Code of Responsibility for the Security and Confidentiality of Student Records and Data / Family Education Rights & Privacy Act (FERPA)

Each employee of AUA who has access to student records, data and our physical facilities holds a position of trust relative to this information and must recognize the responsibilities entrusted to them in preserving the security and confidentiality of this information.  Security and confidentiality is a matter of concern for all employees and any person who has access to our records, data systems or physical facilities.

The Family Educational Rights and Privacy Act of 1974, as amended and otherwise known as FERPA, sets forth requirements regarding the privacy of student records and is in effect to ensure the confidentiality of information used in our operations.  A summary of the essence of FERPA is captured in the following statements:

• Students at postsecondary institutions must be permitted to inspect and review educational records.
• Students have the right to request the amendment of inaccurate or otherwise inappropriate records.
• School officials may not disclose personally identifiable information from a student’s education record, without written permission, unless such disclosure is permitted by one of the FERPA signed-consent exceptions.
• Institutions are responsible for insuring that all of its school officials comply with FERPA.

More information regarding FERPA is available through the Office of the University Registrar.

Accordingly, any employee who maintains access to student records, data systems and our physical facilities should never:

1. Make or permit unauthorized use of any information.
2. Seek personal benefit or permit others to benefit personally by any confidential information which has come to them by virtue of their work assignment and in accordance with AUA office policies.
3. Exhibit or divulge the contents of any record or report to any person except in the conduct of their own work assignment in accordance with AUA policies.
4. Knowingly include or cause to be included in any record a false, inaccurate or misleading entry.
5. Remove any official record (or copy) or report from the office where it is kept except in the performance of their duties.
6. Operate or request others to operate or access any AUA, equipment, systems or software for purely personal business.
7. Aid, abet, or act in conspiracy with another to violate any part of this code.
8. Leave information, files or data unattended or in unsecure areas.

You are required to immediately report any violation of this code to your supervisor.  As an employee, you should become familiar with the provisions of this code.  Remember, we all share the responsibility for ensuring the security and privacy of the records and data we maintain.  Particularly, those requiring student consent to release information.

FERPA regulations allows for the disclosure of information defined as “Directory Information.”  Directory Information is defined as information contained in an education record of a student “that would not generally be considered harmful or an invasion of privacy” [34 C.F.R.§99.3].  Specifically, directory information includes but may not be limited to: students name, address, telephone listing, electronic mail address, photograph, date and place of birth, major field of study, dates of attendance, grade level, enrollment status, participation in officially recognized activities, or sports, weight and height of athletic team members, degrees, honors, awards received and the most recent educational institution attended.  If you are ever in doubt about releasing any student information, you should withhold the information from the requestor and first check with your immediate supervisor.

When a student has chosen to indicate information is not to be released, the requestor should be advised, “we are unable to release any information” and given no indication of whether or not you may have the information on the person.  You are advised to refer any questions or requests for information that you are unsure of to your supervisor.