reporting: When? • Federal agencies, including ED: • Report prime award information to on 5th and 20th of each month • Prime recipients: • Report first tier subaward information by end of the month following the month in which the subaward was made Brustein & Manasevit, PLLC

15. FFATA Reporting: What? • Name of entity receiving award • Amount of award • Funding agency • NAICS code (contracts)/ CFDA number (grants) • Program source • Award title descriptive of the purpose of the funding action • Location of the subawardee (congressional district) • Place of performance (congressional district) • Unique identifier (DUNS) of entity and parent; and • Total compensation and names of top five executives, if required Brustein & Manasevit, PLLC

16. FFATA Reporting: Executive Compensation • Prime recipient must report the total compensation and names of 5 most highly compensated executives for both (a) itself, and (b) first-tier subawardees if: • More than 80% of annual gross revenue is from the federal government, and those annual revenues are greater than $25 million, and • Compensation information is not already available through reporting to SEC Brustein & Manasevit, PLLC

17. FFATA Guidance • April 6, 2010 OMB memo requiring the reporting of first-tier subawards • August 27, 2010 OMB guidance containing specific instructions on subaward reporting • http://www.whitehouse.gov/omb/open • FSRS FAQs • https://www.fsrs.gov/#a-faqs Brustein & Manasevit, PLLC

18. Privacy Under FERPA Brustein & Manasevit, PLLC

19. FERPA: Quick Overview • Family Educational Rights and Privacy Act (FERPA) • Education Records • Directory Information • Prohibition on Disclosure of Records • Prior Written Consent Rule & Exceptions • Right to Access and Inspect Brustein & Manasevit, PLLC

20. FERPA Rules • Section 513 of the Education Amendments of 1974 (P.L. 93-380) (aka “Buckley Amendment”) • Later codified at 20 U.S.C. § 1232g (Section 444 of the General Education Provisions Act) • Regulations are located in 34 C.F.R. Part 99 Brustein & Manasevit, PLLC

21. Basic FERPA Responsibilities • Educational agency or institution may not disclose personally identifiable information within education records to third-parties without prior written consent of the parent or eligible student (with exceptions) – 20 U.S.C. § 1232g(b). • Educational agency must permit the parent or eligible student to inspect and review all education records unless such right has been waived (with exceptions) – 20 U.S.C. § 1232g(a). Brustein & Manasevit, PLLC

22. Basic FERPA Responsibilities (cont.) • Parent or eligible student has the right to request the correction of education records which they believe to be inaccurate or misleading (with limitations) – 34 C.F.R. 99.20. • Designating directory information – 34 C.F.R. 99.3. • Educational agency must provide annual notification of rights – 34 C.F.R. 99.7. Brustein & Manasevit, PLLC

23. Who is covered by FERPA? • Any “educational agency or institution” that receives funds under any program administered by the U.S. Department of Education if: • (1) The educational institution provides educational services or instruction, or both, to students; or • (2) The educational agency is authorized to direct and control public elementary or secondary, or postsecondary educational institutions. Brustein & Manasevit, PLLC

24. Who has FERPA rights? • Eligible students or parent(s) • Rejected applicant does not have FERPA rights • Student accepted for admission at a school but who ultimately does not attend – no FERPA rights • Employees of schools – no FERPA rights Brustein & Manasevit, PLLC

25. Education Records • Education records include, but are not limited to: • Student GPAs and transcripts; final course grades • Admissions materials • Financial aid records • Disciplinary records • Attendance records • Academic counseling records • Personally identifiable information within the above documents cannot be disclosed unless (1) directory information, (2) prior written consent, or (3) an exception to general rule Brustein & Manasevit, PLLC

26. Directory Information • FERPA allows information designated as “directory information” to be disclosed (without consent) under two conditions: • Annual notification of right to opt out of the disclosure • Opportunity to opt out of the disclosure Brustein & Manasevit, PLLC

27. Directory Information (cont.) • SSN and other student ID numbers cannot be designated directory information • School may designate a user ID or unique identifier (not an SSN) used by the student to access or communicate within electronic systems under the condition that: • The user ID or other unique identifier cannot permit access to education records except when combined with other authenticating information known only to the student (such as a password or separate PIN) Brustein & Manasevit, PLLC

28. Personally Identifiable Information • Personally identifiable information includes but is not limited to: • The student's name; • The name of the student's parent or other family members; • The address of the student or student's family; • A personal identifier, such as the student's social security number, student number, or biometric record; Brustein & Manasevit, PLLC

29. Personally Identifiable Information (cont.) • Other indirect identifiers, such as date/place of birth, mother's maiden name; • Information that is linked or linkable to a specific student that would allow a reasonable person in the school community, to identify the student with reasonable certainty; or • Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. Brustein & Manasevit, PLLC

30. “De-Identification” of Information • Sets forth objective standards (“reasonable person” standard) for whether information released would make the student easily identifiable • Recognizes that re-identification risk of any release of redacted records is cumulative (because of new technology) • Requires educational agencies and institutions to apply a consistent de-identification strategy for all data releases of a similar type Brustein & Manasevit, PLLC

