IX. Disclosure of Confidential Information to Third Parties

A. Student authorization to release data from records:

1. Policy. Third parties, agencies, or organizations shall not have access to personally identifiable information from student records, other than to public (directory) information relating to particular student's, except as provided in Section 130.721 of the Universitywide Policies, without the written consent of the student, specifying (1) the records to be released; and (2) to whom the records are to be released. For further information about personally identifiable records, see Section 130.720 of the Universitywide Policies. Except for third parties not required to obtain the consent of the student prior to disclosure of confidential information, there is no general right of access to student records. This includes state or federal agencies, or the student's parent, spouse, or family members. See Section 130.721 of the Universitywide Policies for further identification of such third parties.

2. Procedures. Units which anticipate frequent third party requests (e.g. Registrar's Office, Career Services, college offices) should provide appropriate forms to facilitate this authorization process. Such written permission should be maintained in accordance with University policy regarding records retention and treated as confidential. (Note: in lieu of a form, records managers may photocopy the request with accompanying waiver signed by the student for filing in the student's folder).

A student may authorize release of information from his or her record to third parties by written request to the administrative unit responsible for the record. The form or written request to release records must be received prior to the release of the records to third parties.

B. Record keeping requirements when confidential information from files is released:

1. Policy. A record of disclosures is not required for disclosures to students of their own records; disclosures with the written consent of the student; disclosures to University officials under Section 130.721(a) of the Universitywide Policies, or for disclosure of public information.

C. Notification of release of confidential information to campus officials or employees without written authorization of the student.

1. Policy. No campus official or employee shall have access to records before signing a written form indicating the legitimate educational interest of the campus official or employee.

2. Procedure. The office maintaining records shall require each campus official or employee, except campus staff with an established "legitimate educational interest," to complete a form indicating specifically the legitimate educational interest that each has in seeking student record information. This form must be kept with the student records of the individual and is available for inspection by the student. The form must be signed by the campus official or employee and contain at least the following information:

a. Name of the campus official or employee and campus department (board) or unit;
b. Date of request and date of release;
c. Statement of legitimate educational interest requiring access of information;
d. Assurance that information will not be released to any other third party without the written consent of the student.

D. Release of confidential information to third parties who are not campus officials or employees:

1. Release of confidential information to third parties who are not campus officials or employees is not permitted without the written consent of the student for whom the information pertains, except as permitted by state or federal statute or University policy. A list of third parties who may have access to confidential student record information without student consent is present in Section 130.721 of the "Universitywide Policies Applying to Disclosure of Information from Student Records."

For these procedures, an administrative unit may be a college, department, division, or other administrative unit.