All Policies › Information Technology › Managing Student Records

Managing Student Records

On this page: Policy Statement · Reason for Policy · Policy Scope · Procedures · Frequently Asked Questions · Forms · Appendices · Additional Contacts · Definitions · Responsibilities · Related Information · History

Policy Statement

North Central University will protect the privacy and records access rights that apply to education records maintained by or for the university about its current and former students. The university will:

• Provide students with an annual notice of their rights.
• Regulate and manage access to education records.
• Provide students with the right to request amendment to their education records and the right to a hearing concerning their education records if the student believes they are inaccurate, misleading, or otherwise in violation of the privacy or other rights of the student.
• Provide complete education records in response to a student’s request that records be provided.

Accessing, Disclosing, and Using Student Education Records

School officials with legitimate educational interest may have access to student information, if their responsibilities reasonably require access to that information for educational, administrative, or research purposes in the performance of their job duties. University employees who have access to student education records are required to carefully protect them and will be held accountable for safeguarding them.

Personally identifiable student information may only be released in accordance with university policy or with the written permission of the student. When a student provides a valid authorization to release student records to a third party, all records that are legally covered by the authorization must be released as requested by the student. Students must complete appropriate FERPA Authorization form(s) to notify the university in writing of their standing release to the university to disclose confidential student information from the Registrar’s Office, Student Financial Services, One Stop, Student Development, or other university services.

Students must present their North Central University photo ID when requesting information in person at various university offices. Written requests for information must come from the student’s secure university email account. To request information over the telephone, a Student Record Release will be required from both the student and any individuals authorized on the student’s account. Parents or legal guardians authorized on the account will be required to provide their student’s name, their name and relationship to the student, along with a Student Records Release PIN.

While parents of dependent students, as defined under the Internal Revenue Code, may initiate a request for access without the student’s consent, final disclosure requires the student to complete a formal authorization.

Disclosing and Restricting Directory Information

Directory information may appear in public documents and may otherwise be disclosed without student consent unless a student submits a written request to the One Stop to block or restrict the disclosure of directory information. If a block or restriction is in place, no information will be provided to anyone who may wish to contact a student or verify a student’s status at the university.

The restriction of information is permanent until a request is submitted, in writing, that the restriction be removed. The restriction will remain in place even after the last date of attendance or graduation. Once a restriction is in place, a student must conduct business with the university in person, with photo ID, or provide a written request of release.

Restricted directory information is made available only where an emergency is involved, at the direction of a court order, or to university staff and faculty with a legitimate educational interest.

Third Party Disclosure

The university will not disclose education records or personally identifiable information from a student’s education record to any third party without prior consent of the student, except as authorized by Family Educational Rights and Privacy Act and university policy.

The university may release a student’s education records to officials of other educational institutions in which that student seeks or intends to enroll or is enrolled, so long as disclosure is for purposes related to the student’s enrollment or transfer.

Managing Third Parties

The university will inform all parties to whom personally identifiable information is given that they are not permitted to disclose that information to others without the written consent of the student and that the information is to be used only for the purpose(s) intended. However, parties to whom personally identifiable information is given may make further disclosures of the information if they are acting on behalf of the university and as directed by the university.

Third party servicers, as defined by the Department of Education, must adhere to the same information security standards as the university and are subject to the university’s information security program and FTC requirements for financial institutions.

Documenting Disclosure

The university will keep a record of each request that has been made for personally identifiable information (PII). This information will be kept with the education record for as long as the record is maintained.

The PII from education records provided to third parties or third-party servicers is limited to the PII that is necessary for the party or servicer to perform the Title IV function(s) or service(s) the third-party servicer has contracted to perform on behalf of the institution.

The record of disclosure must include the following:

1. The parties who have requested or received PII from the education records.
2. The legitimate interests the parties had in requesting or obtaining the information.

If the university discloses PII from education records with the understanding that further disclosures will be made, the record of disclosure must include the names and legitimate interests of the additional parties.

No formal record is required in instances of disclosure to the student who is the subject of the record or to persons within the university who are eligible to receive information, nor is a record required when directory information is given.

Further Limitations on Disclosure and Access to Third Parties

Granting direct access to third parties to Department of Education systems and data (e.g., the National Student Loan Data System (NSLDS)) is expressly prohibited.