31. Opt Out of Directory Information: In-Class Disclosures of Information • Student may not use the right to opt of directory information to prevent disclosure or prevent requiring a student to disclose his/her name, electronic ID number, or institutional e-mail address in a class where he/she is enrolled (“the right to opt out of directory information disclosures does not include a right to remain anonymous in class”) • Student’s opt-out decision is indefinite, unless the student rescinds the decision at a later date Brustein & Manasevit, PLLC

32. Disclosure of Personally Identifiable Information: Outsourcing ED has issued policy letters regarding the use of private contractors and other third parties providing services and functions to educational agencies and institutions: • Use of contractors for developing and maintaining longitudinal data systems = allowable disclosure under FERPA (under the “authorized agents” exception, as long as the contractors have “legitimate educational interests”) • Use of other state agency officials as “authorized agents” in maintaining state longitudinal systems = not allowable – lack of “direct control” by educational agency Brustein & Manasevit, PLLC

33. Disclosure to OrganizationsConducting Studies • Institution must enter into written agreement with recipient organization that specifies the purpose of the study • Institution does not have to agree with or endorse the conclusions or results of the study Brustein & Manasevit, PLLC

34. Disclosure to OrganizationsConducting Studies (cont.) • Written agreement must include provisions: • Designating authorized representative; • Specifying the (1) information to be disclosed (2) for purpose of carrying out an audit or evaluation of federal- or State- supported education programs, or to enforce or to comply with federal legal requirements that relate to those programs; • Requiring authorized representative to destroy or return PII from education records when the information is no longer needed for the purpose specified Brustein & Manasevit, PLLC

35. Disclosures for Auditing Purposes • Authorized representatives of: • The Comptroller General of the United States; • The Attorney General of the United States; • The Secretary; or • The State and local educational authorities. • May have access to education records in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of, or compliance with, Federal legal requirements that relate to those programs. Brustein & Manasevit, PLLC

36. Disclosure for Auditing Purposes • What About OIG? • For example: • DOL OIG wants access to education records for audit of an entity’s WIA program. Can an institution make such a disclosure? • Inspector General Act gives OIG authority to conduct audits • OIG is not listed in FERPA rule exceptions • Institutions may want to get a ruling from either DOL or FPCO before turning over education records Brustein & Manasevit, PLLC

37. Access to Education Records by School Officials • Educational agencies or institutions must use reasonable methods to ensure that teachers and other school officials obtain access only to education records in which they have a legitimate interest • The approach must be a combination of appropriate physical, technical, administrative and operational controls • If physical or technological controls are not used, policies and procedures must be effective in limiting access to appropriate staff • Reasonableness of controls depends upon usual and customary good practices, requiring ongoing review and modification Brustein & Manasevit, PLLC

38. Disclosure to Prospective School • An exception to the written consent requirements if the disclosure is “to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer.” • Still requires notification Brustein & Manasevit, PLLC

39. Disclosure to Prospective School (cont.) • Some schools maintain “blanket consortium agreements” • Allows students to take courses at multiple institutions toward the same degree or certificate, without notifying students every time records are disclosed between institutions • So long as annual notification specifies that the institution will make such disclosures, individual notifications are not required Brustein & Manasevit, PLLC

40. Other Disclosures • The Campus Sex Crimes Prevention Act • Clery Act • Health and Safety Emergency • Alumni Brustein & Manasevit, PLLC

41. Confirming the Identity of the Party Receiving the Disclosure • Must use reasonable methods to identify and authenticate the identity of the recipient before providing information • Must have usual and customary good business practices, which require ongoing review and modification of procedures when necessary • Must reduce the risk of unauthorized disclosure to a level that is commensurate with the likely threat and potential harm from wrongful disclosure Brustein & Manasevit, PLLC

42. Recent Updates • Uninterrupted Scholars Act • Passed in 2012 • Expanded list of agencies exempt from disclosure prohibitions, provided any disclosure of records is consistent with a State’s confidentiality laws : • State or local welfare agencies • Tribal organizations responsible for student placement and care • Extended the release of records to parents and students in child welfare court proceedings involving child abuse and neglect or dependency issues. Brustein & Manasevit, PLLC

43. Recent Updates • OMB Super Circular • Online posting of A-133 audit reports • Must remove all PII • Short time frame for submitting reports (no extensions) Brustein & Manasevit, PLLC

44. Future Concerns Brustein & Manasevit, PLLC

45. More Reporting? • 112th Congress introduced bill expanding ARRA reporting to all federal programs • General bipartisan support • No effort to reintroduce in 113th Congress…yet Brustein & Manasevit, PLLC

46. Evolving Privacy • FERPA rules change almost every two years • Federal definitions of privacy, exempt agencies, PII constantly evolving • ED interpretation of federal statute shifts with administrations Brustein & Manasevit, PLLC

47. Questions? Brustein & Manasevit, PLLC

48. Disclaimer This presentation is intended solely to provide general information and does not constitute legal advice. Attendance at the presentation or later review of these printed materials does not create an attorney-client relationship with Brustein & Manasevit, PLLC. You should not take any action based upon any information in this presentation without first consulting legal counsel familiar with your particular circumstances. Brustein & Manasevit, PLLC