JO - Student Records and Data Protection

1. PURPOSE AND PHILOSOPHY

The Board of Education of Nebo School District values the privacy and confidentiality of personal information disclosed by students and their parents to District schools. The District maintains and uses certain personal information for a variety of educational purposes to meet the needs of students. The Board recognizes that students and their parents entrust the District with personal information and expect that it be kept secure and confidential. 

State and federal laws require the District to protect the privacy of student data and education records and to ensure parental access. The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g, 34 CFR Part 99, governs access to education records. Likewise, Title 53E, Chapter 9 of the Utah Code, Student Privacy and Data Protection, requires the District to adopt policies to protect personally identifiable student data. Utah Code Ann. § 53E-9-101, et seq. Some records and information are granted additional protections by other laws. Nebo School District complies with all state and federal student privacy laws. 

This policy is adopted to communicate to employees and patrons the District’s obligations under state and federal student data privacy laws and to outline procedures to ensure compliance therewith. 

2. DEFINITIONS

“Attendance” includes, but is not limited to, (a) attendance in person or by paper correspondence, videoconference, satellite, internet, or other electronic information and telecommunications technologies for students who are not physically present in the classroom; and (b) the period during which a person is working under a work-study program. 

“Cumulative File” refers to a physical file that is maintained at the school’s main office and that typically contains the following information: immunization records, birth certificate, academic record, parent contact information, etc. A cumulative file shall be maintained for each student from entrance into District schools until withdrawal or graduation from the District. This cumulative file shall move with the student from school to school and be maintained at the school where currently enrolled until graduation or withdrawal. Records for non-enrolled students shall be retained for the period of time required by law. 

“Dates of Attendance” means the period of time during which a student attends or attended a District school. Examples include an academic year or a particular term. However, dates of attendance does not include specific daily records of a student’s attendance. 

“Directory Information” means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. 

Directory information includes, but is not limited to, the following student information:

Name;

Address;

Telephone listing;

Email address;

Photographs, videos, and other likenesses;

Major field of study;

Grade level (not to be confused with academic grade or any other indicator of a student’s academic progress or content mastery);

Teachers’ names;

Enrollment status (e.g., full-time or part-time);

Dates of Attendance;

Participation in officially recognized activities and sports;

Weight and height of members of athletic teams;

Degrees, honors, and awards received; and

The most recent educational agency or institution attended.

Directory information does not include a student’s social security number in whole or in part. 

Directory information does not generally include a student identification number. However, directory information may include a student identification number used by the student for purposes of accessing or communicating in electronic systems, but only if the student identification number cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a personal identification number (PIN), password, or other factor known or possessed only by the authorized user. 

“Education Records” is used as defined by FERPA and means those records, files, documents, and other materials that contain information directly related to a student and that are maintained by the District or by a person acting for the District. Education Records are more fully described in section 3 of this policy. The term “education records” does not include:

Records or personal notes made by District personnel that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to anyone other than a temporary, approved substitute.

Records maintained by law enforcement officers.

Records relating to a student who is employed by the District that (a) are made and maintained in the normal course of business, (b) relate exclusively to the student in the student’s capacity as an employee, and (c) are not available for use for any other purpose. Records relating to a student who is employed as a result of his or her status as a student are education records and are not excepted under this paragraph. 

Records created or received by the District after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student. 

Grades on peer-graded papers before they are collected and recorded by a teacher. 

“Parent” means a parent of a student and includes a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian. 

“Personally Identifiable Information” includes, but is not limited to, the following:

The student’s name;

The name of the student’s parent or other family members;

The address of the student or student’s family; 

A personal identifier, such as the student’s social security number, student number, or biometric record;

Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name; 

Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or

Information requested by a person who the District reasonably believes knows the identity of the student to whom the education record relates. 

“Personally Identifiable Student Data” means student data that identifies or is used to identify a student and includes the data listed under the definition in Utah Code Ann. § 53E-9-301. 

“Record” means any information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche. 

“Student” means any individual who is or has been in attendance at a District school and for whom the District maintains education records. 

3. EDUCATION RECORDS

Each principal is the records custodian for the education records located at the school. These records may include, but are not limited to, the following:

Admission data, including student name, parent name(s), address, phone number, and birth certificate. 

Standardized test data, including intelligence, aptitude, interest, personality, and social adjustment ratings.

All achievement records, as determined by tests, recorded grades and teacher evaluation. However, grades on assignments, including peer-graded assignments, are not education records until the teacher has collected them and recorded them in the gradebook.

