IV.J. Policy on the Confidentiality of Student Records

(Source: Provost’s Memorandum 18-69, December 8, 1969; revised, Office of the Provost, Almanac, February 1, 1977; revised, Almanac, April 29, 1997; revised, Almanac, December 14, 1999; revised, Almanac, March 16, 2010)

I. Statement of Purpose

The purpose of this policy is to describe the rights and responsibilities of students, faculty and staff regarding the confidentiality of student records, including as specified under the Family Educational Rights and Privacy Act (FERPA).

II. Scope

A. Information

This policy pertains to personally identifiable information1 contained in education records.  The term “education records” generally includes records that are directly related to a student and maintained by the University or a party acting for the University. 

Exceptions:

  1. Sole possession of the maker. This policy does not apply to records kept in the sole possession of the maker and used only as a personal memory aid and not accessible to any other individual except a temporary substitute of the maker of the record.
  2. Peer graded papers. This policy does not apply to grades on peer-graded papers/assignments before they are collected and recorded by a teacher. 
  3. Law enforcement records. This policy does not apply to records created and maintained by a law enforcement unit, including the Penn Police, for law enforcement purposes. 
  4. Employment records. This policy does not apply to records relating exclusively to an individual in his or her capacity as an employee except for records regarding an individual in attendance who is employed as a result of his or her status as a student. 
  5. Treatment-related records. This policy does not apply to records made or maintained by a healthcare professional that are used only in connection with treatment of the student and disclosed only to individuals providing treatment. 
  6. Other FERPA exceptions. This policy does not apply to any records or information specifically excepted from the term “education records” under FERPA and its implementing regulations, as they may be amended.

B. Individuals

  1. Individuals in attendance. This policy applies to students who are or have been in attendance at the University. 
  2. Alumni.  In general, this policy does not apply to records that contain only information about an individual after he or she is no longer a student at the University.  However, if the record relates back to the student’s attendance at the University, it is still an “education record.”  A separate policy protecting the privacy of alumni records may be found at www.upenn.edu/privacy. 
  3. Deceased individuals. Neither FERPA nor this policy applies to records of deceased persons. The person responsible for such records, however, should exercise informed discretion in responding to requests for disclosures and should ensure that the person making the request has a legitimate interest in the information and that the privacy interests of the deceased and third parties are considered. 
  4. Applicants.  This policy does not apply to applicants for admission.  However, the admission-related records of applicants who become students at the University are subject to the policy. 

III. Notice

Penn will annually inform individuals in attendance of their rights under FERPA, including the right to consent to disclosure of personally identifiable information contained in their education records, the right to opt out of the disclosure of “directory information,” the right to review and seek correction of education records, and the right to file a complaint with the Department of Education concerning the University’s alleged failure to comply with FERPA.

IV. Disclosure of Education Records

A. Consent Required

As a general rule, personally identifiable information from education records may not be disclosed to other parties without the student’s prior written or electronic consent. Such consent shall be signed (on paper or using an appropriate electronic signature method) and dated and specify records or information to be disclosed, the purpose(s) of the disclosure, and the party or class of parties to whom disclosure may be made.

B. Consent Not Required

In certain cases (some of which are described below) personally identifiable information from education records may, and in some cases must, be disclosed from the records of a student without that individual’s prior written consent. If such disclosure is made, it should be limited to that information necessary for the purpose of the disclosure. Note also that specific requirements and qualifications may apply to these exceptions.

