I. OBJECTIVE & PURPOSE
To provide guidelines and procedures to ensure that student educational records are maintained in a confidential and secure manner by the University, its faculty, staff and others who may come in contact with such data in compliance with federal and state laws and University requirements.
II. STATEMENT OF POLICY
Students are the University of North Florida's first priority and it is paramount that those who come into contact with student educational records are aware of their obligations regarding such records as set forth in this policy.
A. Legal Requirements
The University must maintain student educational records in a confidential manner pursuant to the Family Educational Rights and Privacy Act of 1974, as amended, ("FERPA"), also known as the Buckley Amendment (20 U.S.C. 1232 g) and Section 1002.225, Florida Statutes. FERPA provides students with a right of access to their educational records, permits students to challenge the accuracy of the records and prohibits the non-consensual release of such information except in limited circumstances.
This policy applies to all students in attendance at the University of North Florida. In accordance with the federal regulations implementing FERPA, the University of North Florida defines in attendance for first time students to include those having registered for classes. Thereafter, a student is deemed to be "in attendance" during all periods of enrollment, during breaks between terms, during University holidays and vacations, and during periods of suspension.
The University informs students of their rights under FERPA by annual publication of the University policy in the Student Handbook, the University Catalog and online via the University Registrar.
B. Student's Right to Inspect and Review Their Educational Records.
Students who are currently attending or who have been enrolled as a student at the University of North Florida may inspect and review their own educational records upon request. Educational records are, with certain exemptions as listed below, those records, files documents, and other materials which contain information directly related to a student that are maintained by any employee or agent of the University. The following categories of information are exempted and are not considered to be "educational records."
1. Records made by University personnel in the sole possession of the maker and are not accessible or revealed to any other person.
2. Records maintained by the University Police Department for law enforcement purposes.
3. Medical and counseling records used solely for treatment.
4. Healthcare records and documentation of disability maintained by the Disability Resource Center and/or the ADA Compliance office.
5. Student employment records.
6. Records only related to a former student (alumni records). Records of that individual while a student continue to be considered educational records.
While the above-referenced records may not be deemed confidential pursuant to FERPA, the records may in fact be confidential pursuant to other laws requiring that they be maintained in a confidential and secure manner.
In addition, students do not have a right to inspect the following records:
a. Financial records of parents
b. Confidential letters and statements of recommendations placed in educational records prior to January 1, 1975
c. Confidential letters and statements of recommendations for admission, employment, or honorary recognition placed in educational records after January 1, 1975, for which students have waived their right of access.
C. Waiver of Right of Access
Students may waive their right of access to confidential letters and statements of recommendation. Even if the student signs a waiver, upon the student's request, the names of all persons making confidential recommendation will be made available.
Employees or agents of the University may not require a student to waive his or her right of access for receipt of the University benefits or services.
D. Procedures for Inspection and Review
A student who desires to review his/her educational records must complete a Student Request to Inspect and Review form and provide it to the University Registrar. The form is available from either One-Stop Student Services or the University Registrar. Upon receipt of the request, the University has 45 days to respond to the student; however, arrangements for inspection will be made as expeditiously as possible.
Educational records will be inspected and reviewed by the student in the presence of a University Official. Contested records may not be changed or deleted during the process of inspection and review.
Upon written request the student will be provided with a copy of that portion(s) of his or her educational record at a reasonable cost to the student (as prescribed by state law). When a record contains information about more than one student, disclosure cannot include information regarding the other student(s).
E. Students Right to Challenge Information in Their Educational Records
Students who believe that there is misleading, inaccurate or information in violation of their privacy rights in their educational record, may request that the University amend their educational record by providing a written request to the University Registrar which clearly identifies the part of the record they want amended, and specifies the reason the record is inaccurate, misleading or in violation of their privacy rights. The University shall notify the student in writing of their decision. If the University decides to amend the record as requested, the record shall be amended accordingly. If the University decides not to amend the record as requested the written decision will advise the student of rights to a hearing as outlined in this policy.
F. Procedures for Hearings to Challenge Records
Students challenging information in their records must submit, in writing, a request for a hearing to the University Registrar listing the specific information in question and the reasons for the challenge. Hearings will be conducted by a University official who does not have a direct interest in the outcome of the hearing.
Students shall be afforded a full and fair opportunity to present evidence relevant to the reasons for the challenge. Thereafter, the hearing officer will render a decision in writing, noting the reason for the decision and summarizing all evidence presented within 10 days after the challenge is filed.
