UPM #21 – Access to Student Records

Effective Date: November 30, 2004

PURPOSE

This memorandum describes the criteria to be used in determining who is eligible to access student records data, the circumstances under which data may be released, and procedures to follow in requesting access to student data. This policy is designed to comply with the provisions of the Family Educational Rights and Privacy Act (FERPA) of 1974, 20 U.S.C. Sec. 1232g and with the University’s policies for the use of human subjects in research as monitored by the Office of Research Administration.

1. GENERAL PROVISIONS

With certain exceptions, officials of UNC-CH will not disclose personally identifiable information from a student’s education records without the student’s prior written consent. “Directory information” will be disclosed without the student’s prior written consent unless the student has notified the Office of the University Registrar to restrict release of that information. “Directory information” is defined as:

• Name
• Person ID (PID)*
• Local address
• Local telephone listing
• Grade/billing (permanent) address
• Grade/billing (permanent) telephone listing
• Date and place of birth
• County, state, or US territory from which student originally enrolled
• Major field of study
• Class (junior, senior, etc.)
• Enrollment status (full-time, half-time, part-time)
• Participation in officially recognized activities and sports
• Weight and height of members of athletic teams
• Dates of attendance
• Degrees and awards received
• The most recent previous educational agency or institution attended by the student
• Anticipated graduation date
• Campus electronic mail address

* Because the Person ID Number is public information, posting non-directory information such as grades using any part of the PID as an identifier is not permitted.

Note: Parent name, address, and telephone number are not directory information. Foreign country of origin is not directory information.

All University offices receiving student information are accountable for maintaining the privacy of student information in compliance with University and federal policies. The University’s FERPA policy outlines all the conditions for release of information and also explains the student’s right to review, correct, or amend the record. Any questions concerning the release of student information should be directed to the Associate University Counsel, CB# 9105, (919) 962-3031.

2. RECORD CUSTODIANS

1. Information on newly admitted students is under the control of the Undergraduate, Graduate, or Professional School Admissions Offices. The admissions portion of the file contains information from admissions applications and other academic data collected during the admissions process.
2. The records of enrolled and previously enrolled students are under the control of the Office of the University Registrar. Data from the admissions offices comes under the jurisdiction of the University Registrar after newly admitted students have had their enrollment deposit credited to their account. The file contains basic demographic and academic data on all enrolled and previously enrolled students.
3. The records of students attending prior to 1903 have been retired to Wilson Library and are under the control of the University Archivist.

3. RECORD ACCESS

1. For persons entitled only to directory information, the following rules shall apply:Information can be provided on printed rosters, floppy disk, gum label, or electronic transfer. Normally, requests are completed free of charge. Requests that require extreme effort may be charged for supplies and/or excessive work time. Reports not associated with the business of the University will be run with a priority after University requests.Such reports may contain only directory information on students. If a student has requested that directory information not be released from his/her education records, that student’s information shall be excluded from the data released.

   Requests for data on newly admitted students who have not yet had the opportunity to request that directory information be restricted will not be honored until after the last day to register for the term in question. Students have until the last day to register (end of fifth class day in the fall and spring semesters) to record their directory restriction.

   Addresses are updated through the end of the second week of class. Accurate address information will not be available until after the second week of classes. Requestors entitled only to directory information can not receive information sorted by any non-directory-information characteristic (for example, names and addresses sorted by ethnic group).

2. Departments within the University requesting other than directory information will be given such information if they have a legitimate educational interest. University officials have a legitimate educational interest if it is necessary or desirable for them to have access in order to carry out their official duties and/or to implement the policies of The University of North Carolina, or if it is in the educational interest of the student in question for such officials to have the information.Persons receiving this information (or directory information prior to its publication) are responsible for protecting the confidentiality of the students involved. They are not permitted to re-release this data to anyone else, other than University officials with a legitimate educational interest, without the prior written consent of the students involved.
3. Departments within the University (including graduate students working for departments) requesting student data for the purpose of conducting basic research must submit a notice of review approval from the appropriate Institutional Review Board for the protection of human research subjects along with the “Request for Release of Student Related Data” form approved by the department.Departments within the University requesting student data for research which is directly linked to the administration of the University may be given such data without prior review by an Institutional Review Board unless the research involves the collection of “sensitive” information. (“Sensitive” information includes, but is not limited to, information regarding sexual behavior, use of controlled substances, illegal activities, voter registration, religious preference and practice, etc.) A notice of review approval must accompany requests for data to be used in such studies from the appropriate Institutional Review Board.Departments (including graduate students) requesting non-directory information for research must have prior written consent from each student about whom the information is sought.
4. Recognized student organizations within the University requesting non-directory information will be given such information after verification by the Vice Chancellor for Student Affairs. The Vice Chancellor for Student Affairs will determine that the organization is a recognized student organization, that the information will not be used for research involving collecting of “sensitive” information without appropriate institutional review action, and that the information is needed for legitimate recruitment of members, or for selection for honors and awards. The signature of a supervising faculty or staff member is required. The faculty or staff member is responsible for insuring that the information is used only for the approved purpose and not released to any other students or individuals.
5. Instructors have access to classrolls through Faculty/Staff Central. Classrolls and the student photos on the classrolls are non-directory information. Instructors will be required to review the policy on confidentiality of student records and pass a short quiz the first time they connect to this service.
6. Persons who misuse information can be denied further access for five years.
7. If a student is claimed as a dependent on his/her parent’s federal income tax return, either of the student’s parents may obtain access to the student’s education records without the student’s prior written consent. To be eligible to receive information under this section, the parent must complete a “Parent(s) Certification of Student’s Dependent Status for Federal Income Tax Purposes”and submit it to the Office of the University Registrar along with a copy of his/her federal income tax return for the tax year in question.Because tax dependency can change from year to year, parents who wish to establish eligibility to receive information from their student’s education records must complete a new certification and submit their most recent federal tax returns each year. When the Office of the University Registrar receives a completed certification and attachment, it images the documents and indexes them so they can be retrieved.University employees in other offices who receive requests for student information from parents call the Office of the University Registrar to verify that the parents are legally qualified to receive the information. Upon request the Office of the University Registrar will send a copy of the imaged form to the requesting department for its files.

