The Middle States Commission on Higher Education has proposed the adoption of a policy that would prohibit Middle States-accredited colleges and universities from providing “incentive payment” (e.g., tuition sharing or per capita payments) to recruiters “based on [their] success in securing student enrollment….” If approved, the policy would apply to the recruitment of prospective students in the United States and internationally. As to prospective applicants in the United States, the policy would not result in significant change as a practical matter, as the United States Department of Education’s Title IV program integrity rules already prohibit payment of such compensation in connection with the recruitment of prospective students eligible for Title IV aid. Historically, however, institutions have been able to pay incentive compensation for the recruitment of foreign students residing outside the United States who are not eligible to participate in Title IV programs.  (In 2013 and 2014, the National Association for College Admission Counseling (NACAC) approved an amended Statement of Principles of Good Practice that allows institutions to use commissioned agents to recruit students outside the United States, while encouraging the implementation of protections designed to protect applicants and their families against potential conflicts of interest resulting from the practice.) If adopted, the proposed policy would pose challenges for Middle States-accredited institutions (in Delaware, the District of Columbia, Maryland, New Jersey, New York, Pennsylvania, Puerto Rico and the Virgin Islands) that compete for international enrollments with peer institutions accredited by other regional accreditors, who would not be similarly restricted absent adoption of corresponding prohibitions by their respective regional accreditors. Middle States is accepting public comments on its proposed policy through April 17, 2017. Unless the proposed policy is withdrawn following closure of the comment period, the policy (including any revisions based on comments received) will likely be submitted for approval by vote of the Chief Executive Officers of Middle States’ member institutions sometime this summer.

Late Wednesday, March 15, just hours before President Trump’s new travel ban was scheduled to take effect, the U.S. District Court for the District of Hawaii granted a temporary restraining order that prevents the implementation of Executive Order 13780.  Recall, President Trump issued Executive Order 13780, entitled, “Protecting the Nation from Foreign Terrorist Entry into the United States” (“EO 13780”), on March 6, 2017.  The temporary restraining order issued by the U.S. District Court in Hawaii prohibits the federal government from enforcing EO 13780 on a nationwide basis. As you know from our March 7, 2017 blog post, EO 13780 sought to suspend the entry of non-immigrants from Iran, Libya, Somalia, Sudan, Syria and Yemen for an initial 90-day period if they were not physically present in the U.S. on March 16, 2017, did not have a valid visa at 5:00 pm EST on January 27, 2017, and did not have a valid visa on March 16, 2017.  EO 13780 also sought to suspend the entire refugee admission program for 120 days and to cap the admission of refugees to no more than 50,000 for fiscal year 2017.  As a result of the decision of the U.S. District Court in Hawaii on March 15, foreign nationals hailing from any of the restricted countries may continue to travel to the U.S. until further notice. At a rally in Nashville, Tennessee on Wednesday evening, President Trump criticized the ruling issued by the U.S. District Court in Hawaii and further declared that his administration will fight to uphold EO 13780, including the travel ban, all the way to the Supreme Court, if necessary.  Given the fluidity of this situation, we continue to advise that individuals from the restricted countries who are presently in the U.S. forego any unnecessary international travel at this time.