  1. To “school officials” with “legitimate educational interests.”
    1. “School officials” means employees of the University, including faculty and staff, as well as certain individuals such as vendors or contractors, performing work for the University under proper authorization.
    2. A school official has “legitimate educational interests” in personally identifiable information in the records of a student if the information in question is required or would be helpful to the official in the performance of his or her duties.
    3. A contractor, consultant, volunteer, or other party to whom the University has outsourced services may be considered a school official provided that the outside party (1) performs a service for which the University would otherwise use its employees (2) is under the direct control of the University with respect to the use and maintenance of education records and (3) is subject to FERPA requirement governing the use and redisclosure of personally identifiable information from education records. 
    4. The University must use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests. Custodians of records will establish control procedures to ensure that these limitations are observed. If the custodian does not use physical or technological access controls, the custodian must ensure that its administrative policy for controlling access to education records is effective.
  2. To another school where the student seeks or intends to enroll or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer and the University has provided notice of the disclosure or annual notice of its policy to make such disclosures.
  3. In connection with financial aid for which a student has applied, or which he or she has received, but only for such purposes as determining eligibility for financial aid, the amount of financial aid, and the conditions that will be imposed, or for enforcing the terms or conditions of financial aid.
  4. To comply with a judicial order or lawfully issued subpoena provided that the University makes a reasonable effort to notify the student whose records are involved in advance of disclosing the information. Prior notification may be prohibited in certain situations. All subpoenas and court orders should be directed to the Office of General Counsel and disclosure in response to them must be approved by that office.
  5. In connection with an emergency, to appropriate persons if knowledge of the information is necessary to protect the health or safety of the student or other individuals.
  6. To parents as described in Section IV. (c) below.
  7. Regarding directory information as described in Section IV. (d) below.
  8. Other circumstances as authorized by FERPA and its implementing regulations, as they may be amended or as otherwise required by law. Questions about legal requirements should be directed to the Office of General Counsel.

C. Parental Notification—Consent Not Required

The University’s policy regarding disclosure of student information to parents is based both upon legal requirements and the University’s philosophy that students should be treated as adults. The University generally will not share personally identifiable information (other than directory information) from a student’s education records with third parties, including parents or guardians, without student consent, except in limited circumstances where such disclosure is permitted under FERPA (described  below) and where the University determines in its discretion that disclosure is appropriate.

  1. In connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. 
  2. To the parent or legal guardian of a student under the age of 21, information regarding the student’s violation of a University policy governing the use or possession of alcohol or drugs. 
  3. To a person who submits a written affirmation that he or she is the parent or legal guardian of a student and that the student is a dependent within the meaning of Section 152 of the Internal Revenue Code of 1954. 
  4. In other limited circumstances as allowed under FERPA and its implementing regulations, as they may be amended. 

In cases involving a health or safety emergency or a violation of a University policy regarding the use or possession of alcohol or drugs, a decision to notify parents or guardians about information contained in an education record—and the actual communications to the parents or guardians—will be made by the Office of the Vice Provost for University Life or another senior student affairs officer, in each case after consultation with the student’s school office and other appropriate offices. Whenever practicable, a student whose parents or guardians are to be notified will be informed before such notification occurs and given an opportunity to initiate contact with his or her parents or guardians. 

D. Consent Not Required—Directory Information

“Directory Information” is generally regarded to be less sensitive than other types of information in a student’s education record.  The University designates as “directory information,” which may be disclosed from records relating to a student without his or her consent if the student has not “opted out” of allowing such disclosure, the following categories of information: a student’s name, address (local, home or electronic mail), telephone number, date and place of birth, Penn ID number, major field of study, participation in officially recognized activities (including social and honorary fraternities) and sports, weight and height if a member of an athletic team, dates of attendance, degrees and awards received, and previous educational institutions attended. 

Each year, a notice will be given to students concerning these categories and their right to refuse to permit the University to make any or all of them available (i.e., “opt out”). Failure to respond to the annual notice in certain cases may result in the routine disclosure of one or more of the designated categories of personally identifiable information. The University will continue to exercise informed discretion in responding to requests for directory information. 

E. Limitation on Redisclosure

As required by FERPA, the University will inform a party to whom a disclosure of personally identifiable information from the records of a student is made; that disclosure is made only on the condition that the party will not disclose the information to any other party without the student’s prior written consent. Exceptions to this requirement include disclosure of directory information, disclosures to the student, to parents under appropriate circumstances, to victims of certain disciplinary matters, and disclosures pursuant to court orders and valid subpoenas. 