Health services records, including: 

The results of a tuberculin test required by the District. 

The findings of screening or health appraisal programs the District conducts or provides. 

Immunization records. Consistent with Nebo School District Policy JHCB, Immunization of Students, each school shall maintain an individual immunization record during the period of attendance for each student admitted. The school shall cooperate with other districts in transferring students’ immunization records when requested.

Attendance records. 

Student questionnaires. 

Records of teacher, counselor, or administrative conferences with the student or pertaining to the student. 

Verified reports of serious or recurrent behavior patterns. 

Copies of correspondence with parents and others concerned with the student. 

Records transferred from other districts in which the student was enrolled. 

Records pertaining to participation in extracurricular activities. 

Information relating to student participation in special programs. 

Records of fees assessed and paid. 

Transcripts. 

Other records that may contribute to an understanding of the student. 

Directory Information

Directory information, as defined in subsection 2.4, may, at the discretion of the principal or his/her designee, be released to appropriate individuals or organizations that file a written request at the school.

The District shall give annual public notice that includes, but is not limited to, the following:

The types of personally identifiable information that it has designated as directory information. 

The right of the parent to refuse to permit the school to designate information about the student as directory information. 

The period of time within which the parent must notify the school in writing that he or she does not want any or all of those types of information about the student designated as directory information. 

Records Retention

Student records shall be retained in accordance with Utah Code Ann. § 53E-9-306, § 63G-2-604, and Utah Admin. Code R277-487. Except as provided in paragraph 3.3.2, records may be destroyed or expunged according to retention schedules adopted by District policy or by the Utah State Archives

Student records shall be retained as long as the District has an administrative need for the records. 

4. ACCESS TO EDUCATION RECORDS

Access By Parents

Except as provided in paragraph 4.1.2 or 4.1.5, or as further restricted under section 7, parents have a right to inspect and review the education records of their children. Access to the education records of a student who is or has been in attendance at a school in the District shall be granted to the parent of the student who is a minor or who is a dependent for tax purposes.

The school shall presume that each parent, regardless of custody designation, has authority to inspect and review their student’s records unless the school has been provided a copy of a court order, state statute, or other legally binding document that specifically revokes these rights.

A parent’s right to inspect and review his or her student’s education record includes the right to access attendance records, test scores, grades, psychological records, applications for admission to other schools/colleges, and health or immunization information.

Notwithstanding the transfer of rights provided in paragraph 4.2.2, a parent who claims a student as a dependent when filing taxes retains the right to access the student’s education record.

If material in the education record of a student includes information on another student, only the portion of the material relating to the student whose records were requested may be inspected and reviewed. 

Access By Students

Notwithstanding the rights afforded to parents in subsection 4.1, students in Nebo School District may also inspect and review their own education records in accordance with procedures set forth by the school that maintains the records. 

When a student reaches eighteen (18) years of age or is attending an institution of post-secondary education, the rights accorded to, and consent required of, parents transfer from the parents to the student. 

Access By School Officials

School officials who have a legitimate educational interest in a student’s education record may access the record without parental consent.

For the purpose of this policy, “school official” shall mean an employee or agent of the District or of facilities with which the District contracts for placement of students with disabilities. The term also includes attorneys, consultants, and independent contractors, including providers of online educational services, who are retained by the District or by facilities with which the District contracts for placement of students with disabilities. 

The “school official exception” applies to third party contractors, including an online educational service provider, as long as the contractor: (1) performs an institutional service or function for which the District would otherwise use its own employees; (2)  has been determined to meet the criteria set forth in the District’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records or PII; (3) is under the direct control of the District regarding the use and maintenance of the education records or PII; and (4) uses the education records or PII only for authorized purposes and does not re-disclose the education records or PII to other parties (unless the provider has specific authorization from the District to do so and it is otherwise permitted by FERPA. 

In order to ensure that online educational services, whether paid or free services, do not present a risk to the privacy or security of students’ data or to school or District IT systems, online educational services must be approved by school or District administrators prior to implementation. 

Agreements with online educational service providers that use and share student information under the school official exception shall ensure the following and must be approved by the District Student Data Manager: 

The purposes for which the provider may use student information are clearly defined, ensuring compliance with FERPA and PPRA, particularly with regard to PII in student education records. 

The ways in which the school or District will exercise direct control over the provider’s use and maintenance of student data are specified. This should include requirements and restrictions related to the provider’s collection, use, storage, and sharing of student data.