The Supreme Court will not review the Fourth Circuit’s decision in Gloucester County School Board v. G.G. despite agreeing in October 2016 to do so. The Fourth Circuit’s decision in favor of G.G., a transgender Virginia high school student, had been stayed by the Supreme Court while it considered whether to grant the School Board’s petition for certiorari. The effect of that stay was that the Fourth Circuit’s invalidation of the School Board policy restricting bathroom and locker room access to students’ biological gender was put on hold until the Supreme Court heard the case. However, in a surprise move on March 6, 2017 the Supreme Court vacated the Fourth Circuit’s decision in favor of G.G., and remanded the case back to the Fourth Circuit for further consideration in light of the February 22, 2017 joint guidance from the Departments of Education and Justice. The Departments’ February 22 joint guidance (“February 22 Dear Colleague Letter”) rescinded Obama era guidance that interpreted Title IX’s prohibition against sex discrimination to encompass discrimination based on gender identity and transgender status.  The nation’s highest court, through this decision to vacate and remand, has declined the opportunity to settle the question of whether federal Title IX protections against sex discrimination in education extend to gender identity and transgender status. The Trump Administration’s February 22 Dear Colleague Letter giving states and local districts the responsibility of deciding policy as it relates to transgender students will create inconsistent conditions for transgender students across the country, and the Fourth Circuit’s decision on remand will likely add to the jurisdictional variations on this issue. The Supreme Court’s refusal to hear this case vitiates an opportunity to set a national standard for transgender students’ rights in education. While the February 22 Dear Colleague Letter rescinded the previous administration’s transgender guidance in education, there is nothing in the February 22 Dear Colleague Letter that prohibits institutions of higher education from continuing to promulgate and enforce current transgender policies that are consistent with the previous administration’s guidance. However, the Fourth Circuit’s decision on remand, which will have the effect of law, not mere guidance, may affect the policies for those institutions within the Fourth Circuit’s jurisdiction, which includes Virginia, North Carolina, South Carolina, West Virginia, and Maryland. Institutions across the country should refer to their state and local discrimination laws and consult with counsel should they decide to make changes to policies affecting transgender students, employees, and visitors.

As Yogi Berra once said: “It’s like déjà vu all over again.” Since mid-February, the Trump Administration promised the imminent release of a revised and improved executive order addressing travel ban and refugee admissions. The wait is over.  On Monday, March 6, 2017, President Trump signed a new executive order titled “Protecting the Nation from Foreign Terrorist Entry into the United States” (the new EO).  The new EO revokes and replaces Executive Order 13769 (EO 13769), which President Trump signed on January 27, 2017.  From the get-go, there was significant confusion surrounding the scope and implementation of EO 13769, immediately followed by numerous legal challenges.  On February 9, 2017, the United States Court of Appeals for the Ninth Circuit upheld a temporary restraining order issued by a lower court, which prohibited the federal government from enforcing any restrictions contained in EO 13769. Unlike EO 13769, which was effective immediately, the new EO allows for a ten-day grace period and will not become effective until 12:01 a.m. on Thursday, March 16, 2017. Similar to its predecessor, the new EO imposes a 90-day “temporary pause” on the entry into the United States of nationals from the following six countries: Iran, Libya, Somalia, Sudan, Syria and Yemen. Most notably, Iraq is no longer on the list. Nevertheless, the new EO states that Iraqi nationals will be subject to additional scrutiny where they may “have connections with ISIS or other terrorist organizations, or otherwise pose a risk to either national security or public safety.” In an effort to avoid the chaos that ensued following EO 13769, the new EO provides greater clarity on the scope of the travel ban. Specifically, the 90-day travel ban will apply only to those foreign nationals from the six enumerated countries of concern if:

• the foreign national is not physically present in the United States on the effective date of the order (March 16, 2017);
• the foreign national did not have a valid visa at 5:00 pm EST on January 27, 2017; and
• the foreign national does not have a valid visa on March 16, 2017.

The new EO order is very clear that it does not apply to green card holders, those with validly issued visas, and dual citizens.   In addition, the new EO allows for exceptions and individualized assessments to be made by consular and border immigration officers in certain cases. In addition to implementing a revised travel ban, the new EO also addresses the current refugee program. Specifically, the new EO:

• caps the admission of refugees to no more than 50,000 for fiscal year 2017;
• directs the Secretary of State to suspend refugee travel into the United States for 120 days (beginning on March 16, 2017); and
• directs the Secretary of Homeland Security to suspend decisions on applications for individuals seeking refugee status for 120 days (beginning on March 16, 2017).

Noticeably absent from the new EO is the indefinite ban on the admission of Syrian refugees that appeared in EO 13769. While the headlining topics of the new EO remain focused on travel restrictions and refugee admissions, it is worth noting that the new EO also mandates the following:

• the immediate suspension of the Visa Interview Waiver Program (but for individuals seeking a visa based upon diplomatic or diplomatic-type visa status);
• a review of non-immigrant visa reciprocity agreements currently in place with other countries to ensure that such agreements are “truly reciprocal”;
• the collection and disclosure of certain data to the American people pertaining to foreign nationals and their involvement in or connection to certain nefarious activities (i.e., terrorist-related offenses, acts of gender-based violence against women, etc.).

