Policy 5125

Students

Student Records; Confidentiality

Educational records, defined as records directly related to a student, will be kept for each student and will reflect the physical, emotional, social and academic aspects of a student’s development in the educational process.

The Board of Education recognizes the need to comply with the legal state and federal requirements regarding the confidentiality, access to and amendment of student records.  The procedures for the confidentiality of student records shall be consistent with federal statutes, including the Family Educational Rights and Privacy Act of 1974 (FERPA), as amended, and its implementing and revised regulations and the Connecticut General Statutes.

Safeguards shall be established by the school administration to protect the student and the student’s family from invasion of privacy in the collection, maintenance and dissemination of information, and to provide accessibility to recorded information by those legally entitled thereto. Access to inspect or review a student’s educational record or any part thereof may include the right to receive copies under limited circumstances.

For the purposes of this policy:

“Parent” means a natural parent, an adopted, or a legal guardian or an individual acting as a parent in the absence of a parent or guardian.  If parents are divorced or legally separated the parent granted custody and the parent not granted custody of a minor child both have the right of access to the academic, medical, hospital, or other health records of the child, unless a court order prohibits access.  Whenever a student has attained the age of 18 years or is attending an institution of post secondary education, the permission or consent required of, and the rights accorded to, the parents or guardians of the student shall thereafter only be required of, and accorded to, the student, unless parents of a student eighteen (18) years of age or older who is a dependent as defined in Section 152 of the Internal Revenue Code of 1956.  

A parent who is incarcerated is also entitled to knowledge of and access to all educational, medical or similar records maintained in the cumulative record of any minor student of such incarcerated parent except in situations (1) where such information is considered privileged as defined in C.G.S. 10-154a, (2) such incarcerated parent has been convicted of sexual assault, or aggravated sexual assault, or (3) such incarcerated parent is prohibited pursuant to a court order.

“Student” means an individual who is or has been “in attendance” in person at an educational agency or institution for whom education records are maintained.  It also includes those situations in which students “attend” classes but are not physically present, including attendance by videoconference, satellite, Internet, or other electronic information and telecommunication technologies.

“Eligible Student” is a student or former student who has reached 18 years of age or is attending an institution of post-secondary education or is an emancipated minor.

“Student record” means any item of information directly related to an identifiable student, other than directory information, which is maintained by a school district or required to be maintained by an employee in the performance of his/her duties whether recorded in handwriting, print, 
computer media, video or audio tape, film, microfilm and microfiche. Student records include information relative to an individual student gathered within or without the school system and maintained within the school system, regardless of the physical form in which it is maintained. 

Any information maintained for the purpose of review by a second party is considered a student record.  Records that pertain to an individual’s previous attendance as a student are “education records” under FERPA regardless of when they were created or received within the school system. Student records shall not include informal notes related to a student compiled by a school officer or employee which remain in the sole possession of the maker and are not accessible or revealed to any other person except a substitute for the maker of the record.

Employment records used only in relation to a student’s employment by the district are not considered student records. In addition student records do not include alumni records that contain information about the student after the student is no longer in attendance, records maintained by a law enforcement unit of an educational agency or institution that were created by that unit for the purpose of law enforcement or records of an eligible student that are maintained by a physician, psychologist, professional or paraprofessional made in connection with the treatment of the student and disclosed only to individuals providing such treatment. 

“Law Enforcement Unit” means an individual office, department, division, or other component of an education agency or institution that is officially authorized or designated by that agency or institution to (1) enforce laws or refer matters of law enforcement to appropriate authorities, or (2) maintain the physical security and safety of the agency or institution.

“Substitute” means a person who performs the duties of the individual who made the notes on a temporary basis, and does not refer to a person who permanently succeeds the maker of the notes in his or her position.

“School Official” means a person employed by the District as an administrator, supervisor, instructor, or support staff member, including health or medical staff and law enforcement unit personnel, a person serving on the Board of Education, a person or company with whom the district has contracted to perform a special task (such as an attorney, auditor, medical consultant, or therapist), or a parent or student serving on an official committee such as a disciplinary or grievance committee, or assisting another school official in performing his/her tasks.

“Authorized Representative” means any entity or individual designated by a state or local educational authority or an agency headed by an official listed in §99.31(a)(3) to conduct with respect to Federal or State-supported education programs, any audit or evaluation, or any compliance  or enforcement activity in connection with Federal legal requirements that relate to these programs.

“Education Program” means any program that is principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education and adult education, and any program that is administered by an educational agency or institution.

“Early Childhood Education Program” means a Head Start program, a state licensed or regulated child care program, or a program that serves children from birth through age six that addresses the children’s cognitive, social, emotional and physical development and is a (i) state prekindergarten program; (ii) a program authorized under the Individuals with Disabilities Education Act; or (iii) is a program operated by a local educational agency.

“Personally Identifiable Information” includes, but is not limited to, the student’s name, the name of the student’s parent or other family members; the address of the student or his/her family; a personal identifier, such as the student’s social security number, student number or biometric record (a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual, including fingerprints, retina and iris patterns, voice prints, DNA sequence, facial characteristics and handwriting); a list of personal characteristics or indirect identifiers, such as the student’s date of birth, and mother’s maiden name; or other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

“Legitimate Educational Interest” means the need for a school official to review an education record in order to fulfill his or her professional responsibilities.

“Directory Information” means information contained in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. Directory information includes, but is not limited to, one or more of the following items: parent’s name and/or e-mail address, student’s name, address, telephone number, date of birth, major field(s) of study, participation in officially recognized activities and sports, photographic, computer and/or video images, grade levels, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous public or private school attended by the student.

A student’s social security number or student ID number is prohibited from designation as directory information.  However, student ID numbers and other electronic personal identifiers used to access or communicate in electronic systems may be disclosed only if the identifier is not used by itself to authenticate identity and cannot be used to gain access to education records.

A student’s ID number or other unique personal identifier that is displayed on a student ID badge is considered directory information, but only if the identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a PIN, password, or other factor known or possessed only by the authorized user.

The Superintendent shall be responsible for ensuring that all requirements under federal and state statutes shall be carried out by the district. He/She will develop procedures (administrative regulations) providing for the following:

1.    Annually informing parents of their rights.

2.    Permitting parents to inspect and review educational records, including, at least, a statement of the procedure to be followed by a parent or eligible student who requests to inspect and review the educational records, with an understanding that the procedure may not deny access to educational records; a description of the circumstances in which the district feels it has a legitimate cause to deny a request for a copy of such records; a schedule of fees for copies; and a listing of the types and locations of education records maintained by the school and the titles and addresses of school officials responsible for those records.

