Documentation and Reporting Requirements under FFATA and FERPA Brustein & Manasevit, PLLC Spring...

Documentation and Documentation and Reporting Requirements Reporting Requirements under FFATA and FERPAunder FFATA and FERPA

Brustein & Manasevit, PLLCwww.bruman.comSpring Forum 2013

Steven Spillan, [email protected]

1Brustein & Manasevit, PLLC

OverviewOverviewFederal reporting requirements

under FFATA

Privacy Issues under FERPA

Future Concerns


REPORTING UNDER REPORTING UNDER FFATAFFATA


What is “reporting?”What is “reporting?”Accountability measure used by

granting agencies to ensure that federal funds are spent appropriately

Information supplied directly by grant recipients

For agencies and Congress, represents an agreement on accountability measure that both believe are neither too lax nor too burdensome


Federal Reporting Federal Reporting RequirementsRequirementsVarious reporting requirements

under EDGAR and specific statutory programs

ARRA reporting

FFATA


Federal Funding Federal Funding Accountability and Accountability and Transparency Act (FFATA)Transparency Act (FFATA)Enacted 2006 (took effect 2010)Applies to grants and contractsDramatic increase in reporting

requirements as part of push for public transparency

Along with ARRA, required development of centralized, web-based data collection and reporting platform


FFATA Reporting: FFATA Reporting: BackgroundBackgroundReporting needed to:

◦Assess grant performance/effectiveness◦Provide Public opportunity to review

Increase in scope/amount of data means:◦Need for better risk management◦New technologies

Reported information available on single, searchable website open to public: www.usaspending.gov


FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients “Prime Recipients” receive a

grant or contract directly from federal government


FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients Beginning with grants and contracts

awarded to prime recipients after October 1, 2010

Report on mandatory and discretionary grants and contracts

New layer of reporting: prime recipients must report data on first-tier subawards and executive compensation◦Subawards include both subgrants and

subcontracts


FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients Applies to initial awards of $25,000

or more:◦Prime recipients must report first-tier

subawards of $25,000 or more, and executive compensation if conditions are met

If initial award is below $25,000, FFATA does not generally apply, but:◦ If subsequent grant modifications push

grant over threshold, FFATA will apply◦ If modifications reduce grant below

threshold, FFATA continues to apply


FFATA Reporting: Exempt FFATA Reporting: Exempt from Reportingfrom ReportingExpenditures including contracts,

purchase agreements, vendor agreements and consultant agreements for supplies, equipment, and services

Grants under ARRAFederal awards to individualsFederal awards to entities with gross

income of less than $300,000Classified information


FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients

Prime recipients that receive federal grants must register with two systems:◦FFATA Subaward Reporting System (FSRS)

Accessible to federal reporting and prime recipients

Information available on www.usaspending.gov

◦Central Contractor Registration System (CCR) Entities that do business with federal

government Links to Dun and Bradstreet (DUNS)


FFATA Reporting: FFATA Reporting: SubawardsSubawardsFirst tier subawards

◦A grant or contract from a prime recipient to a subgrantee or subcontractor

Second tier subawards◦A subsequent subgrant or

subcontract between the subawardee and another entity


FFATA Reporting: When?FFATA Reporting: When?

Federal agencies, including ED:◦Report prime award information

to on 5th and 20th of each monthPrime recipients:

◦Report first tier subaward information by end of the month following the month in which the subaward was made


FFATA Reporting: What?FFATA Reporting: What?Name of entity receiving awardAmount of awardFunding agencyNAICS code (contracts)/ CFDA number (grants)Program sourceAward title descriptive of the purpose of the funding

actionLocation of the subawardee (congressional district)Place of performance (congressional district)Unique identifier (DUNS) of entity and parent; andTotal compensation and names of top five executives,

if required


FFATA Reporting: Executive FFATA Reporting: Executive CompensationCompensationPrime recipient must report the total

compensation and names of 5 most highly compensated executives for both (a) itself, and (b) first-tier subawardees if:◦More than 80% of annual gross revenue

is from the federal government, and those annual revenues are greater than $25 million, and

◦Compensation information is not already available through reporting to SEC


FFATA GuidanceFFATA GuidanceApril 6, 2010 OMB memo

requiring the reporting of first-tier subawards

August 27, 2010 OMB guidance containing specific instructions on subaward reporting◦http://www.whitehouse.gov/omb/ope

nFSRS FAQs

◦https://www.fsrs.gov/#a-faqs 17Brustein & Manasevit, PLLC

PRIVACY UNDER PRIVACY UNDER FERPAFERPA


Family Educational Rights and Privacy Act (FERPA)◦Education Records◦Directory Information◦Prohibition on Disclosure of Records