Despite the Trump Administration’s efforts to narrowly tailor this newest EO, we anticipate that there will be legal challenges filed by various stakeholders in the coming days and weeks.

On February 22, 2017, in its first “Dear Colleague Letter,” the Trump Administration withdrew existing U.S. Department of Justice and Department of Education guidance that interpreted Title IX’s protections against sex discrimination to encompass discrimination based on gender identity and transgender status. In this joint Dear Colleague Letter (“February 22 DCL”), the Departments point to recent litigation challenging the previous administration’s interpretation of Title IX as applied to transgender students as reason to withdraw the existing guidance so that the Departments could “further and more completely consider the legal issues involved.” The Departments specifically cite to the Fourth Circuit’s decision in G.G. v. Gloucester County School Board, which deferred to the Obama era Departments’ interpretation that Title IX’s protections against sex discrimination encompass discrimination based on gender identity and transgender status, as well as the U.S. District Court for the Northern District of Texas’ nationwide injunction of the federal guidance in State of Texas et al. v. United States of America et al. States’ Rights and Local Educational Policy In essence the February 22 DCL initiates an analytical shift. The Departments no longer discuss transgender students’ rights as a question of civil rights, but rather, now, as one of educational policy and States’ rights: “the Departments believe that, in this context, there must be due regard for the primary role of the States and local school districts in establishing educational policy.” The February 22 DCL does not replace the guidance it withdraws with new policy or requirements. While it rescinds protections for transgender students, in the penultimate paragraph the Departments note, generally, that the U.S. Department of Education’s Office for Civil Rights will “continue its duty under law to hear all claims of discrimination and will explore every appropriate opportunity to protect all students and to encourage civility in our classrooms.” It is unclear what this statement means for transgender students in the context of this rollback document. There is nothing in the February 22 DCL that prevents institutions from continuing to enforce their current transgender policies, including nondiscrimination policies that are consistent with the Departments’ 2016 guidance. However, institutions in states with laws that require persons to use the single-sex facilities that correspond to their biological sex, rather than their gender identity, could be compelled to change institutional policies to reflect state standards. The Trump Administration’s decision to give states and local districts the responsibility of deciding “educational policy” as it relates to transgender students will almost certainly foster inconsistent conditions for transgender students across the country. New York State The New York State Attorney General Eric Schneiderman and the New York State Department of Education (NYSED) issued a prompt joint reminder on February 23, 2017 in which they “vehemently objected” to the Departments’ revocation of the prior guidance. New York State reminded its school districts, if not explicitly its higher education institutions, that they have an independent obligation to follow state and local laws and New York State Education Department guidance prohibiting harassment and discrimination of transgender students. The New York Attorney General said that his office will “use all the existing tools of federal, state, and local law to ensure that transgender kids are safe in their schools and are provided equal access to all programming and facilities consistent with their gender identity.” Bond’s recent Information Memo has more on the impact of the February 22 DCL on school districts. The Supreme Court’s review of G.G. v. Gloucester County School Board On October 28, 2016, the Supreme Court announced its intention to review the Fourth Circuit’s decision in G.G. v. Gloucester County School Board that was based on the federal appellate court’s deference to the Department of Education’s interpretation of federal law. It is unclear what, if any, impact the rescission of prior Department transgender guidance will have on the Supreme Court’s decision to review Gloucester County, but it is possible that a decision by the Supreme Court in that case may settle – in ways that agency guidance cannot – the question of whether Title IX protections against sex discrimination include discrimination based on gender identity and transgender status.  

Last month, Bond, Schoeneck & King  sought  an exemption from cybersecurity regulations proposed by the New York State Department of Financial Services (DFS) for colleges, universities and other charitable organizations that would have been covered under the regulations solely because they operate charitable gift annuity programs.  Joined by the Commission on Independent Colleges and Universities, Bond submitted a letter to DFS urging adoption of the exemption noting, among other reasons, that the proposed regulations, designed for large financial institutions such as banks, would impose an exceptional financial and administrative burden on institutions and organizations unrelated to their mission, size, resources or operations. Moreover, as set forth in the letter, these organizations are already covered by other cybersecurity laws and regulations.

