Upload
jack-gallagher
View
233
Download
0
Tags:
Embed Size (px)
Citation preview
Documentation and Documentation and Reporting Requirements Reporting Requirements under FFATA and FERPAunder FFATA and FERPA
Brustein & Manasevit, PLLCwww.bruman.comSpring Forum 2013
Steven Spillan, [email protected]
1Brustein & Manasevit, PLLC
OverviewOverviewFederal reporting requirements
under FFATA
Privacy Issues under FERPA
Future Concerns
2Brustein & Manasevit, PLLC
REPORTING UNDER REPORTING UNDER FFATAFFATA
3Brustein & Manasevit, PLLC
What is “reporting?”What is “reporting?”Accountability measure used by
granting agencies to ensure that federal funds are spent appropriately
Information supplied directly by grant recipients
For agencies and Congress, represents an agreement on accountability measure that both believe are neither too lax nor too burdensome
4Brustein & Manasevit, PLLC
Federal Reporting Federal Reporting RequirementsRequirementsVarious reporting requirements
under EDGAR and specific statutory programs
ARRA reporting
FFATA
5Brustein & Manasevit, PLLC
Federal Funding Federal Funding Accountability and Accountability and Transparency Act (FFATA)Transparency Act (FFATA)Enacted 2006 (took effect 2010)Applies to grants and contractsDramatic increase in reporting
requirements as part of push for public transparency
Along with ARRA, required development of centralized, web-based data collection and reporting platform
6Brustein & Manasevit, PLLC
FFATA Reporting: FFATA Reporting: BackgroundBackgroundReporting needed to:
◦Assess grant performance/effectiveness◦Provide Public opportunity to review
Increase in scope/amount of data means:◦Need for better risk management◦New technologies
Reported information available on single, searchable website open to public: www.usaspending.gov
7Brustein & Manasevit, PLLC
FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients “Prime Recipients” receive a
grant or contract directly from federal government
8Brustein & Manasevit, PLLC
FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients Beginning with grants and contracts
awarded to prime recipients after October 1, 2010
Report on mandatory and discretionary grants and contracts
New layer of reporting: prime recipients must report data on first-tier subawards and executive compensation◦Subawards include both subgrants and
subcontracts
9Brustein & Manasevit, PLLC
FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients Applies to initial awards of $25,000
or more:◦Prime recipients must report first-tier
subawards of $25,000 or more, and executive compensation if conditions are met
If initial award is below $25,000, FFATA does not generally apply, but:◦ If subsequent grant modifications push
grant over threshold, FFATA will apply◦ If modifications reduce grant below
threshold, FFATA continues to apply
10Brustein & Manasevit, PLLC
FFATA Reporting: Exempt FFATA Reporting: Exempt from Reportingfrom ReportingExpenditures including contracts,
purchase agreements, vendor agreements and consultant agreements for supplies, equipment, and services
Grants under ARRAFederal awards to individualsFederal awards to entities with gross
income of less than $300,000Classified information
11Brustein & Manasevit, PLLC
FFATA Reporting: Prime FFATA Reporting: Prime Recipients Recipients
Prime recipients that receive federal grants must register with two systems:◦FFATA Subaward Reporting System (FSRS)
Accessible to federal reporting and prime recipients
Information available on www.usaspending.gov
◦Central Contractor Registration System (CCR) Entities that do business with federal
government Links to Dun and Bradstreet (DUNS)
12Brustein & Manasevit, PLLC
FFATA Reporting: FFATA Reporting: SubawardsSubawardsFirst tier subawards
◦A grant or contract from a prime recipient to a subgrantee or subcontractor
Second tier subawards◦A subsequent subgrant or
subcontract between the subawardee and another entity
13Brustein & Manasevit, PLLC
FFATA Reporting: When?FFATA Reporting: When?
Federal agencies, including ED:◦Report prime award information
to on 5th and 20th of each monthPrime recipients:
◦Report first tier subaward information by end of the month following the month in which the subaward was made
14Brustein & Manasevit, PLLC
FFATA Reporting: What?FFATA Reporting: What?Name of entity receiving awardAmount of awardFunding agencyNAICS code (contracts)/ CFDA number (grants)Program sourceAward title descriptive of the purpose of the funding
actionLocation of the subawardee (congressional district)Place of performance (congressional district)Unique identifier (DUNS) of entity and parent; andTotal compensation and names of top five executives,
if required
15Brustein & Manasevit, PLLC
FFATA Reporting: Executive FFATA Reporting: Executive CompensationCompensationPrime recipient must report the total
compensation and names of 5 most highly compensated executives for both (a) itself, and (b) first-tier subawardees if:◦More than 80% of annual gross revenue
is from the federal government, and those annual revenues are greater than $25 million, and
◦Compensation information is not already available through reporting to SEC
16Brustein & Manasevit, PLLC
FFATA GuidanceFFATA GuidanceApril 6, 2010 OMB memo
requiring the reporting of first-tier subawards
August 27, 2010 OMB guidance containing specific instructions on subaward reporting◦http://www.whitehouse.gov/omb/ope
nFSRS FAQs
◦https://www.fsrs.gov/#a-faqs 17Brustein & Manasevit, PLLC
PRIVACY UNDER PRIVACY UNDER FERPAFERPA
18Brustein & Manasevit, PLLC
Family Educational Rights and Privacy Act (FERPA)◦Education Records◦Directory Information◦Prohibition on Disclosure of Records
◦Prior Written Consent Rule & Exceptions
◦Right to Access and Inspect
FERPA: Quick OverviewFERPA: Quick Overview
19Brustein & Manasevit, PLLC
Section 513 of the Education Amendments of 1974 (P.L. 93-380) (aka “Buckley Amendment”)
Later codified at 20 U.S.C. § 1232g (Section 444 of the General Education Provisions Act)
Regulations are located in 34 C.F.R. Part 99
FERPA RulesFERPA Rules
20Brustein & Manasevit, PLLC
• Educational agency or institution may not disclose personally identifiable information within education records to third-parties without prior written consent of the parent or eligible student
(with exceptions) – 20 U.S.C. § 1232g(b).
