Outsourcing Information
Systems
ECURE
1:30-2:30, October 10, 2002
Richard Rainsberger
Consultant, Education Records Law and
Privacy
1
Outsourcing
 An institution's hiring of an agent to
perform an ongoing process/task that the
institution would normally perform itself.
2
Subcontracting
 An arrangement between the college and
consultants for one-time projects.
3
By outsourcing, you are
establishing an agency
relationship:
 Agent: An organization, company, or
bureau that provides some service for
another; a company having a
franchise to represent another.
4
Student Services Outsourced
Printing of diplomas/certificates
Printing of class schedules, catalogs
International credential evaluation
Transcript ordering
Admission (the whole magilla; or one part it)
Enrollment certification
Grade reporting
Registration
5
Reasons to Consider Outsourcing
•Need to reduce cost
•Access to technology
•Reduce capital
investment
•Manage periodic service
demands
•Staffing constraints
•Facilitate organizational
change
•Desire to enhance
service
•Response to student
demand
•Generate revenue
•Keep up with the competition
6
AACRAO Outsourcing Survey 2001
(based on 400 responses to random survey of members)
Reasons for considering outsourcing:
Over 80% of the respondents identified the following
as being Extremely or Very Important:
•Budget constraints
•Staffing constraints
•Enhanced services
•Access to technology
•Response to student demand
7
AACRAO Outsourcing Survey 2001
Reasons for considering outsourcing:
Over 70% of the respondents identified the following
as being Somewhat or Not Important:
•Keeping up with Competition
•Generating Revenue
8
Outsourcing Journal, April 2002
Interest in outsourcing based on:
•Improving core business results……….. 39%
•Cost savings……………………………… 36%
•Upgrade current service levels…………….. 9%
•Inability to staff appropriately……………... 7%
•Implementation of large scale initiatives...… 5%
•Avoiding needed investment…………….… 4%
9
Outsourcing Fears
•Misuse of information
•Loss of control
•Poor service tarnishes name
•Staff morale
•Institutional brand name dilution
•Vendor goes out of business
10
Where to Start?
1. Develop a goal statement/identify a desired
outcome
2. Why do you think outsourcing will benefit your
institution?
3. What are your expectations for outsourcing?
4. What is the state of your current service?
5. Who is affected by this service? How do they
currently evaluate the service?
11
Where to Start?
1. Develop a goal statement/identify a desired
outcome
To establish an on-line, integrated, real
time information system that provides
customer access 24/7 and permits
customers to process any administrative
transactions via web based processing.
12
Where to Start?
2. Why do you think outsourcing will benefit your
institution?
Outsourcing will benefit the institution
by providing a customer-friendly
environment for accessing accounts,
processing administrative
transactions, and providing state-ofthe-art technology at a lower cost.
13
Where to Start?
3. What are your expectations for outsourcing?
•More favorable satisfaction ratings from our customers
after the system has been implemented for one year
•Improved security for administrative transactions
•Decrease in number of errors to research
•An “audit trail” of all transactions made to the system
•Automatic scheduled backups with ease of information
retrieval
14
Where to Start?
4. What is the state of your current service?
•Is the service delivered in a timely manner?
•Is service of the desired quality?
•Are service expectations being met?
•Are new features desired?
•Is staffing a problem?
15
Where to Start?
5. Who is affected by this service? How do they
currently evaluate the service?
•Students
•Faculty
•Staff and administrators
•Boards, Legislators, and Regulating Bodies
•Alumni
16
Basis for Evaluating the Outsourcing Vendor
Reference Checks
•Request list of current users
•Request list of cancelled/former users
•Contact references and verify vendor
performance in critical areas
17
Basis for Evaluating the Outsourcing Vendor
Quality of Service
•Speed and convenience of delivery
•Accuracy and completeness
•Standards of professional practice
•Error rate/need of repeat service
•Service downtime
•Response to user-identified problems
•Quality of vendor communication
18
Basis for Evaluating Outsourcing Vendor
Cost of Service
“…the cost of providing the service
through a vendor should be
compared to the cost of performing
the function internally.”
_________________
AACRAO 2001 Outsourcing Survey
19
Basis for Evaluating Outsourcing Vendor
Cost of Service
•Include all institutional costs
•Determine whether cost shifts
occur
•Identify hidden costs
•Vendor support costs
•Image/reputational cost
•Termination cost
20
Privacy Issues
•FERPA regulates what, who and how
•Vendor must act as agent to handle
confidential records
•Current and future data disposal
•Confidentiality and intergrity of data
•Ultimate accountability remains with the
institution
21
So What Does FERPA Say?
22
34 CFR 99 FERPA Regulations
(Appendix 2 of AACRAO FERPA Guide)
 § 99.31 Under what conditions is
prior
consent (of a student) not required
to disclose information?
23
§ 99.31 Under what conditions is prior
consent not required to disclose
information?
 (a)An ... institution may disclose personally
identifiable information from an education
record of a student...if the disclosure meets one
or more of the following conditions:
(1)The disclosure is to other school
officials whom the …institution has
determined to have legitimate educational
interests.
24
§ 99.33 What limitations apply to the
redisclosure of information?
 (a)(1) An ... institution may disclose personally identifiable
information from an education record only on the condition
that the party to whom the information is disclosed will not
disclose the information to any other party without the prior
consent of the student….
 (e) If this Office (FPCO) determines that a third party
improperly rediscloses personally identifiable information
from education records ..., the ... institution may not allow
that third party access to personally identifiable information
from education records for at least five years.
25
§ 99.7 What must an educational … institution
include in its annual notification?
 (a)(3)(iii) If the ... institution has a policy of
disclosing education records under §99.31(a)(1), a
specification of criteria for determining who
constitutes a school official and what constitutes a
legitimate educational interest (must be included
in the annual notification).
26
Model Annual Notification of Rights under
FERPA for Post Secondary Institutions

