PURPOSE OF THIS POLICY
Colorado State University respects the rights of its students and is committed to protecting the privacy of their Education Records. The University complies with the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. §1232g) and regulations (34 C.F.R. Part 99). This policy describes the student’s rights and responsibilities with respect to the privacy of Education Records and the methods by which FERPA privacy requirements are to be observed.
APPLICATION OF THIS POLICY
This policy applies to the Education Records of Colorado State University students who are enrolled, or who were formerly enrolled, regardless of their age or parental dependency, including records related to the student’s application for admission. At CSU, a student is considered to be enrolled and covered under FERPA on the first day of classes of the student’s first term of enrollment. FERPA does not apply to records of applicants for admission who are denied acceptance or, if accepted, do not attend the institution.
EXEMPTIONS FROM THIS POLICY
FERPA requirements do not apply to certain categories of student records, including (but not limited to) certain personnel records, Law Enforcement Records, Sole Source Notes, and alumni records containing information obtained after the student is no longer in attendance at the University. FERPA rights and protection of student records expire upon death of the student.
DEFINITIONS USED IN THIS POLICY
- Directory Information: Information that FERPA allows to be disclosed without student consent, including student name, email address, telephone number, major field of study, classification level (freshman, sophomore, etc.), dates of attendance, current or previous enrollment status (full-time, half-time, or less than half-time), anticipated date/term of graduation and expected degree(s), honors and degrees awarded, participation in officially recognized activities and sports, height and weight of athletic team members, and video and photographic images of students (with the exception of the official CSU identification photograph).
- Education Records: Records, files, documents, and other materials that contain information directly related to a student and are maintained by CSU (or by a person acting for CSU), except for records that are specifically exempted by the FERPA laws. Education Records include records of students in credit-bearing as well as non-credit-bearing courses.
- FAMweb: The online portal created by CSU where Trusted Individuals designated by the student have secure online access to view selected Education Records of that student.
- FAMweb User: A person who has been granted FAMweb access by the student to view Education Records and/or Private Information as indicated by the student.
- Law Enforcement Records: Records that are created and maintained by the CSU Police Department (CSUPD) for law enforcement purposes.
- Legitimate Educational Interest: A School Official has a Legitimate Educational Interest if the official is performing a task that is: specified in his or her position description or contract agreement; related to a student's education or to discipline of a student; providing a service or benefit related to the student or student's family; or maintaining the safety and security of campus. An example would be when an academic advisor reviews the student's record of courses completed in order to advise the student. If the School Official is a third-party contractor, volunteer or agent, the agreement with the contractor must include certain provisions protecting the Personally Identifiable Information from re-disclosure.
- Medical Treatment Records: Records that are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in a professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than the persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice.
- Parent: Includes a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian.
- Personally Identifiable Information (PII): Information excluding Directory information that, if disclosed alone or in combination with other available information, would make it possible to identify an individual to whom the information pertains. This includes items such as a social security number; a personal identification number; a password; a pass code; an official state or government-issued driver's license or identification card number; a government passport number; biometric data, such as defined in C.R.S. § 24-73-103(1)(a); an employer, student, or military identification number; a financial transaction device as defined in C.R.S. § 18-5-701(3); grades, financial/account information; CSU ID photo; class and work schedules; residency status; class rank; age; birth date and place of birth.
- RAMweb: The online portal created by CSU that provides applicants and students with access to their records and information such as application status, registration, financial information, personal records, jobs, and more. RAMweb is where students go to set up the permissions for FAMweb Users.
- School Official: Any person employed by the University in an administrative, supervisory, academic, research, or support capacity, or who is under contract to the University to do work or perform a special task for which access to Education Records is required. School Officials include, but are not limited to: professors; instructors; administrators; health staff; counselors; attorneys; clerical staff; governing board members; members of committees and disciplinary bodies.
- Sole Source Notes: Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person (except a temporary substitute for the maker of the record). Sole Source Notes do not include student evaluations, grades or any records that are required to be kept in the ordinary course of University business.
- Trusted Individual: A person listed by the student on a FERPA authorization form granting access to specified Education Records.
It is CSU’s policy that a student’s PII will be disclosed only when (i) required by law; (ii) properly authorized by the student; or (iii) authorized by law and the University determines that the information should be disclosed.
Nothing in this policy supersedes the requirements of FERPA.
Student Rights and Responsibilities Regarding their Education Records
A student's rights regarding their Education Records include:
- The right to inspect and review the student’s Education Records within 45 days of the day the University receives a request for access.