Student’s Right to Review

Students are entitled by law to review portions of their records at the university and to request amendments of such records if the student believes they are inaccurate, misleading, or otherwise in violation of the privacy or other rights of the student.

Distributing and Posting Grades

The posting of grades or examination results with personally identifiable information (i.e., student ID number, Social Security Number, student name) is prohibited. Examinations, papers, blue books, or any other graded materials that contain personally identifiable student information (i.e., name, student ID number) should be distributed directly to students or made available for pick up in departmental offices in a manner that ensures the privacy of each student’s grade.

References or Recommendations from University Employees

Students who request written or verbal references or recommendations from university employees need to do so in writing. Such letters or statements are most effective if they contain specific information about the student’s academic or work performance; this type of information is considered “non-directory” information and cannot be released without the signed written consent of the student.

Complaints

If a student believes that the University is not in compliance with university policy, university procedures, and/or FERPA, the student should check first with the office involved and/or the Office of the Registrar.

If a student wishes to file a complaint with the Department of Education concerning the university’s failure to comply with FERPA, the student must submit the complaint, in writing, to the U.S. Department of Education’s Student Privacy Policy Office.

Sanctions

Employees or student employees who violate this policy may be subject to disciplinary action for misconduct and/or performance based on the administrative process appropriate to their employment.

Students who violate this policy may be subject to proceedings for non-academic misconduct based upon their student status.

Back to top ↑

---

Reason for Policy

To provide clear expectations for the handling of, and granting access to, educational records of current and former University students in accordance with Family Educational Rights and Privacy Act (FERPA), 20 U.S.C.A. section 1232g, and implementing regulations, 34 C.F.R. Part 99.

Back to top ↑

---

Policy Scope

University employees (faculty, staff, student employees) and other covered individuals (e.g., affiliates, vendors, independent contractors, etc.) in their accessing and handling of student records, data, or information in any form (paper, digital text, image, audio, video, microfilm, etc.) while conducting university business (administrative, financial, teaching, research, or service). This policy applies to all current or former students at the university.

Back to top ↑

---

Procedures

Responding to Authorizations to Disclose Student Records

Students may authorize disclosure of their student records to prospective employers, educational institutions, or for other reasons. Because student education records cover a wide range of record types, the university employee receiving the request must consult the appropriate offices to obtain information that responds to the request.

If the requester has a valid authorization from the student, the recipient of the request must ensure that all records that respond to the request and are authorized by the student for release are produced and disclosed.

The recipient of the request must forward the disclosure request to the Office of the Registrar.

The Office of the Registrar must ensure that the request is accompanied by an authorization signed by the student.

Requesting a Review or Amendment of Education Records

Requesting a Review of Education Records

To gain access to an education record, the student must file a request with the Office of the Registrar. The university will make the records available to the requesting student within 45 days following the receipt of the request. The university will respond to reasonable requests for explanations and interpretations of the record and must provide copies at a reasonable fee if requested. The university does not routinely provide copies. However, if copies are provided, the fee will be 10 cents per page, plus mailing costs. An official copy of the student’s academic record will be prepared at the cost of the transcript fee for that academic year.

Requesting an Amendment to Education Records

If a student believes that any of the education records relating to her or him contain information that is inaccurate, misleading, or in violation of her or his rights of privacy, the student may ask the university to amend such information. The student may also ask that additional explanatory material be inserted in the record by the custodian.

• The student submits the request to amend their record in writing. The request must be signed and dated by the student and must include sufficient information to identify the challenged record and a statement of the reason that amendment should be made.
• The data custodian will review the request and either approve the request or deny the request.

If the custodian decides that the information is inaccurate, misleading, incomplete, or otherwise in violation of the student’s privacy or other personal rights, they will amend the record accordingly and inform the student in writing.

If the custodian denies the request to amend the record, they must inform the student in writing, indicating the reason for refusal. The custodian must also advise the student of their right to a hearing to challenge the content of the record and their right to insert a statement in the record setting forth their views.

Appealing the Decision to Amend Education Records

If the custodian refuses to amend the education record in accordance with the request or fails to act on the written request, the student may request a hearing to review the request.

The request for hearing must be in writing and signed and dated by the student. Copies should be directed to the provost. The request must include the name of the custodian to whom the petition for amendment was directed and sufficient information to identify the challenged record. If possible, the student should include copies of the request for amendment and the custodian’s written decision.

