Confidentiality of Student Records
The Family Educational Rights and Privacy Act (FERPA) of 1974, as amended, is a federal law that protects the privacy and confidentiality of personally identifiable information contained within student education records. The University of Alabama complies with FERPA's confidentiality protections and adheres to procedures dealing with student education records and directory information recommended by the American Association of Collegiate Registrars and Admissions Officers (AACRAO).
Records Encompassed Within this Privacy Law
- A "student" must be enrolled and "in attendance" at the University for his/her records to be protected by this policy. A student is defined as "in attendance" when a person registers for his/her first course at the University. This includes all persons taking courses on campus, by correspondence, by distance, as well as the period when a person is working under a work study program at the University. This may be full-time or part-time pursuing undergraduate, graduate or professional studies.
- "Education records" of a student that are covered by this privacy rights law are defined by FERPA to include any records, files, documents, or other materials that contain personally identifiable information directly related to the student and that are maintained by the University of Alabama or by officials acting for the University. The definition of "personally identifiable information" is any information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. Personally identifiable information includes the student's name, family member's names, address of student or family, social security number, CWID, and indirect identifiers such as date of birth, Mother's maiden name, biometric records, etc. The term "biometric record" is defined, as a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting. By definition, the University is prohibited from disclosing information, even in redacted form, that is requested by a party if the school reasonably believes the party knows the identity of the student to whom the record relates.
- Personal observations and conversations with students are not covered "records." Peer-graded papers not yet collected and recorded by a teacher are also not covered. Additional records that arenotcovered by this law include:
- Records of institutional, supervisory, and administrative personnel which are in the sole possession of the maker and which are not accessible to any other person except a substitute;
- Records maintained by the University's Department of Public Safety that are maintained solely for law enforcement officials and which are not made available to persons other than law enforcement officials of the same jurisdiction;
- Employment records of University employees (unless the employee is primarily a student and happens to work for the University);
- Health records of students covered by HIPAA (such as health records at University Medical Center) and student's records that have been made and/or maintained by physicians, psychiatrists, psychologists, or other recognized professionals or paraprofessionals and which are made, maintained or used only in connection with the provision of treatment to the student and are not available to anyone other than persons for the purpose of providing treatment; and
- Alumni/former student records containing information about a student no longer in attendance and not directly relating to the individual's attendance as a student.
Students' Rights Regarding Their Education Records
- With respect to protected "education records," FERPA affords a student four primary rights, which are explained in more detail in Sections I through IV of this policy:
- the right to ask the University not to disclose "directory information";
- the right to prevent disclosure of all other information in an education record, unless the student consents to such release;
- the right to review his/her own education records; and
- the right to seek to amend inaccurate and misleading information in his/her education record.
I. THE RIGHT TO ASK THE UNIVERSITY NOT TO DISCLOSE DIRECTORY INFORMATION
FERPA affords a student the right, upon election by that student, to prevent disclosure of personally identifiable "directory information" contained in the student's education records, except to the extent that FERPA otherwise authorizes disclosure.
A. Directory Information That May Be Disclosed Without the Student's Consent
- The University of Alabama has designated the following information from a student's education record as "directory information," which may be disclosed under FERPA without the student's permission. (Asterisked items are printed in the University's telephone directory):
- Preferred Name
- Local Address
- UA School/College(s)
- Local Phone Number
- Major(s)/Degree Program(s)
- Permanent Address
- Degree(s) Earned and Date(s)
- Permanent Phone Number
- Academic Awards and Honors
- UA email address
- Prior Postsecondary Institution(s) Attended
- Dates of Attendance
- Full-/Part-Time Enrollment Status
- Participation or membership in officially recognized activities, social or greek organizations, and sports (or in intercollegiate athletic teams)
- Weight and height of members of intercollegiate athletic teams.
- The University and its contractors/vendors may not use a Social Security number or other non-directory information, either alone or in combination with other data elements, to identify student records when disclosing or confirming directory information without the written consent from the student.
B. Some Ways the University Routinely Releases Directory Information
- "Directory Information" may be made available, without the student's consent, through a variety of ways, including, but not limited to the following media:
- The University's annual printed telephone directory
- Electronic and Internet directories
- Telephone or written responses to requests from external/third parties including but not limited to potential employers and/or scholarship agencies
- Announcements released by the Office of University Relations to newspapers in particular students' hometown newspapers, and
- Announcement of official graduations, which occur at the completion of each semester or term
C. Steps A Student Must Take to Prevent Disclosure of Directory Information
The University of Alabama assumes that a student's failure specifically to request blocking access to any element of "directory information" constitutes approval for disclosure. To prevent the University from disclosing any "directory information" to third parties, students must notify this office by going thru myBama ( www.mybama.edu). On the Student tab, go to the “Update Directory Information/Confidentiality Hold” page located in the Banner Self-Service channel, under Student Services and then Student Records. Select “Yes” and then submit. The request to prevent disclosure of "directory information" will remain in effect permanently, including after departure from the University, unless subsequently changed by the student. The University of Alabama presumes all candidates for a degree want their name recorded in the Commencement Program for sentimental, as well as, historical reasons. As a result, their name will appear in the University's Commencement Program (and be available for public dissemination) unless the candidate checks the "Do Not Print in Program" box on the degree application.
