Legal and Compliance
Other Requirement Title:
Family Educational Rights and Privacy Act (FERPA), Compliance with
January 08, 2009
This procedure item applies to:
The Family Educational Rights and Privacy Act of 1974 (FERPA) gives students the right to inspect and review their education records and, under certain circumstances, the right to request that such records be amended. It limits the right of the State University of New York (University) and its campuses to disclose education records or information contained in such records without the student’s consent. FERPA also requires that campuses notify students, on an annual basis, of their rights under FERPA. The University is committed to protecting the privacy of personally identifiable information contained in education records in accordance with FERPA. Accordingly, this statement sets forth the procedures that the University will use to comply with FERPA.
All State University of New York (University) campuses shall inform students annually of their rights under the Family Educational Rights and Privacy Act of 1974 (FERPA) This notice may be contained in campus handbooks, catalogs of general circulation which are distributed on an annual basis, or by whatever means the campus deems appropriate.
Campuses wishing to release directory information are required to notify students of the categories of information designated as such and of the right of students to prohibit the release of any or all directory information pertaining to them. Campuses also must inform students of the time period during which they are able to designate that any such information not be released.
A. With the exception of certain enumerated records, a student is guaranteed access to his or her education records subject only to reasonable regulation as to time, place and supervision. The records listed below are examples of documents that are not accessible under FERPA:
1. confidential letters and recommendations placed in a student’s file prior to Jan. 1, 1975;
2. confidential letters and recommendations placed in a student’s file after January 1, 1975, to which the student waived his or her right to inspect and review, and that are related to the student’s admission, application for employment or job placement, or receipt of honors.
3. records to which access has been waived by the student;
4. records which are excluded from the FERPA definition of education records;
5. financial data and income tax forms submitted in confidence by the student’s parents in connection with an application for, or receipt of, financial aid; and
6. records connected with an application to attend a state operated or community college campus of the University if the applicant never enrolled at such campus. FERPA rights are provided only to applicants upon actual acceptance and subsequent enrollment;
B. For those records that contain information on more than one student, the requesting student has the right to view only those portions of the record that pertain to his or her own education records.
C. The placement records maintained by campus offices of career development may be inspected by the subject of the file, with the exception of recommendations or evaluations, which have been received with the student’s written waiver of access.
D. Student inspection of records is granted only upon written request, presented in person with appropriate identification, and must be made in the presence of designated personnel of the office maintaining the records. All requests shall be granted as soon as practicable, but in no event later than 45 days after the date of request. No documents or files may be altered or removed once a request has been filed.
E. A student may receive a copy of any and all records to which he or she has lawful access, upon payment of the copying fee set by the campus, except when a hold has been placed on his or her record pending the payment of debts owed the University, or when the student requests a copy of a transcript, the original of which is held elsewhere. The campus may not charge a “search and retrieval” fee. Copying fees may not exceed $.25 per page.
If, upon inspection and review of his or her record, a student believes that the record is inaccurate, misleading or otherwise in violation of his or her privacy rights, he or she may ask that the record be changed or may insert a statement explaining the alleged inaccuracy or misstatement in the file. Any disagreement should be resolved informally, if possible. Campuses should promulgate procedures for making a correction in a record within the education record of a student.
Should a campus deny a student’s request for a change, the campus should notify the student of its decision and advise the student of the right to a hearing to challenge the information believed to be inaccurate, misleading or in violation of the student’s privacy rights. Campuses should promulgate procedures for the conduct of such hearings, including giving students 30 days to request such hearing and a full and fair opportunity to present evidence relevant to the issues raised in the original request to amend the student’s education records. Campus procedures should allow the student to be assisted by one or more individuals, including an attorney, at the student’s expense. The campus shall prepare a written decision based solely on the evidence presented at the hearing. The decision will include a summary of the evidence presented and the reasons for the decision. The decision of the hearing committee shall be final, except as otherwise provided by the campus.
If the campus decides that the information is inaccurate, misleading or in violation of the student’s right of privacy, it will amend the record and notify the student, in writing, that the record has been amended. The challenge to be considered in such hearing may extend only to the material in the respective campus file. While it may extend to the correct recording of a grade, it does not apply to the appropriateness of the grade. If the campus decides that the challenged information is not inaccurate, misleading or in violation of the student’s right of privacy, it will notify the student of the right to place in the record a statement commenting on the challenged information and a statement setting forth reasons for disagreeing with the decision. Such a statement shall become a part of the information contained in the education record and will be disclosed with it.
Campuses shall develop procedures for handling student information contained in files maintained by offices of career development and for advising students of the disclosure that may be made of such records. Campuses should seek to eliminate any pledges of confidentiality in printed forms sent to those writing letters of evaluation and should advise those writing evaluations of the applicability of FERPA. In cases where an evaluation cannot be obtained absent such a pledge, campuses may consider allowing students to enter into a specific waiver of access to evaluations solicited and/or received under condition of confidentiality.