Upon receipt of a request for hearing, the provost, or their designee, will designate an impartial person to serve as hearing officer. The hearing officer will schedule and conduct the hearing in the following manner:

• The hearing will be scheduled within a reasonable period from the date the provost or the designee, receives the written request for hearing. (The recommended time is within two weeks.)
• The student will be given written notice of the date, place, and time at least five days before the hearing.
• The student may present evidence at the hearing relevant to the issues raised and may be assisted or represented at the hearing by one or more persons of the student’s choice, including attorneys, at the student’s expense.
• The custodian will be afforded a full and fair opportunity to present oral and written evidence relevant to the issues raised in the request for amendment.
• The decision will be issued to the provost or the designee in writing within a reasonable period after conclusion of the hearing. (The recommended time is within one week.)

The decision will be final and will be based solely upon the evidence presented at the hearing and will include a written summary of the evidence and the reasons for the decision.

If the hearing officer decides that the information is inaccurate, misleading, incomplete, or otherwise in violation of the student’s privacy or other personal rights, the provost or the designee will direct the custodian to amend the record and to notify past recipients of the disputed data, including recipients named by the student.

The provost or the designee will also immediately notify the student, in writing, of the outcome of the hearing. A copy of the decision will be enclosed, and, if the decision is adverse to the student, inform the student of the right to place in the educational record a statement commenting on the information in the record, and setting forth disagreement with the hearing officer’s decision.

Back to top ↑

---

Frequently Asked Questions

Q: Who can see my education records?

A: University officials with a legitimate educational interest may access student information when their job duties reasonably require it. Anyone else needs your written permission unless FERPA or university policy allows the disclosure.

Q: How do I give someone permission to access my records?

A: Complete the FERPA Authorization & Student Records Release PIN Form in Colleague Self-Service. Parents or guardians you authorize must give your name, their name and relationship to you, and your Student Records Release PIN when they call.

Q: What counts as directory information?

A: Your name, current address and phone number, NCU email address, major, dates of attendance, enrollment status, class standing, degrees, honors, and awards, participation in recognized activities and sports, and the weight and height of athletic team members.

Q: How do I keep my directory information private?

A: Submit a FERPA Block Request Form. The block stays in place, even after you graduate, until you ask in writing to remove it. While it stays in place, you must handle university business in person with photo ID or by written request.

Q: How do I see my education records?

A: File a request with the Office of the Registrar. The university makes the records available within 45 days of receiving your request.

Q: What if my record contains an error?

A: Submit a signed and dated written request to amend the record, identifying the record and explaining why it needs to change. If the custodian denies the request, you may request a hearing through the provost.

Q: Can a professor post grades by name or student ID?

A: No. The university prohibits posting grades or exam results with personally identifiable information such as a name, student ID number, or Social Security number.

Q: Do I need to give permission for a reference letter?

A: Yes. Ask for references in writing. A reference that describes your academic or work performance requires your signed written consent.

Q: Where can I take a FERPA complaint?

A: Start with the office involved or the Office of the Registrar. You may also file a written complaint with the U.S. Department of Education.

Back to top ↑

---

Forms

• FERPA Authorization & Student Records Release PIN Form (Colleague Self-Service)
• FERPA Block Request Form

Back to top ↑

---

Appendices

There are no appendices associated with this policy.

Back to top ↑

---

Additional Contacts

Subject	Contact	Phone	Email
Policy Clarification and Interpretation	Office of Innovation & Technology	612.343.4170	oit@northcentral.edu
Student Academic Records	Office of the Registrar	612.343.4409	registrar@northcentral.edu
Cybersecurity			cybersecurity@northcentral.edu
Education Record Request	Office of the Registrar	612.343.4409	registrar@northcentral.edu
Education Record Amendments			academics@northcentral.edu
Student Aid / Title IV	One Stop		onestop@northcentral.edu

Back to top ↑

---

Definitions

Annual Notice

The notice the university will provide to each student in attendance at the University at least annually of their rights pursuant to FERPA and the procedures for exercising their rights. The annual notification includes:

• Information regarding an eligible student’s right to inspect and review their education records.
• The right to seek to amend the records.
• The right to consent to disclosure of personally identifiable information from the records (except in certain circumstances).
• The right to file a complaint regarding an alleged failure by a school to comply with FERPA.
• The university’s definitions/criteria of the terms “school official” and “legitimate educational interest.”

