Transcript Slide 1

Documentation and Reporting
Requirements under FFATA
and FERPA
Brustein & Manasevit, PLLC
www.bruman.com
Spring Forum 2013
Steven Spillan, Esq.
[email protected]
Brustein & Manasevit, PLLC
1
Overview

Federal reporting requirements under
FFATA

Privacy Issues under FERPA

Future Concerns
Brustein & Manasevit, PLLC
2
REPORTING UNDER
FFATA
Brustein & Manasevit, PLLC
3
What is “reporting?”
Accountability measure used by granting
agencies to ensure that federal funds are
spent appropriately
 Information supplied directly by grant
recipients
 For agencies and Congress, represents an
agreement on accountability measure that
both believe are neither too lax nor too
burdensome

Brustein & Manasevit, PLLC
4
Federal Reporting Requirements

Various reporting requirements under
EDGAR and specific statutory programs

ARRA reporting

FFATA
Brustein & Manasevit, PLLC
5
Federal Funding Accountability and
Transparency Act (FFATA)
Enacted 2006 (took effect 2010)
 Applies to grants and contracts
 Dramatic increase in reporting
requirements as part of push for public
transparency
 Along with ARRA, required development
of centralized, web-based data collection
and reporting platform

Brustein & Manasevit, PLLC
6
FFATA Reporting: Background

Reporting needed to:
◦ Assess grant performance/effectiveness
◦ Provide Public opportunity to review

Increase in scope/amount of data means:
◦ Need for better risk management
◦ New technologies

Reported information available on single,
searchable website open to public:
www.usaspending.gov
Brustein & Manasevit, PLLC
7
FFATA Reporting: Prime Recipients

“Prime Recipients” receive a grant or
contract directly from federal government
Brustein & Manasevit, PLLC
8
FFATA Reporting: Prime Recipients



Beginning with grants and contracts awarded
to prime recipients after October 1, 2010
Report on mandatory and discretionary
grants and contracts
New layer of reporting: prime recipients
must report data on first-tier subawards and
executive compensation
◦ Subawards include both subgrants and
subcontracts
Brustein & Manasevit, PLLC
9
FFATA Reporting: Prime Recipients

Applies to initial awards of $25,000 or more:
◦ Prime recipients must report first-tier subawards
of $25,000 or more, and executive compensation
if conditions are met

If initial award is below $25,000, FFATA does
not generally apply, but:
◦ If subsequent grant modifications push grant over
threshold, FFATA will apply
◦ If modifications reduce grant below threshold,
FFATA continues to apply
Brustein & Manasevit, PLLC
10
FFATA Reporting: Exempt from
Reporting
Expenditures including contracts,
purchase agreements, vendor agreements
and consultant agreements for supplies,
equipment, and services
 Grants under ARRA
 Federal awards to individuals
 Federal awards to entities with gross
income of less than $300,000
 Classified information

Brustein & Manasevit, PLLC
11
FFATA Reporting: Prime Recipients

Prime recipients that receive federal grants
must register with two systems:
◦ FFATA Subaward Reporting System (FSRS)
 Accessible to federal reporting and prime recipients
 Information available on www.usaspending.gov
◦ Central Contractor Registration System
(CCR)
 Entities that do business with federal government
 Links to Dun and Bradstreet (DUNS)
Brustein & Manasevit, PLLC
12
FFATA Reporting: Subawards

First tier subawards
◦ A grant or contract from a prime recipient to
a subgrantee or subcontractor

Second tier subawards
◦ A subsequent subgrant or subcontract
between the subawardee and another entity
Brustein & Manasevit, PLLC
13
FFATA Reporting: When?

Federal agencies, including ED:
◦ Report prime award information to on 5th
and 20th of each month

Prime recipients:
◦ Report first tier subaward information by
end of the month following the month in
which the subaward was made
Brustein & Manasevit, PLLC
14
FFATA Reporting: What?
Name of entity receiving award
 Amount of award
 Funding agency
 NAICS code (contracts)/ CFDA number (grants)
 Program source
 Award title descriptive of the purpose of the funding action
 Location of the subawardee (congressional district)
 Place of performance (congressional district)
 Unique identifier (DUNS) of entity and parent; and
 Total compensation and names of top five executives, if
required

Brustein & Manasevit, PLLC
15
FFATA Reporting: Executive
Compensation

Prime recipient must report the total
compensation and names of 5 most highly
compensated executives for both (a)
itself, and (b) first-tier subawardees if:
◦ More than 80% of annual gross revenue is
from the federal government, and those
annual revenues are greater than $25 million,
and
◦ Compensation information is not already
available through reporting to SEC
Brustein & Manasevit, PLLC
16
FFATA Guidance
April 6, 2010 OMB memo requiring the
reporting of first-tier subawards
 August 27, 2010 OMB guidance containing
specific instructions on subaward
reporting