II. THE RIGHT TO PREVENT DISCLOSURE OF NON-DIRECTORY INFORMATION
FERPA affords a student the right to prevent disclosures of personally identifiable "non-directory" information contained in the student's education records, unless the student consents and/or except to the extent that FERPA authorizes disclosure without a student's consent. The student's consent should preferably be in writing.
A. Persons and Entities Entitled To Review a Student's Education Records Without the Student's Consent
Notwithstanding the general rule that a student must consent to the release of personally identifiable information from his/her records, FERPA permits (but does not require) limited disclosure to the individuals/entities identified in the following fourteen paragraphs.
School officials with a legitimate educational interest.
- A "school official" may include:
- a person employed by the University in an administrative, supervisory, academic, research or support staff position, including but not limited to law enforcement unit personnel, health staff and in-house attorneys;
- contractors, consultants, volunteers or other outside parties with whom the University has contracted or delegated certain educationally-related functions to provide service under retainer or agreement; including but not limited to collection agency, outsourced service company, agent, attorney, auditor, etc.;
- a person serving on the Board of Trustees;
- a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his/her tasks.
- "Legitimate educational interest" is defined as any authorized interest or activity undertaken in the name of the University for which access to an education record is necessary or appropriate to the proper performance of the undertaking. A school official has a legitimate educational interest if, in the judgment of the individual/office responsible for requested information, the official needs to review an education record in order to fulfill his or her professional responsibility. The information sought and provided must be pertinent to and used within the context of official University business and not for a purpose extraneous to the official's area of responsibility.
- Release of a student's education record to a school official having legitimate educational interest does not constitute institutional authorization to transmit, share, or disclose any or all of the information to a third party, within or outside the University. An unauthorized disclosure of personally identifiable information from the education records of the student is prohibited.
Parents of a student who is claimed as a dependent, as defined by Section 152 of the Internal Revenue Code of 1986. A student is a dependent if the parent claims the student as a dependent for the current tax reporting year.
- A "parent" includes a natural parent, a guardian, or someone acting as a student's parent in the absence of a parent or guardian.
- All students will be presumed to be non-dependents unless (1) the student verifies that he/she is a dependent student, or (2) the parent(s) provide their most recent filed IRS tax return with evidence to the contrary.
- Divorced or separated parents of dependent students may be provided equal access to records, unless the University is provided with evidence of a court order, state law, or legally binding document that specifically revokes those rights, or unless the University, in the exercise of its discretion, deems such disclosure ill-advised.
- Information may be disclosed to parents and legal guardians of students under the age of 21, without the student's consent, regarding the student's violation of any federal, state or local law, or any rule or policy of the institution governing the use, possession, or distribution of alcohol, narcotics, or other controlled substances.
Officials of another school in which a student seeks or intends to enroll or is enrolled, upon the request of such officials, so long as disclosure is for purposes related to student's enrollment or transfer. An attempt by email, telephone, or written communication will be made to notify the student of the release.
Authorized representatives of the Comptroller General and of the Attorney General of the United States, the Secretary of the Department of Education, or state and local educational authorities in connection with the audit or evaluation of federal- and state- supported programs, or for enforcement of or compliance with legal requirements applicable to federally-supported education programs.
Veterans Administration officials not covered by FERPA but specified under Title 38, section 3690 (c), United States Code.
Persons or organizations providing financial aid to students, or determining financial aid decisions, but only to the extent necessary to determine eligibility, or the amount or condition of such aid, or to enforce the terms of said aid.
Appropriate persons, including parents, in connection with an emergency, if knowledge of the information is necessary to protect the health or safety of the student or other individuals. The totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals will be taken into account, and the University will disclose only if there is an articulable and significant threat. The threat and the parties to whom the University discloses information will be recorded.
Organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, and administer predictive tests, to administer student aid programs, or to improve instruction, but only if personal identification of the student is not made to individuals outside the organization and the information is destroyed when no longer needed for their projects.
Accrediting organizations carrying out their accrediting functions.
Persons in compliance with a judicial order or a lawfully issued subpoena, provided that the institution makes a reasonable attempt to notify the student in advance of compliance. The student bears the responsibility for keeping an up-to-date address on file in the Office of the University Registrar. Certain law enforcement-related subpoenas, however, can mandate the release of information without notification to the student of either the subpoena or the information released.