We are pleased to report that the Final Regulations, issued by DFS on February 16, 2017, granted this exemption. As a result, hundreds of institutions, ranging from some of the largest universities, museums, social service and religious organizations in the State to smaller social service and advocacy organizations, are exempt and need not comply with the regulations.

After hearing oral arguments earlier this week from attorneys representing the White House and the states of Washington and Minnesota, last night, the U.S. Court of Appeals for the Ninth Circuit unanimously upheld the U.S. District Court for the Western District of Washington’s February 3, 2017 issuance of a temporary restraining order prohibiting the federal government from enforcing President Trump’s Executive Order 13769, “Protecting the Nation From Foreign Terrorist Entry Into the United States” (EO 13769).  As you know from our previous blog posts, EO 13769 suspends the entire refugee admission program for 120 days, the Syrian refugee program indefinitely and the entry of immigrants and non-immigrants from Iran, Iraq, Libya, Somalia, Sudan, Syria and Yemen for an initial 90-day period.  For now, as a result of the Ninth Circuit’s decision, citizens from the seven restricted countries will be able to travel to the U.S. Despite the fact that the Ninth Circuit’s ruling refuses to reinstate EO 13769’s travel ban, it is important to note that this situation will continue to be fluid, and the Trump administration will very likely seek to appeal this latest decision. As such, we continue to advise that individuals from the seven restricted countries who are presently in the U.S. forego unnecessary international travel at this time.  In addition, for those individuals from the restricted countries who have valid U.S. visas, who are presently outside the U.S. and who have the intent to return to the U.S., we recommend that they consider traveling to the U.S. while there remains an opportunity to do so.

We previously reported that on January 27, 2017, the Trump administration issued Executive Order 13769 entitled, “Protecting the Nation from Foreign Terrorist Entry into the United States”. EO 13769 suspends: the entire US refugee admission system for 120 days; the Syrian refugee program indefinitely; and the entry of immigrants and non-immigrants from seven designated countries of concern for an initial period of 90 days. Exactly one week later, on February 3, 2017, the United States District Court for the Western District of Washington issued a temporary restraining order that prohibits the federal government from enforcing Executive Order (“EO”) on a nationwide basis. On February 4, 2017, the Department of Homeland Security (“DHS”) issued a statement announcing that “…in accordance with the judge's ruling, DHS has suspended any and all actions implementing the affected sections of the Executive Order…” and that “…DHS personnel will resume inspection of travelers in accordance with standard policy and procedure.” In addition, all airlines and terminal operators have been notified to permit the boarding of all passengers without regard to nationality. Similarly, the Department of State (“DOS”) confirmed that all visas that had been provisionally revoked pursuant to EO 13769 have now been reinstated and are valid once again. In response to these developments, the Trump administration announced that it would file an emergency stay of the order “at the earliest possible time.” Late in the day on February 4th, the Department of Justice (“DOJ”) filed a formal notice of appeal with the United States Court of Appeals for the Ninth Circuit.  The appeal sought to resume the travel ban by requesting an emergency stay of the decision issued by the Western District of Washington.  Early Sunday morning, the Ninth Circuit Court of Appeals issued an initial decision denying the DOJ's emergency request.  However, the federal appeals court has also asked both parties to brief their respective legal arguments before rendering its final decision.  For now, the travel ban remains suspended. Developments from this past week have demonstrated that the interpretations and implementation of EO 13769 continue to fluctuate and evolve.  Accordingly, individuals from the seven designated countries of concern who are currently in the United States would be well-advised not to travel outside of the United States until the issues surrounding EO 13769 have been clearly settled by the judicial system.