- The right to request amendment of the student’s Education Records that the student believes are inaccurate or misleading and a right to place with the Education Record a statement about the contents of the record. If the University decides not to amend the records as requested, the student will be notified of this decision and advised of the right to a hearing. Additional information about the hearing procedures will accompany the notification.
- The right to limit disclosure of PII contained in the student’s Education Records, except to the extent that FERPA authorizes disclosure without consent, and the right to consent to disclosures that are not otherwise authorized by law.
- The right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA. The name and address of the office that administers FERPA is: Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Ave. SW, Washington, DC 20202-4605.
A student’s responsibilities include:
- The responsibility to read the Student Record Privacy Statement and Annual Notification published by the Office of the Registrar.
- The responsibility to manage any restrictions on the disclosure of Directory Information, so that these restrictions do not interfere with the student’s work or academic life by preventing disclosures intended for his or her benefit.
- The responsibility to manage any consent that the student has given for disclosures to be made to any other person, and to withdraw such consent, in writing or via RAMweb when the student no longer wishes to permit such disclosures. Written withdrawal of consent must be submitted to the office where the consent form was filed.
Disclosure of Education Records
The following procedures apply to the disclosure of information from a student’s Education Record. Additional procedures and forms may be established by the Office of the Registrar.
Directory Information may be disclosed without notice or consent; however, students have the right to request that their Directory Information be kept confidential, in which case, the University will not disclose that information without consent, or as authorized by law.
However, students should be aware that restricting the release of Directory Information or placing a full confidential hold on their account may have unintended consequences. For example, such restriction may make it difficult for potential employers or other schools to verify enrollment, a student’s name may be excluded from the commencement program, and student organizations, fellow students and others may have difficulty locating the student through the University Directory.
Except as specifically required by law or by an approved University contract, the University will not create or distribute lists or compilations of Directory Information elements such as students’ email addresses, or students’ mailing addresses except as necessary for official business purposes of the University, as approved by the Registrar or Dean of Students.
Personally Identifiable Information (PII)
PII may be disclosed to a person or party external to the University, without the student’s consent, as authorized under the FERPA regulations, 34 C.F.R. §99.31, including (but not limited to):
- To School Officials who have a Legitimate Educational Interest;
- When required pursuant to a subpoena or other court order;
- When the disclosure is to the student’s Parent, and the conditions for disclosures to Parents are met as set forth below;
- When the disclosure is required by law. In particular, federal law requires that the University disclose the “final results” of any institutional disciplinary proceeding dealing with an alleged crime of violence or an alleged non-forcible sex offense to the alleged victim of the offense (or the alleged victim’s next of kin, or to any person whom CSU determines to have a legitimate interest in such information). As used herein, “final results” that may be disclosed after all hearings and determinations are final under the University’s rules and policies, are: the student’s name; the violation committed under CSU’s Student Conduct Code; and any sanction imposed by the institution against the student;
- When the University determines that there is a health or safety emergency that warrants such disclosure. A health or safety emergency exists whenever there is an articulable and significant threat to the health or safety of the student or another person;
- When the disclosure is to officials of another institution of higher education where the student is enrolled, or is seeking to enroll, for purposes related to that enrollment;
- For financial aid purposes; or
- Any other exception provided under FERPA applies.
Disclosures to Parents
According to FERPA, the University may, but is not required to disclose any part of the student’s Education Record to a student’s Parents. The University primarily provides Parents and Trusted Individuals with access to limited information through FAMweb or with written student consent. In those instances where a Parent or any individual or entity requests Education Records that are not available via FAMweb and the student has not provided written consent, the request should be referred to the Dean of Students for additional review and response.
A qualified Parent or Trusted Individual is granted access to the student’s Education Record when any of the following conditions are met:
- A Parent of the student has claimed the student as a dependent on the Parent’s federal tax return and the Parent’s identity has been verified by the Office of the Registrar, the Office of Financial Aid, the Collaborative for Student Achievement, Business and Financial Services, or another authorized School Official. If one Parent has claimed the student as a dependent, another Parent of the student may also be allowed to receive such disclosures. The “Parent Affidavit and Request for Student Academic Information” form or a copy of the tax return in the Office of Financial Aid can serve as verification the Parent claimed the student on the federal tax return;
- The student has authorized the disclosure in writing by providing the University entity with a signed permission to release academic records;
- The student has authorized the disclosure in writing or consented to access via FAMweb; the individual may view defined areas of the student record. Discussion with University officials in regards to details of the student record require a signed FERPA disclosure;
- There is a health or safety emergency which, in the discretion of the University, warrants disclosing the information;
- The student is under the age of 21, and the information relates to a violation of law or policy involving the use or possession of drugs or alcohol. It is CSU’s policy to notify a student’s Parents in these circumstances in order to help reduce alcohol and drug use by CSU students, engage Parents in dialogue about their student’s behavior related to alcohol/drugs, and assist students and the CSU community in understanding that CSU takes underage alcohol/drug use seriously; or
- The information relates to a law enforcement matter and is contained in a record made by a law enforcement authority, including, but not limited to, campus police.
