PURPOSE OF THIS POLICY
Colorado State University respects the rights of its students and is committed to protecting the privacy of their education records. Colorado State University complies with the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. §1232g) and regulations (34 C.F.R. Part 99). This policy describes the student’s rights and responsibilities with respect to the privacy of education records and the methods by which FERPA privacy requirements are to be observed.
APPLICATION OF THIS POLICY
This policy applies to the Education Records of Colorado State University students who are currently enrolled, or who were formerly enrolled, regardless of their age or status with regard to parental dependency, including records related to the student’s application for admission. A student is considered to be currently enrolled and covered under FERPA when the student confirms his or her decision to attend the University. The can be done by remitting an enrollment deposit (including those students receiving waivers for such), completing an enrollment request form, or registering for classes.
EXEMPTIONS FROM THIS POLICY
FERPA requirements do not apply to certain categories of student records, including (but not limited to) certain personnel records, law enforcement records, sole source notes (notes that are only in the possession of the person who made them and not accessible to others), and alumni records, which contain information about a student obtained after he or she is no longer in attendance at the University.
DEFINITIONS USED IN THIS POLICY
- Directory Information: ”Directory Information” includes: student name, current mailing address, e-mail address, telephone number, major field of study, classification level (freshman, sophomore, etc.), dates of attendance, current or previous enrollment status (full-time, half-time, and less than half-time), anticipated date/term of graduation and expected degree(s), honors and degrees awarded, participation in officially recognized activities and sports, height and weight of athletic team members, and video and photographic images of students (with the exception of the official CSU identification photograph).
- Education Record: Records, files, documents, and other materials which contain information directly related to a student and are maintained by CSU (or by a person acting for CSU), except for those records which are specifically exempted from such definition under the FERPA statute and regulations. Included in education records are records of persons in credit bearing as well as non-credit bearing courses.
- Law Enforcement Records: Records that are created by the CSU Police Department and maintained in CSUPD records for law enforcement purposes.
- Medical Treatment Records: Records that are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in a professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than the persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice.
- Private Information: Personally identifiable information in an education record that is not defined as Directory Information and includes, but is not limited to, items such as: grades, CSU ID number, CSU ID photo, social security number, class schedule, residency status, class rank, age, birth date, and place of birth.
- School Official: Any person who is employed by the University in an administrative, supervisory, academic, research, or support staff position, or employed by or under contract to the University to perform a special task (such as an attorney or an auditor). School Officials include, but are not limited to: professors; instructors; administrators; health staff; counselors; attorneys; clerical staff; governing board members; members of committees and disciplinary bodies. A third party contractor, agent or volunteer retained by the University for purposes of performing work that requires access to Education Records is also considered to be a School Official for purposes of this Policy.
- Sole Source Notes: Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person (except a temporary substitute for the maker of the record). Sole Source Notes do not include student evaluations, grades or any records that are required to be kept in the ordinary course of university business.
It is the policy of CSU that a student’s Private Information shall be disclosed only when the disclosure is (i) required by law; (ii) properly authorized by the student; or (iii) otherwise required or permitted by law and, in the discretion of the University, should be disclosed.
Additionally, to increase efficiency for students and parents requesting certain education records, such as transcripts, billing information and course schedules, the University developed an online portal providing convenient access to such records. The University also recognizes parents may, from time to time, have requests for other protected information regarding students that it may, but is not required to provide. The University wishes to have those requests reviewed by a central source to efficiently determine what information may, and should, be shared with a qualified parent.
Nothing in this policy shall supersede the requirements of FERPA. This policy is subject to change whenever required to maintain compliance with applicable laws or regulations.
Student Rights and Responsibilities Regarding their Education Records
A student's rights regarding their Education Records include:
Under the Family Educational Rights and Privacy Act (hereafter called FERPA), a student’s rights include:
- The right to inspect and review the student’s Education Records within 45 days of the day the university receives a request for access.
- The right to request amendment of the student’s Education Records that the student believes are inaccurate or misleading and a right to place with the Education Record a statement about the contents of the record. If the university decides not to amend the records as requested, the student will be notified of this decision and advised of the right to a hearing. Additional information about the hearing procedures will accompany the notification.
- The right to limit disclosure of personally identifiable information contained in the student’s Education Records, except to the extent that FERPA authorizes disclosure without consent, and the right to consent to disclosures that are not otherwise authorized by law.