◦ http://www.whitehouse.gov/omb/open

FSRS FAQs
◦ https://www.fsrs.gov/#a-faqs
Brustein & Manasevit, PLLC
17
PRIVACY UNDER FERPA
Brustein & Manasevit, PLLC
18
FERPA: Quick Overview
 Family
Educational Rights and Privacy
Act (FERPA)
◦ Education Records
◦ Directory Information
◦ Prohibition on Disclosure of Records
◦ Prior Written Consent Rule &
Exceptions
◦ Right to Access and Inspect
Brustein & Manasevit, PLLC
19
FERPA Rules

Section 513 of the Education Amendments of
1974
(P.L. 93-380) (aka “Buckley Amendment”)

Later codified at 20 U.S.C. § 1232g (Section
444 of the General Education Provisions Act)

Regulations are located in 34 C.F.R. Part 99
Brustein & Manasevit, PLLC
20
Basic FERPA Responsibilities
Educational agency or institution may not
disclose personally identifiable information
within education records to third-parties
without prior written consent of the parent or
eligible student
(with exceptions) – 20 U.S.C. § 1232g(b).
• Educational agency must permit the parent or
eligible student to inspect and review all
education records unless such right has been
waived (with exceptions) – 20 U.S.C. § 1232g(a).
•
Brustein & Manasevit, PLLC
21
Basic FERPA Responsibilities (cont.)
Parent or eligible student has the right to
request the correction of education
records which they believe to be inaccurate
or misleading (with limitations) – 34 C.F.R.
99.20.
 Designating directory information – 34
C.F.R. 99.3.
 Educational agency must provide annual
notification of rights – 34 C.F.R. 99.7.

Brustein & Manasevit, PLLC
22
Who is covered by FERPA?

Any “educational agency or institution” that
receives funds under any program
administered by the U.S. Department of
Education if:
 (1) The educational institution provides
educational services or instruction, or
both, to students; or
 (2) The educational agency is authorized to
direct and control public elementary or
secondary, or postsecondary educational
institutions.
Brustein & Manasevit, PLLC
23
Who has FERPA rights?

Eligible students or parent(s)

Rejected applicant does not have FERPA
rights

Student accepted for admission at a school
but who ultimately does not attend – no
FERPA rights

Employees of schools – no FERPA rights
Brustein & Manasevit, PLLC
24
Education Records

Education records include, but are not limited
to:
◦
◦
◦
◦
◦
◦

Student GPAs and transcripts; final course grades
Admissions materials
Financial aid records
Disciplinary records
Attendance records
Academic counseling records
Personally identifiable information within the
above documents cannot be disclosed unless (1)
directory information, (2) prior written consent,
or (3) an exception to general rule
Brustein & Manasevit, PLLC
25
Directory Information

FERPA allows information designated as
“directory information” to be disclosed
(without consent) under two conditions:
◦ Annual notification of right to opt out of the
disclosure
◦ Opportunity to opt out of the disclosure
Brustein & Manasevit, PLLC
26
Directory Information (cont.)


SSN and other student ID numbers cannot
be designated directory information
School may designate a user ID or unique
identifier (not an SSN) used by the student to
access or communicate within electronic
systems under the condition that:
o
The user ID or other unique identifier cannot
permit access to education records except when
combined with other authenticating information
known only to the student (such as a password or
separate PIN)
Brustein & Manasevit, PLLC
27
Personally Identifiable Information

Personally identifiable information includes but
is not limited to:
◦ The student's name;
◦ The name of the student's parent or other
family members;
◦ The address of the student or student's
family;
◦ A personal identifier, such as the student's
social security number, student number, or
biometric record;
Brustein & Manasevit, PLLC
28
Personally Identifiable Information (cont.)
Other indirect identifiers, such as date/place of
birth, mother's maiden name;
 Information that is linked or linkable to a
specific student that would allow a reasonable
person in the school community, to identify the
student with reasonable certainty; or
 Information requested by a person who the
educational agency or institution reasonably
believes knows the identity of the student to
whom the education record relates.

Brustein & Manasevit, PLLC
29
“De-Identification” of Information
Sets forth objective standards (“reasonable
person” standard) for whether information
released would make the student easily
identifiable
 Recognizes that re-identification risk of any
release of redacted records is cumulative
(because of new technology)
 Requires educational agencies and institutions to
apply a consistent de-identification strategy for
all data releases of a similar type

Brustein & Manasevit, PLLC
30
Opt Out of Directory Information:
In-Class Disclosures of Information
Student may not use the right to opt of
directory information to prevent disclosure or
prevent requiring a student to disclose his/her
name, electronic ID number, or institutional email address in a class where he/she is enrolled
(“the right to opt out of directory information
disclosures does not include a right to remain
anonymous in class”)
 Student’s opt-out decision is indefinite, unless
the student rescinds the decision at a later date

Brustein & Manasevit, PLLC
31
Disclosure of Personally Identifiable
Information: Outsourcing
ED has issued policy letters regarding the use of
private contractors and other third parties
providing services and functions to educational
agencies and institutions:
◦ Use of contractors for developing and
maintaining longitudinal data systems =
allowable disclosure under FERPA (under the
“authorized agents” exception, as long as the
contractors have “legitimate educational
interests”)
◦ Use of other state agency officials as
“authorized agents” in maintaining state
longitudinal systems = not allowable – lack of
“direct control” by educational agency
Brustein & Manasevit, PLLC
32
Disclosure to Organizations
Conducting Studies
Institution must enter into written agreement
with recipient organization that specifies the
purpose of the study
 Institution does not have to agree with or
endorse the conclusions or results of the study

Brustein & Manasevit, PLLC
33
Disclosure to Organizations
Conducting Studies (cont.)