Data Custodian

A data custodian is an employee of the university who has administrative and/or operational responsibility over a specific type, category, or piece of institutional data.

Directory Information

Information in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. The following information about a student has been designated by the university as directory information:

• Name
• Current address and telephone number
• NCU e-mail address
• Major
• Dates of attendance
• Current enrollment status
• Student class standing
• Degrees, honors, and awards
• Participation in officially recognized activities and sports.
• Weight and height of members of athletic teams

Education Records

Records directly related to a student that are maintained by or on behalf of the university. Education records do not include:

• Records of instructional, administrative, and educational personnel that are in the sole possession of the maker (i.e., file notes of conversations), used only as a personal memory aid, not intended to be accessible or revealed to any individual except, in the case of an instructor, a temporary substitute.
• Law enforcement records of the university security
• Medical records and mental health records, including counseling records created, maintained, and used only in connection with provision of medical treatment or mental health treatment or counseling to the student and that are not disclosed to anyone other than the treatment facility.
• Employment records unrelated to the student’s status as a student.
• Alumni records

Eligible Student

An individual for whom the university maintains a record, regardless of age, who is attending or has attended the university. It does not include persons who have been admitted but did not attend the university.

Student Records Release PIN

A number or code word or set of codes that is supplied by the student for the purposes of identity verification and allowing authorized third parties to review or receive personally identifiable or FERPA protected information. Students can use a combination of PINs for specific record types and for audience types.

Legitimate Educational Interest

An interest in student records for the purpose of performing stated job duties.

Personally Identifiable Information

Information obtained from or contained in an education record that can be used to identify a student to whom the record relates or to another student. It specifically includes information determined by the university to be:

• Linked or linkable to a specific student and would allow a reasonable person in the university community who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty;
• Information requested by a person who the university reasonably believes knows the identity of the student to whom the education record relates.

Unless the context of this policy indicates otherwise, a reference to an education record includes personally identifiable information contained in or obtained from an education record.

School Official

Any person employed by the university in an administrative, supervisory, academic, or support staff position, including law enforcement unit and health staff; a person or company with whom the university has an affiliation or contract; the university Board of Regents or a person assisting another university official in performing their tasks, if that person or contractor requires access to an education record in order to fulfill his or her official responsibilities on behalf of the university.

Written Consent

Written consent must contain the following:

• Information necessary for unambiguous identification of the student whose records are to be disclosed.
• Specification of the record(s) from which information is to be released and of the items of information within the record(s) which are to be released.
• The person or class of persons who may receive the information.
• The purpose for which the information is to be released.
• The date of the request.
• The signature of the student

Back to top ↑

---

Responsibilities

Custodians of Education Records

• Protect student data.
• Respond to requests by students to amend an educational record.

Provost

• Appoint the custodians of student education records.
• Appoint hearing officers to review hearing requests.

Hearing Officers

• Comply with the hearing procedures.

Students

• Complete a request to prevent disclosure of directory information. The block stays in effect, including after graduation, until the individual requests its removal in writing.

One Stop

• Process student FERPA-related request.
• Coordinate and manage responses to student education record requests.
• Coordinate and manage relationships with third party servicers.

Office of the Registrar

• Publish an annual public notice designating directory information and informing students of their option to prohibit release of directory information.

Office of Innovation & Technology

• Manage the university’s information security program.
• Coordinate with university departments, offices, and personnel on data security.

School Officials

• Respond to inquiries about students without their consent if the requested information is a matter of public record or directory information and not restricted.

Back to top ↑

---

Related Information

Related Policies & Procedures

• Acceptable Use of Information Technology
• Information Security
• Privacy
• Data Breaches

Related Legislation & Information

• FERPA – Family Educational Rights and Privacy Act, 20 U.S.C.A. section 1232g, and implementing regulations, 34 C.F.R. Part 99.
• Gramm-Leach-Bliley Act (GLBA)
• Title IV of the Higher Education Act (HEA), as amended, HEA; P.L. 89-329
• Third Party Servicers FAQ

Back to top ↑

---

History

Amended

2026-10-01 – Non-substantive updates (e.g., titles and copy errors); corrected the personally identifiable information definition to match FERPA; clarified parent access requests and the duration of directory information blocks; moved procedures onto the policy page; added frequently asked questions.

Issued

2022-07-20

Back to top ↑