1. Documentation and Reporting Requirements under FFATA and FERPA Brustein & Manasevit, PLLC www.bruman.com Spring Forum 2013 Steven Spillan, Esq. sspillan@bruman.com 1Brustein & Manasevit, PLLC

2. Overview Federal reporting requirements under FFATA Privacy Issues under FERPA Future Concerns 2Brustein & Manasevit, PLLC

3. REPORTING UNDER FFATA 3Brustein & Manasevit, PLLC

4. What is “reporting?” Accountability measure used by granting agencies to ensure that federal funds are spent appropriately Information supplied directly by grant recipients For agencies and Congress, represents an agreement on accountability measure that both believe are neither too lax nor too burdensome 4Brustein & Manasevit, PLLC

5. Federal Reporting Requirements Various reporting requirements under EDGAR and specific statutory programs ARRA reporting FFATA 5Brustein & Manasevit, PLLC

6. Federal Funding Accountability and Transparency Act (FFATA) Enacted 2006 (took effect 2010) Applies to grants and contracts Dramatic increase in reporting requirements as part of push for public transparency Along with ARRA, required development of centralized, web-based data collection and reporting platform 6Brustein & Manasevit, PLLC

7. FFATA Reporting: Background Reporting needed to: ◦ Assess grant performance/effectiveness ◦ Provide Public opportunity to review Increase in scope/amount of data means: ◦ Need for better risk management ◦ New technologies Reported information available on single, searchable website open to public: www.usaspending.gov www.usaspending.gov 7Brustein & Manasevit, PLLC

8. FFATA Reporting: Prime Recipients “Prime Recipients” receive a grant or contract directly from federal government 8Brustein & Manasevit, PLLC

9. FFATA Reporting: Prime Recipients Beginning with grants and contracts awarded to prime recipients after October 1, 2010 Report on mandatory and discretionary grants and contracts New layer of reporting: prime recipients must report data on first-tier subawards and executive compensation ◦ Subawards include both subgrants and subcontracts 9Brustein & Manasevit, PLLC

10. FFATA Reporting: Prime Recipients Applies to initial awards of $25,000 or more: ◦ Prime recipients must report first-tier subawards of $25,000 or more, and executive compensation if conditions are met If initial award is below $25,000, FFATA does not generally apply, but: ◦ If subsequent grant modifications push grant over threshold, FFATA will apply ◦ If modifications reduce grant below threshold, FFATA continues to apply 10Brustein & Manasevit, PLLC

11. FFATA Reporting: Exempt from Reporting Expenditures including contracts, purchase agreements, vendor agreements and consultant agreements for supplies, equipment, and services Grants under ARRA Federal awards to individuals Federal awards to entities with gross income of less than $300,000 Classified information 11Brustein & Manasevit, PLLC

12. FFATA Reporting: Prime Recipients Prime recipients that receive federal grants must register with two systems: ◦ FFATA Subaward Reporting System (FSRS)  Accessible to federal reporting and prime recipients  Information available on www.usaspending.govwww.usaspending.gov ◦ Central Contractor Registration System (CCR)  Entities that do business with federal government  Links to Dun and Bradstreet (DUNS) 12Brustein & Manasevit, PLLC

13. FFATA Reporting: Subawards First tier subawards ◦ A grant or contract from a prime recipient to a subgrantee or subcontractor Second tier subawards ◦ A subsequent subgrant or subcontract between the subawardee and another entity 13Brustein & Manasevit, PLLC

14. FFATA Reporting: When? Federal agencies, including ED: ◦ Report prime award information to on 5 th and 20 th of each month Prime recipients: ◦ Report first tier subaward information by end of the month following the month in which the subaward was made 14Brustein & Manasevit, PLLC

15. FFATA Reporting: What? Name of entity receiving award Amount of award Funding agency NAICS code (contracts)/ CFDA number (grants) Program source Award title descriptive of the purpose of the funding action Location of the subawardee (congressional district) Place of performance (congressional district) Unique identifier (DUNS) of entity and parent; and Total compensation and names of top five executives, if required 15Brustein & Manasevit, PLLC

16. FFATA Reporting: Executive Compensation Prime recipient must report the total compensation and names of 5 most highly compensated executives for both (a) itself, and (b) first-tier subawardees if: ◦ More than 80% of annual gross revenue is from the federal government, and those annual revenues are greater than $25 million, and ◦ Compensation information is not already available through reporting to SEC 16Brustein & Manasevit, PLLC

17. FFATA Guidance April 6, 2010 OMB memo requiring the reporting of first-tier subawards August 27, 2010 OMB guidance containing specific instructions on subaward reporting ◦ http://www.whitehouse.gov/omb/open http://www.whitehouse.gov/omb/open FSRS FAQs ◦ https://www.fsrs.gov/#a-faqs https://www.fsrs.gov/#a-faqs 17Brustein & Manasevit, PLLC