That at the request of the school District, the District may audit the provider to verify compliance with the contract. 

If student education records will be maintained by the provider, how the school or District will access records upon parental request are specified.

At the completion of the contract with the District, if the contract has not been renewed, the provider shall return or delete all personally identifiable student data under the District’s control, unless a student or the student’s parent consents to the maintenance of the PII. 

Teachers and staff shall seek administrative approval before entering into agreements with providers, including free online educational services, and only administrators authorized under Nebo School District Policy DJC, Contracting Procedures and Authority, may sign contracts. 

Approval from a school or District administrator must be granted before entering into not only formal contracts, but also for consumer-oriented “click-wrap” software that is acquired simply by clicking “accept” to the provider’s terms of service. 

School officials have a legitimate educational interest in a student’s records when they are working with the student, considering disciplinary or academic actions, reviewing an individualized education program (IEP) for a student with disabilities, compiling statistical data, or investigating or evaluating programs that may involve the student.

Access By Other Persons

Personally identifiable information in education records shall not be released, except to the following:

Individuals for whom the parent has given written consent. Parents should use the District Consent to Release Educational Records of Student form. 

School officials, as described in subsection 4.3, including teachers, who have legitimate educational interests. 

Officials of other schools, school systems, or institutions of postsecondary education in which the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer. 

Authorized representatives of the Comptroller General of the United States, the Secretary of Education, or state and local educational authorities who require access to student or other records necessary in connection with the audit and evaluation of federal or state supported education programs or in connection with the enforcement of or compliance with federal legal requirements that relate to such programs. 

Personnel involved with the student’s application for, or receipt of, financial aid. 

Organizations conducting studies for educational agencies or institutions for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instruction. Such studies must be conducted so that personal identification of students and their parents will not be revealed to persons other than authorized personnel of the organizations conducting the studies. 

Accrediting organizations that require the information for purposes of accreditation. 

Parents of a student who is a dependent for tax purposes. 

The student.

Individuals authorized by a judicial order or lawfully issued subpoena. 

Appropriate persons who, in an emergency, must have such information in order to protect the health or safety of the student or other person.

Persons or organizations authorized in writing by the school’s administration to obtain directory information. 

An agency caseworker or other representative of a state or local child welfare agency who provides documentation showing the right of that caseworker or representative to access the particular student’s case plan

The parent shall provide a signed and dated written consent before the school discloses personally identifiable information from a student’s education records to any individual, agency, or organization other than the parent, the student, or those listed in subsection 4.4.1. Such consent shall specify records to be released, the reason for such release, and to whom the records are to be released. Parents should use the District Consent to Release Educational Records of Student form.

Records of Access to Student Records

Each school should maintain a record, kept with the education record of each student, that indicates all individuals, agencies, or organizations that have requested or obtained access to a student’s education records. The record shall include at least the name of the person or agency that made the request and the legitimate interest the person or agency had in the information. The record will be maintained as long as the school maintains the student’s education record. The record of access shall be available only to parents, school officials responsible for custody of the records, and those state, local, and federal officials authorized to audit the operation of the system.

The record should not include requests for access by, or access granted to, parents of the student or officials of Nebo School District, requests accompanied by prior written consent of the parent, or requests for directory information.

Subpoenaed Records. A school that receives a subpoena for student records should immediately notify the Legal Department. A reasonable effort will be made to notify the parent that a subpoena has been received requesting access to their student’s records. Upon direction from the Legal Department, the school shall release student records to the entity or persons designated in the subpoena. The school shall not disclose to any person the existence or contents of the subpoena if a court orders the school to refrain from disclosure.

Transfer Not Permitted. Personal information from student education records shall be transferred to a third party only on the condition that such party will not permit any other party to have access to such information without the written consent of the student’s parent. If a third party permits access to information in violation of this policy, the school shall not permit access to information from education records to that third party for a period of not less than five (5) years.

Fees for Copies. No fee shall be charged to search for or to retrieve the education records of a student. A fee may be charged for copies of education records that are made for the parents or students under this policy provided that the fee does not effectively prevent them from exercising their right to inspect and review those records. Hardship cases shall be dealt with on an individual basis. 

5. REQUEST PROCEDURES

Education records shall be made available to the parent. Records may be reviewed during regular school hours upon written request to the records custodian. The records custodian or designee shall be present to explain the record and to answer questions. The confidential nature of the student’s records shall be maintained at all times, and the records shall be restricted to use only in the principal’s or counselor’s office or other restricted area designated by the records custodian. The original copy of the record or any document contained in the cumulative file shall not be removed from the school.

