Guidelines for the Implementation of the Student Records Access Policy and the Family Educational Rights and Privacy Act (FERPA)
The Student Records Access Policy of the Board of Trustees of The City University of New York (CUNY) provides that the University and its colleges shall be in full compliance with the Family Educational Rights and Privacy Act (FERPA), 20 U.S. §1232g, and its implementing regulations, 34 CRF Part 99.
Under FERPA, students generally have the right to review their education records and must consent in writing before certain personally identifiable information is disclosed to third parties. These guidelines contain information about these requirements and important exceptions, as well as definitions, procedures, and the annual notification of student rights.
I. Definitions
II. Student’s Right to Review Education Records
A. Procedures for Review and Inspection
B. Records Not Subject to Mandatory Access
C. Procedures for Amending or Correcting Records
III. Disclosure of Education Records
A. Student Consent Required
B. Directory Information
C. Disclosure of Education Records without Prior Consent
D. Recordkeeping Requirements
E. Limits on Redisclosure
IV. Procedural Requirements
A. Annual Notification of Rights
B. Appeal Rights
V. Forms
A. Notification of Student Rights Concerning Education Records and Directory Information (required annual notice)
B. FERPA Release Form (for students who want records disclosed)
C. Directory Information Non-Disclosure Form (for students who wish to object to the disclosure of directory information)
D. College Denial of Appeal for Access to Records E. Student Appeal Form I.
DEFINITIONS used in this Guidance and attachments:
A. Student. A current or former student at a college, including a student in an on-line course or program, who has actually attended a class. An applicant is not a Student until the applicant has begun attending class at a college or 2 other CUNY program. An individual who is a Student at one CUNY college is not a Student at another CUNY college unless he or she also attends classes at that other college. An individual remains a Student while working under a work-study program.
B. Directory Information. Directory information is information in a student’s education record not generally considered harmful or an invasion of privacy under FERPA. It may be disclosed to others without a student’s prior written consent, subject to certain exceptions. Information that is considered directory information at CUNY are listed in section III.B, below.
C. Education Records. Data or information which directly relates to a student and is maintained by a college or the University Central Office. Education Records may be created or recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche. Information about a student that is maintained by an educational institution in a computer data base is part of a student’s education record and thus protected by FERPA. Unless an exception applies, access to such information is limited to individuals who are School Officials with a legitimate educational interest in the information. Exceptions to the term Education Record are discussed below.
D. Personally identifiable information (PII). Information that makes an education record “personally identifiable” to a particular student, including but not limited to:
a. The student’s name or preferred name
b. The name of the student’s parent or other family member
c. The address of the student or other family member.
d. Personal identifiers, such as the student’s social security number or biometric record
e. Other indirect identifiers, such as the student’s date of birth, place of birth, or mother’s maiden name
f. Other information that, alone or in combination, is linked or linkable to a specific student, and which would allow a reasonable person in the school community to identify the student
g. Information requested by a person who the college reasonably believes knows the identity of the student to whom the education record relates.
E. School Official. A person employed by the University in an administrative, supervisory, academic, research, or support staff position (including law enforcement and health services staff); a person or company with whom the 1 A biometric record means a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual, such as fingerprints, voiceprints, or facial characteristics. 3 college or University has contracted as its agent to provide a service instead of using University employees or officials; a student serving on an official college or University-wide committee, such as a disciplinary committee; or an individual assisting another School Official in performing his or her tasks. Members of the Board of Trustees are also School Officials. A contractor, consultant, volunteer or other party (collectively “contractor”) to whom a college or the University has outsourced institutional services or functions may be a School Official so long as the contractor is performing services that would otherwise be performed by employees, is under the direct control of the college or the University with respect to the use and maintenance of education records, and is subject to the requirements on use and re-disclosure of PII set out below. The State Comptroller, and his or her agents and representatives, are also School Officials for the purposes of auditing CUNY’s educational programs.
F. Legitimate Educational Interest. A School Official has a legitimate educational interest in obtaining access to a particular record if access is reasonably necessary in order to fulfill his or her professional responsibilities for the college or University. \
G. FERPA Appeals Officer. College official or employee designated by the President to hear student appeals from denials of access to records, requests to correct records, or other rights under FERPA.