The University will disclose information from a student’s education records only with the written consent of the student, except that records may be disclosed without consent when the disclosure is to one of the following categories of requestors, subject to the condition that the requestor not redisclose personally identifiable information without student consent or otherwise in compliance with FERPA. Campuses must use reasonable methods to authenticate the identity of persons to whom education records are disclosed:
A. to school officials who have a legitimate educational interest in the records;
A school official is a:
1. person employed by the campus in an administrative, supervisory, academic or research, or support staff position, including health or medical staff;
2. member of University’s Board of Trustees;
3. a contractor, consultant, volunteer or other outside party providing services or functions to the campus which would otherwise be provided by employees of the campus;
4. person who is employed by the campus’s law enforcement unit; or
5. student serving on an official committee, such as a disciplinary or grievance committee, or who is assisting another school official in performing his or her tasks;
6. a person employed by the University’s System Administration.
A school official has a legitimate educational interest if the official requires the information for the purpose of fulfilling his official duties, including but not limited to:
1. performing a task that is specified in his or her position description or contract agreement;
2. performing a task related to a student’s education;
3. performing a task related to the discipline of a student;
4. providing a service or benefit relating to the student or student’s family, such as health care, counseling, job placement or financial aid;
5. maintaining the safety and security of the campus; or
6. participating in or conducting studies, evaluations, or assessments of educational programs.
B. to officials of another school, upon request, in which a student seeks or intends to enroll or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer (the student shall receive notification of the disclosure unless the student initiated the disclosure), including updated or corrected information;
C. to authorized representatives of the Comptroller General of the United States, the Secretary of the U.S. Department of Education, authorized representatives of the attorney general for law enforcement purposes (investigation or enforcement of federal legal requirements of federally supported education programs), or state and local educational authorities. Campuses should record the names of State and local educational authorities, federal officials and agencies that may make further disclosures of the information provided them without consent and shall obtain a copy of records of further disclosure when requested by the parent or student involved;
D. to school officials or lending institutions, in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as to:
1. determine eligibility for the aid;
2. determine the amount of the aid;
3. determine the conditions for the aid; or
4. enforce the terms and conditions of the aid;
E. state and local officials or authorities to whom such information is specifically required to be reported or disclosed pursuant to a state statute adopted prior to Nov. 19, 1974, if the allowed reporting or disclosure concerns the juvenile justice system and the system’s ability to effectively serve the student whose records are released; or information that is allowed to be reported pursuant to a State statute adopted after November 19, 1974, which concerns the juvenile justice system and the system’s ability to effectively serve, prior to adjudication, the student whose records are released (nothing in this paragraph shall prevent the State of New York from further limiting the number or type of state or local officials who will continue to have access);
F. organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating or administering predictive tests, administering student aid programs and improving instruction, if such studies are conducted in such a manner as will not permit the personal identification of students and their parents by persons other than representatives of such organizations that have legitimate interests in the information; such information will be destroyed when no longer needed for the purpose for which it is conducted and there is a written agreement between the campus and the organization;
G. accrediting organizations in order to carry out their accrediting functions;
H. parents of a dependent student, as defined in Section 152 of the Internal Revenue Code of 1954; (While FERPA permits campuses to release education records to parents of dependent students without student consent, it does not require them to do so. The parent must provide a copy of their most recent federal income tax return establishing the student’s dependency or the campus can rely on the student’s assertion of dependency for tax purposes on a form provided by the campus. Full rights under the Act shall be given to either parent, unless the University has been provided with evidence that there is a court order, state statute or legally binding document relating to such matters as divorce, separation or custody that specifically revokes those rights.)
I. to appropriate persons, including parents, in connection with an emergency, if the knowledge of such information is necessary to protect the health or safety of the student or others, taking into account the totality of the circumstances pertaining to the threat to health or safety. The campus may disclose education records if it determines that there is an articulable and significant threat to the health or safety of a student or other persons, but only to those persons whose knowledge of the information is necessary to protect the health or safety of the student or other persons. A record must be kept of the threat and the parties to whom the information was disclosed;
J. to comply with a judicial order or lawfully issued subpoena, provided the University makes a reasonable effort to notify the student of the order or subpoena in advance of compliance; (Notification may be prohibited if the University receives a federal grand jury subpoena or any other subpoena, which states that the student should not be notified. The USA Patriot Act amends FERPA to allow designated federal officials to obtain copies of student records relevant to an investigation of terrorism or other crimes, without notifying the student. The Office of University Counsel shall be consulted prior to release of any education records pursuant to subpoena or the USA Patriot Act.)
K. to an alleged victim of any crime of violence as that term is defined in Section 16 of Title 18, United States Code, or a non-forcible sex offense, the final results of any disciplinary proceeding conducted by the campus against the alleged perpetrator of that crime or offense with respect to that crime or offense if the University determines as a result of the disciplinary proceeding that the student committed a violation of the University’s rules or policies with respect to such crime or offense(The Office of University Counsel shall be consulted prior to release of the record.); The campus shall not require the alleged victim to execute a non-disclosure agreement as a condition for receipt of this information;
(For the purpose of disclosure under this paragraph, the final results of any disciplinary proceeding shall include only the name of the student, the violation committed and any sanction imposed by the campus on that student; and may not include the name of any other student, such as a victim or witness, unless that other student provides written consent permitting such disclosure.)