3.    Not disclosing personally identifiable information from a student’s education records without the prior written consent of the student’s parent, except as otherwise permitted by administrative regulations; including at least a statement of whether the school will disclose personally identifiable information from the records to other school officials within the school who have been determined by the school to have legitimate educational interests, and, if so, a specification of the criteria for determining which parties are “school officials” and what the school considers to be a “legitimate educational interest”; and a specification of the personally identifiable information to be designated as directory information.

4.    Appointing an individual to be responsible for the care and upkeep of all education records.

5.    Maintaining the record of disclosures of personally identifiable information from a student's education records and permitting a parent to inspect that record.

6.    Providing a parent/guardian with an opportunity to seek the correction of the student’s education records through a request to amend the records.  If the District decides that an amendment of the records as requested is not warranted, to inform the parent/guardian or eligible student and advise him/her of the right to a hearing and permitting the parent/guardian or an eligible student to place a statement in the education records of the student.

7.    Guaranteeing access to student records to authorized persons within five days following the date of request.

8.    Assuring security of student records (e.g. achievement, attendance, immunization, HIV, transgender).
 
9.    Enumerating and describing the student records maintained by the school system.

10.    Annually informing parents under what conditions that their prior consent is not required to disclose information.

11.    Ensuring the orderly retention and disposition, per applicable state statutes, of the district‘s student records.

12.    Notifying parents of secondary school students that it is required to release the student’s name, address and telephone listing to military recruiters and institutions of higher learning upon request.  Parents or eligible students may request that the District not release this information, and the District will comply with the request.

13.    Notifying parents annually of the District’s policy on the collection or use of personal information collected from students for the purpose of marketing or selling that information or otherwise providing that information to others for that purpose, including arrangements to protect student privacy that are provided by the agency in the event of such collection, disclosure or use.

Legal Reference:    Connecticut General Statutes
Policy adopted: November 1, 2016                
Policy revised:     January 2, 2018                   
NEWTOWN PUBLIC SCHOOLS, Newtown, Connecticut

Regulation 5125(a)
Students

Student Records; Confidentiality

Definitions

As used in this regulation:

1.    “Student” means an individual who is or has been “in attendance” in person at an educational agency or institution for whom education records are maintained.  It also includes those situations in which students “attend” classes but are not physically present, including attendance by videoconference, satellite, Internet, or other electronic information and telecommunication technologies.

2.    “Student Record” means any item of information directly related to an identifiable student, other than directory information, which is maintained by the school district or required to be maintained by an employee in the performance of his/her duties whether recorded by handwriting, print, computer media, video or audio tape, film, microfilm and microfiche. Student records include information relative to an individual student gathered within or without the school system and maintained within the school district, regardless of the physical form in which it is maintained.  Any information which is maintained for the purpose of review by a second party is considered a student record.

“Student Record” shall not include informal notes related to a student compiled by a school officer or employee which remain in the sole possession of the maker and are not accessible or revealed to any other person except a substitute for the maker of the record.  Employment records used only in relation to a student’s employment by the district are not considered student records. In addition student records do not include alumni records that contain information about the student after the student is no longer in attendance, records maintained by a law enforcement unit of an educational agency or institution that were created by that unit for the purpose of law enforcement or records of an eligible student that are maintained by a physician, psychologist, professional or paraprofessional made in connection with the treatment of the student and disclosed only to individuals providing such treatment.

3.    “Substitute” means a person who performs the duties of the individual who made the notes on a temporary basis, and does not refer to a person who permanently succeeds the maker of notes in his or her position.  

4.    “Directory Information” means information contained in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. Directory information includes, but is not limited to, one or more of the following items:
 
5.    “Parent” means a natural parent, an adopted parent, or legal guardian or an individual acting as a parent in the absence of a parent or guardian. If parents are divorced or legally separated, both the parent granted custody and the parent not granted custody have the legal right of access to the academic, medical, hospital or other health records of the child, unless a court order prohibits access.

Whenever a student has attained eighteen (18) years or is attending an institution of post secondary education, the permission or consent required of, and the rights accorded to, the parents or guardian of the student shall thereafter only be required of, and accorded to, the student, unless parents of a student eighteen (18) years of age or older who is a dependent as defined in Section 152 of the Internal Revenue Code of 1956.

A parent who is incarcerated is also entitled to knowledge of and access to all educational, medical or similar records maintained in the cumulative record of any minor student of such incarcerated parent except in situations (1) where such information is considered privileged as defined in C.G.S. 10-154a, (2) such incarcerated parent has been convicted of sexual assault, or aggravated sexual assault, or (3) such incarcerated parent is prohibited pursuant to a court order.

6.    “School Official” means a person employed by the district as an administrator, supervisor, instructor or support staff member, including health or medical staff and law enforcement unit personnel, a person serving on the Board of Education, a person or company with whom the district has contracted to perform a special task (such as an attorney, auditor, medical consultant, or therapist), or a parent or student serving on an official committee such as a disciplinary or grievance committee, or assisting another school official in performing his/her tasks.

7.    “Disclosure” means to permit access to or the release, transfer, or other communication of personally identifiable information contained in education records, to any party, by any means including oral, written, or electronic means.  It is also permitted to return an educational record to the provider or creator of the record, including the return of a questionable document to the purported sender for verification of information in the document.

8.    “Personally Identifiable Information” includes but is not limited to the student’s name, the name of the student's parent or other family member, the address of the student or student’s family, a personal identifier such as the student’s Social Security Number or student number, or “biometric records” (a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual, including fingerprints, retina and iris patterns, voice prints, DNA sequence, facial characteristics and handwriting), a list of personal characteristics or indirect identifiers, such as the student’s date and place of birth and mother’s maiden name, or other information that would allow a reasonable person in the school or community who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

9.    “Access” means a personal inspection and review of a record or an accurate copy of a record, an oral description or communication of a record or an accurate copy of a record and a request to release a copy of any record.

10.    “Eligible Student” means a student or former student who has reached eighteen years (18) of age or who is attending an institution of post-secondary education or is an emancipated minor.