H. General Counsel and Vice Chancellor for Legal Affairs. The General Counsel and Vice Chancellor for Legal Affairs (“General Counsel”) is charged with hearing appeals concerning failures by any college to comply with FERPA. The Office of the General Counsel and Vice Chancellor for Legal Affairs (“OGC”) is also responsible for issuing advisory memoranda on FERPA.
II. STUDENT’S RIGHT TO REVIEW EDUCATION RECORDS. A student generally has the right to review his or her own education records.
A. Procedures for Review and Inspection.
1. A college must permit a student to inspect and review his/her education records within 45 days of the college's receipt of a request for access, subject to the exceptions below. Such request shall be made to the college’s Registrar. Although an initial request may be oral, the college should require the student to put the request in writing and identify the records the student wishes to inspect. A school official may be present when the student inspects and reviews education records; this is advisable if the student is inspecting original records. FERPA provides a right to inspect and review; it generally does not require the college to provide copies of records to the student or to allow the student to make copies on their own electronic device.
2. If the request is denied or not responded to within 45 days of receipt, the student may appeal to the College’s FERPA Appeals Officer. The appeal must be in writing and should identify the particular records to which access was requested, the date of the original request for access, the person to whom the request was made, and the reasons why the student believes that the student has a right of access to the record. The FERPA Appeals Officer should render a decision on the appeal no later than 30 days after receipt of the appeal. Denial of an appeal for access must be in writing and contain the reasons for the denial and a statement that the student has a further right to appeal. Attachment D is a suggested form for a college’s denial of an appeal. The student who wishes to appeal must, within 30 days, send the appeal to OGC at 205 East 42nd Street, 11th Floor, New York, New York, 10017. Attachment E is a suggested form for a student’s appeal.
B. Records Not Subject to Mandatory Access. A student has no right to review, and the College need not permit inspection of, the following types of records. (Please note that other laws, such as state medical privacy laws or the New York State Freedom of Information Law (FOIL), may relate to some of these categories).
1. Confidential letters and confidential statements of recommendations placed in the education records before 1975, or after January 1, 1975, if the student (1) has waived the right to inspect and review those letters and statements, and (2) those letters and statements are related to the student’s (a) admission to an educational institution, (b) application for employment, or (c) receipt of an honor or honorary recognition; and (3) the waiver is not required as a condition of admission to or receipt of another service or benefit from the college.
2. Financial records of the student’s parents, and any information those records contain.
3. Records that are in the sole possession of the maker, are used as a personal memory aid and are not accessible or revealed to another person except a temporary substitute for the maker of the record.
4. Records maintained on behalf of a college by its law enforcement unit (i.e. Public Safety Department or equivalent), or by a contract guard service, provided that such records are: (1) created and maintained by the law enforcement unit; and (2) created for a law enforcement purpose. This law enforcement unit exception does not apply to copies of law enforcement unit records in the possession of another office within the college or to records created and maintained by the law enforcement unit exclusively for a non-law enforcement purpose.
5. Employment records of a college employee who is also a student provided that: (a) such records are normally maintained by the college; (b) such records relate exclusively to the individual’s employment; (c) such records are used only for employment purposes; and (d) such employment is not the result of student status (e.g., work study, graduate assistants).
6. Records made by a health care provider—a physician, psychiatrist, psychologist, or other recognized professional/paraprofessional acting or assisting in his or her professional or paraprofessional capacity, which: (a) are created, maintained, or used only in connection with the provision of treatment of the student, and (b) are not disclosed to anyone other than the individuals providing the treatment.
7. Records which pertain to a student but were generated after the student is no longer in attendance and not directly related to attendance as a student (for example, alumni records created after the student’s graduation.)
8. Grades on peer-graded papers before they are recorded by a teacher.
9. Any other record, which, pursuant to any other law or regulation, is privileged, or which is otherwise inaccessible to the student.
