MANAGING STUDENT RECORDS

About This Policy

Policy Statement

North Central University will protect the privacy and records access rights that apply to education records maintained by or for the university about its current and former students. The university will:

• Provide students with an annual notice of their rights.
• Regulate and manage access to education records.
• Provide students with the right to request amendment to their education records and the right to a hearing concerning their education records if the student believes they are inaccurate, misleading, or otherwise in violation of the privacy or other rights of the student.
• Provide complete education records in response to a student’s request that records be provided.

Accessing, disclosing, and using student education records
School officials with legitimate educational interest may have access to student information, if their responsibilities reasonably require access to that information for educational, administrative, or research purposes in the performance of their job duties. University employees who have access to student education records are required to carefully protect them and will be held accountable for safeguarding them.

Personally identifiable student information may only be released in accordance with university policy or with the written permission of the student. When a student provides a valid authorization to release student records to a third party, all records that are legally covered by the authorization must be released as requested by the student. Students must complete appropriate FERPA Authorization form(s) to notify the university in writing of their standing release to the university to disclose confidential student information from the Registrar’s Office, Student Financial Services, One Stop, Student Development, or other university services.

Students must present their North Central University photo ID when requesting information in person at various university offices. Written requests for information must come from the student’s secure university email account. To request information over the telephone, a Student Record Release will be required from both the student and any individuals authorized on the student’s account. Parents or legal guardians authorized on the account will be required to provide their student’s name, their name and relationship to the student, along a Student Records Release PIN.

Parents of a dependent student as defined under the Internal Revenue Code may request access to their dependent student’s education records without the student’s consent. Access must be authorized by the student.

Disclosing and restricting directory information
Directory information may appear in public documents and may otherwise be disclosed without student consent unless a student submits a written request to the One Stop to block or restrict the disclosure of directory information. If a block or restriction is in place, no information will be provided to anyone who may wish to contact a student or verify a student’s status at the university.

The restriction of information is permanent until a request is submitted, in writing, that the restriction be removed. The restriction will remain in place even after the last date of attendance or graduation. Once a restriction is in place, a student will must conduct business with the university in person, with photo ID, or provide a written request of release.

Restricted directory information is made available only where an emergency is involved, at the direction of a court order, or to university staff and faculty with a legitimate educational interest.

Third party disclosure
The university will not disclose education records or personally identifiable information from a student’s education record to any third party without prior consent of the student, except as authorized by Family Educational Rights and Privacy Act and university policy.

The university may release a student’s education records to officials of other educational institutions in which that student seeks or intends to enroll or is enrolled, so long as disclosure is for purposes related to the student’s enrollment or transfer.

Managing third parties
The university will inform all parties to whom personally identifiable information is given that they are not permitted to disclose that information to others without the written consent of the student and that the information is to be used only for the purpose(s) intended. However, parties to whom personally identifiable information is given may make further disclosures of the information if they are acting on behalf of the university and as directed by the university.

Third party servicers, as defined by the Department of Education, must adhere to the same information security standards as the university and are subject to the university’s information security program and FTC requirements for financial institutions.

Documenting disclosure
The university will keep a record of each request that has been made for personally identifiable information (PII). This information will be kept with the education record for as long as the record is maintained.

The PII from education records provided to a third-parties or third-party servicers is limited to the PII that is necessary for the party or services to perform the Title IV function(s) or service(s) the third-party servicer has contracted to perform on behalf of the institution.

Disclosure request must include the following:

1. The parties who have requested or received PII from the education records.
2. The legitimate interests the parties had in requesting or obtaining the information.

If the university discloses PII from education records with the understanding that further disclosures will be made, the record of disclosure must include the names and legitimate interests of the additional parties.

No formal record is required in instances of disclosure to the student who is the subject of the record or to persons within the university who are eligible to receive information, nor is a record required when directory information is given.

Further limitations on disclosure and access to third parties
Granting direct access to third parties to Department of Education systems and data (e.g., the National Student Loan Data System (NSLDS)) is expressly prohibited.

Student’s right to review
Students are entitled by law to review portions of their records at the university and to request amendments of such records if the student believes they are inaccurate, misleading, or otherwise in violation of the privacy or other rights of the student.

Distributing and posting grades
The posting of grades or examination results with personally identifiable information (i.e., student ID number, Social Security Number, student name) is prohibited. Examinations, papers, blue books, or any other graded materials that contain personally identifiable student information (i.e., name, student ID number) should be distributed directly to students or made available for pick up in departmental offices in a manner that ensures the privacy of each student’s grade.

References or recommendations from university employees
Students who request written or verbal references or recommendations from university employees need to do so in writing. Such letters or statements are most effective if they contain specific information about your academic or work performance; this type of information is considered “non-directory” information and cannot be released without the signed written consent of the student.

Complaints
If a student believes that the University is not in compliance with university policy, university procedures, and/or the FERPA, the student should check first with the office involved and/or the Office of the Registrar.

If a student wishes to file a complaint with the Department of Education concerning the university’s failure to comply with FERPA, the student must submit the complaint, in writing, to the Family Policy Compliance Office.

Sanctions

Employees or student employees who violate this this policy may be subject to disciplinary action for misconduct and/or performance based on the administrative process appropriate to their employment.

Students who violate this policy may be subject to proceedings for non-academic misconduct based upon their student status.

