8330 - STUDENT RECORDS

School District of the City of Holland

Administrative Guidelines

8330 - STUDENT RECORDS

Student records shall be maintained in accordance with Board of Education Policy 8330 and State/Federal laws and regulations.

The student record is the legal record for each student who is or has attended schools within the District. All information contained in the student record must be factual, verifiable, and of a constructive nature. The Board shall collect, maintain, and use only information necessary for legally mandated functions.

Education Records, as defined in 34 C.F.R. 99.3 (Family Educational Rights and Privacy Act), means those records, files, documents and other materials that are: (1) directly related to a student; and (2) maintained by Board or by a party acting for the Board. "Record" means any information recorded in any way, including, but not limited to: handwriting; print; computer media; tape; film; microfilm and microfiche.

Student "personally identifiable information" includes, but is not limited to: the student's name; the name of the student's parent(s) or other family members; the address of the student or student's family; a personal identifier, such as the student's social security number, student number, or biometric record; other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name; other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or information requested by a person who the District reasonably believes knows the identity of the student to whom the education record relates.

The term, Education Records, does not include:

A.	records of instructional, supervisory, and administrative personnel and educational personnel ancillary thereto that are:

	1.	kept in the sole possession of the maker thereof; and

	2.	used only as a personal memory aid; and

	3.	not accessible or revealed to any other person except a temporary substitute for the maker of the record;

		For the purpose of this definition, a "substitute" means an individual who performs on a temporary basis the duties of the individual who made the record, and does not refer to an individual who permanently succeeds the maker of the record in his/her position.

B.	records maintained by a law enforcement unit (e.g., School Resource Officer) of the School District that were created by that law enforcement unit for the purpose of law enforcement.

C.	records relating to an individual who is employed by the Board, that:

	1.	are made and maintained in the normal course of business;

	2.	relate exclusively to the individual in that individual's capacity as an employee; and

	3.	are not available for use for any other purpose.

	Records, however, relating to an individual at the District who is employed as a result of his/her status as a student are education records.

D.	records on a student who is eighteen (18) years of age or older, or is attending an institution of postsecondary education, that are:

	1.	made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his/her professional capacity, or assisting in a paraprofessional capacity; and

	2.	made, maintained, or used only in connection with treatment of the student; and

	3.	disclosed only to individuals providing the treatment (except, that the records can be personally reviewed by a physician or other appropriate professional of the student’s choice). For the purpose of this definition, "treatment" does not include remedial educational activities or activities that are part of the program of instruction at the educational agency or institution;

E.	records created or received by the Board after an individual is no longer a student in attendance and that are not directly related to the individual's attendance as a student (e.g. information pertaining to the accomplishments of alumni);

F.	grades on peer-graded papers before they are collected and recorded by a teacher.

The District maintains or may establish video surveillance for security reasons at various areas around its facilities and on its buses. Video recordings which show students may constitute a student record, under certain circumstances. This is generally where the record is maintained to document student conduct or misconduct, unless it is maintained for law enforcement purposes as described above. Generally video taken of athletic events or other student performances which are open to the public will not be considered student records. The Superintendent or designee will determine whether the video constitutes a student record prior to the release of any video surveillance containing students, other than to authorized individuals.

The student's school record shall contain the following information that shall be retained permanently or for one hundred years:

	A.	name, address and telephone listing of parent (see Form 8330 F1)

	B.	enrollment data to include validated birth record, proof of residency, immunization records, and social security number or computer number

	C.	attendance records

	D.	grades and/or transcripts

	E.	standardized and/or mandated achievement test data, including proficiency/achievement test records that include the date each student meets the proficient level for the test administered; and

	F.	date of graduation and/or transfer or withdrawal

The student's education records shall contain, if applicable to the individual, the following information, to be retained for a period not less than two (2) years beyond the date of high school graduation:

	A.	health and medical information; emergency medical authorization forms may be destroyed upon the annual receipt of the forms as required by law

	B.	court order on parental rights and responsibilities and/or custodial or guardianship arrangements, including any court orders regulating access of a parent to school records

	C.	awards and recognitions

	D.	information and/or data relevant to the identification, evaluation and/or placement of students in accordance with the Individuals with Disabilities Education Act, Section 504 of the 1973 Rehabilitation Act or other applicable State laws and regulations

	E.	reports and such other confidential information generated by professionals or agencies outside the District relevant to the student's educational program

	F.	such other verifiable, factual and relevant information to be used in making decisions regarding the student's educational program, including disciplinary records

		Disciplinary records are not to be removed from the permanent record when the student leaves the school.