On January 27, 2017 President Trump signed an Executive Order (“EO”) titled "Protecting the Nation from Foreign Terrorist Entry into the United States".  Given the diverse composition of colleges and universities, which includes faculty, staff and students, this EO significantly impacts the higher education community.  Specifically, the EO suspends the entire US refugee admission system for 120 days and the Syrian refugee program indefinitely.  In addition, the EO suspends the entry of immigrants and non-immigrants from certain designated countries of concern for an initial period of 90 days.  It should be noted that after 90 days, travel is not automatically reinstated for foreign nationals from these countries of concern.  Instead, the EO has mandated that the United States Department of Homeland Security (“DHS”) be required to report whether countries have provided information "needed…for the adjudication of any…benefit under the INA…to determine that the individual seeking the benefit is who the individual claims to be and is not a security or public-safety threat."  If a country refuses to provide the requested information regarding its nationals to enable the United States to adjudicate visas, admissions or other benefits provided under the INA, the EO states that foreign nationals from that country will be prohibited from entering the United States until compliance has been achieved.  The EO currently applies to individuals from seven designated countries: Iran, Iraq, Libya, Somalia, Sudan, Syria, and Yemen. There has been significant confusion regarding the scope and implementation of the EO’s travel ban. Currently, the travel ban appears to include and apply to the following groups of individuals: non-immigrant visa holders, immigrant visa holders, refugees, derivative asylees, Special Immigrant Visas (SIVs), etc.  Moreover, any foreign national holding a passport from one of the seven designated countries is considered to be from the designated country.  Accordingly, dual citizens who hold passports issued by both a designated country and non-designated country may also be subject to the travel ban.  Further adding to the confusion regarding the scope of this EO, the DHS Secretary John Kelly issued a clarification statement on January 29, 2017 which noted that status as a lawful U.S. permanent resident (a.k.a. “green card holder”) “will be a dispositive factor” used in the case-by-case analysis for determining re-entry and/or admission into the United States. Based on the information set forth in the EO, colleges and universities would be well-served to advise students, faculty and staff who are from any of these seven designated countries to refrain from traveling outside of the United States until further notice. While the EO has specifically identified seven countries of concern, there is speculation that this list may evolve and expand in the future.  Therefore, foreign nationals that hold immigrant and/or non-immigrant visas and who are presently in the United States from other Middle Eastern countries should strongly consider avoiding any international travel, where possible, until additional administrative and judicial guidance has been released. To date, legal challenges have been filed in federal courts throughout the United States on constitutional grounds. We anticipate that additional lawsuits by various stakeholders will be pursued in the coming days and weeks. Thus far, courts in New York, Massachusetts, Virginia and Washington have granted stays of removal and/or temporary orders restraining the enforcement of the EO.  While each court decision is slightly different, and does not overrule or invalidate the EO on its face, they do send two messages: (i) the subject matter contained in the EO will be subject to legal challenges; and (ii) given the gravity of the situation, the courts will likely address any such legal challenges in an expeditious manner.  As suggested above, until more practical guidance is issued from the courts, the DHS and/or the White House, colleges and universities should advise faculty, staff and students that could potentially be impacted by this EO not to travel abroad.

On November 14, 2016, the United States Citizenship and Immigration Services (“USCIS”) released a new Form I-9 (Rev. 11/14/2016 N) to replace the prior form which expired on March 31, 2016.  Beginning January 22, 2017, colleges and universities must use this updated form for the initial employment verification of all new hires (including student employees) moving forward.  Use of the updated Form I-9 also applies to the reverification of an individual’s employment eligibility, as appropriate.  Institutions should be aware that: (i) the new Form I-9 has an expiration date of August 31, 2019; and (ii) prior versions of the Form I-9 are no longer valid and should not be used in the future. By way of background, the Immigration Reform and Control Act (“IRCA”) requires all employers – including colleges and universities – to verify the identity and legal work authorization of individuals hired after November 6, 1986, including U.S. citizens and legal permanent residents,. Specifically, the I-9 verification process requires individuals to present facially valid documentation to enable higher education institutions to verify an individual’s identity and to further confirm that the individual is authorized to work in the United States.  For record-keeping purposes, colleges and universities must retain completed Form I-9s for either three (3) years after an individual’s date of hire or one (1) year after the employment relationship ends – whichever is later. According to the USCIS, the new Form I-9 is “designed to reduce errors and enhance form completion using a computer”.  Dubbed a “smart form”, the online version of this updated form now includes various enhancements intended to minimize technical errors commonly made by institutions and employees.  For example, some of the new I-9 smart form features include the following:

• Embedded prompts in the online Form I-9 which provide instructions on how to properly complete that particular question.
• Drop down lists for certain questions (e.g., citizenship/immigration status, number of preparers/translators, state, document title, issuing authority, etc.) and calendar entries for requested dates (e.g., date of birth, document expiration dates, etc.).
• The opportunity to list / enter information for more than one preparer and/or translator (if applicable).
• Auto-population of “N/A” in certain blank fields (where applicable).
• Auto-population of the employee’s name and citizenship/immigration status into Section 2 based upon responses provided in Section 1. A mechanism which prompts an individual about missing information and/or incomplete fields – highlighted in red – before moving from one section to another within the form.
• An “error-checking mechanism” which provides prompts and error messages where there may be potential response inconsistencies between citizenship/immigration status and proffered I-9 supporting documentation.
• A “Start Over” option that enables an individual to clear the Form I-9 and start anew, if necessary.
• A “Print” option that enables an individual to print the Form I-9 once data has been entered.
• An “Instructions” option which automatically links an online user to a separate copy of the Form I-9 instructions.
• Automatic generation of a quick response (QR) code.

Higher education institutions are reminded that even if they opt to use the enhanced online version of the Form I-9, they must still print the document, gather the necessary handwritten signatures and store the completed form pursuant to the applicable I-9 recordkeeping requirements. In addition to the electronic enhancements mentioned above, the USCIS has made several other notable revisions to the new Form I-9. A summary of the main changes within each section of the form appears below. Improved Instructions: In this latest round of revisions, the USCIS has separated the instructions from the actual Form I-9. In addition, the USCIS has amended the instructions to provide more detail and guidance in an effort to reduce errors during the verification process. The Form I-9 instructions are now 15 pages in length. Colleges and universities should note that they are still required to make either an electronic or hard-copy of these instructions available to employees when they complete the Form I-9. Section 1: Employee Information and Attestation

• The “Other Names Used” field has been renamed to “Other Last Names Used (if any)”. This field has changed to require only last name changes in an effort to protect the privacy of individuals (transgendered and others) who have changed their first names, as well as to avoid potential discrimination issues.
• Foreign national employees are no longer required to provide both their Form I-94 number and foreign passport information in Section 1. Instead, the updated form requires foreign national workers to supply one response from the following three (3) options: (i) an Alien Registration Number; or (ii) a Form I-94 Admission Number; or (iii) a foreign passport number.
• Higher education institutions must now affirmatively answer whether a preparer/translator has been used for completion of Section 1 of the Form I-9. If a preparer/translator has been used, the updated form now provides additional spaces to enter multiple preparers/translators.

Section 2: Employer or Authorized Representative Review and Verification 

• Addition of the employee’s “Citizenship/Immigration” status at the beginning of Section 2. (This information should be consistent with what the employee has listed in Section 1.)
• A new dedicated box / blank section where institution representatives may enter additional information/notes previously written in the margins (e.g., annotations for OPT extensions, receipts, Temporary Protected Status, etc.).

****** As noted above, the new Form I-9 includes new electronic features to facilitate fewer errors during the completion process. Reducing the number of technical/paperwork violations on the Form I-9 has become increasingly important since the federal government implemented higher civil fines against institutions who commit immigration-related offenses, which includes, among other things, Form I-9 and E-Verify violations.  With respect to I-9 paperwork errors (e.g., errors or omissions on the Form I-9), the federal government raised the civil penalty range from $110-$1,110 (per relevant individual) to $216-$2,156 (per relevant individual) – an increase of approximately ninety-six percent (96%).  The new penalties took effect on August 1, 2016.

Given the anticipation of heightened immigration enforcement by the new administration, colleges and universities may be well-served to review their I-9 procedures and records to ensure compliance with IRCA. If you have questions about the new Form I-9 or general I-9 compliance issues, contact Caroline M. Westover, any of the attorneys in our Immigration Law Practice or Higher Education Law Practice, or the attorney in the firm with whom you are regularly in contact.

