• Home
  • Student Records Policy

Student Records Policy


This policy is intended to inform students of their rights and responsibilities pertaining to their university records, in compliance with federal notification requirements; to reflect the University's responsibility; to protect the privacy of student records; and to articulate definitions relating to student records, how they may be accessed and disclosed, the complaint procedure and other information relevant to the student record.

Applies to: 

University employees (faculty, staff, student employees) and all covered individuals (including but not limited to affiliates, vendors, and independent contractors) in their accessing and handling of student records, data or information in all forms during the course of conducting University business (administrative, financial, teaching, research, or service). This policy shall apply to all current or former students of the University of Kansas (KU).

Juniper Gardens
Medical Center, Kansas City
Policy Statement: 

1. Overview

The University of Kansas protects the privacy of its students’ education records in compliance with the federal Family Educational Rights and Privacy Act (FERPA) and its implementing regulations. FERPA and this policy also provide students the right to inspect and review their educational records. A notice of this policy is published each year on the Office of the University Registrar website. Notification of this publication is made annually to enrolled students via email.

2. Student Access to Education Records

A student has the right and shall be accorded the opportunity to inspect, review, and/or receive copies of the student's educational records upon written request to the appropriate record custodian. Requests must be submitted in accordance with the applicable campus procedures for the University of Kansas Medical Center (KUMC) and all reporting units and University of Kansas Lawrence Campus (KUL) and all reporting units.

The University must comply with the student's request within a reasonable period, not to exceed 45 days after the request is received.

Copies may be provided at the student's request and expense; however, the charge to the student for any such records, except for official academic transcripts, statements of degree and enrollment certifications may not exceed the copy charges allowed by the University (see the Comprehensive Fee Schedule). The University may not charge a fee to search for or retrieve a record requested by a student regarding only the education record. The student shall be asked to provide the student's University I.D. and/or other government issued/approved identification to receive and/or view the student’s educational records.

A student who is financially indebted to the University will not be allowed to receive a copy of their academic transcript/diploma, nor will a request to transmit the academic transcript/diploma to another person or agency be honored so long as the debt remains; however, the student will be permitted to view the documents in accordance with the provisions of this policy. Academic transcript and diploma requests also may be denied in connection with disciplinary actions resulting from academic or non-academic misconduct.

The University is not required to allow inspection and review of the following records:

  1. Financial records of the student's parents submitted as part of the financial aid process or for other official University purpose;
  2. Confidential letters and statements of recommendation that were placed in the student's education records prior to January 1, 1975, as long as they are used only for the purpose for which they were specifically intended; and
  3. Confidential letters and statements of recommendation received after January 1, 1975, for which the student has signed a waiver of the right to access and that pertain to (a) admission to this or any other educational institution or agency; (b) application for employment; or (c) receipt of an honor or honorary recognition; so long as these letters are used solely for the purpose for which they were specifically intended.

If an education record contains information on more than one student, the student may inspect only the information about their records.

3. Waiver of Rights

The University may request, but not require, students to waive rights under this policy. The waivers must be in writing and signed by the student, or must be positively indicated electronically and include appropriate electronic authorization. A student may waive the right to inspect and review confidential statements and confidential letters of recommendation only if: (a) the student, upon request, is notified of the names of all persons providing letters/statements; (b) the letters/ statements are used only for the purpose for which they were originally intended; (c) the waiver is not required as a condition of admission to or for any other service or benefit of the University.

The student may revoke any waiver in writing, the revocation may only apply to documents received or entered into the record after the date of execution of the revocation.

4. Disclosure of "Personally Identifiable" and "Directory Information"

The University shall obtain the written consent, or system consent via appropriate electronic authorization in an authorized University system from the student before disclosing personally identifiable information from the education records of the student, other than directory information, except as otherwise provided in this policy.

The University may, without the consent of the student, disclose directory information. If a student wishes to have such information withheld, the student must notify the appropriate Registrar either in writing, or via an authorized University system requiring electronic authentication. This notification may occur at any time; however, if a student wishes to prevent the publication of directory information in the University telephone directory, the student must notify the appropriate Registrar by the end of the first week of the term.