• Educational agency must permit the parent or eligible student to inspect and review all education records unless such right has been waived (with exceptions) – 20 U.S.C. § 1232g(a).
Basic FERPA ResponsibilitiesBasic FERPA Responsibilities
21Brustein & Manasevit, PLLC
Parent or eligible student has the right to request the correction of education records which they believe to be inaccurate or misleading (with limitations) – 34 C.F.R. 99.20.
Designating directory information – 34 C.F.R. 99.3.
Educational agency must provide annual notification of rights – 34 C.F.R. 99.7.
Basic FERPA Responsibilities (cont.)Basic FERPA Responsibilities (cont.)
22Brustein & Manasevit, PLLC
Any “educational agency or institution” that receives funds under any program administered by the U.S. Department of Education if:(1) The educational institution
provides educational services or instruction, or both, to students; or
(2) The educational agency is authorized to direct and control public elementary or secondary, or postsecondary educational institutions.
Who is covered by FERPA?Who is covered by FERPA?
23Brustein & Manasevit, PLLC
Eligible students or parent(s)
Rejected applicant does not have FERPA rights
Student accepted for admission at a school but who ultimately does not attend – no FERPA rights
Employees of schools – no FERPA rights
Who has FERPA rights?Who has FERPA rights?
24Brustein & Manasevit, PLLC
Education records include, but are not limited to:◦ Student GPAs and transcripts; final course
grades◦ Admissions materials◦ Financial aid records◦ Disciplinary records◦ Attendance records◦ Academic counseling records
Personally identifiable information within the above documents cannot be disclosed unless (1) directory information, (2) prior written consent, or (3) an exception to general rule
Education RecordsEducation Records
25Brustein & Manasevit, PLLC
FERPA allows information designated as “directory information” to be disclosed (without consent) under two conditions: ◦Annual notification of right to opt out
of the disclosure◦Opportunity to opt out of the
disclosure
Directory InformationDirectory Information
26Brustein & Manasevit, PLLC
SSN and other student ID numbers cannot be designated directory information
School may designate a user ID or unique identifier (not an SSN) used by the student to access or communicate within electronic systems under the condition that:o The user ID or other unique identifier
cannot permit access to education records except when combined with other authenticating information known only to the student (such as a password or separate PIN)
Directory Information (cont.)Directory Information (cont.)
27Brustein & Manasevit, PLLC
Personally identifiable information includes but is not limited to:
◦The student's name;◦The name of the student's parent or
other family members;◦The address of the student or
student's family;◦A personal identifier, such as the
student's social security number, student number, or biometric record;
Personally Identifiable Personally Identifiable InformationInformation
28Brustein & Manasevit, PLLC
Other indirect identifiers, such as date/place of birth, mother's maiden name;
Information that is linked or linkable to a specific student that would allow a reasonable person in the school community, to identify the student with reasonable certainty; or
Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
Personally Identifiable Information Personally Identifiable Information (cont.)(cont.)
29Brustein & Manasevit, PLLC
Sets forth objective standards (“reasonable person” standard) for whether information released would make the student easily identifiable
Recognizes that re-identification risk of any release of redacted records is cumulative (because of new technology)
Requires educational agencies and institutions to apply a consistent de-identification strategy for all data releases of a similar type
““De-Identification” of De-Identification” of InformationInformation
30Brustein & Manasevit, PLLC
Student may not use the right to opt of directory information to prevent disclosure or prevent requiring a student to disclose his/her name, electronic ID number, or institutional e-mail address in a class where he/she is enrolled (“the right to opt out of directory information disclosures does not include a right to remain anonymous in class”)
Student’s opt-out decision is indefinite, unless the student rescinds the decision at a later date
Opt Out of Directory Opt Out of Directory Information: In-Class Information: In-Class Disclosures of InformationDisclosures of Information
31Brustein & Manasevit, PLLC
ED has issued policy letters regarding the use of private contractors and other third parties providing services and functions to educational agencies and institutions:◦Use of contractors for developing and
maintaining longitudinal data systems = allowable disclosure under FERPA (under the “authorized agents” exception, as long as the contractors have “legitimate educational interests”)
◦Use of other state agency officials as “authorized agents” in maintaining state longitudinal systems = not allowable – lack of “direct control” by educational agency
Disclosure of Personally Disclosure of Personally Identifiable Information: Identifiable Information: OutsourcingOutsourcing
32Brustein & Manasevit, PLLC
Institution must enter into written agreement with recipient organization that specifies the purpose of the study
Institution does not have to agree with or endorse the conclusions or results of the study
Disclosure to OrganizationsDisclosure to OrganizationsConducting StudiesConducting Studies
33Brustein & Manasevit, PLLC
Written agreement must include provisions:◦ Designating authorized representative;◦ Specifying the (1) information to be disclosed
(2) for purpose of carrying out an audit or evaluation of federal- or State- supported education programs, or to enforce or to comply with federal legal requirements that relate to those programs;
◦ Requiring authorized representative to destroy or return PII from education records when the information is no longer needed for the purpose specified
Disclosure to OrganizationsDisclosure to OrganizationsConducting Studies (cont.)Conducting Studies (cont.)
