Family Education Rights and Privacy Act

The Family Educational Rights and Privacy Act (FERPA) affords eligible students certain rights with respect to their Education Records. Under FERPA, eligible students have the right to access their education records maintained by the postsecondary institution regardless of whether they are also enrolled in a secondary institution.  Parents retain FERPA rights to access their child’s education records maintained by a secondary school until the student turns 18.  These parental rights remain in effect for the purpose of accessing secondary school records even if the student is concurrently enrolled in college.  For the purpose of accessing postsecondary education records, FERPA rights transfer from the parents to the student once the student is enrolled and in attendance at the postsecondary institution. See the policy (for definitions). These rights include:

1. The right to inspect and review student's education records within 45 days after the day the College or University receives a request for access.
   Students should submit to the appropriate official as identified by the institution, written requests that identify the record(s) they wish to inspect. The college or university official will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the college or university official to whom the request was submitted, that official shall advise the Student of the correct official to whom the request should be addressed. 

2. The right to request amendment of the student’s education record that the student believes is inaccurate. 
   Students may ask an appropriate college or university official as identified by the institution, to amend a record that they believe is inaccurate, misleading or a violation of the student’s right to privacy. However, this right is not intended to provide a process to question substantive judgments that are correctly recorded. Consequently, amendment requests do not allow a student to contest a grade in a course because the student believes that a higher grade should have been assigned. 

   To request amendment of an education record, the student should contact the official identified by the institution as responsible for the record, clearly identifying the part of the record to be changed and specifying why it is inaccurate. The institution will notify the student of the decision. If the institution decides not to amend the record as requested by the student, a college or university official will advise the student of their right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.

3. The right to provide written consent before the College or University discloses Personally Identifiable Information (PII) from the student's education records, except to the extent that FERPA authorizes disclosure without consent.
   CSCU institutions shall obtain the prior consent of the student before disclosing PII contained in the student’s education records, EXCEPT to the extent that this policy authorizes disclosure without consent. 

   For additional details on FERPA exceptions to the requirement for consent, see Disclosure of Student Information Without Prior Consent below.
    

4. The right to refuse to permit the College or University to release Directory Information (opt out) about the student, except to school officials with a legitimate educational interest and others as indicated in paragraph 3 above. To do so, a student exercising this right must notify the university's or college's registrar, in writing. Once filed, this notification becomes a permanent part of the student's record until the student instructs the university or college, in writing, to remove it. Communication in writing includes university issued email and completion of digital forms provided by the institution for this purpose.

   A student may exercise their right to opt out of the release of directory information, prohibiting disclosure of the Student's information without the Student's consent as noted in section 3.
    

5. The right to file a complaint with the U.S. Department of Education (USDE) concerning alleged failures by colleges or universities to comply with the requirements of FERPA.  

   The USDE has a website with informational videos and a complaint form with instructions at https://studentprivacy.ed.gov/file-a-complaint. The name and address of the office that administers FERPA is:

   U.S. Department of Education  
   Student Privacy Policy Office
   400 Maryland Avenue, SW  
   Washington, DC 20202-8520

FERPA permits the disclosure of PII from students’ education records, without consent of the student if the disclosure meets certain conditions found in § 99.31 of the FERPA regulations. Except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the student, regulations require the institution to record the disclosure. Eligible students have a right to inspect and review the record of disclosures. 

Except in the case of a lawful judicial order or subpoena, a postsecondary institution has sole discretion and may choose to disclose PII from education records without obtaining prior written consent of students for these authorized purposes:

• School officials with Legitimate Educational Interests.
  To other School Officials, whom the college or university has determined to have Legitimate Educational Interests.

• Transfer of enrollment
  To officials of another school where the student seeks or intends to enroll, or where the student is already enrolled if the disclosure is for purposes related to the student’s enrollment or transfer.