The University may disclose personally identifiable information from a student’s Education Record(s) without the consent of the student if the disclosure is made to:

  1. School officials within the institution determined to have a legitimate educational interest(s).
  2. Authorized persons to comply with a judicial order or lawfully issued subpoena, provided the University makes a reasonable effort to notify the student in advance of compliance; except the University will not disclose to the student information about a grand jury subpoena, a subpoena issued for a law enforcement purpose when notice is prohibited, or a court order obtained by the United States Attorney General or Assistant Attorney General in investigations or prosecutions of certain criminal offenses or an act of terrorism, in accordance with law or regulation. certain officials of the U.S. Department of Education, the Comptroller General and state and local educational authorities in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs.
  3. Financial aid personnel in conjunction with an application for or receipt of financial assistance, provided that the disclosure is needed: (a) to determine the eligibility of the student for financial aid; (b) to determine the amount of financial aid; (c) to determine the conditions that will be imposed; or (d) to enforce the terms or conditions of the financial aid.
  4. Parent(s) or legal guardian(s) of dependent students who provide a written request for grades to the University Registrar pursuant to Board of Regents policy. Dependency, for this purpose, is defined by the Internal Revenue Code of 1954, Section 152. The student will be notified in writing and/or electronically of any disclosure of grades made to the student's parent(s) or legal guardian(s).
  5. Appropriate parties, including parents, in connection with an emergency, if knowledge of the information is necessary to protect the health or safety of the student or other individuals. In deciding to disclose personally identifiable information from an education record in a health and safety emergency, the University shall take into account the totality of the circumstances pertaining to the threat or health of the student or other individuals. If the University determines that there is an articulable and significant threat to the health or safety of the student or other individuals, disclosure may be made to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individuals. All disclosures will be documented. Kansas Department of Health and the Environment (KDHE) or local law enforcement officials for the following purposes: Watkins Health Services is required to report to KDHE the names and current address of students who have certain communicable diseases, including hepatitis, tuberculosis and sexually transmitted diseases. Additionally, Watkins Health Services is required to report to local law enforcement officials the name of any student who is wounded with a deadly weapon.
  6. Organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, or administer predictive tests; to administer student aid programs; to improve instruction or services in a manner that does not permit personal identification of students by individuals other than representatives of the organizations that have legitimate interests in the information. The University and the organization will enter into a written agreement, containing: the purpose, scope, and duration of the study, and the information to be disclosed in the study; restrictions to use information only for the purpose of the study, to destroy or return the information when no longer needed, to specify the time period for destruction of information; and agreement to not re-disclose information. The appropriate Registrar must provide clearance for the release of and will maintain a record of all student records involved in the release. The University may release records or information from education records after the removal of all personally identifiable information or when the release is of de-identified student level data for the purpose of education research by attaching a code to each record that cannot be used to ascertain personally identifiable information about a student.
  7. Accrediting organizations to carry out their accrediting functions.
  8. An outside contractor, consultant, or other party who is acting for the University, subject to the written direction and security requirements of the University, and who is performing a service or function that the University would otherwise have to perform for itself.
  9. To initiate legal action against a parent or student, or to defend the University if a parent or student initiates legal action against the University, when the student’s education records are relevant to the legal action.
  10. Individuals requesting academic information for deceased students. The appropriate Registrar will evaluate each request for the release of a transcript or other academic records of a deceased student on the individual merits of that request. The University of Kansas may deny the request in whole or to release only part of the academic records that are requested.
  11. Officials of another school, school system, or postsecondary institution where a student seeks or intends to enroll, or is already enrolled, to supplement, update or correct any records sent by the University during the student’s application or transfer period.
  12. To a victim of an alleged perpetrator of a crime of violence or non-forcible sex offense, as defined in 8 U.S,C. 16, the final results of the disciplinary proceeding conducted by the University against the alleged perpetrator of that crime or offense, regardless of the conclusion. See Clery Act Compliance Information.
  13. To Veterans Administration officials pursuant to 38 U.S.C. 3690 (c).
  14. To the public concerning sex offenders and other individuals required to register under community notification programs.
  15. Information the university has designated as “directory information,” unless a hold has been placed upon release of the information by the student.
  16. As described by the Parental Notification Policy.