L. the University also has the discretion to disclose to any parent or legal guardian of a student under the age of 21 information about a violation of any federal, state or local law, or any rule or policy of the University governing the use or possession of alcohol or a controlled substance if the campus determines that the student has committed a disciplinary violation with respect to such use or possession;
M. to Veterans Administration Officials pursuant to 38 USC 3690 (c);
N. information a campus has designated as “directory information,” unless a hold has been placed upon release of the information by the student;
O. to the court those records that are necessary to defend the University when a student initiates legal action against the institution;
P. to the military, directory information as it is presently defined under the Solomon Amendment, even if the institution has not designated such information as directory information in its policy.
Directory information that must be released to the military:
1. student’s name and address;
2. telephone listing;
3. date and place of birth;
4. class level (Freshman, sophomore etc.);
5. academic major;
6. degrees received; and
7. the educational institution in which the student was most recently enrolled.
Information that Institutions are not required to release to the military:
1. Directory information, but only if the student has requested that the University not release such information to anyone;
2. information the institution certifies it does not have; or
3. information not defined as directory information.
Q. to the apparent creator of a record to verify authenticity;
R. when the disclosure concerns a registered sex offender, including a student, and is information received under a community notification program under 42 USC §14071.
Each campus of the University will maintain a record of requests for and/or disclosures of information from a student’s education records. The record will indicate the name of the party making the request and what records, if any, were received, the legitimate interest in the records, any additional party to whom it may be disclosed, and the legitimate interest the additional party had in requesting or obtaining the information. The record may be reviewed by the student. This recordkeeping is not required if the request was from, or the disclosure was to:
A. the student;
B. a school official determined to have a legitimate educational interest;
C. a party with written consent from the student;
D. a party seeking directory information; or
E. a federal grand jury or law enforcement agency pursuant to a subpoena that by its terms requires nondisclosure.
Attendance – includes, but is not limited to attendance in person or by correspondence, videoconference, satellite, internet or other electronic information and telecommunications technologies for students who are not physically present in the classroom and the period during which a person is working under a work-study program.
Directory information -information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed, including, but is not limited to, the student's name, address, telephone listing, electronic mail address, photograph, date and place of birth, major field of study, dates of attendance, grade level, enrollment status (e.g., undergraduate or graduate; full-time or part-time), participation in officially recognized activities and sports, weight and height of members of athletic teams, degrees, honors and awards received, the most recent educational agency or institution attended, and student ID number but only if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity.
Disciplinary action or proceeding - the investigation, adjudication, or imposition of sanctions by an educational agency or institution with respect to an infraction or violation of the internal rules of conduct applicable to students of the agency or institution.
Disclosure - to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records to any party, by any means, including oral, written, or electronic means, except the party identified as the party that provided or created the record.
Education records - records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution. The term does not include:
(1) Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record.
(ii) Rec ords relating to an individual in attendance at the agency or institution who is employed as a result of his or her status as a student are education records and not excepted under paragraph (b)(3)(i) of this definition.
(i) Made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity;
(iii) Disclosed only to individuals providing the treatment. For the purpose of this definition, ``treatment'' does not include remedial educational activities or activities that are part of the program of instruction at the agency or institution; and
(5) Records created or received by the University about an individual after he or she is no longer a student in attendance at that campus and that are not directly related to the individual’s attendance as a student.
(6) Peer-graded papers before collection and recording by the course instructor.
Personally identifiable information - includes, but is not limited to the student's name; the name of the student's parent or other family member; the address of the student or student's family; a personal identifier, such as the student's social security number, student number or biometric record; a list of personal characteristics that would make the student's identity easily traceable; or other indirect identifiers such as date of birth, place of birth, and mother’s maiden name or other information that, along or in combination, is linked or linkable to a specific student that would allow a reasonable person in the campus community to identify the student with reasonable certainty.
There is no related procedures relevant to this requirement.
There are no forms relevant to this requirement.
34 CFR Part 99 (FERPA Regulations)
20 U.S.C. §1232g (FERPA Statute)
38 U.S.C. §3690(c) (Access to U.S. Officials regarding Veterans Benefits)
18 U.S.C. §16 (Definition of Violent Crime)
26 U.S.C. §152 (IRS Definition of Dependent)
Memorandum to Presidents from the office of the University counsel and vice chancellor for Legal Affairs dated May 29, 1985 was an updated advisory regarding compliance with the Family Educational Rights and Privacy Act of 1974 (FERPA), commonly known as the Buckley Amendment.
Memorandum to presidents from the office of the University counsel and vice chancellor for Legal Affairs dated August 20, 1976 regarding final regulations issued by the Department of Health, Education and Welfare, which define and interpret the Family Educational Rights and Privacy Act of 1974.
There are no appendicies relevant to this requirement.