34Brustein & Manasevit, PLLC
Disclosures for Auditing PurposesAuthorized representatives of:
◦ The Comptroller General of the United States;
◦ The Attorney General of the United States;◦ The Secretary; or◦ The State and local educational authorities.
May have access to education records in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of, or compliance with, Federal legal requirements that relate to those programs.
35Brustein & Manasevit, PLLC
Disclosure for Auditing PurposesWhat About OIG?For example:
◦DOL OIG wants access to education records for audit of an entity’s WIA program. Can an institution make such a disclosure?
Inspector General Act gives OIG authority to conduct audits
OIG is not listed in FERPA rule exceptions
Institutions may want to get a ruling from either DOL or FPCO before turning over education records
36Brustein & Manasevit, PLLC
Educational agencies or institutions must use reasonable methods to ensure that teachers and other school officials obtain access only to education records in which they have a legitimate interest
The approach must be a combination of appropriate physical, technical, administrative and operational controls
If physical or technological controls are not used, policies and procedures must be effective in limiting access to appropriate staff
Reasonableness of controls depends upon usual and customary good practices, requiring ongoing review and modification
Access to Education Records Access to Education Records by School Officialsby School Officials
37Brustein & Manasevit, PLLC
An exception to the written consent requirements if the disclosure is “to officials of another school, school system, or institution of postsecondary education where the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer.”
Still requires notification
Disclosure to Prospective Disclosure to Prospective SchoolSchool
38Brustein & Manasevit, PLLC
Disclosure to Prospective School (cont.)Some schools maintain “blanket
consortium agreements” ◦Allows students to take courses at
multiple institutions toward the same degree or certificate, without notifying students every time records are disclosed between institutions
So long as annual notification specifies that the institution will make such disclosures, individual notifications are not required
39Brustein & Manasevit, PLLC
The Campus Sex Crimes Prevention Act
Clery Act
Health and Safety Emergency
Alumni
Other DisclosuresOther Disclosures
40Brustein & Manasevit, PLLC
Must use reasonable methods to identify and authenticate the identity of the recipient before providing information
Must have usual and customary good business practices, which require ongoing review and modification of procedures when necessary
Must reduce the risk of unauthorized disclosure to a level that is commensurate with the likely threat and potential harm from wrongful disclosure
Confirming the Identity of Confirming the Identity of the Party Receiving the the Party Receiving the DisclosureDisclosure
41Brustein & Manasevit, PLLC
Recent UpdatesRecent UpdatesUninterrupted Scholars Act
◦Passed in 2012◦Expanded list of agencies exempt from
disclosure prohibitions, provided any disclosure of records is consistent with a State’s confidentiality laws : State or local welfare agencies Tribal organizations responsible for student
placement and care◦Extended the release of records to
parents and students in child welfare court proceedings involving child abuse and neglect or dependency issues.
42Brustein & Manasevit, PLLC
Recent UpdatesRecent UpdatesOMB Super Circular
◦Online posting of A-133 audit reports◦Must remove all PII◦Short time frame for submitting
reports (no extensions)
43Brustein & Manasevit, PLLC
FUTURE CONCERNSFUTURE CONCERNS
44Brustein & Manasevit, PLLC
More Reporting?More Reporting?
112th Congress introduced bill
expanding ARRA reporting to all
federal programs
General bipartisan support
No effort to reintroduce in 113th
Congress…yet
45Brustein & Manasevit, PLLC
Evolving PrivacyEvolving PrivacyFERPA rules change almost every
two yearsFederal definitions of privacy,
exempt agencies, PII constantly evolving
ED interpretation of federal statute shifts with administrations
46Brustein & Manasevit, PLLC
QUESTIONS?
47Brustein & Manasevit, PLLC
DisclaimerDisclaimerThis presentation is intended solely to provide general information and does not constitute legal advice.
Attendance at the presentation or later review of these printed materials does not create an
attorney-client relationship with Brustein & Manasevit, PLLC. You should not take any action based
upon any information in this presentation without first
consulting legal counsel familiar with your particular
circumstances.
48Brustein & Manasevit, PLLC