5. Notice to Third Parties

The University must inform the parties to whom personally identifiable information is given that they are not permitted to disclose that information to others without the written consent of the student and that the information is to be used only for the purpose(s) intended. However, parties to whom personally identifiable information is given may make further disclosures of the information if they are acting on behalf of the University and as directed by the University. The names of the additional parties to which the receiving party may disclose the information and the legitimate interests of each of these additional parties must be provided as part of the request process. If a third party outside the University permits access to personally identifiable information in violation of University policy, the University shall not permit access to information from education records to that third party for a period of not less than five (5) years. Once the third party that is acting on behalf of the University has finished the project or contract under which personally identifiable information is utilized, the third party shall be required to return the information to the University, or if directed by the University, to securely destroy and/or wipe systems containing such data.

6. Maintaining Education Records and Records of Requests and Disclosures

Each office that maintains education records shall adopt its own policy regarding the destruction of education records, subject to the University Record Retention policy. No education record, however, may be destroyed if there is an outstanding request or notice of pending request to inspect and review the record. Also, the record of requests for and disclosures of the education record and any explanations that are a part of the record must be maintained for as long as the education record to which it pertains is maintained.

The applicable record custodian shall maintain documentation of requests and disclosures of personally identifiable information from a student's education records. The record shall include, whether requests are granted or not, the name(s) of the person(s) who requested the information; the names of the additional parties to whom the receiving party may disclose the information on behalf of the University; and their legitimate interests in the information. Records of requests and disclosures will not be maintained for: (a) requests made by the student; (b) requests for which the student has given written consent; (c) requests made by school officials with legitimate educational interests; or (d) requests for directory information.

The record of requests and disclosures may be inspected by the student, by school officials responsible for the custody of the records, and by federal and state officials for the purpose of auditing record keeping procedures.

7. Complaint Procedure

If a student believes that the University is not in compliance with this policy and/or the Family Educational Rights and Privacy Act (FERPA), the student should check first with the office involved and/or the Office of the Vice Provost for Enrollment Management (Lawrence/Edwards campus), or the applicable Dean of Students (Medical Center).

If a student wishes to file a complaint with the federal government concerning the University's failure to comply with FERPA, the student must submit the complaint, in writing, to the Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue, SW, Washington, D.C. 20202-5920, (https://studentprivacy.ed.gov/file-a-complaint). The Family Policy Compliance Office will notify the student and the University when the complaint has been received. They will investigate the complaint, and may require further information. Following the investigation, they will provide written notification of findings and the basis for such findings. In the event the University is found not to comply, it will be afforded the necessary time to comply. If it does not then comply, additional action may be taken by the Family Policy Compliance Office. For guidelines concerning this complaint procedure, see 34 CFR Paragraph 99.64 and the subsequent regulations of the Family Educational Rights and Privacy Act.

Exclusions or Special Circumstances: 

Faculty, staff and/or student employees who violate this University policy may be subject to disciplinary action for misconduct and/or performance based on the administrative process appropriate to their employment.

Students who violate this University policy may be subject to proceedings for non-academic misconduct based upon their student status.

Faculty, staff, student employees and/or students may also be subject to the discontinuance of specified information technology services based on the policy violation.