11.    “Law Enforcement Unit” means an individual office, department, division, or other component of an education agency or institution that is officially authorized or designated by that agency or institution to (1) enforce laws or refer matters of law enforcement to appropriate authorities, or (2) maintain the physical security and safety of the agency or institution.

12.    “Legitimate Education Interest” means the need for a school official to review an educational record in order to fulfill his/her professional responsibilities.

13.    “Signed and Dated Waiver Consent” means signed and dated written consent to disclose personally identifiable student information from a student’s records must specify the records to be disclosed, the purpose of disclosure and the party to whom such records should be provided.  Consent may include a record and signature in electronic form provided that the consent identifies and authenticates a particular person as the source of consent.

14.    “Authorized Representative” means any entity or individual designated by a state or local educational authority or an agency headed by an official listed in 34 C.F.R.§99.31(a)(3) to conduct with respect to Federal or State-supported education programs, any audit or evaluation, or any compliance or enforcement activity in connection with Federal legal requirements that relate to these programs.

15.    “Education Program” means any program that is principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education and adult education, and any program that is administered by an educational agency or institution.

16.    “Early Childhood Education Program” means a Head Start program, a state licensed or regulated child care program, or a program that serves children from birth through age six that addresses the children’s cognitive, social, emotional and physical development and is a (i) state prekindergarten program; (ii) a program authorized under the Individuals with Disabilities Education Act; or (iii) is a program operated by a local educational agency.

Types of Records 

The school district shall maintain only the following three categories of records:

1.    “Mandatory Permanent Student Records” are those records which are maintained in perpetuity (at least 50 years) and which schools have been directed to compile by statute, regulation, or authorized administrative directive.  Such records shall include the following:
 
2.    “Mandatory Interim Student Records” are those records which the schools are directed to compile and maintain for stipulated periods of time and are then destroyed as per statute, regulations (6 years following the student’s graduation, or the graduation of the class to which he/she belonged, after appropriate notification to parents and/or eligible students via media and an opportunity provided to copy said records), or authorized administrative directive. Such records include the following:     Note:    Disciplinary records of suspension and expulsion are subject to being expunged according to state and federal statutes.

3.    “Permitted Records” are those records having clear importance only to the current educational process of the student.  Such records may be destroyed after 6 years following the student’s graduation, or the graduation of the class to which he/she belonged, after appropriate notification to parents and/or eligible students via media and an opportunity provided to copy said records.  Such records may include the following: Maintenance and Security of Student Records

1.    Custodian of Records

    A.    The Director of Pupil Personnel is hereby designated as custodian of student records. The address of the custodian is: 
        The Director of Pupil Personnel, Newtown Public Schools, 3 Primrose Street, Newtown, CT 06470
 
    B.    In each school, the principal, or a certified employee designated by the principal, is responsible for implementation of Board of Education policies and administrative regulations relating to student records maintained in that school.

    C.    With respect to confidential HIV-related information, if the principal is a recipient of an HIV-related disclosure, the Principal shall be the guardian of records. If not, whoever was the recipient of the HIV-related disclosure shall be the guardian of the record.

    D.    With respect to child abuse and neglect investigation material, the Superintendent of Schools or designee shall be guardian.

2.    Files

    A.    A record for each individual student shall be maintained in a central file at the school attended by the student, or when records are maintained in different locations, a notation shall be placed in the central file indicating where such records may be found.

    B.    Student records shall be stored in locked containers (files) or rooms.

    C.    Records containing information to child abuse/neglect referrals or reports; or containing confidential HIV-related information should be kept separate from the student’s cumulative folder, in confidential files.

    D.    If the Administration changes the name and/or gender in a transgender or gender non-conforming student’s education record, all education records containing the student’s birth name and gender shall be maintained, if so required under federal and/or state law and regulations, separately from other education records and in a strictly confidential location and manner.

3.    Information

    A.    All anecdotal information and assessment reports maintained as student records must be dated and signed by the individual who originated the record. Each school principal shall keep on file a record of enrollment and scholarship for each student currently enrolled in that school.

Access to Student Records

1.    School Officials

    A.    School officials, as defined, have access to students’ educational records without consent, if the official has been determined to have a legitimate educational interest in the records. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his/her professional responsibility.

    B.    Contractors, consultants, volunteers, and other parties to whom a school has out sourced services or functions are considered “school officials” who may have access to student records, without parental consent, if the following conditions are met:
 
C.    The district or school may not disclose education records to an outside service provider unless it has specified in its annual FERPA notification to parents/students that it uses contractors, consultants, volunteers, as “school officials” to provide certain institutional services and functions.

D.    In controlling access to education records by school officials and outside service providers, schools must:
 
2.    Parents

A.    Parents of currently enrolled or former students shall have an absolute right during regular business hours to access to any and all student records related to their children which are maintained by the district.  Neither the student record, nor any part thereof, shall be withheld or edited.  If the student records contain information on more than one student, the parent may inspect and review or be informed of only the specific information which pertains to that student.

B.    A parent or guardian’s request for access to student records shall be made in writing to the custodian of student records.  Access shall be granted no later than forty-five (45) days following the date of the request.
  C.    A requesting parent shall be notified of the location of all student records, if not centrally located.

D.    A school professional shall be present at all such inspections and reviews and shall respond to reasonable requests for explanations and interpretations of the records.

E.    When a parent’s dominant language is not English, the district shall make an effort to
 
3.    Parental Consent  4.    Without Parental Consent

    A.    No person or agent shall be permitted access to student records without written parental consent or under judicial order, except that access to those particular records relevant to the legitimate educational interests of the requester shall be permitted to the following:
 

Note: Section 504 and Title II of the ADFA generally prohibits post-secondary institutions from making pre-admission inquiries about an applicant’s disability status. However, after admission, such institutions may request such information concerning a current student.

B.    Information from student records may be released to the following: Such disclosure is subject to the following FERPA requirements:
The school must have a written agreement with the receiving organization that:

• Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed.
• Requires the organization to use the information from education records only to meet the purpose or purposes of the study stated in the agreement.
• Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate interests.
• Requires the organization to destroy or return all personally identifiable information when no longer needed for purposes of the study.
• Specifies the time period in which the information must be returned or destroyed.

Note:    Whenever possible, Newtown Public Schools will either release de-identified information or remove students’ names and Social Security Numbers to reduce the risk of unauthorized disclosure of personally identifiable information.

