EDUCAUSE QuickPoll Results: Third-Party Service Agreements and Contracts

EDUCAUSE is helping institutional leaders, technology professionals, and other staff address their pressing challenges by sharing existing data and gathering new data from the higher education community. This report is based on an EDUCAUSE QuickPoll. QuickPolls enable us to rapidly gather, analyze, and share input from our community about specific emerging topics.^Footnote1

The Challenge

Recently, the U.S. Department of Education published a "dear colleague letter," issuing new guidance on third-party servicers (TPSs).^Footnote2 Under this new guidance, the definitions of "third-party servicer" and "activities" are much broader and, for many, unclear. More outsourced services (e.g., student recruitment and retention, instructional content management, marketing) could be subject to TPS requirements. These changes have left many stakeholders confused about what contracts now fall under this new guidance, what they need to do to stay in compliance, and whether there is enough time to take appropriate actions given that the deadline for reporting is in less than six months. As institutions digest, plan, and react, it is important to think not only about future steps and implications but also about the current state of decision-making and processes for third-party services. How have institutions been securing third-party services? What does that process look like, and who is involved in the decision-making? This QuickPoll examines both the current state of decision-making about third-party services and the potential impacts of the new guidance issued.

The Bottom Line

Institutions' decision-making processes in choosing and procuring third-party services aren't as collaborative as they could be; only some stakeholders have a seat at the table. Further adding to these challenges is the new TPS guidance from the Department of Education. Some stakeholders are not even familiar with these changes, and those who are familiar feel that there is a lack of clarity in the guidelines. As institutions seek further clarification and begin to respond, they may need to review and update existing processes surrounding the procurement of third-party services, focusing on areas such as communication, transparency, collaborative decision-making, and efficiency. If the new TPS guidance is here to stay, colleges and universities will need to review numerous existing contracts and will face greater constraints in the adoption of future services. The challenges related to compliance might drive institutions to adopt more centralized practices, whether they feel that is holistically best for them or not. Tackling some of the general challenges in the procurement process now may help institutions better adapt in the future.

The Data: A Peek at Typical Third-Party Services

Institutions contract for a variety of technology services from third parties. We asked respondents to think of a third-party service that they are most familiar with and answer some questions on this specific service.^Footnote3 Respondents identified a plethora of services, including everything from email, printing, word processing software, web hosting services, and SaaS apps to CRM, project management, and LMS platforms. Most respondents (83%) indicated that the service was a typical type of contract for their institution to sign. The most common provisions included in the third-party service were security (78%), student privacy protections (60%), and confidentiality (59%) (see figure 1).

The Data: Who Are the Decision Makers?

Decision-making for third-party services is somewhat centralized. Over half (59%) of respondents indicated that the decision-making for third-party services at their institution is somewhat centralized (i.e., a centralized unit is responsible, but other units are extensively involved). Over one in five (21%) indicated that the decision-making is not at all centralized, and only 4% indicated that it is fully centralized. (See figure 2.)

Communication about decision-making processes across the institution can also be a challenge in higher education. Nearly two-thirds of respondents (66%) reported that the decision-making process for choosing third-party services is communicated only to those most impacted by the service. Only 9% said that it's communicated broadly to most or all members of the institution. Over a quarter of respondents (26%) indicated that this process is closed and confidential, raising questions about the extent to which stakeholders find confidentiality necessary or beneficial. (See figure 3.^Footnote4)

Directors, managers, and technology professionals are key decision makers. We asked respondents to think about who was involved in the decision-making process for the third-party service they are most familiar with. More than half (55%) reported that multiple units or departments were involved in approving that service. The stakeholders most commonly reported to be involved in the decision-making process were directors and managers (80%), technology professionals (75%), and C-level leaders (58%). Those less commonly reported as being involved were academic deans and department chairs (33%), instructional designers and faculty developers (24%), faculty (20%), student affairs professionals (15%), and library professionals (14%). (See figure 4.)

The Data: Dear Colleague Letter

Many are unfamiliar with the new requirements. Surprisingly, over half of respondents (56%) indicated that they are not familiar with the Department of Education's new requirements for TPSs. For respondents familiar with the new requirements, we asked whether they considered all service agreements and contracts to be a form of outsourcing under the new requirements. The responses were mixed—40% said yes, 37% said no, and 23% said they did not know. These respondents also indicated their sentiment toward the new requirements, and not many view the changes favorably. Only 11% felt somewhat or very favorable, while 54% felt somewhat or very unfavorable (see figure 5).