F. Verification of Identity and Authority

Before disclosing personally identifiable information from education records, University employees must take reasonable steps to verify the identity of the requesting party as well as their authority to have access to the information. 

V. Maintaining a Record of Disclosures

As required by FERPA, the University will maintain a record of requests for and/or disclosures of personally identifiable information from a student’s education records. The record must include the identities of the requesters and recipients and the legitimate interests they had in the information.  This record should be maintained with records for as long as the records themselves are maintained and may be inspected by the student.

These recordkeeping requirements do not apply to requests from or disclosures to:

  1. the student;
  2. a school official with a legitimate educational interest;
  3. a person with written consent from the student;
  4. a person seeking directory information; or
  5. a federal grand jury or law enforcement agency in connection with an order or subpoena requiring

VI. Right to Review Education Records & Seek Correction

A. Individuals who are or have been in attendance at the University are entitled to inspect and review their education records upon a written request. The request to inspect or review records must be honored within 45 days after the University has received the request. The request should be directed to the office that maintains the record and such office may charge a reasonable fee for copies.

B. A student does not have a right to inspect or review the following:

  1. Financial records and statements of the student’s parent(s), except with the written permission of the parent(s).
  2. Confidential letters and statements of recommendation related to admission to an educational institution, application for employment, or the receipt of an honor or honorary recognition that were placed in a student’s records after January 1, 1975, and as to which the student has executed a written waiver of his or her right to inspect and review; provided that the University uses the letters and statements only for the purpose for which they were originally intended and notifies the student upon request of the names of all individuals providing such letters and statements. 
  3. Other records as to which the student has executed a written waiver of his or her right to inspect and review. The University may not require a student to waive his or her rights under FERPA or this policy.
  4. Those portions of records that contain information on other students.
  5. Other exceptions as prescribed by FERPA and its implementing regulations, as they may be amended. 

C. Opportunity to Seek Correction

  1. A student who believes that information contained in his or her education records is inaccurate or misleading or violates his or her privacy rights may request that the University amend them, and the University will decide whether to do so within a reasonable period of time.
  2. If the University decides that the information is inaccurate or misleading or otherwise in violation of the privacy rights of a student, the University will amend the record and inform the student of the amendment in writing. 
  3. If the University declines to amend the student’s records, it will so inform the student and inform him or her of the right to request a hearing to challenge the information believed to be inaccurate, misleading or in violation of his or her privacy rights. A hearing, however, may not be requested by a student to contest the appropriateness of a grade. 
  4. The hearing will be conducted by an individual who does not have a direct interest in the outcome of the hearing and will provide the student an opportunity to present evidence, relevant to the request to amend the student’s records. The University will provide a written decision within a reasonable period of time after the hearing based on the evidence presented at the hearing.  The decision will include a summary of the evidence and the reasons for the decision. Additionally, information regarding hearing procedures will be provided when the student receives notice of his or her rights.
  5. If, after a hearing, the University determines that a student’s challenge is without merit it will notify the student of the right to place in his or her records a statement commenting on the challenged information and/or setting forth reasons for disagreeing with the University’s decision. The University will maintain such statement with the student’s record and disclose the statement whenever it discloses the portion of the record to which the statement relates.

VII. Right to File Complaint

Students have a right to file a complaint concerning any alleged failure by the University to comply with the requirements of FERPA and its implementing regulations. A complaint may be filed with the federal office that administers FERPA: 

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-5901

A complaint may be filed internally via the University’s Compliance and Reporting Line by phone at (215) 726-6759 or online at www.upenn.edu/215pcomply.

VIII. Waiver of Rights

A student may waive any of his or her rights under FERPA and this policy, provided that the waiver is made in writing and signed by the student. The University may not require a student to waive his or her rights under FERPA or this policy. 

1

The term “personally identifiable information” includes, but is not limited to, the name of the student or family member, the address of the student or family member, identification number, biometric record, indirect identifier (such as date of birth or mother’s maiden name) or other information that, alone or in combination, is linked to the student and would allow a reasonable person in the school community, without personal knowledge of relevant circumstances, to identify the student with reasonable certainty.