4. AUTHORIZING OFFICIALS

1. The Director of Undergraduate, Graduate, or Professional School Admissions or a designate will review and approve requests coming from any source for information on newly admitted students prior to enrollment.
2. The Vice Chancellor for Student Affairs or a designate will review requests and verify the university affiliation of student organizations requesting non-directory information.
3. The University Registrar or a designate will review and approve requests from academic departments, research offices, and outside sources requesting information on enrolled students.

5. PROCEDURES FOR REQUESTING ADDRESS LISTING AND PRINTED REPORTS

1. All requests for data should be made to the appropriate authorizing official on the appropriate form (“Request for Release of Student Related Data”). Forms are available in the Office of the University Registrar.
2. The signature of the requester indicates acceptance of responsibility for protection of the data and certification that it will be used only as described in the request.
3. The authorizing official will review the request and, if approved, will forward it to the office having custody of the records. The authorizing official can place restrictions or conditions on the release of the requested information.
4. The department having custody of the records will review the request to insure that the data are available and current. The department will then submit the request after confirming payment (if applicable).

6. ACCESS TO THE STUDENT INFORMATION SYSTEM THROUGH A DATA LINE

1. Offices on campus having access to student information through on-line access (computer workstations, PC’s, etc.), have the responsibility to protect the confidentiality of students’ records by protecting their workstation from unauthorized use. Unattended computer workstations should be either turned off or logged off.
2. Offices wishing online access to student records should send a completed “Student Information System Access and Training Request” form to the Student Information System Coordinator.
3. If the office does not yet have a computer connection to the AIS system, a letter explaining this should accompany this form. The letter should describe the type of information needed (addresses, class schedules, etc.) and the population of students about whom information is needed (e.g., enrolled students, applicants, graduate, undergraduate, etc.). A description of the proposed physical location of the terminals and security measures to prevent unauthorized access should also be included. The appropriate admissions office must approve access to applicant data.
4. Workstations can be connected through telephone lines or through the campus network. Dial-up access or access through an office network that permits dial up access requires the purchase of a special password generator call a “SECURID Card.” The card is obtained through the AIS Security Officer.

7. ACCESS TO THE RECORDS OF DECEASED STUDENTS

1. FERPA’s protection of personally identifiable information in a student’s education records ends at the time of a student’s death. As a courtesy to the families of recently deceased students who were enrolled at the time of death, the University generally will not release information from their education records for one year without the consent of the deceased student’s next-of-kin.
2. The request for this information must contain the deceased student’s name at the time of enrollment, student ID number (if known), approximate dates of enrollment, the requester’s name, relationship to the deceased, and the purpose of the request. A death certificate or obituary notice is necessary to prove the death of the person in cases where the University records do not contain sufficient information to make this determination.
3. The standard transcript fee will be charged to family or researchers receiving copies of a deceased student’s records.
4. Unless it has information to the contrary, 75 years after the date the records were first created, the University will presume that the student is deceased. Thereafter the student’s education records will be open.

ATTACHMENTS

• The University of North Carolina at Chapel Hill Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974 (Revised November 1, 2000)
• Excerpt from the Federal Register, Vol. 53, No. 69, Monday, April 11, 1988, Rules and Regulations, Part 99 – Family Educational Rights and Privacy. (As amended November 21, 1996)
• Parent(s) Certification of Student’s Dependent Status for Federal Income Tax Purposes