An alleged victim of any crime of violence or of a non-forcible sex offense, but only of the final results of any institutional disciplinary proceeding against the perpetrator of that crime with respect to the crime, and regardless of the outcome of the proceeding. Also, if the University determines through its disciplinary proceeding that a student has committed a violation of the University's rules or policies with respect to an alleged crime of violence or non-forcible sex offense, the University may reveal to anyone the "final results," which are limited by FERPA to include only the name of the student being disciplined, a description of the violation committed, and any sanction imposed by the University on that student. Final results of disciplinary proceedings reached prior to October 7, 1998 may not be released.
University officials in defense of a claim. If a parent or eligible student initiates a legal claim or otherwise takes any adversarial position in writing against the University, the University may disclose to the court or other entity that has authority to take specific action against the University, the student's education records that are necessary for the University to defend itself.
Information about registered sex offender. Information provided to the University under a community notification program concerning a student required to register as a sex offender.
Return of record to creator. If the University has created any record, it may disclose that information to teachers and other school officials with legitimate educational interests, such as persons who need to verify the accuracy or authenticity of the information. Likewise, the University may return a record to its identified source to be able to verify its authenticity.
B. Notification to Third Parties of Confidentiality of Records Released
Unless information is disclosed to a third party pursuant to a subpoena or court order, or regarding final results of disciplinary proceedings as described in paragraph A11, or to a parent of a dependent student, University officials releasing non-directory information must notify the third party recipient that it is illegal under the Family Educational Rights and Privacy Act of 1974 to share the information with anyone else without written permission from the student
C. Maintaining Records of Who Reviews An Education Record
Officials maintaining records shall maintain a log identifying all parties, who, without the student's written consent, request or obtain access to non-directory information within a student's education record. No entry is needed for disclosure to "school officials with a legitimate educational purpose," or for disclosure to parents of dependent students. The log will contain the reason why access was requested. The log shall be kept with the education record, and thus will not be made available to anyone other than the student and authorized University employees.
III. THE RIGHT TO REVIEW HIS/HER EDUCATION RECORDS
FERPA affords a student the right to inspect and review his or her education records within 45 days of receipt of a written request for access. This right does not necessarily include the right to make a copy of the records.
A. Written requests to Inspect and Review
Students should submit written requests that identify the record(s) they wish to inspect to the Office of the University Registrar, 206 Student Services Center, The University of Alabama, Box 870134, Tuscaloosa, AL 35487. The University Registrar or designee will make arrangements for access and will notify the student of the time and place where records may be inspected. If the University official to whom the request was submitted does not maintain the records, that official will advise the student of the correct official to whom the request should be addressed.
B. When Copies will be Provided
FERPA does not guarantee a student the right to a copy of his/her education record. The University will generally provide access by providing a copy of the records at a cost to the student only if failure to provide a copy would effectively deny the student access to the records. The University may use a third party to maintain a record for the student's inspection. Copies of part or all of the student's education record will not be issued to the student or any other party as long as there are delinquent financial obligations owed by the student to the University.
C. Documents a Student Is Not Entitled to Review
The right of inspection and review does not entitle a student to review (1) financial statements of the student's parents; (2) confidential letters and statements of recommendation to which a student has waived his/her right to inspect and review; or (3) portions of records that contain information about more than one student (in which case the University must first redact personally identifiable information about the other student(s)).
IV. THE RIGHT TO SEEK TO AMEND INACCURATE AND MISLEADING INFORMATION
FERPA gives a student the right to request an amendment to the student's education records to correct information that the student believes to be inaccurate or misleading.
After a student examines his or her records, it is possible for the student to challenge entries and add factual, explanatory information to the records. This request may not include amendments to the accuracy/fairness of grades in courses or any other assessment of academic performance. If the University does not agree to amend a record as requested, the student will be notified and informed of the right to a hearing. Results of hearings will be given in writing to eligible students according to procedures, which shall include:
- Hearings will be conducted within a reasonable time frame;
- Parents and/or eligible students will be given notice of date, place, and time of hearing;
- The hearing will be conducted by an official of the institution, named by the Provost/Vice President of Academic Affairs, who does not have a direct interest in the outcome of the hearing;
- Parents and/or eligible students can present evidence relevant to the issue and may be represented by individuals including attorneys; and
- Decisions will be given in writing in a reasonable period of time and will be based solely on evidence presented at the hearing.
V. RESOURCES FOR OBTAINING ADDITIONAL INFORMATION ABOUT THE UNIVERSITY'S POLICY ON CONFIDENTIALITY OF STUDENT RECORDS
A. University of Alabama Resources
Questions related to FERPA, students' privacy rights, and The University of Alabama's compliance procedures should be directed to the Office of the University Registrar, 206 Student Services Center, Box 870134, Tuscaloosa, Alabama 35487, www.registrar.ua.edu.
B. Department of Education Resources
A student covered by FERPA has a right to file a complaint with the U.S. Department of Education if he or she believes the University has failed to comply with the requirements of FERPA. A complainant must be an eligible student affected by an alleged violation. The name and address of the office that administers FERPA is:
Family Policy Compliance Office
U. S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-4605
Telephone: (202) 260-3887
Fax: (202) 260-9001