Information Other Than Education Records
FERPA neither requires nor prohibits a faculty member or other School Official from sharing concerns or observations with a Parent about their student based on personal knowledge or observation rather than on the Education Record. If the information is contained in any written record (other than a Sole Source Note) for such information, he or she must first confirm that the appropriate written consent form for the disclosure has been received.
How to Provide Consent to a Disclosure
A student may consent to the release of any or all of his or her PII by completing a written consent form and returning it to the Office of the Registrar or other responsible School Official. Consent may be ongoing, or may be given for a specified period of time or limited to a single instance. Forms are available from the Office of the Registrar’s website. Financial information consent forms are available in RAMweb and must be submitted to Accounts Receivable Operations.
Students are also afforded the opportunity to consent to the release of certain Education Records to be viewed by any individual without the necessity of giving consent each time the disclosure is requested. This is done by registering the email address of the person to whom the disclosures will be made in RAMweb and then designating the information to be disclosed in FAMweb. The types of information that may be designated for disclosure via FAMweb are limited and do not mean School Officials may speak to the Parent or Trusted Individual about the Education Record. Consent to release PII not accessible through FAMweb requires a separate, written release form signed by the student.
Financial Aid Information
Information from a student’s application for need-based financial aid (including Parental income) and the status of that application will be released only to a Parent whose income information is included on the application (e.g., the Free Application for Federal Financial Aid, or FAFSA, application form).
Medical Treatment Records
Medical treatment records may only be disclosed with the student’s written consent, when required by court order or subpoena, or as otherwise permitted under one of the exceptions for disclosure of PII described in FERPA laws and authoritative guidance and this policy. When a medical treatment record is disclosed in accordance with this policy, it becomes an “Education Record” under FERPA and this policy. Disclosures must be limited to only such portions of the medical record that are relevant and necessary to the litigation or other matter for which disclosure is authorized.
Responsibilities of CSU Faculty and Staff
CSU faculty, staff and agents of CSU who have access to student Education Records are responsible for:
- Understanding the requirements of FERPA and this policy;
- Annually, or at more frequent intervals, reaffirming statements of acceptable use in accessing University administrative systems and student Education Records.
- Protecting the confidentiality of student Education Records as required by this Policy;
- Accessing student Education Records only when they have a Legitimate Educational Interest for doing so; and
- Authenticating the identity of those requesting student Education Record information and confirm their right to access prior to release of information. For assistance with authentication procedures, University employees should contact the Office of the Registrar.
All CSU employees and units with access to PII shall take all reasonable measures to assure the security and confidentiality of such records.
Special Responsibilities of the Registrar’s Office
The Office of the Registrar is responsible for disseminating the Student Record Privacy Statement and Annual Notification under FERPA, for obtaining written consent and authorization to release a student’s records, and for facilitating authorized disclosures.
The Office of the Registrar will inform parties to whom PII is released that recipients are not permitted to disclose the information to others without the written consent of the student (unless the disclosure is required or permitted by law without the student’s consent).
The Office of the Registrar will periodically review FERPA policies and procedures with the assistance of the Office of the General Counsel and the Office of Policy & Compliance.
Concerns, complaints, questions or suggestions regarding the release of student records should be addressed to the Office of the Registrar.
COMPLIANCE WITH THIS POLICY
Failure to comply by University employees and agents may result in disciplinary action in accordance with applicable University policies. Assistance with compliance is provided by the Office of the Registrar.
FORMS AND TOOLS
The following forms are available on the Office of the Registrar’s website:
Approved December 3, 2012 by Anthony A. Frank, President
Approved December 9, 2014 by: Office of Policy & Compliance (editorial only--headings and spacing)
Approved February 10, 2019 by Lynn Johnson, Vice President for University Operations