◦Prior Written Consent Rule & Exceptions

◦Right to Access and Inspect

FERPA: Quick OverviewFERPA: Quick Overview


Section 513 of the Education Amendments of 1974 (P.L. 93-380) (aka “Buckley Amendment”)

Later codified at 20 U.S.C. § 1232g (Section 444 of the General Education Provisions Act)

Regulations are located in 34 C.F.R. Part 99

FERPA RulesFERPA Rules


• Educational agency or institution may not disclose personally identifiable information within education records to third-parties without prior written consent of the parent or eligible student

(with exceptions) – 20 U.S.C. § 1232g(b).

• Educational agency must permit the parent or eligible student to inspect and review all education records unless such right has been waived (with exceptions) – 20 U.S.C. § 1232g(a).

Basic FERPA ResponsibilitiesBasic FERPA Responsibilities


Parent or eligible student has the right to request the correction of education records which they believe to be inaccurate or misleading (with limitations) – 34 C.F.R. 99.20.

Designating directory information – 34 C.F.R. 99.3.

Educational agency must provide annual notification of rights – 34 C.F.R. 99.7.

Basic FERPA Responsibilities (cont.)Basic FERPA Responsibilities (cont.)


Any “educational agency or institution” that receives funds under any program administered by the U.S. Department of Education if:(1) The educational institution

provides educational services or instruction, or both, to students; or

(2) The educational agency is authorized to direct and control public elementary or secondary, or postsecondary educational institutions.

Who is covered by FERPA?Who is covered by FERPA?


Eligible students or parent(s)

Rejected applicant does not have FERPA rights

Student accepted for admission at a school but who ultimately does not attend – no FERPA rights

Employees of schools – no FERPA rights

Who has FERPA rights?Who has FERPA rights?


Education records include, but are not limited to:◦ Student GPAs and transcripts; final course

grades◦ Admissions materials◦ Financial aid records◦ Disciplinary records◦ Attendance records◦ Academic counseling records

Personally identifiable information within the above documents cannot be disclosed unless (1) directory information, (2) prior written consent, or (3) an exception to general rule

Education RecordsEducation Records


FERPA allows information designated as “directory information” to be disclosed (without consent) under two conditions: ◦Annual notification of right to opt out

of the disclosure◦Opportunity to opt out of the

disclosure

Directory InformationDirectory Information


SSN and other student ID numbers cannot be designated directory information

School may designate a user ID or unique identifier (not an SSN) used by the student to access or communicate within electronic systems under the condition that:o The user ID or other unique identifier

cannot permit access to education records except when combined with other authenticating information known only to the student (such as a password or separate PIN)

Directory Information (cont.)Directory Information (cont.)


Personally identifiable information includes but is not limited to:

◦The student's name;◦The name of the student's parent or

other family members;◦The address of the student or

student's family;◦A personal identifier, such as the

student's social security number, student number, or biometric record;

Personally Identifiable Personally Identifiable InformationInformation


Other indirect identifiers, such as date/place of birth, mother's maiden name;

Information that is linked or linkable to a specific student that would allow a reasonable person in the school community, to identify the student with reasonable certainty; or

Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

Personally Identifiable Information Personally Identifiable Information (cont.)(cont.)


Sets forth objective standards (“reasonable person” standard) for whether information released would make the student easily identifiable

Recognizes that re-identification risk of any release of redacted records is cumulative (because of new technology)

Requires educational agencies and institutions to apply a consistent de-identification strategy for all data releases of a similar type

““De-Identification” of De-Identification” of InformationInformation


Student may not use the right to opt of directory information to prevent disclosure or prevent requiring a student to disclose his/her name, electronic ID number, or institutional e-mail address in a class where he/she is enrolled (“the right to opt out of directory information disclosures does not include a right to remain anonymous in class”)

Student’s opt-out decision is indefinite, unless the student rescinds the decision at a later date

Opt Out of Directory Opt Out of Directory Information: In-Class Information: In-Class Disclosures of InformationDisclosures of Information


ED has issued policy letters regarding the use of private contractors and other third parties providing services and functions to educational agencies and institutions:◦Use of contractors for developing and

maintaining longitudinal data systems = allowable disclosure under FERPA (under the “authorized agents” exception, as long as the contractors have “legitimate educational interests”)

