Skip to main content

Student Privacy and Release of Information (Policy 2250)

University Policy 2250

Download a Printable Version of Policy 2250

Effective Date

July 1987

Last Revision Date

February 2017

Responsible Party

Office of Institutional Compliance and Ethics, (208) 426-1258

Scope and Audience

This policy applies to all University faculty, staff, and students.

Additional Authority

Family Educational Rights and Privacy Act of 1974 (“FERPA”) – 20 U.S.C. § 1232g

1. Policy Purpose

This policy details the privacy protections that students have in their student records, including the limits and exceptions to that privacy. This policy is designed to comply with the Family Educational Rights and Privacy Act of 1974 (also known as “FERPA” or the “Buckley Amendment”) and all subsequent amendments.

2. Policy Statement

The Family Educational Rights and Privacy Act (“FERPA”) is a federal law giving Students certain rights with respect to their Education Records. FERPA provides the right to:

a. Inspect and review the Student’s Education Records within 45 days of the day the University receives a request for Access;

b. Request the amendment of the Student’s Education Records that the Student believes are inaccurate or misleading;

c. Consent to Disclosures of personally identifiable information contained in the Student’s Education Records, except to the extent that FERPA authorizes Disclosure without consent; and

d. File a complaint with the U.S. Department of Education concerning alleged failures on the part of the University to comply with the requirements of FERPA.

3. Definitions

3.1 Access

The right of students to review and inspect their education record and to control the review and inspection of the education records by third parties.

3.2 Attendance

A student is considered to be in attendance: (1) upon registering for a course and (2) during the period during which they are working under a work-study program.

3.3 Directory Information

A student’s name, local and permanent addresses, telephone listing, photograph, major field of study, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student.

3.4 Disclosure

Permitting access to or the release, transfer, or other communication of personally identifiable information contained in education records by any means, including oral, written, or electronic means, to any party except the party identified as the party that provided or created the record.

3.5 Education Records

Records maintained by Boise State University or by a person acting on behalf of Boise State University that contains information directly related to a student. The following are not considered a part of education records:

a. Records by a University official which are in the sole possession of the maker of the record, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute;

b. Records that are created and maintained by the University Department of Public Safety for the purpose of law enforcement;

c. Records related to the employment of a person at Boise State University where those records are maintained in the normal course of business and relate exclusively to that person in their capacity as an employee and are not available for use for any other purpose, except records relating to student employees which are education records; and

d. Records maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than the persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice. These records are known as “treatment records.” (Note that if a treatment record is disclosed to anyone, including the student themselves, for any purpose other than for the purpose of providing treatment to the student, these records will cease being considered treatment records and shall become education records.)

e. Records created or received by an educational agency or institution after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student.

3.6 Financial Aid

A payment of funds provided to an individual (or a payment in kind of tangible or intangible property to the individual) that is conditioned on attendance of the individual at the University.

3.7 Legitimate Educational Interest

An interest in education records by a University official where the information is:

a. Necessary to perform appropriate tasks that are specified in a University official’s position description or by a contract agreement;

b. Used within the context of University business and not for purposes extraneous to the University official’s areas of responsibility to the University;

c. Relevant to the accomplishment of some task or to a determination about the student; and/or

d. Used consistently with the purposes for which the information is maintained.

3.8 Parent

A natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian. The determination of whether an individual is acting as a parent for purposes of this definition must be made by Institutional Compliance and Ethics. Generally if a student is living in the care of an individual on a day-to-day basis, that individual may be considered a parent for purposes of this policy.

3.9 Personally Identifiable Information

Information that can be used to distinguish or trace an individual’s identity either directly or indirectly through linkages with other information. Excludes directory information.

3.10 University Officials

Administrators; faculty; professional staff; academic advisors; clerical or support employees including the Department of Public Safety; volunteers; persons or companies with whom the University has contracted as its agent, acting with a legitimate educational interest, to provide a service instead of using University employees or officials (such as an attorney, auditor, collection agent, or service provider); staff in the Alumni Association; staff at the University Foundation; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing their tasks.

3.11 Student

Any individual who is formally admitted and is or has been in attendance at Boise State University. Does not include applicants for admission nor persons who have been admitted but have not yet registered. Under guidance provided by the Department of Education, all FERPA rights transfer from a parent to a student when a student begins their postsecondary education.