• Audit or Evaluate Publicly Funded Education Programs. 
  To authorized representatives of the U. S. Comptroller General, the U.S. Attorney General, the U.S. Secretary of Education, or State and local educational authorities, such as a state postsecondary authority that is responsible for supervising the university’s State-supported education programs. Disclosures under this provision may be made, subject to the requirements of §99.35, in connection with an audit or evaluation of Federal- or State- supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. These entities may make further disclosures of PII to outside entities that are designated by them as their authorized representatives to conduct any audit, evaluation, or enforcement or compliance activity on their behalf.

• Financial Aid
  The college or university may disclose education records that are not classified as Federal Tax Information (FTI) in connection with financial aid for which the Student has applied or which the Student has received, if the information is necessary to determine eligibility for the aid, determine the amount of the aid, determine the conditions of the aid, or enforce the terms and conditions of the aid.

• Limited Studies
  To organizations conducting studies for, or on behalf of, the school, in order to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction.

• Accrediting Organizations
  To accrediting organizations to carry out their accrediting functions.

• Judicial orders and subpoenas
  To comply with a judicial order or lawfully issued subpoena.

• Emergencies
  To appropriate officials in connection with a health or safety emergency, subject to § 99.36. (§ 99.31(a)(10))

• Directory Information
  Directory information, as defined by this policy, is FERPA protected information that may be disclosed at the discretion of the college or university.

• Victims of a crime
  To a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense, subject to the requirements of § 99.39. The disclosure may only include the final results of the disciplinary proceeding with respect to that alleged crime or offense, regardless of the finding.

• Disciplinary proceedings
  To the general public, the final results of a disciplinary proceeding, subject to the requirements of § 99.39, if the school determines the student is an alleged perpetrator of a crime of violence or non-forcible sex offense and the student has committed a violation of the school’s rules or policies with respect to the allegation made against him or her.

• Violation of law
  To parents of a student regarding the student’s violation of any Federal, State, or local law, or of any rule or policy of the school, governing the use or possession of alcohol or a controlled substance if the school determines the student committed a disciplinary violation and the student is under the age of 21.  

“Attendance” includes but is not limited to, (a) Attendance in person or by paper correspondence, videoconference, satellite, Internet, or other electronic information and telecommunications technologies for students who are not physically present in the classroom; and (b) The period during which a person is working under a work-study program. (https://studentprivacy.ed.gov/content/attendance) Dates of Attendance refers to the period during which a student attends or attended an educational agency or institution. Examples include an academic year, a spring semester or a first quarter.

“Directory Information” is FERPA protected information contained in the education records of Students that would not generally be considered harmful or an invasion of privacy if disclosed.  A college or university may disclose directory information without consent if it has given: a) public notice of the types of information which it has designated as directory information, b) eligible students the right to restrict the disclosure of such information, and c) the period of time within which an eligible student has to notify the school in writing that they do not want any or all of those types of information designated as “Directory Information.”

“Disclosure Records” are maintained by the appropriate institutional data custodians to record each request for and each disclosure of Personally Identifiable Information of a student and except those listed in section C.1 below, record the individuals or entities who have requested or obtained Personally Identifiable Information and their legitimate interest in obtaining it.

“Education Records” include any information or data (including metadata) that directly relate to a student and are maintained by an educational agency or institution or party acting on behalf of the agency or institution. Education records may be in any medium, including but not limited to: handwriting, print, computer media, video or audiotape, film, photographs, microfilm, microfiche, and electronic media such as email. This includes data captured about students when browsing college and university websites such as the student’s IP address, browser type, session information, pages visited and referral websites. Education records also include disclosure records maintained by appropriate CSCU record custodians regarding the student’s education record(s). Education records are exempt from disclosure under the Connecticut Freedom of Information Act.