    (5)    Officials and employees of private schools or school districts where the student is enrolled or intends to enroll subject to the rights of parents by law.
    (6)    An agency caseworker or other representative of a State or local child welfare agency, or tribal organization who has the right to access a student’s case plan, as defined and determined by the State or tribal organization, when such agency or organization is legally responsible for the care and protection of the student, provided that the education records, or the personally identifiable information contained in such records will not be disclosed by such agency or organization, except to an individual or entity engaged in addressing the education needs of the students and authorized by such agency or organization to receive such disclosure.
 
5.    Court Order

A.    Information concerning a student shall be furnished in compliance with a court order.
B.    The service of a subpoena upon a district employee or official solely for the purpose of causing the employee to produce a school record pertaining to any student may be complied with by such employee, in lieu of personal appearance as witness in the proceeding, by submitting to the court, or other agency issuing the subpoena, at the time and place required by the subpoena, a copy of such record, accompanied by an affidavit certifying that such copy is a true copy of the original record on file in the school or school office. The copy of the record shall be in the form of a photograph, microfilm, micro card, or miniature photograph or other photographic copy or reproduction or an enlargement thereof.

Nothing in this regulation shall preclude the district from providing in its discretion statistical data from which no student may be identified to any public agency or entity or private nonprofit college, university, or educational research and development organization when such actions would be in the best educational interests of students.

If it is determined, per the federal regulations, that a third party improperly redisclosed personally identifiable information from education records in violation of Section 99.33(a), of FERPA Regulations, the district may not allow that third party access to personally identifiable information from education records for at least five years.

6.    Disclosure to Parents of “Eligible Students” and Rights of Students

A.    Rights of parents under FERPA transfer to students once the student has reached 18 years of age or is attending a post secondary institution and thereby becomes an “eligible student.”

B.    Disclosure to parents without student consent after FERPA rights have transferred to students is permitted under the following circumstances:
  7.    Disclosure of Information in Health and Safety Emergencies (Also see section above)

A.    The district may include in the education records of a student appropriate information concerning disciplinary action taken against the student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community.
B.    Such appropriate information concerning disciplinary action may be disclosed to teachers and school officials in the district who have been determined to have legitimate educational interests in the behavior of the student.  This must be strictly construed.
C.    Such appropriate information, concerning disciplinary action, may be disclosed to teachers and school officials in other schools who have been determined to have legitimate educational interests in the behavior of the student.
D.    In making a determination, the district or school must take into account the totality of the circumstances pertaining to a threat to the safety or health of the student or other individuals.  If a school determines that there is an articulable and significant threat to the safety or health of a student or other individuals, it may disclose information from education records to appropriate parties whose knowledge of the information is necessary to protect the health and safety of the student or other individuals.
E.    The district or school is required to record the articulable and significant threat that formed the basis for the disclosure and the parties to whom the information was disclosed.  “Appropriate parties” include the parents of an eligible student.
F.    Pursuant to C.G.S. 19a-581 through 19a-585, confidential information concerning HIV status may not be released to anyone EXCEPT a health care provider with a written release from the parents.

8.    Redisclosure of Educational Records

The school district may disclose personally identifiable from an education record only on the condition that the party to whom the information is disclosed will not subsequently redisclose the information to any other party without the proper consent of the parent or eligible student, and that such party may only use the information for the purposes for which disclosure was made.

Notwithstanding the provision stated, the school district may disclose personally identifiable information from an education record with the understanding that the information may be redisclosed by the recipient of the information under the following conditions:

A.    Federal and State officials that receive education records for audits, evaluation, and compliance and enforcement purposes may redisclose such records under the same conditions that apply to other recipients of education records.

B.    A state educational agency that received records for audit, evaluation or compliance or enforcement purposes may redisclose records for other qualifying purposes, such as:
 
9.    Criteria

A.    “School officials and employees” as used in this regulation means district employees and elected district officers, and other parties as defined in this regulation.

B.    The following criteria shall be used in determining whether a “school official or employee” has a “legitimate educational interest”.
 
C.    The district and/or school shall use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom they disclose education records.  The district and its schools may use PINS, passwords, personal security questions, “smart cards” and tokens, biometric indicators, or other factors known or possessed only by the user, as appropriate. Identification means determining who is the intended or authorized recipient of the information.  Authentication means ensuring that the recipient is who he/she claims to be.

Challenging Contents of Records

1.    Following an inspection and review of a student’s records the parent or guardian of the student or former student may challenge the content of any student record.

    A.    The parent or eligible student may file a written request with the Superintendent of Schools to correct or remove any information recorded in the written records concerning the parent’s child which the parent alleges to be:
 
(3)    A conclusion or inference outside of the observer’s area of competence.

(4)    Not based on the personal observation of a named person with the time and place of the observation noted.
 
2.    Hearing Panel
 
3.    Whenever there is included in any student record information concerning any disciplinary action taken by school system personnel in connection with the student, the student’s parent or guardian may include in such student’s record a written statement or response concerning the disciplinary action.

Directory Information
1.    The following student information is declared to be directory information in accordance with Policy 3520.12:     Note:    FERPA regulations prohibits the use of a Social Security Number (SSN) as an identification element when disclosing or confirming directory information unless the student has provided written consent for the disclosure.

2.    Directory information may be released to the following: 3.    Subject to the provisions of C.G.S. 1 19(b11), high schools shall provide the same directory information and on campus recruiting opportunities to military recruiters as are offered to nonmilitary recruiters or commercial concerns. (cf. 5145.14 On Campus Recruitment).

4.    No information may be released to a private profit making entity other than employers, prospective employers and representatives of the news media.

5.    The names and addresses of students enrolled in grade 12 or who have terminated enrollment prior to graduation may be provided, in accordance with the terms of the law, to a private school or college cooperating under state law.

6.    The custodian of records will normally limit or deny the release of specific categories of directory information unless he determines that such release is required by law or is in the best interests of students.

7.    Notice shall be given annually of the categories of information which the school district plans to release and of the recipients.
 
8.    Disclosure of directory information on former students is permitted without providing notice or additional opt-out opportunities.  A former student’s opt-out provided while he/she was a student in the district must continue to be honored unless specifically rescinded by the former student.

9.    Opt-out from directory information does not prevent a school from identifying a student by name or from disclosing an electronic identifier or instructional e-mail address in the classroom.  A student does not have the right to remain anonymous in class and an opt-out may not be used to impede routine classroom communications and interactions, whether the class is held in a specified physical location or online through electronic communications.

Access Log

1.    A log or record shall be maintained for each student's record. The record log shall contain:
 
2.    Such listing need not include the following:
      
3.    The log or record shall be open to inspection only by a parent or guardian and the custodian of student records, or the custodian’s designee, and to other school officials with legitimate interests in the records, and to the Comptroller General of the United States, the Secretary of the Office of Education, an administrative head of an education agency as defined in 20 U.S.C. 1232g., and state educational authorities as a means of auditing the school system’s operations.

4.    If the district makes a release of education records without consent in a health and safety emergency, the district must record:
 
Fee for Reproducing Records
        
1.    A fee based upon the actual cost of reproduction, handling and postage (if any) shall be charged for furnishing copies of any student record. Such charge will not exceed 50¢ per page.

2.    Parents of students eligible to receive special education and related services (or the eligible student) have the right to receive one free copy of their child’s education records. The request for the free copy must be in writing and the Board will comply with the written request within ten (10) school days of the request. Notwithstanding the fact that a test instrument or portion of a test instrument may meet the criteria of an “education record” under the Family Educational Rights and Privacy Act, 20 USC 1232g, any test instrument or portion of a test instrument for which the test manufacturer asserts a proprietary or copyright interest in the instrument shall not be copied. The parent or eligible student retains the right to review and inspect such information, and the board of education shall respond to reasonable requests from the parent or eligible student for explanations and interpretations of the student’s education record, which may include reviewing copyrighted testing instruments.

3.    The custodian of student records annually shall recommend a fee schedule for approval by the Board of Education.

4.    No fee shall Transfer of Student Records

1.    Whenever a student transfers to another Connecticut public school district or to a charter school, the following student records shall be forwarded upon written notification of the student’s enrollment from the other district:
 
2.    The student’s records shall be transferred to the new school district or charter school no later than 10 days after receipt of such notification.

3.    Whenever a student transfers to a school district in another state or to a private school, the district shall transfer the student’s Mandatory Permanent Student Record upon receipt of a written request.

4.    Upon notification by the Department of Children and Families of a decision to change the school placement for a student attending district schools who is place in out-of-home care by DCF pursuant to an order of temporary custody or an order of commitment, in accordance with section 46b-129 of the Connecticut General Statutes, the Board shall transmit to the receiving school, not later than one (1) business day after receipt of such notification from DCF, all essential education records for the student, including, but not limited to, the student’s individualized education program (“IEP”) and behavioral intervention plan, if any, and all documents necessary for the receiving school to determine appropriate class placement and to provide educational services.

5.    Permitted student records may be forwarded.

6.    Student records shall not be withheld from the requesting district because of any charges or fees owed by the student or the student’s parents or guardian.

7.    All student records shall be updated prior to transfer.

8.    Parent Notification
 
Expungement of Records Pertaining to Suspension and/or Expulsion

1.    Suspension

Notice of the suspension shall be recorded in the student’s cumulative educational record. Such notice shall be expunged from the cumulative educational record if the student graduates from high school. In cases where the student’s period of suspension is shortened or waived as permitted by Statute, the administration may choose to expunge the suspension notice from the cumulative record at the time the student completes the administration-specified program and meets any other conditions required by the administration. 

If the student has not previously been suspended or expelled, and the administration chooses to expunge the suspension notice from the student’s cumulative recorded prior to graduation, the administration may refer to the existence of the expunged disciplinary notice, notwithstanding the fact that such notice may have been expunged from the student’s cumulative file, for the limited purpose of determining whether any subsequent suspensions or expulsions by the student would constitute the student’s first such offense. 

2.     Notice of Student Expulsion on Cumulative Record 

Notice of expulsion and the conduct for which the student was expelled shall be included on the student’s cumulative educational record. Such notice, except for notice of an expulsion based upon possession of a firearm or deadly weapon, shall be expunged from the cumulative educational record by the Board if the student graduates from high school. 

In cases where the student’s period of expulsion is shortened or waived as permitted by Statute, the Board may choose to expunge the expulsion notice from the cumulative record at the time the student completes the Board-specified program and meets any other conditions required by the Board. 

If the student has not previously been suspended or expelled, and the administration chooses to expunge the expulsion notice from the student’s cumulative record prior to graduation, the administration may refer to the existence of the expunged notice, notwithstanding the fact that such notice may have been expunged from the student’s cumulative file, for the limited purpose of determining whether any subsequent suspension or expulsion by the student would constitute the student’s first such offense. 

Retention and Destruction of Student Records

1.    No additions, except routine updating, shall be made to a student’s record after high school graduation or permanent departure without the parent’s or guardian’s prior consent for those students who have not reached the age of eighteen years.  Adult students may give consent for themselves.

2.    The guide to disposal of municipal records in Connecticut is found in Connecticut General Statutes Section 7 109. For disposal of education records, see Schedule V of “Records Retention Schedules 1982” (Revised 1983) published by the Public Records Administration, Connecticut State Library, Hartford, Connecticut.

3.    The method of destruction shall assure that records are not available to possible public inspection during the destruction process.

Subpoenaed Records

If the school is served with a subpoena issued by competent authority directing the production of school or student records in connection with any court proceeding, the school upon which such subpoena is served may deliver such record, or at its option a copy thereof, to the clerk of such court.  Such clerk shall give a receipt for the same and shall be responsible for the safekeeping of such records, not permitting the removal of such records from the premises of the court.  The clerk shall notify the school to call for the subpoenaed record when it is no longer needed for use in court.  Any such record so delivered to the clerk of the court shall be sealed in an envelope which shall indicate the name of the school or student, the name of the attorney subpoenaing the same and the title of the case referred to in the subpoena.

No such record or copy shall be open to inspection by any person except upon the order of a judge of the court concerned, and any such record or copy shall at all times be subject to the order of such judge.

Any and all parts of any such record or copy, if not otherwise inadmissible, shall be admitted in evidence without any preliminary testimony, if there is attached thereto the certification in affidavit form of the person in charge of such record indicating that such record or copy is the original record or copy thereof, made in the regular course of such business to make such record and that it was the regular course of such business to make such record at the time of the transactions, occurrences or events recorded therein or within a reasonable time thereafter.

A subpoena directing production of such school or student records shall be served not less than eighteen (18) hours before the time for production, provided such subpoena shall be valid if served less than eighteen (18) hours before the time of production if written notice of intent to serve such subpoena has been delivered to the person in charge of such records not less than eighteen hours (18) nor more than two weeks before such time for production.

Notification of Parents

1.    Parents shall be notified in writing of their rights under this regulation upon the date of the student's initial enrollment, and annually thereafter of students current attendance at the same time as notice is issued.  The notice shall be in a form which reasonably notifies parents of the availability of the following specific information:
Issue/Practice of Peer Grading

The definition of “education records” excludes grades on peer-graded papers before they are collected and recorded by a teacher.  Peer-grading does not violate FERPA.

Legal Reference:    Connecticut General Statutes
Student Records; Confidentiality

Legal Reference:    Connecticut General Statutes (continued)
Regulation Adopted:    November 1, 2016            
Regulation Revised:    January 2, 2018, February 28, 2018        
NEWTOWN PUBLIC SCHOOLS,  Newtown, Connecticut

5125
Appendix

The Family Educational Rights and Privacy Act (FERPA)
Guidance for Reasonable Methods and Written Agreements

What is the Family Educational Rights and Privacy Act? 

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. §1232g, is a Federal privacy law administered by the Office of the Chief Privacy Officer (OCPO) in the U.S. Department of Education. FERPA and its implementing regulations in 34 CFR part 99 protect the privacy of students’ education records and afford parents and eligible students (i.e., students who are 18 years of age or older or attend an institution of postsecondary education) certain rights to inspect and review education records, to seek to amend these records, and to consent to the disclosure of Personally Identifiable Information from education records (PII from education records).

The general rule under FERPA is that PII from education records cannot be disclosed without written consent. However, FERPA includes several exceptions that permit the disclosure of PII from education records without consent. Two of these exceptions are discussed in this document ? the studies exception and the audit or evaluation exception. The two exceptions contain specific, and slightly different, requirements, described more fully in the implementing regulations (34 CFR Part 99).

What is the purpose of this document? 

The audience for this document includes schools, school districts (also referred to as local educational agencies (LEAs)), postsecondary institutions, and State educational authorities (such as State educational agencies (SEAs)) that may disclose PII from education records. Our intent is to provide these entities with information about requirements and best practices for data disclosures under the studies exception and the audit or evaluation exception. 

What is the Studies Exception? (see 20 U.S.C. §1232g(b)(1)(F) and §99.31(a)(6))
 
The studies exception allows for the disclosure of PII from education records without consent to organizations conducting studies for, or on behalf of, schools, school districts, or postsecondary institutions. Studies can be for the purpose of developing, validating, or administering predictive tests; administering student aid programs; or improving instruction. 
 
What is the Audit or Evaluation Exception? (see 20 U.S.C. 1232g(b)(1)(C), (b)(3), and (b)(5) and §§99.31(a)(3) and 99.35)

The audit or evaluation exception allows for the disclosure of PII from education records without consent to authorized representatives of the Comptroller General of the U.S., the Attorney General, the Secretary of Education, and State or local educational authorities (FERPA-permitted entities). Under this exception, PII from education records must be used to audit or evaluate a Federal- or State-supported education program, or to enforce or comply with Federal legal requirements that relate to those education programs (audit, evaluation, or enforcement or compliance activity). The entity disclosing the PII from education records is specifically required to use reasonable methods to ensure to the greatest extent practicable that its designated authorized representative complies with FERPA and its regulations.
 
How do you define education program?

“Education program” is an important term under the audit or evaluation exception because PII from education records can only be disclosed to audit or evaluate a Federal- or State-supported “education program,” or to enforce or to comply with Federal legal requirements related to an education program. As specified in the FERPA regulations, §99.3, an education program must be principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution. For a definition of “early childhood program” please refer to §99.3 of the FERPA regulations.

Do we need to have a written agreement to disclose PII from education records without consent?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent. The mandatory elements of that agreement vary slightly between the two exceptions. 

Are there mandatory provisions for written agreements under the studies exception?

Yes. Written agreements under the studies exception must in accordance with the requirements in §99.31(a)(6)(iii)(C):

1.    Specify the purpose, scope, and duration of the study and the information to be disclosed. Your agreement must specify the purpose of the study, describe its scope and its duration, and identify the information being disclosed. 

2.    Require the organization to use PII from education records only to meet the purpose or purposes of the study as stated in the written agreement. Your agreement must specify that the PII from education records must only be used for the study identified in the agreement.

3.    Require the organization to conduct the study in a manner that does not permit the personal identification of parents and students by anyone other than representatives of the organization with legitimate interests. Your agreement must require the organization to conduct the study so as not to identify students or their parents. This typically means that the organization should allow internal access to PII from education records only to individuals with a need to know, and that the organization should take steps to maintain the confidentiality of the PII from education records at all stages of the study, including within the final report, by using appropriate disclosure avoidance techniques.

4.    Require the organization to destroy all PII from education records when the information is no longer needed for the purposes for which the study was conducted, and specify the time period in which the information must be destroyed. Your agreement must require the organization to destroy the PII from education records when it is no longer needed for the identified study. You should determine the specific time period for destruction based on the facts and circumstances surrounding the disclosure and study. The parties to the written agreement may agree to amend the agreement to extend the time period if needed, but the agreement must include a time limit.

Are there mandatory provisions for written agreements under the audit or evaluation exception?

Yes. The mandatory provisions for written agreements under the audit or evaluation exception are similar to, but slightly different from, the provisions required for written agreements under the studies exception. Section 99.35(a)(3) specifically requires that the following provisions be included in written agreements under the audit or evaluation exception:

1.    Designate the individual or entity as an authorized representative. Your agreement must formally designate the individual or entity as an authorized representative. 

2.    Specify the PII from education records to be disclosed. Your agreement must identify the information being disclosed. 

3.    Specify that the purpose for which the PII from education records is being disclosed to the authorized representative is to carry out an audit or evaluation of Federal- or State-supported education programs, or to enforce or to comply with Federal legal requirements that relate to those programs. Your agreement must state specifically that the disclosure of the PII from education records is in furtherance of an audit, evaluation, or enforcement or compliance activity.

4.    Describe the activity with sufficient specificity to make clear that it falls within the audit or evaluation exception. This must include a description of how the PII from education records will be used. Don’t be vague – the agreement must describe the methodology and why disclosure of PII from education records is necessary to accomplish the audit, evaluation, or enforcement or compliance activity.

5.    Require the authorized representative to destroy the PII from education records when the information is no longer needed for the purpose specified. Your agreement should be clear about how the PII from education records will be destroyed.

6.    Specify the time period in which the PII must be destroyed. Your agreement must provide a time period for destruction. You should determine the specific time period for destruction based on the facts and circumstances surrounding the disclosure and activity. The parties to the written agreement may agree to amend the agreement to extend the time period if needed, but the agreement must include a time limit.

7.    Establish policies and procedures, consistent with FERPA and other Federal and State confidentiality and privacy provisions, to protect PII from education records from further disclosure (except back to the disclosing entity) and unauthorized use, including limiting use of PII from education records to only authorized representatives with legitimate interests in an audit, evaluation, or enforcement or compliance activity. The agreement must establish the policies and procedures, consistent with FERPA and other Federal and State laws, to protect PII from education records from further disclosure or unauthorized use.

Can an entity receiving PII from education records disclose it in a way that allows individual students to be identified?

No. Absent consent from the parent or eligible student, FERPA provides that the PII from education records cannot be published in a way that would allow individual students and their parents to be identified. The organization conducting the study, audit, or evaluation can use PII from education records to conduct the study, audit, or evaluation, but results must be published in a way that protects the privacy and confidentiality of the individuals involved. For example, when publishing tables, cell suppression and other methods of disclosure avoidance can be used so that students cannot be identified through small numbers displayed in table cells.

Under the audit or evaluation exception, what is your responsibility to use “reasonable methods” to ensure that your authorized representative is FERPA-compliant to the greatest extent practicable? (§99.35(a)(2))

When you disclose PII from education records under the audit or evaluation exception, you are required to use “reasonable methods” to ensure to the greatest extent practicable that your authorized representative is FERPA-compliant. This specifically means ensuring that your authorized representative does the following:

1.    Uses PII from education records only to carry out an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with, Federal legal requirements related to these programs. You should make sure that the proposed audit or evaluation is legitimate, and require in your written agreement that your authorized representative use the PII from education records only for that audit, evaluation, or enforcement or compliance activity. You should not disclose all of your PII from education records; rather, you should determine which specific elements your authorized representative needs and disclose only those.

2.    Protects the PII from education records from further disclosures or other uses, except as authorized by you in accordance with FERPA. Your agreement must specify that your authorized representative may not further disclose the PII from education records, unless authorized. Approval to use the PII from education records for one audit or evaluation does not confer approval to use it for another.

3.    Destroys the PII from education records when no longer needed for the audit, evaluation, or enforcement or compliance activity. Your agreement must specify that your authorized representative is required to destroy the PII from education records when it is no longer needed and specify the time period in which the PII must be destroyed.

Are there best practices that support reasonable methods? 

Yes. While it is vital for organizations to comply with FERPA and its regulations, FERPA represents the floor for protecting privacy, not the ceiling. Accordingly, the Department is also specifying best practices, in which we describe actions we recommend you take to ensure that your authorized representative is protecting privacy to the greatest extent possible. Best practices are broader than FERPA compliance and describe recommended actions you should take to ensure that your authorized representative is FERPA-compliant to the greatest extent practicable.

These best practices may apply to data sharing under both the audit and evaluation exception and the studies exception. Please keep in mind that not all of the following best practices are appropriate in every instance, and this list does not include every possible protection. Before disclosing PII from education records under one of these exceptions, you should examine the following list and tailor your practices as necessary and appropriate.

•    Convey the limitations on the data. You should take steps to ensure your authorized representative knows the limitations on the use of the data (i.e., that the data is only to carry out the audit or evaluation of Federal- or State-supported education programs, or to enforce or to comply with Federal legal requirements that relate to those programs).
•    Obtain assurances against redisclosure. You should obtain assurances from your authorized representative that the data will not be redisclosed without permission, including such assurances that your authorized representative will provide you (the disclosing entity) the right to review any data prior to publication and to verify proper disclosure avoidance techniques have been used.
•    Be clear about destruction. You should set clear expectations so your authorized representative knows what process needs to be followed for the proper destruction of PII from education records.
•    Maintain a right to audit. You should maintain the right to conduct audits or other monitoring activities of your authorized representative’s policies, procedures, and systems.
•    Verify the existence of disciplinary policies to protect data. You may want to verify that your authorized representative has appropriate disciplinary policies for employees that violate FERPA. This can include termination in appropriate instances. 
•    Verify the existence of a sound data security plan. You may wish to verify before disclosing PII from education records that your authorized representative has a sound data security program, one that protects both data at rest and data in transmission. You have a responsibility to determine if your authorized representative’s data security plan is adequate to prevent FERPA violations. The steps that you may need to take in order to verify a sound data security program are likely to vary with each situation. In some cases, it may suffice to add language to the written agreement that states what data security provisions are required. In other cases, it may be more prudent for you to take a hands-on approach and complete a physical inspection. Additionally, your written agreements could specify required data security elements, including requirements related to encryption, where the data can be hosted, transmission methodologies, and provisions to prevent unauthorized access.
•    Verify the existence of a data stewardship program. You may want to examine your authorized representative’s data stewardship program. Data stewardship should involve internal control procedures that protect PII from education records and include all aspects of data collection – from planning to maintenance to use and dissemination. The Department believes that a good data stewardship plan would have support and participation from across the organization, including the head of the organization, management, legal counsel, and data administrators, providers, and users. The plan should detail the organization’s policies and procedures to protect privacy and data security, including the ongoing management of data collection, processing, storage, maintenance, use, and destruction. The plan could also include designating an individual to oversee the privacy and security of the PII from the education records it maintains. For more information, we have posted for comment a technical brief: “Data Stewardship: Managing Personally Identifiable Information in Electronic Student Education Records” that can be found at http://www2.ed.gov/policy/gen/guid/ptac/technical-briefs.html
•    Disclose only PII from education records that is needed. When you consider disclosing PII from education records to an authorized representative for an audit, evaluation, or enforcement or compliance activity, you may want to explore which specific data elements are necessary for that activity and provide only those elements. You should take care to ensure that you are not disclosing more PII from education records than needed for the stated activity and purpose. You should also explore whether PII from education records is actually required, or whether de-identified data would suffice.
•    Know to whom you are disclosing data. You may want to require your authorized representative to conduct background investigations of employees who will have access to PII from education records, or you may want to conduct these investigations yourself. Additionally, you may want to require your authorized representative to disclose past FERPA or data management violations. If you discover past violations, you would want to explore the circumstances behind the violation, and discover all information that would allow you to make an informed judgment on whether the individual or entity is likely to be a responsible data steward. This may include discovering whether the violation was covered up, including if it was voluntarily reported to affected students or FPCO, and whether appropriate breach response procedures were followed.
•    Verify training. You may want to verify that your authorized representative has a training program to teach its employees about FERPA and how to protect PII from education records, or you may want to train your authorized representatives yourself. 

Are there best practices for written agreements?

You should consider the following items for inclusion in your written agreements for work under both the audit or evaluation exception and the studies exception. We note that this list may not cover everything you want in your agreement – you should look to the facts and circumstances surrounding the disclosure agreement and include all terms necessary to be clear about roles, responsibilities, and expectations for safeguarding PII from education records.

•    Bind individuals to the agreement. It can be important to bind not just the entity to whom you are disclosing PII from education records, but also the individuals who will be accessing that data. There are several ways to accomplish this result. One way is to identify the individuals in the agreement itself, and have them execute the agreement in their individual capacity as well as having a representative execute the agreement for the entity. Alternatively, your agreement can require individuals accessing the PII from education records to execute affidavits of nondisclosure or other documentation indicating their individual agreement to handle the PII from education records properly.
•    Agree on limitations on use of the PII from education records. Your agreement should be clear about limitations on the use of the PII from education records, meaning that it can only be used for the activities described in the agreement. Your agreement may also address methodological limitations, for example, identifying which data sets, if any, the PII from education records may be linked. 
•    Agree to not redisclose. The most basic provision of the agreement is to make clear that the PII from education records is confidential and must not be redisclosed through direct data disclosures or publishing results that allow individuals to be directly or indirectly identified. FERPA-permitted entities may wish to require that specified disclosure avoidance methodologies be applied, or may wish to review all results prior to publication, or both. 
•    Specify points of contact/data custodians. Your written agreements should specify points of contact and data custodians (the individuals directly responsible for managing the data in question).
•    Mention Institutional Review Board (IRB) review and approval. While FERPA does not mention IRBs, research proposals involving human subjects may have to be reviewed and approved by IRBs, if required under protection of human subject regulations of the Department and other Federal agencies. If IRB review and approval is required or expected, this may be noted in the written agreement.
•    State ownership of PII from education records. You may wish for your agreement to be clear that, in disclosing PII from education records to an entity, you are in no way assigning ownership of the PII or records to that entity, and that it may only be redisclosed with your permission or otherwise in compliance with FERPA and its regulations.
•    Identify penalties. Your agreement could include penalties under State contract law such as liquidated damages, data bans of varying length, and any other penalties the parties to the agreement deem appropriate. You may want your agreement to create third-party beneficiary rights, e.g., allowing parties injured by a data breach to sue for damages. While FERPA itself has little flexibility for sanctions, you can include a wide range of appropriate sanctions in your written agreements.
•    Set terms for data destruction. As discussed previously, written agreements for both studies and audits and evaluations are required to contain provisions dealing with the destruction of PII from education records when those records are no longer needed. The agreement could include a method for documenting the destruction, such as the use of notarized statements.
•    Include funding terms. If the agreement involves cost reimbursement, these details could be specified.
•    Maintain right to audit. You may want to include the right to conduct audits or otherwise monitor the entity to which you are disclosing PII from education records to periodically affirm that the entity has appropriate policies and procedures in place to protect the PII from education records.
•    Identify and comply with all legal requirements. It is important to remember that FERPA may not be the only law that governs your agreement. The agreement could broadly require compliance with all applicable Federal, State, and local laws and regulations, and identify the legal authority (whether express or implied) that permits the audit, evaluation, or enforcement or compliance activity.
•    Have plans to handle a data breach. While no one anticipates a data breach, data loss may occur. You may wish to include specific procedures in your written agreements detailing the parties’ expectations in the event that PII from education records is lost, including specifying the parties’ responsibilities with regard to breach response and notification and financial responsibility.
•    Review and approve reported results. If applicable, the written agreement could specify the parties’ agreements with respect to publication of results. For example you may wish to review and approve reports prior to publication to make sure that they reflect the original intent of the agreement.
•    Define terms for conflict resolution. The agreement could specify procedures for how disputes between the parties would be resolved.
•    Specify modification and termination procedures. The agreement could specify how it can be modified or terminated. You may wish to provide specific provisions for termination based on improper handling of PII from education records.

What do I do if the terms of the written agreement are violated?

If the entity to which you have disclosed PII from education records without consent (whether under the studies exception or the audit an evaluation exception) violates the terms of the written agreement, you should evaluate your options under the penalty and termination provisions of the agreement. You may want to stop disclosing PII from education records to that organization, or pursue legal redress. If you have reason to believe that the entity has violated FERPA, you should contact FPCO.

How should the public be informed? 

It is a best practice to keep the public informed when you disclose PII from education records.

•    Inform the public about written agreements. Transparency is a best practice. You might want to post your data sharing agreements on your Web site, or provide some equivalent method to let interested parties know what data you are disclosing, the reasons it is being disclosed, and how it is being protected. While the Department generally recommends public posting of written agreements, parties are encouraged to review their contractual data security provisions carefully and redact, prior to publication, any provisions that may aid those seeking unauthorized access to systems. In certain instances a separate confidential IT Security Plan may be appropriate. For more information on data security best practices, see the Privacy Technical Assistance Center (PTAC) Web site: http://www2.ed.gov/policy/gen/guid/ptac/index.html 

Who should I call if I have questions?

If you would like more information about best practices to protect PII from education records, contact the PTAC Help Desk at PrivacyTA@ed.gov or 855-249-3072.

If you are a parent, eligible student, school, LEA, or SEA and would like more information on FERPA, please call OCPO at 1-800-872-5327.
 
Form #1
ACCESS LOG
Cumulative Record Review
Please record the following information each time you consult, view or access a student’s cumulative record.

NAME	DATE	REASON		NAME	DATE	REASON