3.12 Third Party Restriction

A restriction preventing a third party to whom education records have been released from releasing or redisclosing the information to anyone except the student or the University or in compliance with FERPA and this Policy.

4. Responsibilities and Procedures

4.1 Release of Student Information

The University may release a Student’s Directory Information without authorization. A Student may restrict the release of Directory Information in their Student records by following the process discussed in Section 4.2 below. A Student’s Education Records or other Personally Identifiable Information (other than that contained in the Directory Information) generally shall not be released without the written consent of the Student. However, the University may disclose educational records and/or other Personally Identifiable Information without a Student’s consent if the Disclosure meets one of the following conditions:

a. The Disclosure is to other University Officials who have been determined by the University to have legitimate educational interests.

b. The Disclosure is to officials of other institutions of postsecondary education where the Student seeks or intends to enroll, or where the Student is already enrolled, so long as the Disclosure is for purposes related to the Student’s enrollment or transfer, upon condition that the Student be notified of the transfer, receive a copy of the record if desired, and have an opportunity for a hearing to challenge the content of the record.

c. The Disclosure is to authorized representatives of the Comptroller General of the United States, the Secretary of Education, state educational authorities, or authorized representatives of the Attorney General (for law enforcement purposes) where Education Records may be necessary in connection with an audit and evaluation of Federally-supported education programs, or in connection with the enforcement of the Federal legal requirements which relate to such programs.

d. The Disclosure is in connection with a Student’s application for, or receipt of, Financial Aid if the information is necessary for such purposes as to:

  • Determine eligibility for the aid;
  • Determine the amount of the aid;
  • Determine the conditions for the aid; or
  • Enforce the terms and conditions of the aid.

e. The Disclosure is to state and local officials or authorities to whom such information is specifically allowed to be reported or disclosed pursuant to State statute adopted –

(i.) Before November 19, 1974, if the allowed reporting or Disclosure concerns the juvenile justice system and such system’s ability to effectively serve the Student whose records are released, or

(ii.) After November 19, 1974, if –

  • The allowed reporting or Disclosure concerns the juvenile justice system and such system’s ability to effectively serve, prior to adjudication, the Student whose records are released; and
  • The officials and authorities to whom such information is disclosed certify in writing to the University that the information will not be disclosed to any other party except as provided under State law without the prior written consent of the Student.

f. The Disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating, or administering predictive tests, administering Student aid programs, and improving instruction, if such studies are conducted in such a manner as will not permit the personal identification of Students and their Parents by persons other than representatives of such organizations and such information will be destroyed when no longer needed for the purpose for which it is conducted, and there is a written agreement with the organization conducting the study that:

(i). Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed;

(ii). Requires the organization to use Personally Identifiable Information from Education Records only to meet the purpose or purposes of the Student as stated in the written agreement;

(iii.) Requires the organization to conduct the Student in a manner that does not permit personal identification of Students and Parents by anyone other than representatives of the organization with Legitimate Educational Interests; and

(iv.) Requires the organization to destroy all Personally Identifiable Information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be destroyed.

g. The Disclosure is to accrediting organizations in order to carry out their accrediting functions.

h. The Disclosure is to appropriate authorities in the case of an emergency where the Disclosure of information is necessary to protect the health or safety of the Student or other persons.1. In determining whether such Disclosure is necessary, the totality of the circumstances will be considered including, but not limited to:

(i.) the seriousness of the threat to the health or safety of the Student or other individual; (b) the necessity of gaining the information to deal with the emergency; (c) the ability of the parties to whom the information is disclosed to deal with the emergency; and (d) the extent to which time is of the essence in dealing with the emergency.

(ii.) The Vice President for Student Affairs and Enrollment Management or their designee are the only people authorized to make this determination on behalf of the University.

i. The Disclosure is to comply with a judicial order or lawfully issued subpoena. The University will comply only after making a reasonable effort to notify the Student of the order or subpoena in advance of compliance so that the Student may seek protective action unless the Disclosure is in compliance with:

(i.) A Federal grand jury subpoena and the court has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed.

(ii.) Any other subpoena issued for a law enforcement purpose where the court or other issuing agency has ordered that the existence or the contents of the subpoena, or the information furnished in response to the subpoena, not be disclosed.

