Information Technology Services: Security Policy for SA Users

All employees of Central Washington University (administrative, academic, staff and student workers) are required to abide by the policies governing review and release of student education records. The Family Educational Rights and Privacy Act (FERPA) mandates that information contained in a student's education record must be kept confidential and outlines the procedures for review, release and access of such information.

Access to the Student Administration System will be granted to those individuals who have been determined to have a legitimate educational interest in the data by the SA Data Custodian. Access to specific student data will be granted by approval of the director of the functional area which oversees the student data being requested.

Individuals who have been granted access to any part of the SA data base must understand and accept the responsibility of working with confidential student records. The following rules apply to all University employees with a SA account:

Individual and department passwords are to be kept confidential and should not be shared. When authority to access additional screens or systems is needed, employees should make a request to the SA Data Custodian. It is the responsibility of each department custodian/employee to keep their password confidential and to change passwords whenever they feel someone else may have obtained access to it.

FERPA guidelines are outlined in this web page. In part, the policy states that officials of the University may be given access to student education records on a "need-to-know" basis and that such assessment be limited to job related, legitimate, educational interests. The information contained in a student's education record may not be released to a third party without the written consent of the student. At its discretion CWU may provide directory information without the consent of the student. Directory information is defined as the student's name, local and home addresses and telephone numbers, date and place of birth, major field of study, class, participation in officially recognized activities and sports, dates of attendance, degrees and awards received, and the most recent previous educational institution attended.

Examples of inappropriate use of student records are:

1. Accessing or reviewing a student's record without a legitimate educational interest.
2. Releasing confidential student information (non-directory) to another student, University organization, and person who does not have a legitimate educational interest, or parents of a dependent student, without the student's written authorization.
3. Leaving reports or computer screens containing confidential student information in view of others who do not have a legitimate educational interest in the data.
4. Using the student information for personal business.
5. Giving your password to another individual not authorized to use the SA system or to view a particular screen.
6. Discussing the information contained in the student record outside of the University or while on the job with individuals who do not have a legitimate educational interest in the information (need to know).

Under no circumstances should an employee give confidential information about students to any other students, to other employees, or to any person who has not been authorized to receive such information by their position or by their departmental supervisor. Although directory information may be released without prior consent, any requests coming from students or from anyone off campus should be referred to the Vice President for Student Affairs or to the Registrar.

Students may request that directory information concerning them not be released. If that occurs, a flag denoting such a request will appear on the student record. Virtually no information may then be released without the student's express written consent. If a student has requested directory information be restricted, the following screen will appear:

THIS STUDENT HAS REQUESTED THAT
N O I N F O R M A T I O N
ON OUR STUDENT RECORDS SYSTEM BE RELEASED
T O A N Y O N E F O R A N Y R E A S O N.

BY PRESSING THE RETURN KEY YOU ARE ACKNOWLEDGING YOUR
ACCEPTANCE AND RECOGNITION OF THIS STUDENT'S REQUEST.

Confidential Information

With the exception of the directory information listed above, all student records are considered to be confidential and are open only to University personnel who need the information to carry out their official responsibilities (assigned duties and functions). Although University personnel are authorized access to this information on a "need to know" basis, they are not permitted to release information to persons outside the University unless authorized in writing by the student, by a court order, or by the exceptions listed below under supplemental exceptions. Only the official or designated person responsible for the records has the authority to release them.

Release of Grades

Reports of a student's grades are not routinely sent to the student's parents. However, parents of a dependent student, as defined by the Internal Revenue Code, may obtain grades without student's consent upon presentation of a signed statement confirming that the student is dependent.

The posting of a student's grades is prohibited unless:

• Each student signs a waiver of his/her right to privacy; or
• A confidential number ( other than full social security number) or code is agreed upon between the instructor and individual student prior to the posting.

The returning of papers via an "open" distribution system, e.g., stacking them on an open table, is a violation of a student's right to privacy, unless student(s) submits a signed waiver to the instructor for such purpose.

Rights of Access and Review of Records

Students have the right to inspect, review, or receive an interpretation of copies of their educational records, except as excluded below. This right may be exercised by submitting a written request to the custodian of the records to which access is desired. Such requests should be honored as quickly as possible and reasonable, normally within 48 hours; if detailed documentation and/or interpretation is required, the request should be honored within ten (10) days. In all cases, requests for such information must be honored within 45 days.

If a copy (ies) of a portion or all of the records in the student's file is requested, the custodian of the records may charge a fee for copies made, provided the fee does not effectively prevent students from exercising their right to inspect and review (under supervision of a University employee) their records. You may not charge a fee to search for or to retrieve records. Each custodian or records individual is responsible for requiring proper identification of the individual making the request about his/her records.

Limitation on Access

Educational institutions are not required to make available to students in institutions of post-secondary education the following records:

1. Confidential letters and statements of recommendation which were placed in the education records prior to January 1, 1975.
2. Financial records of the parents of the students or any information contained therein;
3. Records maintained by a physician, psychiatrist, psychologist, or other recognized professionals are not open for student's inspection. Students may, however, have an appropriate professional of their choosing inspect such records;
4. Confidential recommendations for admission, employment, or honors are not open to student access if the student has waived his/her right to access.
5. Law enforcement records maintained solely for law enforcement purposes are unavailable for student access and may be used only by law enforcement officials;
6. Records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto which are in the sole possession of the maker thereof and which are not accessible or revealed to any other person except a substitute ( an individual who performs on a temporary basis the duties of the individual who made the record).

Supplementary Exceptions

In addition to the student access stipulations, the Act provides that the University may release without the student's permission personally identifiable education records to:

1. officials or faculty of the University who have legitimate education interest (need to know to fulfill official responsibilities);
2. officials of other schools or school systems in which the students seek to enroll; in this instance, no notice of release of records needs to be sent to the student;
3. certain federal and state educational authorities: the Comptroller General of the United States; the Secretary; the Commissioner, the Director of the National Institute of Education; state educational authorities;
4. accrediting and University-approved testing agencies;
5. parents of dependent students (requires signed statement from parent confirming the student is dependent per Internal Revenue Code of 1954);
6. appropriate parties in connection with an emergency when the immediate health or safety of the student is threatened;
7. persons presenting an officially-related judicial order of lawfully-issued subpoena; and
8. institutions from which the student has received or applied to for, financial aid.

Right to Challenge Content of Records

A student may challenge the accuracy of handling of educational records maintained by the University on grounds that the records are inaccurate, misleading or otherwise violate the privacy or other rights of the students. Students who wish to exercise these rights should file a request with the custodian of the records in question. Appeals regarding their decisions should be made to the Vice President for Student Affairs.

Complaint Procedures

Students are encouraged to report any violations and seek redress from CWU officials responsible for the area in which the violation occurred. However, complaints regarding violations of rights accorded students by Section 438 of the Privacy Rights of Parents and Students Act or the regulations, may be submitted to the department of Health, Education and Welfare. Such allegations must be submitted in writing.