The following are not education records:
•    records kept in the sole possession of the maker as a personal memory aid;
•    law enforcement records;
•    employment records relating to individuals employed by the college or university; except where employment is conditioned upon status as a student;
•    records related to treatment, “Treatment Records,” provided by a health professional when maintained solely for treatment purposes;
•    records created or received about an individual after that person is no longer a student if not related to that student’s attendance, e.g., alumni records;
•    materials in any admissions files, until the student has been admitted to and has attended the CSCU college or university for which the materials were submitted; and 
•    all other records which are excluded from the FERPA definition of Education Records.

“Eligible Student” An eligible student is an individual attending any CSCU institution, regardless of age, who is enrolled in credit and/or non-credit courses.  This includes individuals participating in dual or concurrent enrollment programs.

“Enrollment” is the official status of an individual as a student at a postsecondary institution, established when the institution creates or maintains education records through course registration or attendance in an educational activity. Enrollment occurs at a minimum when a student is registered for at least one course offered by the institution, including dual or concurrent enrollment courses, regardless of the student’s age or enrollment in secondary school.  For the purpose of this policy, students enrolled in dual or concurrent courses are considered “in attendance” at the institution.

“FERPA” is the Family Educational Rights and Privacy Act, 20 U.S.C. sec. 1232g, et seq. as amended, and the regulations at 34 C.F.R. Part 99.

“Free Application for Federal Student Aid (FAFSA)” is the official form used to apply for federal financial aid, including grants, work-study, and loans to help pay for postsecondary education.

“Federal Tax Information (FTI)” includes any federal tax return information received from the Internal Revenue Service (IRS) by the United States Department of Education (ED) under the FUTURE Act Matching Program (FA-DSS), and information indicating whether a tax return was filed. When FTI is provided by the IRS directly to ED, it is protected under the Internal Revenue Code §6103 and is subject to different restrictions than other data on the FAFSA form.

“Intention to enroll” is determined by a formal declaration of a decision to attend a specific college or university such as completing an application, completing a CSCU document that identifies the intention to transfer, submitting an enrollment deposit, accepting an offer of admission, or registering for a class.

“Legitimate Educational Interest” is the need to review an education record in order for a CSCU School Official to carry out their professional responsibilities. A school official has a legitimate educational interest if the official needs to review an Education Record in order to fulfill their professional responsibilities for the CSCU system or CSCU institution.

“Parent” is defined as including natural parents, a guardian or an individual acting as a parent in the absence of a natural parent or guardian ¹.

“Personally Identifiable Information (PII)” includes information that can be used to distinguish or trace an individual’s identity either directly or indirectly through linkages with other information.

“School Official” is defined by this policy as a person employed by a college or university in an administrative, supervisory, academic, research, or support staff position (including law enforcement unit personnel and health staff); a person serving on the Board of Regents; an employee of the Connecticut State Colleges and Universities system office; or, a student serving on an official committee, such as a disciplinary or grievance committee. A school official also may include a volunteer or contractor outside of the college or university who performs an institutional service or function for which the college or university would otherwise use its own employees and who is under the direct control of the college or university with respect to the use and maintenance of PII from education records, such as a vendor, an attorney, auditor, or collection agent or a student volunteering to assist another school official in performing their tasks.

“Student” means any person who has been notified of their acceptance for admission, registered, enrolled, or attending any College or University course or program including non-credit bearing courses. This applies whether enrollment is full-time or part-time; whether the course(s) occur on-campus, online, or at an off-campus instructional site (domestically, or internationally such as students studying abroad); and whether the student is pursuing undergraduate, graduate, non-degree seeking, post-graduate, or professional studies. Prospective students or individuals who are not Enrolled, as defined by the institution, are not yet “Students” of CSCU under FERPA.  

“Treatment Records” include records which are created or maintained by a physician, psychiatrist, psychologist or other recognized professional or paraprofessional acting or assisting in that capacity, used only in providing treatment to a student, and not available to anyone other than persons providing such treatment, except that such records may be personally reviewed by a physician or other appropriate professional of the student’s choice. Treatment records are typically related to the provision of services which are billable as healthcare treatment by an organization covered by the Health Insurance Portability and Accountability Act (HIPAA).