C. Procedures for Amending or Correcting Records.
1. If a student believes that his/her education records contain information that is inaccurate, misleading, or in violation of the student’s rights of privacy, he or she may ask the college to amend the record. The college shall decide whether to amend within a reasonable time after receiving the request. If the college denies the student's request, it shall inform the student of its decision and of the student’s right to appeal to the FERPA Appeals Officer. A student may not contest the assignment of a grade through this procedure, but may contest whether the assigned grade was recorded accurately.
2. The FERPA Appeals Officer shall hold a hearing within a reasonable time after receipt of the appeal; reasonable notice of the date, time and place of the hearing shall be given to the student. The student shall be given a full and fair opportunity to present relevant evidence. The student may be assisted or represented by one or more individuals of his/her choice. The decision must be based solely on the evidence presented at the hearing. The FERPA Appeals Officer shall within a reasonable time after the hearing issue a decision in writing and include a summary of the evidence and the reasons for the decision.
3. If as a result of the hearing, the FERPA Appeals Officer decides that the information is inaccurate, misleading or otherwise in violation of the student’s privacy rights, the college shall: (a) amend the record 6 accordingly; and (b) inform the student of the amendment in writing. If, on the other hand, the college decides that the information is correct and not in violation of the student’s privacy rights, it shall inform the student of his/her right to place a statement in the record commenting on the contested information or stating why he or she disagrees with the decision of the college. If a statement is placed in the education records of the student, the college shall maintain the statement with the contested part of the record for as long as the record is maintained and disclose the statement whenever it discloses the portion of the record to which the statement relates.
III. DISCLOSURE OF EDUCATION RECORDS.
A. Student Consent Required. A student's written consent is required to disclose personally identifiable information (PII) contained in education records to someone other than the student, unless the information disclosed is Directory Information (Section III.B) or another specific exception (including the exemption for disclosure to School Officials) applies (Section III.C).
1. The consent must be signed and must: (1) specify the records that may be disclosed; (2) state the purpose of the disclosure; and (3) identify the party or class of parties to whom the disclosure may be made. Attachment B is a FERPA Release Form that complies with these requirements.
2. Students and alumni requesting disclosures must provide proof of identity.
B. Directory Information. A college may disclose “directory information” to someone other than the student without a student’s written consent. One of the primary purposes of directory information is to allow the college to include this type of information from the student’s education records in certain school publications, such as on-line directories, yearbooks, Dean’s list and other recognition lists, commencement programs, and sports activity materials.
1. Directory information consists of a student’s:
a. Name
b. Address (to limited recipients set forth below)*
c. Email address (to limited recipients set forth below)*
d. Telephone number (to limited recipients set forth below)*
e. Attendance dates (semesters and sessions, not daily records)
f. Photograph
g. 8-digit student ID number (but only if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity)
h. Enrollment status (full or part-time, undergraduate or graduate, etc.)
i. Level of education (credits completed)
j. Degree enrolled for and major field of study
k. Participation in officially recognized activities and sports (teams)
l. For members of athletic teams only, height and weight
m. Degrees, honors and awards received. *Address, email address and telephone number may be released only to employees of the University and its constituent colleges for the purpose of conducting legitimate University business. They may not be shared with individuals and organizations outside the University.
2. Directory information does not include a student’s social security number, race, ethnicity, gender or immigration status.
3. Each college must notify its students about directory information and allow them to request that the college not disclose such information. A student may request that directory information not be released without prior written consent by completing a form to be made available on the college’s web site as well as in the Registrar’s office of each college during regular business hours. Attachment C is a Directory Information Non-Disclosure Form. Students may not block release of their names, identifiers, or email addresses in classes in which the students are enrolled, and may not refuse to display student ID cards or badges.
C. Disclosure of Education Records without Prior Consent. A college may (and sometimes must) disclose personally identifiable information from an education record of a student without prior consent under the following circumstances:
1. Health and Safety Emergencies. The disclosure is to appropriate parties (including the student’s parents) in an emergency if the information is necessary to protect the health or safety of the student or other individuals. This exception applies where a college, taking into account the totality of the circumstances, is able to articulate a significant threat to the health or safety of a student or other individual and discloses information to any person whose knowledge of the information is necessary to protect the health or safety of the student or other individuals. OGC should be consulted, if possible, prior to the release of information under this emergency provision.