(iii.) An ex parte court order obtained by the United States Attorney General (or designee not lower than an Assistant Attorney General) concerning investigations or prosecutions of an offense listed in 18 U.S.C. § 2332b(g)(5)(B) or an act of domestic or international terrorism as defined in 18 U.S.C. § 2331.

j. The Disclosure is made to the court where:

(i.) The University initiates legal action against a Student or their Parent, where such Education Records are relevant for the University to proceed with the legal action as plaintiff; or

(ii.) A Student or their Parent initiates legal action against the University, where such Education Records are relevant for the University to defend itself.

k. The Disclosure is to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense. The Disclosure may only include the final results of the disciplinary proceeding conducted by the University with respect to that alleged crime or offense. The University may disclose the final results of the disciplinary proceeding, regardless of whether the institution concluded a violation was committed.

l. The Disclosure is in connection with a disciplinary proceeding at the University – the University shall only disclose the final results of the disciplinary proceeding and only if it determines that:1

(i.) The Student is an alleged perpetrator of a crime of violence (as defined in 34 CFR § 99.39) or non-forcible sex offense; and

(ii.) It has been found, with respect to that allegation, that the Student committed a violation of University rules or policies.

m. The Disclosure is to a Parent of a Student regarding the Student’s violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance if:

(i.) The University determines that the Student has committed a disciplinary violation with respect to that use or possession; and

(ii.) The Student is under the age of 21 at the time of the Disclosure to the Parent.

n. The Disclosure concerns sex offenders and other individuals required to register under § 170101 of the Violent Crime Control and Law Enforcement Act of 199, 42 U.S.C. § 14071, and the information was provided to the University under 42 U.S.C. § 14071 and applicable Federal guidelines.

o. Additional Disclosure may be permitted as allowed under FERPA and accompanying regulations.
Student records may also be Disclosure where there is written consent from the Student which specifies the records that may be disclosed, states the purpose of the Disclosure, and identifies the party or class of parties to whom the Disclosures may be made. A copy of these records will also be provided to the Student at the Student’s request.

4.2 Student Right to Restrict Directory Information

Students have the right to restrict the University from disclosing their Directory Information by notifying the University that a Student does not wish for their Directory Information to be disclosed without their written consent. Instructions on how a Student may make this restriction are available at Update FERPA Restrictions.

4.3 Record Keeping Requirement

4.3.1 University Maintenance of Student Education Records

The University shall maintain a record of each request for Access to, and each Disclosure of Personally Identifiable Information from, the Education Records of each Student, as well as the names of state and local educational authorities and agencies that have received Student records and may make further Disclosures of a Student’s Personally Identifiable Information from their Student records without consent. This record shall be maintained with a Student’s Education Records for as long as the Education Records are maintained. Since Education Records are created and maintained on many different areas of campus, all University Officials must forward a copy of the request or Disclosure to the Office of the Registrar so that they may be centrally maintained.

a. For each request or Disclosure the record must include:

(i.) The name(s) of the parties who have requested or received Personally Identifiable Information from the Student records; and

(ii.) The Legitimate Educational Interests the parties had in requesting or obtaining the information.

b. For each Disclosure of Personally Identifiable Information from Education Records that the University makes under the health or safety emergency exception, the University must record the following information:

(i.) The articulable and significant threat to the health or safety of a Student or other individual that formed the basis for the Disclosure; and

(ii.) The parties to whom the University disclosed the information.

(iii.) Since the only people authorized to make this type of Disclosure are the Vice President for Student Affairs and Enrollment Management or their designee, they must ensure that this required information is forwarded to the Office of the Registrar so they may be centrally maintained.

4.3.2 File Retention

Files are to be retained for the minimum period required to serve the basic official functions of the office involved. At the end of that period, such records should be disposed of in a manner that will not violate their confidential nature. Appropriate formal disposal policies will be set down in writing for the personnel of the office concerned.

a. Annually, all basic records of alumni whose date of enrollment in the University occurred five (5) years earlier shall be microfilmed. All information other than the basic record shall be destroyed.

b. The Placement File (student initiated) and all medical records are exempt from Clause C of this Article.