Reason For Policy

To provide clear expectations for the handling of, and granting access to, educational records of current and former University students in accordance with Family Educational Rights and Privacy Act (FERPA), 20 U.S.C.A. section 1232g, and implementing regulations, 34 C.F.R. Part 99.

Policy Scope

University employees (faculty, staff, student employees) and other covered individuals (e.g., affiliates, vendors, independent contractors, etc.) in their accessing and handling of student records, data, or information in any form (paper, digital text, image, audio, video, microfilm, etc.) while conducting university business (administrative, financial, teaching, research, or service). This policy applies to all current or former students at the university.

Procedures

• Responding to Authorizations to Disclose Student Records
• Requesting a Review or Amendment of Education Records

Forms

• FERPA Authorization & Student Records Release PIN Form (Colleague Self-Service)
• FERPA Block Request Form

Appendices

• There are no appendices associated with this policy.

Additional Contacts

Definitions

Annual Notice
The notice the university will provide to each student in attendance at the University at least annually of their rights pursuant to FERPA and the procedures for exercising their rights. The annual notification includes:

• Information regarding an eligible student’s right to inspect and review their education records.
• The right to seek to amend the records.
• The right to consent to disclosure of personally identifiable information from the records (except in certain circumstances).
• The right to file a complaint regarding an alleged failure by a school to comply with FERPA.
• The university’s definitions/criteria of the terms “school official” and “legitimate educational interest.”

Data Custodian
A data custodian is an employee of the university who has administrative and/or operational responsibility over a specific type, category, or piece of institutional data.

Directory Information
Information in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. The following information about a student has been designated by the university as directory information:

• Name
• Current address and telephone number
• NCU e-mail address
• Major
• Dates of attendance
• Current enrollment status
• Student class standing
• Degrees, honors, and awards
• Participation in officially recognized activities and sports.
• Weight and height of members of athletic teams

Education Records
Records directly related to a student that are maintained by or on behalf of the university. Education records do not include:

• Records of instructional, administrative, and educational personnel that are in the sole possession of the maker (i.e., file notes of conversations), used only as a personal memory aid, not intended to be accessible or revealed to any individual except, in the case of an instructor, a temporary substitute.
• Law enforcement records of the university security
• Medical records and mental health records, including counseling records created, maintained, and used only in connection with provision of medical treatment or mental health treatment or counseling to the student and that are not disclosed to anyone other than the treatment facility.
• Employment records unrelated to the student’s status as a student.
• Alumni records

Eligible Student
An individual for whom the university maintains a record, regardless of age, who is or who has attended university. It does not include persons who have been admitted but did not attend the university.

Student Records Release PIN
A number or code word or set of codes that is supplied by the student for the purposes of identity verification and allowing authorized third parties to review or receive personally identifiable or FERPA protected information. Students can use a combination of PINs for specific record types and for audience types.

Legitimate Education Interest
An interest in student records for the purpose of performing stated job duties.

Personally Identifiable Information
Information obtained from or contained in an education record that can be used to identify a student to whom the record relates or to another student. It specifically includes information determined by the university to be:

• Linked or linkable to a specific student and would allow a reasonable person in the university community who does have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty;
• Information requested by a person who the university reasonably believes knows the identity of the student to whom the education record relates.

Unless the context of this policy indicates otherwise, a reference to an education record includes personally identifiable information contained in or obtained from an education record.

School Official
Any person employed by the university in an administrative, supervisory, academic, or support staff position, including law enforcement unit and health staff; a person or company with whom the university has an affiliation or contract; the university Board of Regents or a person assisting another university official in performing their tasks, if that person or contractor requires access to an education record in order to fulfill his or her official responsibilities on behalf of the university.

Written Consent
 Written consent must contain the following:

• Information necessary for unambiguous identification of the student whose records are to be disclosed.
• Specification of the record(s) from which information is to be released and of the items of information within the record(s) which are to be released.
• The person or class of persons who may receive the information.
• The purpose for which the information is to be released.
• The date of the request.
• The signature of the student

Responsibilities

Custodians of Education Records

• Protect student data.
• Respond to requests by students to amend an educational record.

Vice President of Academic Affairs

• Appoint the custodians of student education records.
• Appoint hearing officers to review hearing requests.

Hearing Officers

• Comply with the hearing procedures.

Students

• Complete a request to prevent disclosure to prohibit the disclosure of directory information during the term of enrollment.

One Stop

• Process student FERPA-related request.
• Coordinate and manage responses to student education record requests.
• Coordinate and manage relationships with third party servicers.

Office of the Registrar

• Publish an annual public notice designating directory information and informing students of their option to prohibit release of directory information.

Office of Innovation & Technology

• Manage the university’s information security program.
• Coordinate with university departments, offices, and personnel on data security.

School Officials

• Respond to inquiries about students without their consent if the requested information is a matter of public record or directory information and not restricted.

RELATED INFORMATION

Related Policies & Procedures

• Acceptance Use of Information Technology
• Information Security
• Privacy
• Data Breaches

Related Legislation & Information

• FERPA – Family Educational Rights and Privacy Act, 20 U.S.C.A. section 1232g, and implementing regulations, 34 C.F.R. Part 99.
• Gramm-Leach-Bliley Act’s (GLBA),
• Title IV of the Higher Education Act (HEA), as amended, HEA; P.L. 89-329
• Third Party Servicers FAQ- https://fsapartners.ed.gov/knowledge-center/faqs/third-party-servicer-frequently-asked-questions

History

Issued
2022-07-20