2. To School Officials. The disclosure is to a School Official, as defined above, who has a legitimate educational interest in the record. The College must use reasonable methods to ensure that School Officials have access only to those records in which they have legitimate educational interest. A legitimate educational interest includes the need for one college to access student records maintained by another college in 8 connection with the investigation or potential discipline of the student for alleged misconduct.
3. Enrollment or Transfer. The disclosure is to an official or employee of another college or institution of postsecondary education where the student seeks or intends to enroll or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer, provided that the college also gives the student written notice of such disclosure, and upon request, a copy of the record that was disclosed.
4. Designated Governmental Authorities. The disclosure is to authorized representatives of the United States Comptroller General, Secretary of Education, or Attorney General or to State or local educational authorities, in connection with an audit or evaluation of Federal or State supported education programs or for the enforcement of or compliance with Federal legal requirements which relate to those programs.
5. Financial Aid. The disclosure is in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for purposes such as the determination of eligibility, amount or conditions, or enforcement of the terms and conditions of the aid.
6. Court Order or Subpoena. The disclosure is to comply with a judicial order or lawfully issued subpoena. Before complying with an order or subpoena, the college must notify the student so that the student may seek protective action and do so by mail five business days in advance of compliance, unless a shorter period has been authorized by OGC. The notice should be sent to the last known address for the student and may also be sent to the student’s last known email address.
There is an important exception to the requirement that students be notified in advance of compliance with a subpoena, if a subpoena is (a) a Federal grand jury subpoena and the court has ordered that the existence or the contents of the subpoena or the information furnished in response not be disclosed; (b) any other subpoena issued for a law enforcement purpose and the court or other issuing agency has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed; or (c) an ex parte court order obtained by the 2 Providing PII from an education record to a party identified as having provided or created the record is not a “disclosure,” and a student’s consent is not required to do so. This exception covers situations in which a student submits a transcript, letter of recommendation or similar document which the college believes may be fraudulent. FERPA permits the college to show the document to the purported creator to verify authenticity. United States Attorney General or appropriate designee concerning investigations or prosecution of certain federal crimes relating to domestic or international terrorism.
7. Studies Exception. The disclosure is to an organization conducting a study for or on behalf of the college, pursuant to a written agreement, to (a) develop, validate, or administer predictive tests, (b) administer student aid programs, or (c) improve instruction, so long as the study does not permit personal identification of parents and students by those other than representatives of the organization with legitimate educational interests, and so long as the information is destroyed or returned to the educational institution after the study is over.
8. Accrediting Organizations. The disclosure is to accrediting organizations to carry out their accrediting functions.
9. Disciplinary Proceedings arising from alleged crimes of violence or nonforcible sex offenses. The final results of such proceeding may be disclosed only in these circumstances:
a. The disclosure is of the final results of a disciplinary proceeding against a student whom the college has determined violated an institutional rule or policy in connection with alleged acts that would, if proven, also constitute a crime of violence or nonforcible sex offense. Only the disciplined student’s name, the violation committed (including rules violated and essential finding of fact supporting the determination), and the sanction imposed may be disclosed. This applies only if the final results were reached after October 6, 1998. The release may not include the name of any other student, such as a victim or witness, absent that student’s consent.
b. The disclosure is of the final results of a disciplinary proceeding and made to the victim of an alleged perpetrator of a crime of violence or non-forcible sex offense, even if the institution concluded that no violation was committed.
10. To parents or guardians of financially dependent students. The disclosure is to a parent or legal guardian and the student is a dependent of the parent or legal guardian as defined in the Internal Revenue Code Section 152. A copy of the parent's or guardian’s latest tax return may be requested as documentation.
11. Alcohol or substance use by those under 21. The disclosure is to inform a parent or legal guardian of a student under the age of 21 at the time of the disclosure that the student has committed a disciplinary violation with respect to the use or possession of alcohol or a controlled substance. The determination may be made other than through a disciplinary proceeding.
12. Litigation and administrative proceedings. The disclosure is made in litigation brought by the student against CUNY, or litigation by CUNY against the student and the records are relevant to that litigation. Similar disclosures are permissible where the institution must defend itself against a complaint made by the student to a government entity or an accreditation or licensing organization.