	G.	disciplinary records including any suspension and expulsion action must be included in records transferred to a receiving school

Whenever the District is notified by the Michigan Department of Health and Human Services and/or applicable custodial agency that a student has been placed into foster care or has a change in his/her foster care status or living arrangements, the staff member in charge of admission shall update that student’s records to reflect the foster care placement or change in foster care status or living arrangements. The student’s records shall be updated within twenty-four hours (24) of receiving notification from the MDHHS or the applicable custodial agency.

RESPONSIBILITY

The Custodian of Records (COR) shall be the principal who may delegate certain responsibilities to the school secretary. The COR is responsible for maintaining the confidentiality of directory information, if the parents or eligible student have so requested, and other personally identifiable information in the education records. The COR is responsible for the implementation of this Board’s policies and procedures regarding confidentiality, including informing all personnel in this District who collect, maintain, use, or otherwise have access to student records of this Board’s policies and procedures on confidentiality.

The District's Records Officer (DRO) shall prepare an annual notice to parents/eligible students that informs them of their rights to (see Form 8330 F9):

	A.	inspect and review the student's education records;

	B.	request an amendment to the records if the parent or eligible student believes the information to be inaccurate, misleading, or otherwise in violation of the student's privacy rights;

	C.	limit the disclosure of personally-identifiable information defined as directory information within Policy 8330 or to such other disclosures not required by law;

	D.	request a hearing if the Board refuses to amend records believed by the parent or eligible student to be misleading or inaccurate and to file a complaint with the United States Department of Education if the parent /eligible student is dissatisfied with the results of the hearing;

	E.	obtain a copy of the Board’s policy on student records.

The notice may be in the form of a section of the local newspaper, District's newsletter, and/or the student handbooks (see Form 8330 F9).

The Director Human Resources will also develop a list of uses for which the District commonly would disclose a student’s directory information and develop an opt-out form that lists all of the uses or instances and allows a parent or legal guardian to elect not to have his or her child’s directory information disclosed for one (1) or more of these uses.

Each student’s parent or legal guardian will be provided with the opt-out form within the first thirty (30) days of the school year. The form shall also be provided to a parent or legal guardian at other times upon request.

If an opt-out form is signed and submitted to the District by a student’s parent or legal guardian, the District shall not include the student’s directory information in any of the uses that have been opted out of in the opt-out form. A student who is at least age eighteen (18) or is an emancipated minor may act on his/her own behalf with respect to the opt-out form.

Ongoing Maintenance of Records

A.	Public Listing of Authorized Employees (see Form 8330 F2)

	1.	Each COR shall maintain a current listing of those employees and other persons, approved by the DRO, authorized to access personally-identifiable information housed at the location specified.

	2.	Each COR shall post and maintain the listing for public inspection at his/her respective location.

B.	Types and Location of Records

	1.	The DRO shall prepare a listing of the types and locations of records collected, maintained, or used by the District, and the name of the COR at each location.

		The list shall be provided to parents/eligible students upon request.

	2.	Education records shall be stored in secured facilities and/or equipment, and shall be available only to those specified in policy or these guidelines. Reasonable and appropriate methods (including but not limited to physical and/or technological access controls) shall be utilized to control access to student records and to make certain that school officials obtain access to only those education records in which they have legitimate educational interest. The COR is directed to utilize reasonable methods to identify and authenticate the identity of parents, students, school officials and any other parties to whom the District discloses personally identifiable information from education records.