Uncertainty is driving many to seek clarification. We asked respondents who are familiar with the new requirements what, if anything, their institution is currently doing to prepare to meet the new requirements for TPSs. The most common action reported was seeking further clarification (66%), followed by engaging in discussions (54%). More than a quarter of respondents (29%) indicated that their institution is already reviewing their contracts, while 17% said that they don't know what their institution is doing to prepare. (See figure 6.)

The potential impacts of the new guidelines remain unclear. We asked respondents who are familiar with the new requirements how they think the new requirements for TPSs and institutions will impact their institution. Respondents noted the lack of clarity in the new requirements and identified outcomes ranging from uncertainty to major disruptions. Of those mentioning the potential for significant disruptions, some noted that more time, effort, and resources would be needed to ensure compliance with the new guidelines. Other respondents explained that there could be future constraints on which services they will be able to adopt or continue to use.

Once there is clarity in the new requirements it will cause us to review every contract and perhaps amend agreements to create certain required attestations by third parties.

[It] will significantly constrain our choices for the future and potentially force us off of services we currently heavily use and are part of a high-functioning ecosystem.

If this requirement is adopted it will have significant impacts on the amount [of] work to be done to identify current products/servicers that will require oversight to meet regulations, as well as lengthen the process to acquire new servicers.

If the approach stands as drafted, we would take a very broad approach. We would make sure that big providers of academic content were all under contract. Today, those are often selected by the faculty teaching a course or by a department, without central oversight. We would need to make sure that is covered more centrally to be compliant. That will limit the ability of faculty to adopt new offerings quickly for their teaching.

Common Challenges

There is a need for transparency and collaborative decision-making. Respondents identified a number of challenges that need to be addressed regarding the decision-making process for choosing third-party services at their institution. A lack of communication, collaboration, and efficiency are significant challenges for institutions.

There is little to no transparency about what third-party licenses schools and units hold, nor about enterprise licenses beyond the big-ticket IT systems. This siloed approach leads to overlaps in purchases of the same service, redundant and incompatible systems, decreased bargaining power with vendors, and under-leveraging of enterprise licenses.

Respondents also identified the need for the following:

• Shorter approval times
• Procurement guidelines and frameworks, including policies for informing all relevant stakeholders
• Stakeholder understanding about the acquisition process
• Access to relevant resources
• Consideration of the broad impacts of acquiring specific third-party services
• Governance and standardization in determining needs and selection of services
• Early stakeholder involvement, especially IT
• Input from legal and procurement offices

Promising Practices

Collaborative, efficient processes are the main goal. Respondents provided a variety of promising practices for supporting the third-party service decision-making process. In general, collaboration, inclusion, and efficiency are the keys to a successful process.

• Collaborating and communicating with all relevant stakeholders, regardless of rank or position
• Publishing process templates and contracting guidelines, including guiding principles for balancing cost, need, and usability
• Centralizing some processes to reduce redundancy and decentralizing some processes for flexibility and customization
• Reviewing and evaluating data governance, security, and privacy
• Conducting needs assessments and reviewing market trends to determine current and upcoming needs
• Conducting user pilots and demonstrations
• Vetting vendors with a tool such as the Higher Education Community Vendor Assessment Toolkit (HECVAT) and maintaining a searchable catalog of preapproved vendors
• Minimizing the time required for review processes
• Staying up-to-date on knowledge of local (e.g., state) and higher-level (e.g., federal, international) regulations
• Working directly with vendors to craft tailored proposals

As always, EDUCAUSE has resources to help you make sense of these emerging issues as they develop. Keep an eye on the EDUCAUSE Review Policy Channel, and join other members in discussion on EDUCAUSE Connect Community Groups such as IT Procurement and Supplier Management.

Notes

1. QuickPolls are less formal than EDUCAUSE survey research. They gather data in a single day instead of over several weeks and allow timely reporting of current issues. This poll was conducted between March 20 and March 21, 2023, consisted of 22 questions, and resulted in 185 responses. The poll was distributed by EDUCAUSE staff to NACUBO members via email and EDUCAUSE members via relevant EDUCAUSE Community Groups. We are not able to associate responses with specific institutions. Our sample represents a range of institution types and FTE sizes. Jump back to footnote 1 in the text.↩
2. Jarret Cummings, "EDUCAUSE and Third-Party Servicer Guidance," EDUCAUSE Review, March 16, 2023. Jump back to footnote 2 in the text.↩
3. Only respondents who expressed that they were at least "somewhat familiar" with the decision-making process for choosing third-party services at their institutions were included in this QuickPoll sample. Jump back to footnote 3 in the text.↩
4. Due to rounding errors, proportions of answers to some questions may add to more than 100%. Jump back to footnote 4 in the text.↩

---

Nicole Muscanell is Researcher at EDUCAUSE.

Jenay Robert is Researcher at EDUCAUSE.