Following a public comment period, the New York State Department of Financial Services (“DFS”) has published a modified version of new regulations, previously issued on September 13, 2016, aimed at creating higher cybersecurity standards within the banking, insurance and financial services industries.  The regulations go into effect on March 1, 2017 with phased implementation thereafter, and will likely require significant capital expenditures and operational changes by colleges and universities covered by the regulations.  The public comment period for the proposed modified regulations will be open until January 27, 2017. Colleges and universities must already comply with a panoply of laws, regulations and standards relating to data security:  the Gramm-Leach-Bliley Act, the United States Department of Education guidance applicable to student loan information, the Red Flags Rule, PCI standards for credit card information, and, for some institutions, the Health Insurance Portability and Accountability Act.  The DFS proposed cybersecurity regulations would impose operational requirements and expenditures that are far more burdensome than these existing obligations in many respects, including but not limited to standards for: penetration testing and vulnerability assessments, audit trails, cybersecurity personnel, due diligence, risk assessment, and contracting with third parties, use of multi-factor authentication and annual certification of compliance by the board of directors.  For information on the specific requirements of the proposed cybersecurity regulations, please review our Client Information Memoranda dated September 16, 2016 and January 5, 2017. The new cybersecurity regulations apply to “Covered Entities”, which are defined broadly as “any Person operating under or required to operate under a license, registration, charter, certificate, permit, accreditation or similar authorization under the banking law, the insurance law or the financial services law.”  Among the 3,800 entities regulated by DFS is a subset of institutions and organizations that are engaged in bona fide charitable, religious, missionary, educational or philanthropic activities and are permitted under N.Y. Insurance Law § 1110 to issue charitable gift annuities to donors.  Therefore, unless the new regulations are further modified, such entities (including many colleges and universities) will be required to comply. (To determine if your entity is supervised by DFS, you can perform a search here.) Certain covered entities are exempt from a subset of the new cybersecurity regulations.  Exempt entities include those with fewer than 10 employees, less than $5 million gross annual revenue for three years, or less than $10 million in year-end total assets.  Additional exemptions exist for covered entities that do not operate, maintain, utilize or control any Information Systems and do not control, own, access, generate, receive or possess Nonpublic Information as those terms are defined by the regulations.  Covered entities that qualify for exemptions must file a “Notice of Exemption” with DFS affirming the basis for the exemption.  Unfortunately, due to their size, few colleges and universities will qualify for exemption. It is not immediately clear that DFS intended to include entities regulated solely under Insurance Law § 1110 as covered entities alongside traditional insurance companies.  In fact, according to the Report on Cyber Security in the Insurance Sector, which was conducted as part of the regulation drafting process, DFS surveyed 21 health insurers, 12 property and casualty insurance providers, and 10 life insurance providers, but no colleges, universities, or charitable or religious organizations.  Statements made by the Superintendent of Department of Financial Services, Maria T. Vullo, and Governor Andrew Cuomo in connection with the announcement of the regulations make no mention of not-for-profit organizations or higher education institutions as targets of the regulations. Notwithstanding the apparent primary focus of the regulations, in connection with its reissuance of the regulations on December 28, DFS acknowledged that many of the comments it received concerned the broad definition of “Covered Entity”, but that it opted not to amend that definition at this time.  Institutions issued permits under N.Y. Insurance Law § 1110 to issue charitable gift annuities may wish to submit public comments about the impact of the regulations during the current public comment period, but should proceed on the assumption that the regulations will apply unless and until DFS provides definitive guidance to the contrary.

On November 28, 2016, New York State Governor Andrew Cuomo signed legislation enacting another round of amendments to the Nonprofit Revitalization Act of 2013.  The amendments should ease compliance with the NPRA’s related party transaction rules by incorporating express exceptions, allowing for committee approval, authorizing ratification of past transactions, and narrowing the universe of persons subject to the rules. Private colleges and universities in New York State would be well advised to update their governance documents to incorporate these changes so that their governance documents do not prevent them from taking advantage of these provisions.  In addition, New York institutions should review their governing documents for compliance with other changes made by the amendments, including changes relating to (1) the definition of interested directors (trustees); (2) the formation, composition and authority of Board committees; (3) the role of audit committees; and (4) certain procedural aspects of conflict of interest.