◦Use of other state agency officials as “authorized agents” in maintaining state longitudinal systems = not allowable – lack of “direct control” by educational agency

Disclosure of Personally Disclosure of Personally Identifiable Information: Identifiable Information: OutsourcingOutsourcing


Institution must enter into written agreement with recipient organization that specifies the purpose of the study

Institution does not have to agree with or endorse the conclusions or results of the study

Disclosure to OrganizationsDisclosure to OrganizationsConducting StudiesConducting Studies


Written agreement must include provisions:◦ Designating authorized representative;◦ Specifying the (1) information to be disclosed

(2) for purpose of carrying out an audit or evaluation of federal- or State- supported education programs, or to enforce or to comply with federal legal requirements that relate to those programs;

◦ Requiring authorized representative to destroy or return PII from education records when the information is no longer needed for the purpose specified

Disclosure to OrganizationsDisclosure to OrganizationsConducting Studies (cont.)Conducting Studies (cont.)


Disclosures for Auditing PurposesAuthorized representatives of:

◦ The Comptroller General of the United States;

◦ The Attorney General of the United States;◦ The Secretary; or◦ The State and local educational authorities.

May have access to education records in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of, or compliance with, Federal legal requirements that relate to those programs.


Disclosure for Auditing PurposesWhat About OIG?For example:

◦DOL OIG wants access to education records for audit of an entity’s WIA program. Can an institution make such a disclosure?

Inspector General Act gives OIG authority to conduct audits

OIG is not listed in FERPA rule exceptions

Institutions may want to get a ruling from either DOL or FPCO before turning over education records


Educational agencies or institutions must use reasonable methods to ensure that teachers and other school officials obtain access only to education records in which they have a legitimate interest

The approach must be a combination of appropriate physical, technical, administrative and operational controls

If physical or technological controls are not used, policies and procedures must be effective in limiting access to appropriate staff

Reasonableness of controls depends upon usual and customary good practices, requiring ongoing review and modification

Access to Education Records Access to Education Records by School Officialsby School Officials


An exception to the written consent requirements if the disclosure is “to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer.”

Still requires notification

Disclosure to Prospective Disclosure to Prospective SchoolSchool


Disclosure to Prospective School (cont.)Some schools maintain “blanket

consortium agreements” ◦Allows students to take courses at

multiple institutions toward the same degree or certificate, without notifying students every time records are disclosed between institutions

So long as annual notification specifies that the institution will make such disclosures, individual notifications are not required


The Campus Sex Crimes Prevention Act

Clery Act

Health and Safety Emergency

Alumni

Other DisclosuresOther Disclosures


Must use reasonable methods to identify and authenticate the identity of the recipient before providing information

Must have usual and customary good business practices, which require ongoing review and modification of procedures when necessary

Must reduce the risk of unauthorized disclosure to a level that is commensurate with the likely threat and potential harm from wrongful disclosure

Confirming the Identity of Confirming the Identity of the Party Receiving the the Party Receiving the DisclosureDisclosure


Recent UpdatesRecent UpdatesUninterrupted Scholars Act

◦Passed in 2012◦Expanded list of agencies exempt from

disclosure prohibitions, provided any disclosure of records is consistent with a State’s confidentiality laws : State or local welfare agencies Tribal organizations responsible for student

placement and care◦Extended the release of records to

parents and students in child welfare court proceedings involving child abuse and neglect or dependency issues.


Recent UpdatesRecent UpdatesOMB Super Circular

◦Online posting of A-133 audit reports◦Must remove all PII◦Short time frame for submitting

reports (no extensions)


FUTURE CONCERNSFUTURE CONCERNS


More Reporting?More Reporting?

112th Congress introduced bill

expanding ARRA reporting to all

federal programs

General bipartisan support

No effort to reintroduce in 113th

Congress…yet


Evolving PrivacyEvolving PrivacyFERPA rules change almost every

two yearsFederal definitions of privacy,

exempt agencies, PII constantly evolving

ED interpretation of federal statute shifts with administrations


QUESTIONS?


DisclaimerDisclaimerThis presentation is intended solely to provide general information and does not constitute legal advice.

Attendance at the presentation or later review of these printed materials does not create an

attorney-client relationship with Brustein & Manasevit, PLLC. You should not take any action based

upon any information in this presentation without first

consulting legal counsel familiar with your particular

circumstances.


Documentation and Reporting Requirements under FFATA and FERPA Brustein & Manasevit, PLLC Spring...

Documents

Transcript of Documentation and Reporting Requirements under FFATA and FERPA Brustein & Manasevit, PLLC Spring...