Student Records Policy

1. Overview

The University of Kansas protects the privacy of its students’ education records in compliance with the federal Family Educational Rights and Privacy Act (FERPA) and its implementing regulations. FERPA and this policy also provide students the right to inspect and review their educational records. A notice of this policy is published each year on the Office of the University Registrar website. Notification of this publication is made annually to enrolled students via email.

2. Student Access to Education Records

A student has the right and shall be accorded the opportunity to inspect, review, and/or receive copies of the student's educational records upon written request to the appropriate record custodian. Requests must be submitted in accordance with the applicable campus procedures for the University of Kansas Medical Center (KUMC) and all reporting units and University of Kansas Lawrence Campus (KUL) and all reporting units.

The University must comply with the student's request within a reasonable period, not to exceed 45 days after the request is received.

Copies may be provided at the student's request and expense; however, the charge to the student for any such records, except for official academic transcripts, statements of degree and enrollment certifications may not exceed the copy charges allowed by the University (see the Comprehensive Fee Schedule). The University may not charge a fee to search for or retrieve a record requested by a student regarding only the education record. The student shall be asked to provide the student's University I.D. and/or other government issued/approved identification to receive and/or view the student’s educational records.

Academic transcript and diploma requests may be denied in connection with disciplinary actions resulting from academic or non-academic misconduct.

The University is not required to allow inspection and review of the following records:

1. Financial records of the student's parents submitted as part of the financial aid process or for other official University purpose;
2. Confidential letters and statements of recommendation that were placed in the student's education records prior to January 1, 1975, as long as they are used only for the purpose for which they were specifically intended; and
3. Confidential letters and statements of recommendation received after January 1, 1975, for which the student has signed a waiver of the right to access and that pertain to (a) admission to this or any other educational institution or agency; (b) application for employment; or (c) receipt of an honor or honorary recognition; so long as these letters are used solely for the purpose for which they were specifically intended.

If an education record contains information on more than one student, the student may inspect only the information about their records.

3. Waiver of Rights

The University may request, but not require, students to waive rights under this policy. The waivers must be in writing and signed by the student, or must be positively indicated electronically and include appropriate electronic authorization. A student may waive the right to inspect and review confidential statements and confidential letters of recommendation only if: (a) the student, upon request, is notified of the names of all persons providing letters/statements; (b) the letters/ statements are used only for the purpose for which they were originally intended; (c) the waiver is not required as a condition of admission to or for any other service or benefit of the University.

The student may revoke any waiver in writing, the revocation may only apply to documents received or entered into the record after the date of execution of the revocation.

4. Disclosure of "Personally Identifiable" and "Directory Information"

The University shall obtain the written consent, or system consent via appropriate electronic authorization in an authorized University system from the student before disclosing personally identifiable information from the education records of the student, other than directory information, except as otherwise provided in this policy.

The University may, without the consent of the student, disclose directory information. If a student wishes to have such information withheld, the student must notify the appropriate Registrar either in writing, or via an authorized University system requiring electronic authentication. This notification may occur at any time; however, if a student wishes to prevent the publication of directory information in the University telephone directory, the student must notify the appropriate Registrar by the end of the first week of the term.

The University may disclose personally identifiable information from a student’s Education Record(s) without the consent of the student if the disclosure is made to:

1. School officials within the institution determined to have a legitimate educational interest(s).
2. Authorized persons to comply with a judicial order or lawfully issued subpoena, provided the University makes a reasonable effort to notify the student in advance of compliance; except the University will not disclose to the student information about a grand jury subpoena, a subpoena issued for a law enforcement purpose when notice is prohibited, or a court order obtained by the United States Attorney General or Assistant Attorney General in investigations or prosecutions of certain criminal offenses or an act of terrorism, in accordance with law or regulation. certain officials of the U.S. Department of Education, the Comptroller General and state and local educational authorities in connection with an audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs.
3. Financial aid personnel in conjunction with an application for or receipt of financial assistance, provided that the disclosure is needed: (a) to determine the eligibility of the student for financial aid; (b) to determine the amount of financial aid; (c) to determine the conditions that will be imposed; or (d) to enforce the terms or conditions of the financial aid.
4. Parent(s) or legal guardian(s) of dependent students who provide a written request for grades to the University Registrar pursuant to Board of Regents policy. Dependency, for this purpose, is defined by the Internal Revenue Code of 1954, Section 152. The student will be notified in writing and/or electronically of any disclosure of grades made to the student's parent(s) or legal guardian(s).
5. Appropriate parties, including parents, in connection with an emergency, if knowledge of the information is necessary to protect the health or safety of the student or other individuals. In deciding to disclose personally identifiable information from an education record in a health and safety emergency, the University shall take into account the totality of the circumstances pertaining to the threat or health of the student or other individuals. If the University determines that there is an articulable and significant threat to the health or safety of the student or other individuals, disclosure may be made to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individuals. All disclosures will be documented. Kansas Department of Health and the Environment (KDHE) or local law enforcement officials for the following purposes: Watkins Health Services is required to report to KDHE the names and current address of students who have certain communicable diseases, including hepatitis, tuberculosis and sexually transmitted diseases. Additionally, Watkins Health Services is required to report to local law enforcement officials the name of any student who is wounded with a deadly weapon.
6. Organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, or administer predictive tests; to administer student aid programs; to improve instruction or services in a manner that does not permit personal identification of students by individuals other than representatives of the organizations that have legitimate interests in the information. The University and the organization will enter into a written agreement, containing: the purpose, scope, and duration of the study, and the information to be disclosed in the study; restrictions to use information only for the purpose of the study, to destroy or return the information when no longer needed, to specify the time period for destruction of information; and agreement to not re-disclose information. The appropriate Registrar must provide clearance for the release of and will maintain a record of all student records involved in the release. The University may release records or information from education records after the removal of all personally identifiable information or when the release is of de-identified student level data for the purpose of education research by attaching a code to each record that cannot be used to ascertain personally identifiable information about a student.
7. Accrediting organizations to carry out their accrediting functions.
8. An outside contractor, consultant, or other party who is acting for the University, subject to the written direction and security requirements of the University, and who is performing a service or function that the University would otherwise have to perform for itself.
9. To initiate legal action against a parent or student, or to defend the University if a parent or student initiates legal action against the University, when the student’s education records are relevant to the legal action.
10. Individuals requesting academic information for deceased students. The appropriate Registrar will evaluate each request for the release of a transcript or other academic records of a deceased student on the individual merits of that request. The University of Kansas may deny the request in whole or to release only part of the academic records that are requested.
11. Officials of another school, school system, or postsecondary institution where a student seeks or intends to enroll, or is already enrolled, to supplement, update or correct any records sent by the University during the student’s application or transfer period.
12. To a victim of an alleged perpetrator of a crime of violence or non-forcible sex offense, as defined in 8 U.S,C. 16, the final results of the disciplinary proceeding conducted by the University against the alleged perpetrator of that crime or offense, regardless of the conclusion. See Clery Act Compliance Information.
13. To Veterans Administration officials pursuant to 38 U.S.C. 3690 (c).
14. To the public concerning sex offenders and other individuals required to register under community notification programs.
15. Information the university has designated as “directory information,” unless a hold has been placed upon release of the information by the student.
16. As described by the Parental Notification Policy.

5. Notice to Third Parties

The University must inform the parties to whom personally identifiable information is given that they are not permitted to disclose that information to others without the written consent of the student and that the information is to be used only for the purpose(s) intended. However, parties to whom personally identifiable information is given may make further disclosures of the information if they are acting on behalf of the University and as directed by the University. The names of the additional parties to which the receiving party may disclose the information and the legitimate interests of each of these additional parties must be provided as part of the request process. If a third party outside the University permits access to personally identifiable information in violation of University policy, the University shall not permit access to information from education records to that third party for a period of not less than five (5) years. Once the third party that is acting on behalf of the University has finished the project or contract under which personally identifiable information is utilized, the third party shall be required to return the information to the University, or if directed by the University, to securely destroy and/or wipe systems containing such data.

6. Maintaining Education Records and Records of Requests and Disclosures

Each office that maintains education records shall adopt its own policy regarding the destruction of education records, subject to the University Record Retention policy. No education record, however, may be destroyed if there is an outstanding request or notice of pending request to inspect and review the record. Also, the record of requests for and disclosures of the education record and any explanations that are a part of the record must be maintained for as long as the education record to which it pertains is maintained.

The applicable record custodian shall maintain documentation of requests and disclosures of personally identifiable information from a student's education records. The record shall include, whether requests are granted or not, the name(s) of the person(s) who requested the information; the names of the additional parties to whom the receiving party may disclose the information on behalf of the University; and their legitimate interests in the information. Records of requests and disclosures will not be maintained for: (a) requests made by the student; (b) requests for which the student has given written consent; (c) requests made by school officials with legitimate educational interests; or (d) requests for directory information.

The record of requests and disclosures may be inspected by the student, by school officials responsible for the custody of the records, and by federal and state officials for the purpose of auditing record keeping procedures.

7. Complaint Procedure

If a student believes that the University is not in compliance with this policy and/or the Family Educational Rights and Privacy Act (FERPA), the student should check first with the office involved and/or the Office of the Vice Provost for Enrollment Management (Lawrence/Edwards campus), or the applicable Dean of Students (Medical Center).

If a student wishes to file a complaint with the federal government concerning the University's failure to comply with FERPA, the student must submit the complaint, in writing, to the Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue, SW, Washington, D.C. 20202-5920, (https://studentprivacy.ed.gov/file-a-complaint). The Family Policy Compliance Office will notify the student and the University when the complaint has been received. They will investigate the complaint, and may require further information. Following the investigation, they will provide written notification of findings and the basis for such findings. In the event the University is found not to comply, it will be afforded the necessary time to comply. If it does not then comply, additional action may be taken by the Family Policy Compliance Office. For guidelines concerning this complaint procedure, see 34 CFR Paragraph 99.64 and the subsequent regulations of the Family Educational Rights and Privacy Act.