Lawrence campus & all reporting units
Office of the University Registrar
1502 Building
1502 Iowa Street
Lawrence, KS 66045

KU Medical Center campus & all reporting units
Office of the Registrar
3901 Rainbow Boulevard
Mailstop 4005 
Kansas City, KS 66160

Approved by: 
Approved on: 
Wednesday, January 20, 2010
Effective on: 
Monday, March 1, 2010
Review Cycle: 
Annual (As Needed)

Attendance: Attendance at the University of Kansas is considered to begin on the announced first day of classes for the initial semester (Fall, Spring, or Summer) for which a person is enrolled in one or more classes and shall include any person “attending” on campus or by any electronic means (including for example webinar, correspondence, and the like) as prescribed by the class requirements. Non-credit bearing courses, workshops, seminars, etc. developed, targeted to external audiences, or consisting solely of minor children shall not be considered in attendance for the purposes of this policy, although information related these audiences should be treated in accordance with appropriate data handling and privacy policies and procedures.

Consent: Some University systems incorporate electronic provision of consent within the system (e.g., advising tool, on-line transcript request system, etc). In these systems, proper authentication will require a login with the KU Student on-line ID, secure password, and positive action to indicate release. Such authentication shall constitute consent. In all other cases, consent shall be in writing and shall be signed and dated by the student giving consent. For both written and electronic categories, the consent shall include (a) specification of records to be released; (b) purposes of such release; and (c) parties or class of parties to whom such records may be released.

Custodian of Student Records: Except as otherwise designated in this policy, the head of each academic or administrative unit is responsible for the education records within the unit. A list of custodians of primary records for the Lawrence and Edwards campuses is found in the document “Student Record Policy Records Custodians”. In all cases of subpoenas or court orders, these custodians should consult General Counsel. For all interpretations of this policy and/or if there is a question concerning privacy of the Education Record, these custodians should refer to the appropriate Registrar.

Directory Information: The student related directory information is defined by the University of Kansas as: name; current address and telephone number; permanent address and telephone number; e-mail address (except as limited below); level and school; month and day of birth; major field of study; enrollment status (full-time; half-time; less than half-time); dates of attendance; degrees, honors and awards received; the most recent previous educational institution attended by the student; participation in officially recognized activities and sports (including participation status); and height and weight of members of athletic teams. For purposes of official University news releases, or conducting University business and advancement, student photographs and parent name, address, telephone number and e-mail are also defined as directory information. To protect individual privacy, a student’s email address is not considered “directory information” where requests by non-university organizations for multiple e-mail addresses are made. The name(s), position(s), length of service and/or courses taught may be disclosed for student employees. Information not included above is not directory information and thus is to be maintained as confidential information; this includes but is not limited to Social Security Numbers and KU ID numbers.

Disclosure: Permitting access to or the release, transfer, or other communication of any part or all of the education records of the student or the personally identifiable information contained therein, orally, in writing, by any electronic means, or by any other means to any party. Disclosure does not include the return of the Education Record from an instructor to the student, so long as the student may inspect the Education Record in the possession of the instructor. Release of information from education records as required or permitted by law will not be considered a disclosure under this policy.

Education Records: Those records that are directly related to a student and that are maintained by the University or by a party acting for the University. A record means any information recorded in any way, including, but not limited to, handwriting, print, copmuter media, video-tape, audiotape, film, microfilm, microfiche, and email.

Records described in items 1-5 below are excluded from the category of ''education records,'' therefore, the law does not guarantee the right of student access to the following:

  1. Records created by and kept in the sole possession of an individual staff member that are not revealed to any other individual except to a person who might temporarily substitute for the original staff member.
  2. Medical and psychological records that are maintained only in connection with provision of treatment to the student and that are not available to persons other than those providing treatment except that such records may be personally reviewed by a physician or other appropriate professional of the student's choice and with the student's written consent.
  3. Records that contain only information relating to a person after that person is no longer a student at the University. An example would be information collected by the University or the Alumni Association pertaining to the accomplishments of an alumnus/alumna.
  4. Employment records of any person if maintained in the normal course of business and used only for purposes relating to the employment, unless the person is employed at the University only because of status as a student. In such cases, student employment records are education records and are covered by this policy.
  5. Records of the KU Police Department and the KUMC Public Safety Department created and maintained by those departments for the purpose of law enforcement.