- The right to file a complaint with the U.S. Department of Education concerning alleged failures by the university to comply with the requirements of FERPA. The name and address of the office that administers FERPA is: Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Ave. SW, Washington, DC 20202-4605.
A student’s responsibilities include:
- The responsibility to read the Student Record Privacy Statement and Annual Notification under FERPA.
- The responsibility to manage any restrictions on the disclosure of Directory Information, so that these restrictions do not interfere with the student’s work or academic life by preventing disclosures intended for his or her benefit.
- The responsibility to manage any consent that the student has given for disclosures to be made to any other person, and to withdraw such consent, in writing (or via FamWeb, where applicable), when the student no longer wishes to permit such disclosures.
Disclosure of Education Records
The following procedures apply to the disclosure of information from a student’s Education Record. Additional procedures and forms may be established by the Office of the Registrar.
Directory Information may be disclosed without notice or consent; however, students have the right to request that their Directory Information be kept confidential, in which case, the University will not disclose that information without consent, or as authorized by law.
However, students should be aware that restricting the release of Directory Information or placing a full confidential hold on their account may have unintended consequences. For example, such restriction may make it difficult for potential employers or other schools to verify enrollment, a student’s name may be excluded from the commencement program, and student organizations, fellow students and others may have difficulty locating the student through the University Directory. To avoid these issues, many students choose not to restrict the release of Directory Information.
Except as specifically required by law or by an approved university contract, the university will not create or distribute lists of Directory Information elements such as students’ email addresses, students’ mailing addresses, or other such compilations, except as necessary for official business purposes of the university, as approved by the Registrar. Such lists or compilations may only be distributed to School Officials having a legitimate educational interest in the data.
A student’s Private Information may be disclosed to School Officials only when there is a “legitimate educational interest” in doing so. A School Official has a legitimate educational interest if the official is performing a task that is: specified in his or her position description or contract agreement; related to a student's education or to discipline of a student; providing a service or benefit related to the student or student's family; or maintaining the safety and security of campus. An example would be when an academic advisor reviews the student's record of courses completed in order to advise the student. If the School Official is a third-party contractor, volunteer or agent, the agreement with the contractor must include certain provisions protecting the Private Information from re-disclosure.
Private Information may also be disclosed to a person or party external to the University, without the student’s consent, as authorized under the FERPA regulations, 34 C.F.R. §99.31, including (but not limited to):
- When required pursuant to a subpoena or other court order;
- When the disclosure is to the student’s parent, and the conditions for disclosures to parents are met as set forth below;
- When the disclosure is required by law. In particular, federal law requires that the University disclose the “final results” of any institutional disciplinary proceeding dealing with an alleged crime of violence or an alleged non-forcible sex offense to the alleged victim of the offense (or the alleged victim’s next of kin, or to any person whom CSU determines to have a legitimate interest in such information). As used herein, “final results” that may be disclosed after all hearings and determinations are final under the University’s rules and policies, are: the student’s name; the violation committed under CSU’s Student Conduct Code; and any sanction imposed by the institution against the student;
- When the University determines that there is a health or safety emergency that warrants such disclosure. A health or safety emergency exists whenever there is an articulable and significant threat to the health or safety of the student or another person;
- When the disclosure is to officials of another institution of higher education where the student is enrolled, or is seeking to enroll, for purposes related to that enrollment;
- For financial aid purposes; or
- Any other exception provided under FERPA applies.
Disclosures to Parents
Pursuant to FERPA, the University may, but is not required, to disclose any part of the student’s Education Record to a student’s parents under certain conditions. The University primarily provides qualified parents with access to limited information through FamWeb or with specific student consent. In those instances where a qualified parent requests Private Information that is not available via FamWeb and the student has not provided written consent, such requests should be referred to the Dean of Students for additional review and response.