18. PRIVACY UNDER FERPA 18Brustein & Manasevit, PLLC

19. Family Educational Rights and Privacy Act (FERPA) ◦ Education Records ◦ Directory Information ◦ Prohibition on Disclosure of Records ◦ Prior Written Consent Rule & Exceptions ◦ Right to Access and Inspect FERPA: Quick Overview 19Brustein & Manasevit, PLLC

20. Section 513 of the Education Amendments of 1974 (P.L. 93-380) (aka “Buckley Amendment”) Later codified at 20 U.S.C. § 1232g (Section 444 of the General Education Provisions Act) Regulations are located in 34 C.F.R. Part 99 FERPA Rules 20Brustein & Manasevit, PLLC

21. Educational agency or institution may not disclose personally identifiable information within education records to third-parties without prior written consent of the parent or eligible student (with exceptions) – 20 U.S.C. § 1232g(b). Educational agency must permit the parent or eligible student to inspect and review all education records unless such right has been waived (with exceptions) – 20 U.S.C. § 1232g(a). Basic FERPA Responsibilities 21Brustein & Manasevit, PLLC

22. Parent or eligible student has the right to request the correction of education records which they believe to be inaccurate or misleading (with limitations) – 34 C.F.R. 99.20. Designating directory information – 34 C.F.R. 99.3. Educational agency must provide annual notification of rights – 34 C.F.R. 99.7. Basic FERPA Responsibilities (cont.) 22Brustein & Manasevit, PLLC

23. Any “educational agency or institution” that receives funds under any program administered by the U.S. Department of Education if: (1) The educational institution provides educational services or instruction, or both, to students; or (2) The educational agency is authorized to direct and control public elementary or secondary, or postsecondary educational institutions. Who is covered by FERPA? 23Brustein & Manasevit, PLLC

24. Eligible students or parent(s) Rejected applicant does not have FERPA rights Student accepted for admission at a school but who ultimately does not attend – no FERPA rights Employees of schools – no FERPA rights Who has FERPA rights? 24Brustein & Manasevit, PLLC

25. Education records include, but are not limited to: ◦ Student GPAs and transcripts; final course grades ◦ Admissions materials ◦ Financial aid records ◦ Disciplinary records ◦ Attendance records ◦ Academic counseling records Personally identifiable information within the above documents cannot be disclosed unless (1) directory information, (2) prior written consent, or (3) an exception to general rule Education Records 25Brustein & Manasevit, PLLC

26. FERPA allows information designated as “directory information” to be disclosed (without consent) under two conditions: ◦ Annual notification of right to opt out of the disclosure ◦ Opportunity to opt out of the disclosure Directory Information 26Brustein & Manasevit, PLLC

27. SSN and other student ID numbers cannot be designated directory information School may designate a user ID or unique identifier (not an SSN) used by the student to access or communicate within electronic systems under the condition that: o The user ID or other unique identifier cannot permit access to education records except when combined with other authenticating information known only to the student (such as a password or separate PIN) Directory Information (cont.) 27Brustein & Manasevit, PLLC

28. Personally identifiable information includes but is not limited to: ◦ The student's name; ◦ The name of the student's parent or other family members; ◦ The address of the student or student's family; ◦ A personal identifier, such as the student's social security number, student number, or biometric record; Personally Identifiable Information 28Brustein & Manasevit, PLLC

29. Other indirect identifiers, such as date/place of birth, mother's maiden name; Information that is linked or linkable to a specific student that would allow a reasonable person in the school community, to identify the student with reasonable certainty; or Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates. Personally Identifiable Information (cont.) 29Brustein & Manasevit, PLLC

30. Sets forth objective standards (“reasonable person” standard) for whether information released would make the student easily identifiable Recognizes that re-identification risk of any release of redacted records is cumulative (because of new technology) Requires educational agencies and institutions to apply a consistent de-identification strategy for all data releases of a similar type “De-Identification” of Information 30Brustein & Manasevit, PLLC

31. Student may not use the right to opt of directory information to prevent disclosure or prevent requiring a student to disclose his/her name, electronic ID number, or institutional e- mail address in a class where he/she is enrolled (“the right to opt out of directory information disclosures does not include a right to remain anonymous in class”) Student’s opt-out decision is indefinite, unless the student rescinds the decision at a later date Opt Out of Directory Information: In-Class Disclosures of Information 31Brustein & Manasevit, PLLC