Electronic Authentication System: At the University of Kansas electronic authentication consists of a unique on-line ID and a strong password intended to be known only by the user. The e-signature is used to electronically access systems at the University. It is NOT communicated in written or oral form to permit access and/or signify consent.

Legitimate Educational Interests: The interest of University personnel who have a demonstrably legitimate need to review records in order to fulfill their official professional responsibilities. Such responsibilities must involve the University in its primary educational and scholarly functions and/or secondary administrative functions of maintaining property, disbursing funds, keeping records, providing living accommodations and other services, sponsoring activities, recognizing student educational achievements, and protecting the health and safety of persons or property in the University community. If a question arises concerning the legitimacy of a request to review records, such questions shall be referred to the appropriate Registrar.

Parent: Includes a parent, a guardian, or an individual acting as a parent of a student in the absence of a parent or guardian.

Personally Identifiable Information: Includes the name of the student, the student's parent or other family members, the address of the student or parent, personal identifiers such as social security or student numbers, personal characteristics or information requested by a person whom the University reasonably believes knows the identity of the student to whom the education record relates. In cases where aggregate data is released, this definition includes any cell sizes with five or fewer students.

School Official: Faculty, staff, student employees, or committees (when the members of the committee are appointed or elected to an officially constituted committee) who perform a function or task on behalf of, and at the request of, the University, its faculty, colleges, schools, departments or units are School Officials for purposes of this policy. Additionally, agencies, organizations, contractors, consultants, volunteers and other outside service providers officially acting on behalf of the University and subject to the control of the University and that provide services, functions or conducts research the University would otherwise perform itself are considered school officials for the purposes of this policy (including, but not limited to accountants, attorneys, degree or transcript services, testing services, computer security services).

Student: For purposes of this policy, an eligible student is anyone who is currently attending or who has previously attended the University of Kansas. with the following exceptions:

  1. A person who has applied for admission to, but has never been in attendance at, a component unit of the University (such as the various schools and colleges of the University), even if that individual is or has been in attendance at another component unit of the University, is not considered to be a student with respect to the component to which an application for admission has been made.
  2. A minor who is taking non-credit classes, workshops, seminars, clinics, camps etc. designed and targeted exclusively for minor children.
  3. Attendees at conferences, seminars, workshops or similar activities for which University academic credit is not conferred.

See also “Attendance”.

Student Records; Personally Identifiable Information; Directory Information; FERPA; Educational Records; Legitimate Educational Interests
Change History: 

03/05/2024: Added KUMC link.
02/28/2024: Updated applicable record custodian and removed campus processes to procedural document.
12/07/2023: Updated Office of Public Safety to KU Police Department to reflect department name change.
11/09/2023: Updated broken links.
03/27/2023: Updated broken link.
03/01/2023: Updated contact section.
12/10/2021: Updated internal link.
02/20/2020: Fixed broken link.
08/15/2018: Updated the campus section to match policy statement.
07/11/2016: Updated to remove gendered pronouns.
10/27/2014: Updated references to Health Services in 4.V. to read "Watkins Health Services", consistent with recent unit name change.
10/16/2014: Policy formatting cleanup (e.g., bolding, spacing).
06/26/2013: major revisions in formatting and content to comply with FERPA amendments, implementation of Alcohol Notification Policy and relocation to Policy Library.
(11/29/05 Contact information updated in "Primary Records Custodians and Locations on Lawrence Campus" section.)
(07/28/04 Contact information updated in "Primary Records Custodians and Locations on Lawrence Campus" section.)
(05/26/04 Contact information updated in "Primary Records Custodians and Locations on Lawrence Campus" section.)
Revised Policy approved July 2001
Original adoption date January 1, 1975

Information Access & Technology Categories: 
Information Access
Privacy & Security

Can't Find What You're Looking For?
Policy Library Search
KU Today
One of 34 U.S. public institutions in the prestigious Association of American Universities
Nearly $290 million in financial aid annually
44 nationally ranked graduate programs.
—U.S. News & World Report
Top 50 nationwide for size of library collection.
23rd nationwide for service to veterans —"Best for Vets," Military Times