Written agreement must include provisions:
◦ Designating authorized representative;
◦ Specifying the (1) information to be disclosed (2)
for purpose of carrying out an audit or evaluation
of federal- or State- supported education
programs, or to enforce or to comply with federal
legal requirements that relate to those programs;
◦ Requiring authorized representative to destroy or
return PII from education records when the
information is no longer needed for the purpose
specified
Brustein & Manasevit, PLLC
34
Disclosures for Auditing Purposes

Authorized representatives of:
◦
◦
◦
◦

The Comptroller General of the United States;
The Attorney General of the United States;
The Secretary; or
The State and local educational authorities.
May have access to education records in
connection with an audit or evaluation of Federal
or State supported education programs, or for
the enforcement of, or compliance with, Federal
legal requirements that relate to those programs.
Brustein & Manasevit, PLLC
35
Disclosure for Auditing Purposes


What About OIG?
For example:
◦ DOL OIG wants access to education records for
audit of an entity’s WIA program. Can an
institution make such a disclosure?



Inspector General Act gives OIG authority
to conduct audits
OIG is not listed in FERPA rule exceptions
Institutions may want to get a ruling from
either DOL or FPCO before turning over
education records
Brustein & Manasevit, PLLC
36
Access to Education Records
by School Officials




Educational agencies or institutions must use reasonable
methods to ensure that teachers and other school
officials obtain access only to education records in
which they have a legitimate interest
The approach must be a combination of appropriate
physical, technical, administrative and operational
controls
If physical or technological controls are not used,
policies and procedures must be effective in limiting
access to appropriate staff
Reasonableness of controls depends upon usual and
customary good practices, requiring ongoing review and
modification
Brustein & Manasevit, PLLC
37
Disclosure to Prospective School

An exception to the written consent
requirements if the disclosure is “to officials
of another school, school system, or
institution of postsecondary education
where the student seeks or intends to
enroll, or where the student is already
enrolled so long as the disclosure is for
purposes related to the student's enrollment
or transfer.”

Still requires notification
Brustein & Manasevit, PLLC
38
Disclosure to Prospective School
(cont.)

Some schools maintain “blanket
consortium agreements”
◦ Allows students to take courses at multiple
institutions toward the same degree or
certificate, without notifying students every
time records are disclosed between
institutions

So long as annual notification specifies
that the institution will make such
disclosures, individual notifications are not
required
Brustein & Manasevit, PLLC
39
Other Disclosures

The Campus Sex Crimes Prevention Act

Clery Act

Health and Safety Emergency

Alumni
Brustein & Manasevit, PLLC
40
Confirming the Identity of the Party
Receiving the Disclosure



Must use reasonable methods to identify and
authenticate the identity of the recipient before
providing information
Must have usual and customary good business practices,
which require ongoing review and modification of
procedures when necessary
Must reduce the risk of unauthorized disclosure to a
level that is commensurate with the likely threat and
potential harm from wrongful disclosure
Brustein & Manasevit, PLLC
41
Recent Updates

Uninterrupted Scholars Act
◦ Passed in 2012
◦ Expanded list of agencies exempt from disclosure
prohibitions, provided any disclosure of records is
consistent with a State’s confidentiality laws :
 State or local welfare agencies
 Tribal organizations responsible for student placement
and care
◦ Extended the release of records to parents and
students in child welfare court proceedings
involving child abuse and neglect or dependency
issues.
Brustein & Manasevit, PLLC
42
Recent Updates

OMB Super Circular
◦ Online posting of A-133 audit reports
◦ Must remove all PII
◦ Short time frame for submitting reports (no
extensions)
Brustein & Manasevit, PLLC
43
FUTURE CONCERNS
Brustein & Manasevit, PLLC
44
More Reporting?

112th Congress introduced bill expanding
ARRA reporting to all federal programs

General bipartisan support

No effort to reintroduce in 113th
Congress…yet
Brustein & Manasevit, PLLC
45
Evolving Privacy
FERPA rules change almost every two
years
 Federal definitions of privacy, exempt
agencies, PII constantly evolving
 ED interpretation of federal statute shifts
with administrations

Brustein & Manasevit, PLLC
46
QUESTIONS?
Brustein & Manasevit, PLLC
47
Disclaimer
This presentation is intended solely
to provide general information and does
not constitute legal advice. Attendance at
the presentation or later review of these
printed materials does not create an
attorney-client relationship with Brustein
& Manasevit, PLLC. You should not take
any action based upon any information in
this presentation without first consulting
legal counsel familiar with your particular
circumstances.
Brustein & Manasevit, PLLC
48