The University at Buffalo (UB, university) is committed to protecting the confidentiality of student educational records in accordance with the Family Educational Rights and Privacy Act of 1974 (FERPA).

FERPA gives students the right to:

• Inspect and review their own educational records
• Control the disclosure of information contained in their educational records, except to the extent that FERPA authorizes disclosure without consent
• Request the amendment of their educational records if they believe the records are inaccurate, misleading, or in violation of their privacy rights under FERPA, and if necessary, to have a hearing on this issue
• File a complaint with the United States federal government concerning alleged failures by the university to comply with FERPA requirements

Students have the right to inspect and review their educational records as follows:

• Students submit a written request to the Office of the Registrar, with appropriate identification; the request must identify the record(s) they wish to inspect. 
• The appropriate university official will make arrangements for access and notify the student of the time and place where the records may be inspected. Copies will not be provided, absent exceptional circumstances.
• Access must be provided within 45 days of receiving the request unless good cause for a reasonable delay can be shown. No documents or files may be altered or removed once a request has been filed.

The university is not required to provide a student with the opportunity to inspect and review the following:

• Portions of a student’s educational record that contain information about another student. A student requesting to inspect and review their educational record will only be allowed to inspect and review the specific information that pertains to them.
• Financial information submitted by parents.
• Confidential letters and statements of recommendation that were placed in the educational records of a student prior to January 1, 1975.
• Confidential letters and statements of recommendation that were placed in the educational records of the student after January 1, 1975 when the student has waived their right to inspect and review those letters and statements of recommendation.

Students have the right to control the disclosure of educational records, except to the extent that FERPA authorizes disclosure without consent. Under FERPA, the university may not generally disclose information from a student’s educational records to a third party unless the student has provided written consent.

• Students provide consent via a process defined by the Office of the Registrar, permitting the broad disclosure of their educational record information to specific individuals or third parties (e.g., parents). That process includes verification of identity. Transcripts and copies of institutional records will not be provided to those identified via this process unless deemed necessary by the university. 

FERPA allows the university to disclose information from educational records without the student’s consent as follows:

• When the information is appropriately designated as directory information, which may be   published as the university deems appropriate and displayed in university systems. If a student does not want their directory information released, they must indicate so by completing the  Directory & Information Release/Non-Release form. Non-release does not apply to instances that the university deems as educationally required (such as those within university systems).
  • A student may reverse their directory information release decision at any time.
• The university does not supply directory information in support of commercial or solicitation activities. However, under the Solomon Amendment, when the United States military requests information, the university must release directory information and class level that has not been designated non-releasable by the student.
• To a university official with a legitimate educational interest (i.e., the official needs to review an educational record to fulfill their professional responsibility). In such instances, the data shared with the university official will be only that which is necessary to fulfill their professional responsibility whenever possible and reasonable to do so.
• To a member of University’s Board of Trustees.
• To a contractor, consultant, volunteer, or other outside party providing services or functions to the campus which would otherwise be provided by employees of the campus.
• To a person who is employed by the campus’s law enforcement unit.
• To a student serving on an official committee (e.g., disciplinary, grievance committee), or who is assisting a school official and such access is necessary to perform their assigned duties.
• To a person employed by the State University of New York (SUNY) System Administration with legitimate educational interest.
• To appropriate parties, including parents or guardians, regardless of dependency status, when disclosure is necessary to protect the health or safety of the student or others. Such disclosures may be made only where authorized university offices determine, based on the totality of the circumstances, that an articulable and significant threat exists, and only to those persons whose knowledge of the information is necessary to address that threat.
• To the parents or guardians of a student regarding the student’s violation of any federal, state, or local law, or of any rule or policy of the university, governing the use or possession of alcohol or a controlled substance. The university may non-consensually disclose information under this exception if it is determined that the student has committed a disciplinary violation with respect to that use or possession and the student is under 21 years of age at the time of the disclosure to the parent.
• To persons or organizations providing financial aid to students.
• To officials of another school in which a student seeks or intends to enroll or transfer credit.
• When the disclosure is to comply with a judicial order or lawfully issued subpoena.
• While FERPA permits the university to disclose education records to the parents or guardians of a dependent student without the student’s consent, it does not require such disclosure. As a general matter, students must authorize the release of information to parents or guardians. In the limited circumstances in which the university determines that disclosure is appropriate, the parent or guardian must provide a copy of the most recent federal income tax return establishing the student’s dependency. Full FERPA rights are afforded to either parent or guardian unless the university has been provided with a court order, state statute, or other legally binding document that specifically limits or revokes those rights.
• When the student is deceased. While FERPA permits campuses to release educational records when a student is deceased, it does not require them to do so. In general, the university does not release educational records for deceased students without sufficient justification (as determined by the university) and proof of identity and relationship to the deceased.

The university will maintain a record of requests for and/or disclosures of information from a student's educational records. The record will indicate the name of the party making the request and what records, if any, were received, the legitimate interest in the records, any additional party to whom it may be disclosed, and the legitimate interest the additional party had in requesting or obtaining the information. The record may be reviewed by the student. This recordkeeping is not required if the request was from, or the disclosure was to:

• The student;
• A school official determined to have a legitimate educational interest;
• A party with written consent from the student;
• A party seeking directory information; or
• A federal grand jury or law enforcement agency pursuant to a subpoena that by its terms requires nondisclosure.