Upon request of a properly qualified individual as identified in section 4 of this policy, access to a student’s education record shall be granted within a reasonable period of time, not to exceed 45 days. The school shall respond to reasonable requests for explanations and interpretations of the records. 

Requests To and From Other Schools

Consistent with Utah Code Ann. § 53G-6-604, when a student transfers to, or seeks to enroll in, a District school, the school shall request a certified copy of the student’s educational record directly from the student’s previous school within 14 days after enrolling the student. 

Consistent with Utah Code Ann. § 53G-6-604, and unless prohibited or otherwise affected by paragraphs 5.3.2.1 or 5.3.2.2 below, when a school receives a request for a student’s education records from another school, whether from within or outside the District, the school shall forward a copy of the student’s record to the new school within 30 days of the request. 

If a student’s record has been flagged after notification from the Criminal Investigations and Technical Services Division that the record is that of a missing child, the school shall not forward the record to the requesting school but shall notify the Division immediately of the request. 

If a student falls under the protections of the Interstate Compact on Educational Opportunity for Military Children, Utah Code Ann. § 53E-3-901 et seq., the school shall release the student’s records to a requesting school consistent with the provisions of the Compact. 

6. AMENDING OR EXPUNGING EDUCATION RECORDS

Right to Amend or Expunge Records 

The parent of a student whose records are covered by this policy may ask the school to amend or expunge the student’s record if the parent believes it contains information that is inaccurate, misleading, or in violation of the student’s right of privacy or other rights. A request to amend or expunge a record under this section must be made in accordance with the procedures outlined in subsection 6.2. 

As defined in Utah Admin. Code R277-487-2, “expunge” means to seal a record so as to limit its availability to all except authorized individuals. 

Consistent with Utah Code Ann. § 53E-9-205, no District policy or action may act to shield a student’s education record from the student’s parent or interfere with a parent’s fundamental parental right and primary responsibility to direct the education of the parent’s child. 

Except as otherwise provided by law, no employee may prohibit a parent of a child from accessing the child’s education record. 

Without written parental consent, no employee may make changes to a student’s education record regarding the student’s gender identity. 

Procedure to Amend Records 

A request to amend or expunge student records made pursuant to subsection 6.1 must be submitted to the principal of the school where the student attends. If the student no longer attends a school within the District, the request must be submitted to the principal of the school where the student last attended. 

The request should be made in writing and should include the information the parent believes is inaccurate, misleading, or in violation of the student’s right of privacy, along with a reason or any supporting evidence to support the belief. 

The principal, in consultation with other District employees who have knowledge of the information the parent is seeking to have amended or expunged, shall decide whether to amend or expunge the records. Within fifteen (15) school days of the principal’s receipt of the request, he/she shall notify the parents in writing of the decision. If the principal decides to amend the record, it shall be amended within fifteen (15) school days. If the request is denied, the principal shall notify the parents of their right to a hearing under subsection 6.3. 

Procedure for Hearing

A parent whose request to amend or expunge records is denied under paragraph 6.2.3 may request a hearing on the decision. The request for hearing shall be submitted in writing to the Director of Elementary Education if the student is in sixth grade or below. The request shall be submitted to the Director of Secondary Education if the student is in seventh grade or above. The request must be submitted within ten (10) school days of receipt of the principal’s decision. 

The Director who receives a request for hearing under paragraph 6.3.1 shall schedule a hearing date with the parent and notify the parent in writing of the date, time, and place. The Director shall conduct the hearing and issue a decision unless he/she has a direct interest in the outcome, in which case the hearing will be assigned to an administrator who does not have a direct interest in the outcome. 

The parents shall be given a full and fair opportunity to present evidence, and at their own expense, may be assisted or represented at the hearing.

The parents shall be notified of the decision in writing within ten (10) school days of the hearing. The decision shall be based solely on the evidence presented at the hearing and shall include a summary of the evidence and reasons for the decision. If the decision is to deny the request, the parents shall be informed that they have thirty (30) school days within which to exercise their right to place in the record a statement commenting on the contested information and/or stating any reason for disagreeing with the school’s decision. 