Should the hearing officer's decision be in favor of the student, the record shall be amended accordingly. Should the request be denied, an appeal may be made, in writing, and submitted to the University Registrar within 10 days following the student's notification of the hearing officer's decision. The appeal shall be heard by an Appeals Board of three senior University officials who do not have a direct interest in the outcome of the hearing and a decision rendered, in writing, within a reasonable period of time.
Should the appeal be in favor of the student, the record shall be amended accordingly. Should the request be denied, the student may choose to place a statement with the record commenting on the accuracy of the information in the record and/or setting forth any basis for inaccuracy. When disclosed to an authorized party, the record will always include the student's statement and notice of the Board's decision, as long as the student's record is maintained by the University.
G. Right to File Complaint if Student Believes Privacy Rights Have Been Violated.
Any student who believes that his/her privacy rights under FERPA have been violated has the right to file a complaint with the Family Policy Compliance Office (FPCO) at the following address: Family Policy Compliance Office, United States Department of Education, 400 Maryland Avenue, SW, Washington, D.C. 20202-5920.
H. Disclosure of Information
1. With Student Consent
Should a student wish to authorize the release of his/her educational records to a parent(s), spouse, child(ren), family member or other third party, he/she must complete a Student Information Release Authorization form, available at One-Stop Student Services or the University Registrar. Students may choose to have their educational records released to a third party on a one time basis or to provide a third party access to their records for up to one year. Student Information Release Authorization forms may be executed at any time during the school year; however, for security purposes all release authorizations expire at the conclusion of the summer semester and therefore must be renewed each fall. Students have the right to revoke release authorizations at any time by providing written notification of revocation on the prescribed form.
2. Without Student Consent
Personally identifiable information will not be released from an educational record without the prior written consent of the student, except under one or more of the conditions listed below. Personally identifiable information includes, but is not limited to:
(1) the student's name;
(2) the name of the student's parent or other family member;
(3) the address of the student or student's family;
(4) a personal identifier, such as the student's social security number or student number;
(5) a list of personal characteristics that would make the student's identity easily traceable; or
(6) other information that would make the student's identity easily traceable.
Except with respect to the release of directory information, personally identifiable information will be transferred to a third party only on the condition that such party will agree not to permit any other party to have access to such information without the written consent of the student.
Conditions Under Which Personally Identifiable Information May Be Released From An Educational Record Without The Student's Prior Written Consent:
1. The disclosure is to a University Official with a legitimate educational interest.
a. "University Official" includes:
(1) a person employed by the University as a member of its faculty or staff;
(2) a member of the University of North Florida Board of Trustees;
(3) a member or staff members of the Florida Board of Governors:
(4) a person or company with whom the University has contracted to perform a task (such as a consultant, agent, attorney, auditor, or collection agency);
(5) a person or organization acting as an official agent of the University and performing a business function or service on behalf of the University that the University normally would perform itself; or
(6) a student or community member serving on an official committee such as a disciplinary or grievance committee or assisting another University Official in performing his or her tasks.
b. A University Official is determined to have a legitimate educational interest if the information requested is necessary for that University Official to:
(1) perform tasks related to one'sprofessional or assigned job duties;
(2) perform tasks that are specified by a contract agreement;
(3) perform a task related to a student's education;
(4) perform a task related to discipline;
(5) provide a service or benefit relating to the student or student's family, such as (but not limited to) health care counseling, job placement or financial aid.
2. The disclosure is to officials of another school where the student seeks or intends to enroll.
3. The disclosure is to the Comptroller General, The Secretary of Education, state educational authorities or authorized representatives of the Attorney General for law enforcement purposes.
4. The disclosure is in connection with financial aid for which the student has applied or which the student has received to determine eligibility for aid, the amount of aid, the conditions of aid or enforcement of the terms and conditions of aid.
5. The disclosure is to organizations conducting studies for or on behalf of educational agencies or institutions.
6. The disclosure is to accrediting organizations to carry out accrediting functions.
7. The disclosure is to parents of a dependent student, as defined by Section 152 of the Internal Revenue Code.
8. The disclosure is to comply with a judicial order of a lawfully issued subpoena. The University will make a reasonable effort to notify the student of the order or subpoena in advance of compliance, unless the subpoena is a federal grand jury subpoena or other subpoena issued for law enforcement purposes and directs otherwise.
9. The disclosure is in connection with a health or safety emergency if necessary to protect the health or safety of the student or other individuals.