13. Registered Sex Offenders. The disclosure concerns sex offenders or other individuals required to register under Section 170101 of the Violent Crime Control and Law Enforcement Act of 1994 (Wetterling Act), 42 U.S.C . 14071, and the information was provided to the college under that statute and applicable federal guidelines.
14. Foreign Students with F or J visas. The Department of Homeland Security Office of Immigration and Customs Enforcement (“ICE”) is entitled to specified PII about foreign students with F or J visas: the student’s name, date and place of birth, country of citizenship, student identification number, physical and mailing addresses, current academic status, date of commencement of studies, degree program and field of study, course titles and grades, grade point average for each term, information about certification for practical training, statement of graduation or termination date and reason, number of credits completed each semester and the student’s I-20 ID. ICE representatives do not need a subpoena to obtain this information and notice to the student is not required. Upon request (which the college may obtain in writing), the school has three work days to respond to any request for information concerning an individual student. If the request concerns a student who is being held in custody, the college must respond orally on the same day. The college is allowed ten work days to respond to information about a class of students.
15. Students in the Foster Care System. The disclosure concerns a student who is in a foster care placement, and the disclosure is to a representative of a child welfare agency legally responsible for the care and protection of the student such as the New York City Administration for Children’s Services.
16. De-identified records and information. The disclosure is of de-identifed records and information and the College has reasonably determined that the student is not personally identifiable, taking into account other reasonably available information.
17. To Military Recruiters (Solomon Amendment). In accordance with federal law, educational institutions are required to disclose student recruitment information to U.S. military recruiters. This information consists of a student’s name, addresses, telephone listings, date and place of birth, level of education, academic major, degrees received and educational institution in which the student was most recently enrolled.
D. Recordkeeping Requirements. The Registrar’s office of each college shall maintain a record of each request for and disclosure of a student education record, other than directory information. For each disclosure, the record must include the parties who have requested and received personally identifiable information from the education records and the basis for obtaining the information, including, in the case of a health or safety emergency, the “articulable and significant threat” to health and safety of a student or other individuals.
E. Redisclosure of PII. A college may disclose PII from the education records of a student only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the student or the college’s authorization. Personally identifiable information which is disclosed to an institution, agency or organization, however, may be used by its officers, employees and agents, but only for the purposes for which the disclosure was made. The party to whom the disclosure is made shall be informed in writing of this requirement.
IV. PROCEDURAL REQUIREMENTS.
A. Annual Notification of Rights.
1. Each college must annually inform its current students of their rights under FERPA. While this notification does not need to be made to students individually, it must be by a means likely to inform students of their rights, such as: in a schedule of classes, student handbook or calendar of school events, or posted at the Registrar’s office at the school. This notice should also be placed on the college’s web site.
2. Attachment A is a model Notification of Student Rights Concerning Education Records and Directory Information, which includes (a) a statement of the procedures for inspection and review and amendment of education records, (b) the procedure for requesting amendment of records, the criteria for determining who is a School Official, and what is a legitimate educational interest, (c) rights of appeal, and (d) directory information and how to request non-disclosure.
B. Appeal Rights.
1. A student may appeal an alleged failure by any college to comply with the 12 requirements of FERPA to the College’s FERPA Appeals Officer, and may appeal the decision of that college officer to the General Counsel within 30 days of the decision of the FERPA Appeals Officer. Attachment E is a form for appeals to OGC. It must be completed in writing and submitted with a copy of the determination of the FERPA Appeals Officer and the reasons why the student disagrees with the determination. If the FERPA Appeals Officer does not issue a decision within 30 days of an appeal or the holding of a hearing thereon, whichever is later, the student may also file with OGC.
2. The General Counsel shall render a decision no later than 30 days after the receipt of the appeal. Decisions of the General Counsel shall be submitted to the Board Committee on Student Affairs and Special Programs for its approval, and the student may submit a response.
3. Students are also entitled to file grievances about violations of FERPA with the Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Ave, SW, Washington, DC 20202-8520. Office of the General Counsel July 2019