The Family Educational Rights and Privacy Act (FERPA) affords students certain rights with respect
to their education records. They are….
(3) The right to consent to disclosures of personally identifiable information contained in the
student's education records, except to the extent that FERPA authorizes disclosure without
consent.
One exception which permits disclosure without consent is disclosure to school officials with
legitimate educational interests. A school official is a person employed by the University in an
administrative, supervisory, academic or research, or support staff position (including law
enforcement unit personnel and health staff); a person or company with whom the University has
contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of
Trustees; or a student serving on an official committee, such as a disciplinary or grievance
committee, or assisting another school official in performing his or her tasks.

A school official has a legitimate educational interest if the official needs to review an education
record in order to fulfill his or her professional responsibility….

Available for download at www.ed.gov/offices/OM/fpco.html
27
And what does LeRoy say?
 “…nothing in FERPA prevents an educational
institution from contracting with a person or entity
outside the institution to perform services that the
institution would otherwise provide for itself.”
(Letter from LeRoy Rooker to Daniel Boehmer,
April 19,1993 found in McDonald, Steven J., The
Family Educational Rights and Privacy Act: A
Legal Compendium, NACUA, 1999, pp. 221-223.)
28
Key FERPA Terms for Outsourcing
 School Officials
 Legitimate Educational Interest
 Annual FERPA Notification to Students
29
Balancing Risks
•Identify data and level of confidentiality
•Assess impact if confidentiality
compromised
•Release no unessential data
•Assess vendor training
•Assess vendor data security
•Assess vendor attitude toward exclusivity
of data or service—does it impact other
operations?
30
Balancing Risks
•Assess long term impact of decision on
institution
•Does institution have the resources to
manage the contract? If “yes,” who is
assigned that responsibility?
31
Outsourcing Agreement
•State responsibility of both parties
•Specify ownership and control of data rests
with the institution
•Include non-disclosure agreement
•Specify compliance with FERPA
•Prohibit unauthorized data usage
•Consider indemnity clause; “hold harmless”
•Explicitly name vendor as agent of the
institution
32
Outsourcing Agreement (cont’d)
• Establish dispute resolution procedure
•Specify any usage of school name and logo
•Establish performance measures
•Limit length of initial agreement
•Specify termination notice requirements
•Limit exclusivity
•Provide for periodic review and upgrades
33
Sample Terms
•Non-directory information is to be stored in an
encoded format.
•Non-directory information is not to be viewed by,
displayed to or available to employees at any time.
•The vendor may not sell, distribute, release or
disclose personally identifiable or directory
information without the express written consent of the
institution.
34
Sample Terms (cont’d)
•The vendor has the right to use the name of the
institution only in connection with rendering the
service.
•The institution appoints the vendor as its agent for
the purpose of rendering the service. The agent is
subject to and must comply with all state education
codes and with the Family Educational Rights and
Privacy Act of 1974 (as amended) (FERPA)
35
Sample Terms (cont’d)
•Nothing in the contract shall be construed as limiting
the activities of the institution for which it has been
traditionally and ultimately responsible.
•All fees are as specified in the contract and are for
the period of the contract. Fees may only be changed
with the consent of the institution.
36
Sample Terms (cont’d)
•Upon termination of the contract for any reason, the
vendor will return all information provided by the
institution and will provide a certificate attesting that
all information on the vendor systems and storage
files provided by the institution has been destroyed.
37
Managing the Agreement
•Successful agreement will benefit both school
and vendor
•Regular communication between vendor and
school
•Institution in client complaint loop
•Regular reports on volume, turnaround time,
service downtime, and service errors
38
What happens if things go awry?
Develop a plan for continuing service
if vendor relationship is severed
39
References
AACRAO, Outsourcing Survey and Results (2001).
http://www.aacrao.org/pro_development/outsource.htm
Contact AACRAO Office, 202-293-9161.
Fleming, M. Emerging Business Affiliation Models for ECOMMERCE. In Continuing Legal Education (eds.) E
Commerce (Section III). St. Paul: Minnesota State Bar
Association, 2000.
Kaganoff, Tessa. Collaboration, Technology, and
Outsourcing Initiatives in Higher Education:
A Literature Review. Washington DC: Rand Corp., 1998.
40
To Contact Me…
Richard A. Rainsberger, Ph.D.
Consultant
Education Records Law and Privacy
msrrar@peoplepc.com
434-385-6228
41