10. The disclosure is of the final results of any disciplinary proceeding conducted by the University against a student who is an alleged perpetrator of any crime of violence (as that term is defined in the section 16 of title 18, USC) or a non-forcible sex offense, if the University determines as a result of the disciplinary proceeding that the student committed a violation of the institution's rules or policies with respect to such crime or offense. The information shall include only the name of the student, the violation committed and any sanctions imposed by the University on the student. The University may include the name of any other student such as a victim or witness, only with the written consent of that other student. The University will notify sexual assault victims of the outcome of any disciplinary proceeding against the alleged perpetrator.
Each University unit has an obligation to keep a record of requests and disclosures of student educational record information except when the request is from the student, a University official with a legitimate educational interest, someone requesting directory information, or when the disclosure is with the student's consent. Students have the right to review this record of requests and disclosures of student record information.
I. Directory Information
Directory information may be released to anyone without the student's consent. The University of North Florida has designated the following as directory information:
1. Name, mailing address, current telephone listing;
2. Dates of attendance;
3. Admitted college/majors;
4. Degree awarded;
5. Status (fulltime/part time);
6. Classification as freshman, sophomore, junior, senior, post-bac or graduate student;
7. Participation in officially recognized activities;
9. Weight/height of athletes;
10. Student images, including photographs, videos or any other media containing a student's image or likeness.
A student has the right to refuse to permit the release of his/her directory information and may do so at the One-Stop Student Services or online via myWings through completion of a Nondisclosure Request form. Following the University's processing of a Nondisclosure Request, the University will not release directory information to third parties without the student's express written consent. A student's Nondisclosure Request will remain in effect until the student advises One-Stop Student Services in writing or online via myWings that he/she desires the Nondisclosure Request to be removed.
J. Records Custodians and Requests for Student Records
Different types of student records are kept by various offices at the University of North Florida as indicated below. The right to inspect and review records, in accordance with University policy and state and federal regulation, may be exercised by presenting a written request to the appropriate custodian:
1. Student Health/Medical: Office of Student Medical Services
2. Student Services: Office of Student Affairs
3. Student Disciplinary: Office of Student Affairs
4. Educational Records: Office of Enrollment Services
5. Financial Aid Records: Office of Enrollment Services
6. Student Placement Records: Office of Enrollment Services
7. Continuing Education Records: Division of Continuing Education
8. English Language Program Records: Office of Student Affairs
9. Student Employment Records: Office of Human Resources
10. Athletics Records: Athletics Office
Questions regarding the identity of the custodian of records other than those listed above should be directed to the University Registrar.
K. Ensuring Security and Integrity of Student Records
As discussed throughout this policy, the University is required to maintain student educational records in a confidential and secure manner. To that end, the University has adopted training, record storage, back up and record disposal criteria to ensure that the University meets it obligation to maintain student educational records in a confidential and secure manner.
In the area of training, each employee in Enrollment Services and the Cashier's Office is instructed in FERPA compliance at the time he/she is hired, and each signs a FERPA confidentiality policy form. So that employees remain aware of their responsibilities FERPA refresher training for current staff is held each year. Additionally, all new faculty members are provided FERPA compliance training at new faculty orientation. The FERPA training materials and answers to frequently asked questions regarding student confidentiality requirements have been posted on both the University Registrar and Office of General Counsel's websites for year-round access. The University Registrar's website provides faculty and staff with practical information regarding the University's requirements for posting grades, returning graded course work, not sending final grades via email and other compliance information for ready access by students, faculty and staff.
Regarding secure record storage, all student educational and financial aid records are imaged and interfaced with the University's Enterprise Resource Planning (ERP) system that is hosted by contract through the Central Florida Regional Data Center, located on the campus of the University of South Florida. Access to student educational records in the ERP is password protected, and the level of access to such records is controlled, with the highest level of restriction for those who have the ability to change a record (i.e., data entry personnel and their supervisors), and lower levels of access for academic advisors, faculty, and administrators.
After all academic records are imaged, indexed, and verified in the ERP, paper records are shredded and deposited into covered shredding bins. Shredding bins are collected weekly and taken directly to be disposed at an on-campus facility.
In addition to the above, non-current/inactive paper files are stored in a separate, specially constructed file room built according to applicable fire codes. The University is in the process of imaging these non-current/inactive files with the goal of eliminating the current Records file room and maintaining a paperless file system for all educational and financial aid student records. Some inactive files are kept off campus in a secured, commercially owned warehouse. The University can activate these records and have them returned from the warehouse at any time upon request.
To ensure continued integrity of student educational records, all student data in the ERP is backed up each weekend, with incremental backups occurring each evening. The backup tapes remain in a secure area during the week and are sent to an off-site vault each month for storage and safekeeping.