C.	Consent to Disclose Information (see Form 8330 F4 and Form 8330 F8)

	1.	Whenever there is a request for a copy of information from a student's record, the COR shall obtain written and dated consent, prior to disclosure of records, from parents/eligible students, which includes:

		a.	the records that may be disclosed;

		b.	the purpose for which the disclosure may be made;

		c.	the party or class of parties to whom the disclosure may be made;

		d.	whether or not the parents/eligible students wish to have a copy of the records disclosed and/or, if the student is not an eligible student, whether the Board should provide that student with a copy of the disclosed record.

		Signed permission should be obtained from eligible students prior to allowing their parents access to the records provided the student is not considered a dependent under Section 152 of the Internal Revenue Code.

2.	Prior consent will not be needed if:

	a.	the disclosure is to school officials, including teachers, who have a legitimate educational interest (as defined by Board policy) in the information;

		In order for a contractor, consultant, volunteer or other party to whom the Board has outsourced institutional services or functions to be considered a school official, the outside party must:

		1)	perform an institutional service or function for which the Board would otherwise use employees;

		2)	be under the direct control of the Board with respect to the use and maintenance of education records; and

		3)	be subject to applicable provisions governing the use and re-disclosure of personally identifiable information from education records.

	b.	the disclosure is to another school, school district, or postsecondary institution, as stated in Board policy;

	c.	the disclosure is, subject to the conditions set forth in applicable Federal and/or State statutes and/or regulations, to authorized representatives of the Comptroller General of the United States, the Attorney General of the United States, the United States Secretary of Education, or State and local educational authorities;

	d.	the disclosure is in connections with a student's application for or receipt of financial aid; (See section below entitled: "Disclosure for Student Financial Aid");

	e.	the disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating, or administering predictive tests, administering student aid programs, or improving instruction;

		Disclosures pursuant to this paragraph are limited to circumstances when the study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information; the information is destroyed when no longer needed for the purposes for which the study was conducted; and the Board enters into a written agreement with the organization that contains all the content required by applicable Federal regulations;

		This written agreement will include: (1) specification of the purpose, scope, duration of the study, and the information to be disclosed; (2) a statement requiring the organization to use the personally identifiable information only to meet the purpose of the study; (3) a statement requiring the organization to prohibit personal identification of parents and students by anyone other than a representative of the organization with legitimate interests; and (4) a requirement that the organization destroy all personally identifiable information when it is no longer needed for the study, along with a specific time period in which the information must be destroyed.

	f.	the disclosure is to authorized representatives of the Comptroller General, the Attorney General, the Secretary of Education, or state and local authorities, and is made for the purpose of conducting an audit or evaluation of a federal or state supported education program, or to enforce or comply with federal requirements relating to those programs. A written agreement between the parties is also required under this exception. Mandatory elements of this written agreement include: (1) designation of the receiving entity as an authorized representative; (2) specification of the information to be disclosed; (3) specification that the purpose of the disclosure is to carry out an audit or evaluation of a government supported educational program or to enforce or comply with the program's legal requirements; (4) a summary of the activity that includes a description of methodology and an explanation of why personally identifiable information is necessary to accomplish the activity; (5) a statement requiring the organization to destroy all personally identifiable information when it is no longer needed for the study, along with a specific time period in which the information must be destroyed; and (6) a statement of policies and procedures that will protect personally identifiable information from further disclosure or unauthorized use.

		Pursuant to the audit exception, the District will use "reasonable methods" to verify that the authorized representative complies with FERPA regulations. Specifically, the District will verify, to the greatest extent practical, that the personally identifiable information is used only for the audit, evaluation or enforcement of a government-supported educational program. The District will also ascertain the legitimacy of the audit or evaluation and will only disclose the specific records that the authorized representative needs. Further, the District will require the authorized representative to use the records only for the specified purpose and not to disclose the information any further, such as for another audit or evaluation. Finally, the District will verify that the information is destroyed when no longer needed for the audit, evaluation or compliance activity.

	g.	the disclosure is to accrediting organizations to carry out their accrediting functions;

	h.	the disclosure is to parents of a dependent student, as defined in Section 152 of the Internal Revenue Code of 1986;

	i.	the disclosure is to comply with a judicial order or lawfully issued subpoena;

		Disclosures permitted by this paragraph may only occur after the Board makes a reasonable effort to notify the parent or eligible student of the order or subpoena, so the parent or eligible student may seek protective action, unless the disclosure is authorized by applicable Federal regulations. The Board need not notify the parent when the parent is a party to a court proceeding involving child abuse and neglect (as defined in Section 3 of the Child Abuse Prevention and Treatment Act) or dependency matters, and the order is issued in the context of that proceeding. Additionally, if the Board initiates legal action against a parent or student, the Board may disclose to the court, without a court order or subpoena, the student's education records that are relevant for the Board to proceed with the legal action as plaintiff. Likewise, if a parent or student initiates legal action against the Board, the Board may disclose to the court, without a court order or subpoena, the student's education records that are relevant for the Board to defend itself.

	j.	the disclosure is in connection with an emergency; (See section below entitled: "Emergency Release");

	k.	the disclosure is information the Board has designated as "directory information";

	l.	the disclosure is to the parent of a student who is not an eligible student, or to the student;

	m.	the disclosure concerns sex offenders and other individuals required to register under Section 170101 of the Violent Crime Control and Law Enforcement Act of 1994, and the information was provided to the Board pursuant to that law and its implementing regulations;

	n.	the disclosure concerns the juvenile justice system and its ability to serve, prior to adjudication, the student whose records are released, providing the officials to whom the records are released certify, in writing, to the District that the information will not be released to a third party, except as provided by State law, without the prior written consent of the parents;

	o.	the disclosure is to an agency caseworker or other representative of a State or local child welfare agency, or tribal organization as defined in Federal law, who has the right to access a student’s case plan as determined by the agency or organization, when such agency or organization is legally responsible for the care and protection of the student provided the education records and personally identifiable information will not be unlawfully released to third parties;

		The agency or organization may release the education records and personally identifiable information to an individual or entity engaged in addressing the student’s education needs and authorized by the agency or organization to receive such disclosure and such disclosure is consistent with State or tribal laws applicable to protecting the confidentiality of a student’s education records.

	p.	the disclosure is authorized by other sections of Family Education Rights and Privacy Act (FERPA).

3.	De-identified Records and Information – The District may release education records without prior consent if all personally identifiable information has been removed provided the administration (i.e., the DRO and COR) have made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.

	4.	No person shall release to a parent of a student who is not the custodial parent or any other person any information about the school to which the student has transferred or that would enable the parent who is not the custodial parent to locate the student if the school to which the student has transferred informs this District that the student is under the care of a shelter for victims of domestic violence.

D.	Notification of Collection, Creation and Disclosure

	Upon written request by a student’s parent or legal guardian, the District shall disclose to the parent or legal guardian any personally identifiable information concerning the student that is collected or created by the District as part of the student’s education records.

	If the District provides any personally identifiable information concerning the student that is collected or created by the District as part of the student’s education records to any person, agency, or organization, then the District shall disclose to the student’s parent or legal guardian upon his or her written request:

	1.	the specific information that was disclosed;

	2.	the name and contact information of each person, agency, or organization to which the information has been disclosed;

	3.	the legitimate reason that the person, agency, or organization had in obtaining the information.

	This information shall be provided without charge within thirty (30) days after the District receives the written request and without charge to the parent or legal guardian.

		The District is not required to disclose to the parent or legal guardian, even upon written request, any personally identifiable information concerning the student that is collected or created by the District as part of the student’s education records and is provided to any person, agency, or organization in any of the following situations:

		1.	provision of such information to the Michigan Department of Education or CEPI

		2.	provision of such information to the student’s parent or legal guardian

		3.	provision of such information to its authorizing body or to an educational management organization with which it has a management agreement

		4.	provision of such information to or from its intermediate school district or to another intermediate school district providing services to the District or its students pursuant to a written agreement

		5.	provision of such information to a person, agency, or organization with written consent from the student’s parent or legal guardian or, if the student is at least age eighteen (18)

		6.	provision of such information to a person, agency, or organization seeking or receiving records in accordance with an order, subpoena, or ex parte order issued by a court of competent jurisdiction

		7.	provision of such information as necessary for standardized testing that measures the student’s academic progress and achievement

provision of such information that is covered by the opt-out form described above, unless the student’s parent or legal guardian or, if the student is at least age eighteen (18) or is an emancipated minor, the student has signed and submitted the opt-out form

Parents: Disclosure, Inspection, Review of Records

The COR shall permit parents/eligible students, upon request, to retrieve information from and to inspect and review, records that are maintained by the District that relate to the student's education. The following conditions shall apply:

	A.	At times, agencies or individuals outside the District provide the District with information necessary and relevant to the student's education. Psychological or medical information should be provided to a parent in the presence of an appropriately-licensed professional who can properly explain the information. Such information may be provided to the District only with the written consent of the parent. Upon parental request the Board will notify the parent with the date and source of any record generated outside the District so that parents may access these records through the originator.

	B.	If any education record includes information on more than one (1) student, the parents/eligible student shall have the right to review and inspect only the part of the record that relates to the student, or to be informed of that specific information.

	C.	The request for access to records must be honored within a reasonable period, but in no case later than forty-five (45) days from receipt of the request. Requests to inspect and review education records that are collected, maintained or used by the District with respect to students with disabilities must be honored without unnecessary delay, and before any meeting regarding an individualized educational program (IEP), hearing relating to the identification, evaluation, or placement of the student, or resolution session, and in no case more than forty-five (45) days after the request was made.

D.	The parents/eligible students have a right to have their representative inspect and review the records upon submission of a signed and dated written consent that:

	1.	specifies the records that may be disclosed;

	2.	states the purpose of disclosure;

	3.	identifies the party or class of parties to whom the disclosure may be made.

E.	The Board shall presume that either parent has the authority to disclose, inspect, and review the student's records unless a court order indicates otherwise or unless otherwise prohibited by law.

	If the parents/eligible students request an opportunity to inspect and review records, a written request is necessary.

F.	The parents/eligible students are to complete the Board’s Request for Information Form 8330 F5 prior to receiving copies of any record.

	The COR shall arrange a mutually-agreeable time for the review with the parents/eligible students.

G.	Subject to the limitations within the law, policy, and/or guidelines, the COR shall provide parents/eligible students with copies of any information in the student's education records and shall respond to reasonable requests for explanation and interpretation of the records. Copies of the records shall be provided for the current cost of duplication unless that fee effectively prevents the parents/eligible students from exercising the right to inspect and review the records.

H.	If the parents/eligible students request disclosure of specific information by telephone, the COR shall not disclose requested information.

I.	The District shall not destroy any education record if there is an outstanding request to inspect and review the record.

Parents/Eligible students who have provided the District with signed security and release documents may access the confidential attendance and academic record information about their student through the Internet. Neither the District nor its employees will be held responsible for any privacy violation by the parent/eligible student or any unauthorized party.

Third Party: Disclosure, Inspection/Review, and/or Copies of Records

When authorized, the COR shall permit inspection and review of a student's education records, disclose specified information, or provide copies of education records only after the requesting party has agreed not to share the information with a third party unless the parents/eligible students have so consented or the particular circumstances meet the requirements of the) law on third-party disclosure.

Amendments of Records (see Form 8330 F6a, Form 8330 F6b, Form 8330 F6c)

The COR shall provide parents/eligible students with the opportunity to amend records when they believe that any of the information regarding their child is inaccurate, misleading, or violates the student’s privacy.

	A.	Upon receipt of a written request to amend records, the COR shall ascertain the specific information that is requested to be amended and the reason for the change.

		The COR shall decide whether or not to amend the record.

	B.	If the COR decides not to amend, the parents/eligible students shall be so informed of the decision as well as of their rights to a hearing. The parents/eligible students also have the right to place a statement in the records commenting on the contested information in the records and/or stating s/he disagrees with the decision of the COR. Such a statement shall be maintained with the contested part of the records as long as the records exist and shall be disclosed as part of any record disclosure.

C.	Unless specified otherwise in law, third parties seeking to access confidential information in a student's record that has been generated by a professional or agency outside the District may access these records only through the originator and in compliance with the laws governing disclosure.

D.	If the Board and parents/eligible students agree to the requested amendments, the COR shall make necessary changes in the student record and send the parents/eligible students written confirmation that the changes have been made.

E.	If the parents/eligible students request a Records Hearing, the Superintendent shall:

	1.	select the Records Hearing Officer (RHO) (who may be an official of the District who does not have a direct interest in the outcome of the hearing);

	2.	direct the person selected as the RHO to arrange a hearing with the parents/eligible students within ten (10) business days from the date of the hearing request or at a mutually agreed time.

	The RHO shall inform the parents/eligible students that they shall be afforded a full and fair opportunity to present evidence relevant to the issues and may be assisted or represented by individuals of their choice, including an attorney, at their own expense.

	The RHO is responsible for maintaining the student’s record during the appeal process so that no information is lost or destroyed.

F.	The RHO shall conduct the hearing by:

	1.	introducing the participants;

	2.	reviewing the agenda for the hearing;

	3.	identifying the records in question;

	4.	reviewing the items for which amendment is being requested;

	5.	allowing the parents/eligible students and/or their representative to present evidence related to the issues;

	6.	allowing the Board’s representative(s) to present evidence related to the issues;

	7.	recording the evidence presented by both parties;

	8.	allowing each party a reasonable period of time to question the evidence of the other party;

	9.	adjourning the hearing.

G.	No later than ten (10) business days from the conclusion of the records hearing, the RHO shall summarize and send a copy of the findings to the Superintendent (see Form 8330 F7).

H.	The Superintendent, within ten (10) business days after receiving the findings of the RHO, shall make a decision, based solely upon the evidence presented at the hearing, and send to the parents/eligible students:

	1.	a letter stating the decision and the justification for the decision;

	2.	a copy of the RHO’s Report;

	3.	copies of the amended records, if any;

	4.	a notification of the right to place a statement in the record commenting on the contested information or stating why s/he disagrees with the decision.

EMERGENCY RELEASE

The COR may release any personally-identifiable information (without parent's/eligible student's consent) to appropriate parties, including parents of eligible students, in connection with a health/safety emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

Upon receipt of a request for emergency information, the COR, shall consider the totality of the circumstances pertaining to a threat to the health or safety of others. If the COR determines that an articulable and significant threat exists, s/he may release information from education records to any necessary individuals. If the COR or another school official releases personally identifiable information pursuant to this Section, s/he must record in the student's education records the basis for the decision that a health or safety emergency existed.

TRANSFER OF RECORDS TO OTHER DISTRICTS

Transfer of student records must be within twenty (20) days of request and shall not be withheld from the school for a student's failure to pay any fees, fines, or charges imposed by this District.

The COR shall transfer a student's records to another school when requested by the district in which the student intends to enroll, provided that:

	A.	a reasonable attempt is made to notify the student's parent or eligible student of the transfer (unless the disclosure is initiated by the parent or eligible students; or Board's annual notification - Form 8330 F9 - includes a notice that the Board will forward education records to other agencies or institutions that have requested the records and in which the student seeks or intends to enroll or is already enrolled so long as the disclosure is for purposes related to the student's enrollment or transfer);

	B.	the parent or eligible student, upon request, receives a copy of the record; and

	C.	the parent or eligible student, upon request, has an opportunity for a hearing to challenge the content of the record.

A copy of the cover letter sent to the school district shall be retained in the student's file.

If parents/eligible students request a copy of the records being transferred, they shall be provided at the District's standard fee.

If a student is under the care of a shelter for victims of domestic violence, release of information is limited by law.

DISCLOSURE FOR STUDENT FINANCIAL AID

The COR may release, without parents' consent, student information regarding financial aid for which a student has applied or which a student has received, provided that personally-identifiable information from the education records of the student may be used only to:

	A.	determine the eligibility of the student for financial aid;

	B.	determine the amount of financial aid;

	C.	determine the conditions which will be imposed regarding the financial aid;

	D.	enforce the terms or conditions of the financial aid.

DISCLOSURE FOR PURPOSES OF MARKETING OR SELLING INFORMATION

The School Board shall not sell or otherwise provide to a for-profit business entity any personally identifiable information that is part of a student’s education records. This does not apply to any of the following situations:

	A.	providing the information as necessary for standardized testing that measures the student’s academic progress and achievement

	B.	providing the information as necessary to a person that is providing educational or educational support services to the student under a contract with the District

Safeguarding Education Records and Responding to Data Breaches

Significant challenges exist with respect to the safeguarding of education records from unauthorized access and disclosure. These challenges include inadvertent posting of students' grades or financial information on publicly available Web servers; theft or loss of laptops and other portable devices that contain education records; computer hacking; and failure to retrieve education records at termination of employment or service as a contractor, consultant or volunteer. In light of these challenges, the DRO and COR are directed to work with the District's IT Department/Staff to identify, implement and administer appropriate methods and security controls to protect education records, especially those in electronic information/data systems.

The District's IT Department/Staff is encouraged to review the National Institute of Standards and Technology (NIST) Special Publication (SP) (800-100, "Information Security Handbook: A Guide for Managers," and NIST SP 800-53, "Recommended Security Controls for Federal Information Systems" for guidance and to use any methods or technologies they determine are reasonable to mitigate the risk of unauthorized access and disclosure taking into account the likely harm that would result. The IT Department/Staff is charged with development of appropriate responses to data breaches and other unauthorized disclosures, and said steps should include at a minimum the following:

	A.	reporting the incident to law enforcement authorities;

	B.	determining exactly what information was compromised (e.g. names, addresses, SSNs, ID numbers, grades, etc.);

	C.	taking steps to immediately retrieve data and prevent further disclosures;

	D.	identifying all affected records and students;

	E.	determining how the incident occurred, including which school officials had control of and responsibility for the information that was compromised;

	F.	determining whether the incident occurred because of a lack of monitoring or oversight;

	G.	determining whether any Board policies and/or District procedures were violated;

	H.	conducting a risk assessment and identifying appropriate physical, technological and administrative measures to prevent similar incidents in the future; and

	I.	notify students and parents that the United States Department of Education's Office of Inspector General maintains a Web site describing steps students may take if they suspect they are a victim of identity theft.

While notification of students is not required in all circumstances, it shall be the DRO's responsibility to determine, in conjunction with the Superintendent, whether students and/or parents will be notified of any breaches. If the decision is made not to issue a direct notice to a parent or student upon an unauthorized disclosure of education records, the DRO or COR shall nevertheless record the disclosure so the parent or student will become aware of it during an inspection of the student's education record.

DESTRUCTION AND REVIEW OF RECORDS

If a student is identified as a student with a disability under the Individuals with Disabilities Education Act ("IDEA") or Section 504 of the Rehabilitation Act of 1973, the COR shall:

	A.	maintain the student’s educational records for five (5) years after termination of special education programs, services, and/or graduation; and

	B.	only destroy such educational records after notifying the parents/eligible students that the information is no longer needed to provide educational services and will be destroyed.

The personally-identifiable information on a disabled student shall be retained permanently unless the parents/eligible students request that it be destroyed as specified in these guidelines. The COR should remind them that the records may be needed by the student or the parents for Social Security benefits or other purposes (see Form 8330 F9).

It is important that the address used in Form 8330 F9 be checked annually to verify the accuracy of the address for complaints regarding the Family Educational Rights and Privacy Act (FERPA) and the Protection of Pupil Rights Amendment (PPRA).

20 U.S.C. 1232g
34 C.F.R. Part 99

Revised 10/9/08
Revised 5/4/09
Revised 4/22/10
Revised 4/16/12
Revised 7/31/13
Revised 11/3/17