A parent may be granted access to Private Information when any of the following conditions are met:
- A parent of the student has claimed the student as a dependent on the parent’s federal tax return and the parent’s identity has been verified by the Office of the Registrar, Student Financial Services, the Center for Advising and Student Achievement (CASA), Business and Financial Services, or other authorized School Official. If one parent has claimed the student as a dependent, the other parent may also be allowed to receive such disclosures;
- The student has authorized the disclosure in writing or consented to access via FamWeb;
- There is a health or safety emergency which, in the discretion of the University, warrants disclosing the information;
- The student is under the age of 21, and the information relates to a violation of law or policy involving the use or possession of drugs or alcohol. It is CSU’s policy to notify a student’s parents in these circumstances in order to help reduce alcohol and drug use by CSU students, engage parents in dialogue about their student’s behavior related to alcohol/drugs, and assist students and the CSU community in understanding that CSU takes underage alcohol/drug use seriously; or
- The information relates to a law enforcement matter and is contained in a record made by a law enforcement authority, including, but not limited to, campus police.
Information Other Than Education Records
In addition, students should be aware that FERPA allows, but does not require, a School Official to share with parents information based on that official's personal knowledge or observation that is not based on an Education Record. Therefore, FERPA would neither require nor prohibit a faculty member or other School Official from sharing concerns or observations with a parent about their son or daughter based on personal knowledge or observation. If the information is contained in any written record (other than a Sole Source Note) for such information, he or she must first confirm that the appropriate written consent form for the disclosure has been received.
Student’s Authorization for Disclosure
A student may consent to the release of any or all of his or her Private Information by completing a written consent form and returning it to the Office of the Registrar or other responsible School Official. Consent may be ongoing, or may be given for a specified period of time or limited to a single instance. Forms are available from the Registrar’s Office website.
Students are also afforded the opportunity to consent to the release of certain Private Information to the student’s parents or others without the necessity of giving consent each time the disclosure is requested. This is done by registering the email address of the person to whom the disclosures will be made in RamWeb, an online access point controlled by the student. The information that the student designates for disclosure is made available via an online portal, “FamWeb.” The types of information that may be designated for disclosure via FamWeb are limited. Consent to release private information not accessible through FamWeb requires a separate, written release form signed by the student.
Financial Aid Information
Information from a student’s application for need-based financial aid (including parental income) and the status of that application will be released only to a parent whose income information is included on the application (e.g., the Free Application for Federal Financial Aid, or FAFSA, application form).
Medical Treatment Records
Medical treatment records may only be disclosed with the student’s consent or as permitted under one of the exceptions for disclosure of private information described in FERPA and this policy. When a medical treatment record is disclosed in accordance with this policy, it becomes an “education record” under FERPA and this policy.
Responsibilities of CSU Faculty and Staff
- Faculty, staff and agents of CSU who have access to student Education Records are responsible to:
- Understand the requirements of FERPA;
- Annually, or at more frequent intervals, reaffirming statements of acceptable use in accessing University administrative systems and student education records.
- Protect the confidentiality of student Education Records as required by this Policy;
- Access student Education Records only when they have a legitimate educational interest for doing so; and
- Authenticate the identity of those requesting student education record information and confirm their right to access prior to release of information. For assistance with authentication procedures, University employees should contact the Office of the Registrar.
All CSU units with access to Private Information shall take all reasonable measures to assure the security and confidentiality of such records.
Special Responsibilities of the Registrar’s Office
The Registrar’s Office is responsible for disseminating the Student Record Privacy Statement and Annual Notification under FERPA, for obtaining written consent and authorization to release a student’s records, and for facilitating authorized disclosures.
The Registrar’s Office will inform parties to whom personally identifiable information is released that recipients are not permitted to disclose the information to others without the written consent of the student (unless the disclosure is required or permitted by law without the student’s consent).
The Registrar’s Office will periodically review FERPA policies and procedures with the assistance of the Office of the General Counsel and the Office of Policy & Compliance.
Concerns, complaints, questions or suggestions regarding the release of student records should be addressed to the Registrar’s Office.
COMPLIANCE WITH THIS POLICY
Failure to comply by University employees and agents may result in disciplinary action in accordance with applicable University policies. Assistance with compliance is provided by the Registrar's Office.
FORMS AND TOOLS
The following forms are available on the Registrar’s website:
- Confidentiality of Directory Information
- Student Directory Preference Form
- Student Permission to Release Academic Record
- Parent Affidavit and Request for Student Academic Information Form
Version 1.0 approved December 3, 2012 by Anthony A. Frank, President
Revision 1.01 approved December 9, 2014 by: Office of Policy & Compliance (editorial only--headings and spacing)