• Students have the right to request the amendment of educational records that they believe are inaccurate or misleading. 
• Students requesting to amend their educational record may submit a request to the Office of the Registrar clearly stating the part of the record they want changed and why it is inaccurate or misleading.
• If the university decides to amend the record as requested, record of the student’s request and the amendment will become part of the official student record, following the retention schedule associated with the nature of the amendment.
• If the university decides not to amend the record as requested by the student, the university will notify the student of the decision and advise the student of their right to a hearing regarding the request for amendment and their right to place an explanatory comment on their record.
• Additional information regarding hearing procedures will be provided to the student when notified of the right to a hearing. See Attachment A - FERPA Amendment Request Review Procedure.

Students may report compliance concerns to the Office of Internal Audit, which will ensure that all reports are investigated appropriately.  

Students have the right to file a complaint with the United States federal government concerning alleged failures by the university to comply with the requirements of FERPA.

In accordance with FERPA, UB annually provides students in attendance with information regarding their rights related to educational records. Student Consumer Information is also available on the Office of Financial Aid website.

The Family Educational Rights and Privacy Act of 1974 (FERPA) gives students the right to inspect and review their educational records and, under certain circumstances, the right to request that such records be amended. FERPA limits the right of the university to disclose educational records or information contained in such records without the student’s consent. FERPA also requires that the university notify students, on an annual basis, of their rights under FERPA.

This policy applies to all current and former students, and all individuals with access to educational records maintained by the university and the protected rights of students regarding the release of such records. This policy applies to educational records as defined in the Definitions section of this policy.

Attendance   
Includes but is not limited to the period of time during which a student attends or attended the university in person or remotely. A student is considered to begin the period of attendance at the university for purposes of this policy once they are registered for their initial term of enrollment. The university may also release attendance information related to the period during which a student is working under a work-study program.

Directory Information
Student information that would not generally be considered harmful or an invasion of privacy if disclosed. UB has designated the following as directory information:

• Student name (both chosen/preferred and legal);
• Current address;
• Telephone number;
• Email address;
• Major field of study;
• Dates of attendance;
• Athletics team and intramurals; and
• Honors, degrees, and awards received.

Educational Records
Defined by FERPA as those records that contain information directly related to a student and which are maintained by the university or by a party acting on behalf of the university. This includes, but is not limited to, transcripts, papers, exams, student databases, class schedules, financial records, correspondence, email, and handwritten notations. Educational records may be maintained in any medium.

Educational records include some but not all health-related records:

• The following student health-related records are considered educational records under FERPA:
  • Created, received, maintained, used, or disclosed related to student health information for administrative purposes only and the records are not related to treatment of the student by the campus (e.g., immunization records received by Student Health Service; health information provided to campus to support academic adjustment request).
• Student health-related records that meet the following criteria are not considered educational records under FERPA:
  • Created or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in a professional or paraprofessional capacity or assisting in that capacity; and
  • Created, maintained, or used only in connection with a provision of treatment to that student; and
  • Not disclosed to anyone other than individuals providing the treatment. For the purpose of this definition, “treatment" does not include remedial education activities or activities that are part of the program of instruction at the university.

This definition of educational records does not include:

• Records that are kept in the sole possession of the creator, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the creator of the record.
• Peer-graded assignments prior to being collected and recorded by an instructor.
• Employment records made and maintained in the normal course of business, relating exclusively to that person's capacity as an employee, and not available for any other purpose. However, the records related to a student's employment are educational records when:
  • The position in which the student is employed depends on their status as a student, including when the student receives a grade or credit based on their performance in such capacity.
  • Records of the University Police Department (UPD) that are created and maintained by the UPD for a law enforcement purpose
  • Records that relate to an individual student after they no longer attend or participate in an educational activity as a student and that are not directly related to their attendance as a student.

Family Educational Rights and Privacy Act (FERPA)
The Family Educational Rights and Privacy Act of 1974 is a federal law that protects the privacy of student educational records.

Legitimate Educational Interest
A university official has a legitimate educational interest if the official requires the information for the purpose of fulfilling their official duties, including but not limited to:

• Performing a task that is specified in their position description or contract agreement
• Performing a task related to a student’s education
• Performing a task related to the discipline of a student
• Providing a service or benefit relating to the student or student’s family, such as health care, counseling, job placement, or financial aid
• Maintaining the safety and security of the campus
• Participating in or conducting studies, evaluations, or assessments of educational programs

Parent
A parent of a student; includes a natural parent, guardian, or an individual acting as a parent in the absence of a parent or a guardian.

Student
An individual who is or has been in attendance at the university and for whom the institution maintains education records.

University Official
Person employed by the university in an administrative, supervisory, academic, advising, research, or support position, including law enforcement, health, and medical staff

• Person employed by the State University of New York (SUNY) System Administration 
• Contractor, consultant, volunteer, or other outside party providing services or functions to the campus which would otherwise be provided by employees of the campus
• Person serving on the UB Council
• Student serving on an official committee (e.g., disciplinary, grievance), or assisting a school official in performing their tasks

• Protect and release educational records in accordance with FERPA and this policy.
• Maintain the FERPA request and disclosure log.

• Protect and release educational records in accordance with FERPA and this policy.
• Report requests for educational records to the appropriate data custodian.

• Safeguard electronic access to student records.
• