Confidentiality of Student Records

INTRODUCTION

Our office deals daily with confidential student records. Every person in the office, including our part time and student help, shares in the responsibility to protect student records from unauthorized access and alteration. We should remember that this confidentiality extends past the physical security of paper records or computer access through terminals, but also includes our conversations with friends and family which might violate the privacy of a particular student or group of students.

The privacy of student education records is protected through the 1974 Family Educational Rights and Privacy Act (known as FERPA), 20 U.S.C. Sec. 1232g, through University policy, "The University of North Carolina at Chapel Hill Policies and Procedures Under the Family Educational Rights and Privacy Act of 1974" and through University Registrar Policy Memorandum Number 21, "Access to Student Records" X. These regulations and policies apply to present and former students of the University.

If the University is found guilty of not complying with FERPA regulations, federal funds could be withdrawn from the University. If the unauthorized release of information results in personal damage to the student, the University might also be sued for damages.

There are state laws (G.S. 14 453 through 14 457) that govern unauthorized access to computers and alteration of data. Employees need to be aware of these laws.

The following are considered criminal offenses:

• Unauthorized access to a computer, computer system, or computer network
  
  
• Willfully and without authorization damaging or altering a computer, computer system, computer network, or any part thereof
  
  
• Willfully and without authorization denying an authorized user use of a computer, computer system, or computer network
  
  
• Gaining access to a computer with intent to commit fraud or obtain property or services
  
  
• Willfully damaging computer hardware
  
  
• Maliciously threatening to damage a computer, computer system, computer network, hardware, software, or data with the intent to extort money or compel another person to do or refrain from doing an act

It is extremely important that every employee in the Office of the University Registrar who has access to student records read and understand the University Registrar's Office Policy and the UNC-CH policy in regard to student records. Every employee, including student employees, will have this policy in their possession and will sign a statement that they have received a copy of the policy. Willful violation of the rules safeguarding the confidentiality and integrity of student records may lead to disciplinary action. Any questions about the policy on releasing information from an education record should be directed to the University Registrar.

DIRECTORY INFORMATION

1. With certain exceptions, you will not disclose personally identifiable information from a student's education records without the student's prior written consent. Anything not defined as "directory information" is considered to be non-releasable. Directory information may be released to any agency, institution, organization, or office unless the student has "restricted the release" of that information as described below.

   Directory information is defined as the student's:

   • name
   • personal id number (PID)
   • local address
   • local telephone listing
   • grade/billing (permanent) address
   • grade/billing (permanent) telephone listing
   • date and place of birth
   • county, state, or US territory from which student originally enrolled (if a student enrolled from a foreign country, this is not directory information)
   • major field of study
   • class (junior, senior, etc.)
   • enrollment status (full-time, half-time, less than half time)
   • participation in officially recognized activities and sports
   • weight and height of members of athletic teams
   • dates of attendance
   • degrees and awards received
   • the most recent previous educational agency or institution attended by the student
   • anticipated graduation date
   • campus electronic mail address

   Note: Parent name and parent telephone number are not directory information.

   Prior written consent by the student is not required for access to "directory information" unless the student has notified the Office of the University Registrar to restrict release of that information. The Privacy Flag on Screen 007 will indicate that information is restricted. Also, the message "PRIVATE" will appear at the top of any screen underneath the student's name indicating the student's directory information is restricted.

2. Requests for directory information in the form of lists or mailing labels should be referred to the Administrative Assistant to the Registrar in Suite 3106, SASB North.

   Under the State of North Carolina open records act, directory information in the form of lists, labels, diskettes or email attachments are available to any requestor.

   Mailing lists for newly entering students will not be available until after the end of the registration period (after the fifth class day for fall and spring semesters) in order to give these students an opportunity to file a request to restrict directory information. The applicable admissions offices have jurisdiction on applicant information until the student has started classes. Only university officials and officially recognized student organizations that are exercising university-delegated administrative authority (for example, Honor Court) will be given information before the end of the registration period.

   If the person is a representative of an officially recognized student organization requesting non-directory information (including fraternities and sororities), he/she should be referred to the Assistant Director of Student Affairs for Leadership Development in Steele Building to obtain a data release form (form must be signed by that Assistant Director).

3. Students who wish to modify how their name, address, and telephone numbers appear in the campus directory or web directory, or want all directory information restricted, or want all access to student information blocked on the web, must notify the University Registrar's Office in writing or update the restriction flags through the University web site Student Central.

   A "Request for Non-Disclosure of Information" form is available in our office. It gives students certain options on how information is to be released on campus.

   Section A on the form gives the student the option to block the release of directory information not only in the printed and on-line campus directory, but also in printed lists generated by the Registrar's Office. The message "PRIVATE" will appear on computer terminals. This option will also prevent the student from receiving any information concerning their record over the phone. It will be necessary for the student to come in person and show photo ID, or he/she must send in a written request and acknowledge the fact that he/she has placed a restriction on his/her record but require specific information. If the restriction needs to be removed, the student must either remove it via the web, or in writing to our office, or by completing a form through our office. This request may be submitted before the end of the fall or spring registration period.

   Please note that the privacy flag is a restriction on release of directory information to a third party. Academic and administrative officers on campus with a "legitimate educational interest" are permitted to receive all student data, both directory and non-directory, including mailing labels, regardless of any restriction. The University Registrar and Associate University Counsel determine "legitimate educational interest."

   Section B on the form allows students to retain an entry in the published campus directory but restricts how the information appears. We will accept the requests whenever they are received, however, we cannot guarantee a proper listing in the campus directory if we receive the request after the end of the fall registration period.

4. FERPA's protection of personally-identifiable information ends at the time of the student's death. Unless it has information to the contrary, 75 years after the records were first created, the University will presume that the student is deceased. The date a student's record is created is the date the student first enters the University. Individuals requesting non-directory information from a deceased student's record within the 75-year period must present reliable evidence of the student's death, such as a copy of a death certificate, unless University records already show that the student is deceased.

   As a courtesy to the families of recently-deceased students who were enrolled at the time of their death, for one year after the student's death, the University generally will not release information from his or her education records without the consent of the next-of-kin. People who continue to request such information after being informed of this policy should be referred to the University Registrar.

STUDENT ACCESS TO PERMANENT RECORDS

Any student has the right to inspect his or her education records maintained by our office. Students can not see confidential letters and statements of recommendation that were placed in the record before 1974. Students can not see confidential letters and statements of recommendation that were placed in the record where the students have waived their rights to inspect those letters and statements.

1. Students requesting to examine their own records are requested to show their Student I.D. or driver's license to verify their identity. The Student/Faculty Services Representative will allow the student to view the student record on a terminal screen. Older records, not available by terminal can be viewed by the student only when a Student/Faculty Services Representative is observing the examination of the record. Office personnel should never leave the student and the record unattended.

   Students requesting to view the contents of their folder should make an appointment to allow the Student/Faculty Services Representative time to call the Archivist in order to pull the folder and screen it for confidential materials.
   
   

2. Students are entitled to receive a copy of their transcript upon request. If the transcript is issued openly and directly to the student, the transcript is noted as "ISSUED TO STUDENT." If the transcript is given to the student in a sealed envelope, the transcript is first noted "ISSUED TO STUDENT IN A SEALED ENVELOPE." It is then placed in an envelope, the flap is sealed, the Registrar's signature is stamped across the flap, using the special stamp "Official Transcript Enclosed Void if Opened". If the transcript is to be released to a third party, the student's written consent is required and then the transcript is sent directly from our office to the third party with no special notations stamped on it.

   Normally, we will provide students copies of education records (folder information) upon request. However, we will not provide copies of transcripts from other institutions which may be located in a student's folder. Students can review these documents in person but cannot have copies made. There are two exceptions to this policy. One exception is if the transcript is from a foreign institution since these documents are more difficult to obtain from a foreign country. The second exception is if the student needs the transcript for advising purposes only on our campus. If that is the case, a School/College Office may request it from the Office of the University Registrar and it will be sent directly to the appropriate staff member on campus. The transcript copy in both cases should bear the stamp "Not A Current Transcript From Originating Institution" in several areas. If the transcript is being issued directly to the student it should also bear the stamp "Issued to Student."

   We may deny a request for copies of records if the students are easily able to come to the office and inspect them in person and the records are so voluminous that copying them would be unreasonably burdensome for our office staff. We are permitted up to 45 days to supply copies.
   
   

3. All staff members are encouraged to keep a "watchful eye" whenever students are standing by our desks. Students observed thumbing through or attempting to look at records or information on a terminal should immediately be reminded that the records are confidential and they are not allowed to examine them.
   
   
4. Be mindful of records lying on your desk as you deal with students. The records should be situated so as not to be accessible to others.

THIRD PARTY ACCESS TO NON-DIRECTORY STUDENT INFORMATION

Our own office staff and student and part time help are the only people authorized to work in student record files or at terminals in our office. Individuals from other offices should seek assistance and be supervised by our office staff when seeking information from our records.

Student and part time help should not be given passwords or instruction on logging into inquiry or data entry. Terminals should be set up for their use by a supervisor or designated permanent employee and that person should monitor their work. Student and part time help should not perform computer terminal work at unsupervised locations. Students and part time help should handle only those paper records necessary for the accomplishment of their assigned tasks.

Non-directory information is not disclosed to other persons including campus faculty and staff except under one of the following conditions:

1. The person presents signed, written consent from the student. To be effective, the written consent must be signed and dated by the student and must include:
   
   
   1. specification of the records to be disclosed;
      
      
   2. The purpose of the disclosure; and
      
      
   3. The party or class of parties to whom the disclosure may be made.
      
      
2. The request fits into one of the categories under which non-directory information may be released, as listed below in Release Policies for Specified Groups.

The following is a list of institutions and/or people for which non-directory information may be released, and the appropriate action to take when releasing non-directory information to these third party groups. A Record of Disclosure form must be completed prior to releasing non-directory data to some of the specified groups as indicated below. See the section Record of Disclosure for more information. A form is attached to this policy.

1. To school officials including teachers, officials and employees of the University system who have a legitimate educational interest. "Legitimate educational interest" means they need the information in order to carry out their official duties or implement policies of the University of North Carolina. (Does not require a Record of Disclosure)
   
   
2. To school officials of another school in which the student seeks to enroll and to school officials of another school where the student is concurrently enrolled (for example, inter-institutional students). Grade information can be released to another school if the student is not currently enrolled there but the school needs the information in an expeditious manner for clearing eligibility for re-enrollment. (Requires a Record of Disclosure) If school officials of another school ask for disciplinary information about a student, refer them to the Dean of Students' Office (Student Affairs). See item 21 below.
   
   
3. Federal and state officials whose access to the record is necessary for the audit, evaluation, or legal enforcement of supported educational programs, (these specifically include the United States Comptroller General, the Secretary of Education, and similar state agencies): receive complete information upon request. (Refer to University Registrar) (Requires Record of Disclosure)
   
   
4. Student's high school or other schools previously attended: Requests for grade and course information will be provided in a manner which is not identifiable to individual students. (Does not require a Record of Disclosure)
   
   
5. Dean of Students (Student Affairs), College or School Dean, advisor: Receive complete information. (Does not require a Record of Disclosure)
   
   
6. Departmental Offices: Receive complete information on their students. (Does not require a Record of Disclosure)
   
   
7. Alumni Office/Development Office/Carolina Parents Association: May receive parent information, but may not receive other non-directory data. (Does not require a Record of Disclosure)
   
   
8. Career Planning and Placement: Directory information. May supply information to verify GPA information provided by student. May provide rosters to support special services for different ethnic groups. (Does not require a Record of Disclosure)
   
   
9. Individual faculty members: Directory information only unless legitimate educational need is established. (Does not require a Record of Disclosure)
   
   
10. Fraternities and Sororities: Non-directory information is channeled through Student Affairs. (Does not require a Record of Disclosure)
    
    
11. To protect the health or safety of the student or others in an emergency. Emergencies should be referred to the Dean of Student Affairs. (Requires Record of Disclosure)
    
    
12. Campus Security/UNC Police: Time, building, and room number from class schedule and other locator information (parent name, any addresses) can be released. The campus police may be entitled to other information if they can prove legitimate educational interest. If you are not sure whether campus police are entitled to certain information in a specific case, consult your supervisor or Associate University Counsel. (Does not require a Record of Disclosure)
    
    
13. Organizations providing financial assistance (i.e. Morehead Program): Information on students applying for or receiving aid that is necessary to determine eligibility for aid, to determine the amount of aid, to determine the conditions for aid, or to enforce the terms and conditions of the aid. "Financial aid" means money provided that is conditioned on a person's attendance in school. (Requires Record of Disclosure)
    
    
14. UNC CH Financial Aid Office: Complete information on students applying for or receiving aid. (Does not require a Record of Disclosure)
    
    
15. Libraries, Student Stores, other administrative offices may receive non-directory data as determined by the University Registrar. Service providers who have only a contractual arrangement with the University (for example, Mariott food service) receive only directory information. (Does not require a Record of Disclosure)
    
    
16. Accrediting and Auditing organizations: Complete information. (Refer to University Registrar) (Requires Record of Disclosure)
    
    
17. Both parents of a dependent student (as defined by IRS code) may receive complete information after confirming that at least one parent claims the student as a dependent for federal tax purposes. (Does not require a Record of Disclosure)
    
    
18. Subpoenas and judicial orders: Refer to University Registrar. Subpoena or judicial order requires inspection by Associate University Counsel. In most cases, students must be given reasonable notification in advance of compliance. (Requires Record of Disclosure)
    
    
19. State and local officials can receive information if it concerns the juvenile justice system and that system's ability to serve effectively, prior to adjudication, the student whose records are released, and if the officials to whom the information is disclosed certify in writing to the University that the information will not be disclosed to any other party without the student's written consent, except as provided under State law. Refer to Associate University Counsel.
    
    
20. Disclosure can be made of the results of certain disciplinary proceedings for alleged violations of the Code of Student Conduct. The University may disclose the results of the disciplinary proceeding to the alleged victim of the offense. Refer requests to the Division of Student Affairs.
    
    
21. If the University takes disciplinary action against a student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the University community, it may disclose information about that disciplinary action to teachers and school officials in other schools who have legitimate educational interests in the student's behavior. The Division of Student Affairs should make reports.

Any other cases: Refer to University Registrar, Associate University Registrar for Operations, or Assistant University Registrar for Records and Training.

RECORD OF DISCLOSURE

The University Registrar's Office is required to maintain records of requests and disclosures of non-directory data. The person or agency making a request for disclosure must provide a Record of Disclosure Form for each student for those situations indicated above.

The Record of Disclosure includes:

1. the name of the student
   
   
2. the name of the person making the request
   
   
3. the names of other parties to whom the information may be disclosed
   
   
4. the legitimate interests of the person making the request and the legitimate interests of other parties who may receive the information

A UNC-CH Record of Disclosure form can be used or requesters can provide their own forms or letters if the forms or letters contain the required information.

The Record of Disclosure will be reviewed to determine if the information can be released as requested. The form will be marked to indicate whether or not information was released.

The Record of Disclosure forms will be filed in alphabetical order by student name and maintained as long as the education record is maintained. The record of disclosures may be examined only by the student, the records custodian, and school and Federal officials auditing record keeping procedures.

TRANSCRIPTS

1. Walk-in requests: Ask to see an ID card or driver's license to verify identity of requester. The requester should complete a "Transcript Request" form. The requester has the option to remain in the office and wait for the transcript or to return later at a specified time.
   
   
2. Transcript Pick up: Ask to see an ID card or driver's license to verify identity of a person picking up a previously requested transcript. The transcript can be released to another person if the person has a signed release from the student.
   
   
3. Any transcript issued to the student in an unsealed envelope should be marked "ISSUED TO STUDENT."
   
   
4. Transcripts issued to students in sealed envelopes should be marked as "ISSUED TO STUDENT IN A SEALED ENVELOPE." A "sealed" transcript is one that is placed in a sealed envelope and imprinted with the stamp "Official transcript enclosed Void if opened". The stamp should be placed on the flap in such a way that opening the envelope will deface the seal and signature.
   
   
5. Internal copies of transcripts can be supplied to school deans and advisers for their students upon demand.
   
   
6. Internal transcripts will be supplied to our own admitting offices free of charge for UNC-CH students applying to those offices.
   
   
7. See the attached policy on emergency requests for transcripts.

STUDENT SCHEDULES

1. Student schedules are non-directory information and will not be released except as provided for under the Section, THIRD PARTY ACCESS TO NON DIRECTORY STUDENT INFORMATION. This includes UNC Police. (See Section RELEASE POLICIES FOR SPECIFIED GROUPS)..
   
   
2. Schedule information is furnished to Student Affairs. Emergency calls from people trying to locate students where normal address and telephone information is not enough, should be directed through Student Affairs for them to handle.
   
   
3. We do not supply information for "friends" trying to locate students. Both parents are eligible if at least one parent claims the student as a dependent for federal income tax purposes.
   
   
4. Students can view or have copies of their schedules made from the terminal after showing proper identification. Students calling in requesting information because they have lost their schedule should be advised to come to the office. If there is not enough time, the student should be questioned to determine identification (ID number, birth date), asked to identify the courses on their schedule and then be given only building and time information necessary to get to their next class.
   
   
5. Any other situations will be handled on an individual basis and should be approved by an assistant or associate registrar.

GRADE INFORMATION

1. We no longer automatically mail term grade reports, but will mail a grade report upon request.

   Grade information for the current grading cycle is available to students through our toll-free telephone system (1-800-473-6112). Grade information for current and past terms is available through the University web site Student Central.

   Requests for grade information and copies of grades will be honored in person only after proper identification of the student by use of the ID card or driver's license.
   
   

2. Grades for graduating students can be given over the telephone by asking key questions about identity (ID number, birth date, etc.) and giving out the grade for the course requested to the student. Other students should be directed to the telephone system, the web site, or they can come to our office.
   
   
3. Telephone requests for grade information from someone identifying himself or herself as the student's adviser or from the dean's office may be honored after proper identification. If you recognize the individual calling, the information can be given immediately. If you do not recognize the person, ask for their office name and telephone number and advise that you will call back shortly. Confirm through the phone book that the telephone number is correct for that person or confirm with persons in that department.
   
   
4. If a printed grade report is requested or the parent or student calls for another report, a copy (screen-printed) of the term grades can be mailed only to the grade/billing address that is reflected on Screen 003 for the student. (This is the grade/billing address that was provided by the student and can only be changed by the student.) If the student is requesting that the term grades be sent to a different address from the grade/billing address on file, the student must make the request in writing and include a request to change his/her grade/billing address in the same correspondence.

   Parents may request, in writing, that a copy of the term grades be sent to a different address as long as either parent claims the student on their Federal Income Taxes. The correspondence must specify that at least one parent claims the student for federal income tax purposes and the address to which the term report should be sent. However, the grade/billing address may not be changed without the written request of the student.

   Parents who claim the student as a dependent on their federal income taxes have the same access rights as the student. A privacy flag is a restriction on releasing directory information to a third party. A parent in this circumstance is not a third party and has access to both directory and non-directory information regardless of directory restrictions.

   Only the last term grade report may be sent in any of the circumstances described above. Requests for more than the last term of grades should be considered requests for academic transcripts and processed according to the policies and procedures for issuing transcripts. (See Transcript Section above.) All written requests for term grades will be maintained for one year.

APPENDIX

• Receipt of Policy on Release of Student Information
• Office Procedures for Supervisors Responding to Emergency Requests to FAX Transcripts
• Request for Disclosure of Non-Directory Student Information