4.4 Limits on Re-disclosure

a. The University will disclose a Student’s Personally Identifiable Information from Education Records only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior written consent of the Student unless otherwise allowable under Section 4.1 above. Personally Identifiable Information disclosed to an agency or organization may be used by that agency or organization’s officers, employees, and agents for the purposes for which the Disclosure was made. The limitations on redisclosure are known as Third Party Restrictions.

b. The following is an example of the type of Third Party restrictions statement that the University will place on records released to agencies or organizations:

“Information contained herein is for the intended purpose only and it is not to be used for any other purpose or released to any other person or organization without the written consent of the Student whose name appears herein or as otherwise allowable under Boise State Policy 2250. In accordance with the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g, if you are unable to comply you must return this record immediately to Boise State University’s Office of the Registrar.”

4.5 Authorized Release

A Student may sign a Release of Information (Release) for to allow their Education Records to be disclosed. Such Release will generally indicate specific individuals or organizations that the Student wishes to receive information and the Student has the right to specify the information that they want to be released. A Release may be rescinded through the submission of a subsequent Release form. Release forms are available at https://www.boisestate.edu/registrar/home/student-forms/.

4.6 Right to Inspect and Review Education Records

a. Students have the right to inspect and review their Education Records. The University shall provide Students with this Access within 45 (forty-five) days of their request. Such inspection and review shall take place during business hours. Students should contact the Office of the Registrar at (208) 426-4249. No Education Records may be destroyed if there is an outstanding request to inspect and review them.

b. The University is not required to release to the Student the following information from the Education Records of a Student:

(i.) Financial records and statements or any related information of the Student’s Parents.

(ii.) Confidential letters and statements of recommendation if the Student:

  • Waived their right to inspect and review those letters and statements; and
  • Those letters and statements are related to the Student’s admission to the University, application for employment, or receipt of an honor or honorary recognition.

c. The waiver must be in writing and signed by the Student. The waiver must not be a condition of admission to or receipt of a benefit or service from the University. Even if a Student has signed a waiver, they must be given, upon request, the names of persons providing the recommendations.

d. Education Records of a Student that contains information on more than one Student. A Student may inspect and review only the specific information that pertains to them.

4.7 Request to Amend Education Records

a. A Student who believes that information contained in the Student’s Education Records is misleading, inaccurate, or a violation the Student’s privacy rights, may request that the University amend such records. Such a request should be made at the level closest to the source of the information. Informal meetings and discussions with the faculty member or other University Official responsible for the record should be utilized first.

b. If an informal attempt is unsuccessful a Student may make a formal request to the Office of Institutional Compliance and Ethics for a hearing to challenge the content of the Student’s Education Records on the grounds that the information contained in the Education Records is inaccurate, misleading, or in violation of the Student’s privacy rights.

c. The Office of Institutional Compliance and Ethics shall hold the requested hearing within 45 days of receiving the formal request from the Student. The Student shall be given notice of the date, time, and place, reasonably in advance of the hearing. A hearing officer, a University employee who does not have a direct interest in the outcome of the hearing, will conduct the hearing. The Office of Institutional Compliance and Ethics shall select the hearing officer.

d. The Student shall be provided with a full and fair opportunity to present evidence relevant to the request and may, at the Student’s own expense, be assisted or represented by one or more individuals of the Student’s choice, including an attorney.

e. Following the hearing, the hearing officer will issue a written decision within 45 days of the hearing. That decision must be based solely on the evidence presented at the hearing and must include a summary of the evidence and the reasons for the decision. If the hearing officer determines that the information in the Student records is inaccurate, misleading, or otherwise a violation of the Student’s privacy rights, the hearing officer shall amend the record accordingly.

f. If the hearing officer determines that the Student records shall not be changed, their written decision shall inform the Student of the Student’s right to place a statement in the record commenting on the contested information in the records and/or stating why the Student disagrees with the hearing officer’s decision. Such a statement shall be maintained in the Student’s Student records alongside the contested information and shall be maintained for as long as the Student records are maintained. If the contested information is ever disclosed the University shall disclose the Student’s statement along with that information.

4.8 FERPA Violations

Complaints regarding allegations of FERPA violations should be directed to the Office of Institutional Compliance and Ethics. Students may also file a written complaint with:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue S.W.
Washington, D.C. 20202

5. Forms

FERPA Release of Information
https://www.boisestate.edu/registrar/home/student-forms/

Revision History

January 1994; July 1995; May 2016; February 2017