32. ED has issued policy letters regarding the use of private contractors and other third parties providing services and functions to educational agencies and institutions: ◦ Use of contractors for developing and maintaining longitudinal data systems = allowable disclosure under FERPA (under the “authorized agents” exception, as long as the contractors have “legitimate educational interests”) ◦ Use of other state agency officials as “authorized agents” in maintaining state longitudinal systems = not allowable – lack of “direct control” by educational agency Disclosure of Personally Identifiable Information: Outsourcing 32Brustein & Manasevit, PLLC

33. Institution must enter into written agreement with recipient organization that specifies the purpose of the study Institution does not have to agree with or endorse the conclusions or results of the study Disclosure to Organizations Conducting Studies 33Brustein & Manasevit, PLLC

34. Written agreement must include provisions: ◦ Designating authorized representative; ◦ Specifying the (1) information to be disclosed (2) for purpose of carrying out an audit or evaluation of federal- or State- supported education programs, or to enforce or to comply with federal legal requirements that relate to those programs; ◦ Requiring authorized representative to destroy or return PII from education records when the information is no longer needed for the purpose specified Disclosure to Organizations Conducting Studies (cont.) 34Brustein & Manasevit, PLLC

35. Disclosures for Auditing Purposes Authorized representatives of: ◦ The Comptroller General of the United States; ◦ The Attorney General of the United States; ◦ The Secretary; or ◦ The State and local educational authorities. May have access to education records in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of, or compliance with, Federal legal requirements that relate to those programs. 35Brustein & Manasevit, PLLC

36. Disclosure for Auditing Purposes What About OIG? For example: ◦ DOL OIG wants access to education records for audit of an entity’s WIA program. Can an institution make such a disclosure? Inspector General Act gives OIG authority to conduct audits OIG is not listed in FERPA rule exceptions Institutions may want to get a ruling from either DOL or FPCO before turning over education records 36Brustein & Manasevit, PLLC

37. Educational agencies or institutions must use reasonable methods to ensure that teachers and other school officials obtain access only to education records in which they have a legitimate interest The approach must be a combination of appropriate physical, technical, administrative and operational controls If physical or technological controls are not used, policies and procedures must be effective in limiting access to appropriate staff Reasonableness of controls depends upon usual and customary good practices, requiring ongoing review and modification Access to Education Records by School Officials 37Brustein & Manasevit, PLLC

38. An exception to the written consent requirements if the disclosure is “to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer.” Still requires notification Disclosure to Prospective School 38Brustein & Manasevit, PLLC

39. Disclosure to Prospective School (cont.) Some schools maintain “blanket consortium agreements” ◦ Allows students to take courses at multiple institutions toward the same degree or certificate, without notifying students every time records are disclosed between institutions So long as annual notification specifies that the institution will make such disclosures, individual notifications are not required 39Brustein & Manasevit, PLLC

40. The Campus Sex Crimes Prevention Act Clery Act Health and Safety Emergency Alumni Other Disclosures 40Brustein & Manasevit, PLLC

41. Must use reasonable methods to identify and authenticate the identity of the recipient before providing information Must have usual and customary good business practices, which require ongoing review and modification of procedures when necessary Must reduce the risk of unauthorized disclosure to a level that is commensurate with the likely threat and potential harm from wrongful disclosure Confirming the Identity of the Party Receiving the Disclosure 41Brustein & Manasevit, PLLC

42. Recent Updates Uninterrupted Scholars Act ◦ Passed in 2012 ◦ Expanded list of agencies exempt from disclosure prohibitions, provided any disclosure of records is consistent with a State’s confidentiality laws :  State or local welfare agencies  Tribal organizations responsible for student placement and care ◦ Extended the release of records to parents and students in child welfare court proceedings involving child abuse and neglect or dependency issues. 42Brustein & Manasevit, PLLC

43. Recent Updates OMB Super Circular ◦ Online posting of A-133 audit reports ◦ Must remove all PII ◦ Short time frame for submitting reports (no extensions) 43Brustein & Manasevit, PLLC

44. FUTURE CONCERNS 44Brustein & Manasevit, PLLC

45. More Reporting? 112 th Congress introduced bill expanding ARRA reporting to all federal programs General bipartisan support No effort to reintroduce in 113 th Congress…yet 45Brustein & Manasevit, PLLC

46. Evolving Privacy FERPA rules change almost every two years Federal definitions of privacy, exempt agencies, PII constantly evolving ED interpretation of federal statute shifts with administrations 46Brustein & Manasevit, PLLC

47. QUESTIONS? 47Brustein & Manasevit, PLLC

48. Disclaimer This presentation is intended solely to provide general information and does not constitute legal advice. Attendance at the presentation or later review of these printed materials does not create an attorney-client relationship with Brustein & Manasevit, PLLC. You should not take any action based upon any information in this presentation without first consulting legal counsel familiar with your particular circumstances. 48Brustein & Manasevit, PLLC