7. OTHER LAWS GOVERNING THE MAINTENANCE AND DISCLOSURE OF STUDENT RECORDS

Some records covered by FERPA are granted additional restrictions, accessibility rights, or procedures by other laws, including, but not limited to, Utah state law; the Richard B. Russell National School Lunch Act, 42 U.S.C. 1751, et seq.; the Individuals with Disabilities Education Act (IDEA), 20 U.S.C. 1400 et seq.; the Health Insurance Portability and Accountability Act (HIPAA), Pub. L. 104-191; Armed Forces recruiter access, 20 U.S.C. 7908; the Children’s Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. 6501-6505; and 42 CFR Part 2 (confidentiality of alcohol and drug abuse patient records).

Utah Student Privacy and Data Protection

Utah law imposes certain requirements in addition to those provided by FERPA. Utah Code Ann. § 53E-9-101 et seq. 

The superintendent shall designate one or more Student Data Managers, who shall authorize and manage the sharing, outside of the District, of personally identifiable student data. 

The superintendent shall establish an external research review process for a request for data for the purpose of external research or evaluation. 

The District shall create and maintain a Data Governance Plan and a metadata dictionary. 

The District shall annually make available to students and parents a Student Data Collection Notice that identifies the student data it collects; describes procedures for collection, maintenance, and disclosure of that data; states a student’s rights under Utah Code Ann. § 53E-9-301 et seq.; and includes the following statement: 

“The collection, use, and sharing of student data has both benefits and risks. Parents and students should learn about these benefits and risks and make choices regarding student data accordingly.”

Richard B. Russell National School Lunch Act (NSLA)

The NSLA, which has stricter privacy provisions than FERPA, restricts who may have access to records on students who are eligible for free and reduced-price meals. This includes student and household information obtained from the free and reduced-price eligibility process and the student’s free or reduced-price eligibility status. Individuals who may be permitted access to this information under FERPA may be denied access under the more restrictive provisions of NSLA. Employees should consult with the Food Services Department and the Legal Department for guidance concerning the allowable use of free and reduced-price eligibility data.

Individuals with Disabilities Education Act (IDEA)

Access and retention of records governed by the IDEA shall be consistent with the requirements and procedures outlined in 34 CFR 300.610-6.27, and with Nebo School District Policy JS, Special Education. Employees should consult with the Special Education Department regarding disclosure and maintenance of special ed records. 

Health Insurance Portability and Accountability Act (HIPAA)

The HIPAA Privacy Rule protects certain health records from unauthorized disclosure. However, the Privacy Rule does not generally apply to student records at District schools because the schools do not meet HIPAA’s definition of a “covered entity.” In addition, the Privacy Rule does not apply because health records maintained by the schools meet the definition of “education records” under FERPA and are therefore covered by the FERPA privacy restrictions rather than by HIPAA. This includes student immunization records, medical records provided by parents, and student health records maintained by school nurses on behalf of the District. 

Armed Forces Recruiter Access

Notwithstanding the provisions set forth in FERPA, military recruiters and institutions of higher education shall be granted access to secondary school student names, addresses, and telephone listings unless the student or parent makes a request that this information not be given without prior written parental consent.

Children’s Online Privacy Protection Act of 1998 (COPPA)

COPPA, 15 U.S.C. 6501-6505, was enacted to protect the privacy of children using the internet and may have an impact on student privacy. Employees who direct or allow students to use the internet must be familiar with website privacy statements, parental consent requirements, and the requirements of this policy for protecting the privacy of student information and education records. 

Confidentiality of Alcohol and Drug Abuse Patient Records

Federal regulations found at 42 CFR Part 2 prohibit the disclosure of information about individuals who apply for or receive alcohol or drug abuse treatment services. The regulations apply to assessment, diagnosis, counseling, treatment, or referral for treatment and generally forbid the release of information, even to parents, about students referred for drug or alcohol abuse assessment, diagnosis, counseling, or treatment without the patient’s consent. The restrictions apply to records of students who receive counseling services because they are children of alcoholics or drug abusers. Any student records containing information related to treatment services for drug or alcohol abuse should be kept confidential. Employees should consult the Legal Department before disclosing such records. 

8. NOTICE AND TRAINING

The District will provide annual notice to parents of their rights under this policy and relevant laws including FERPA (34 CFR § 99.7), the PPRA (20 USC § 1232h), and Utah’s student data collection notice requirement (Utah Code Ann. § 53E-9-305).  

The District will annually provide training on the confidentiality of education records and the requirements of this policy to all employees with access to student records, as required by Utah Admin. Code R277-487-3.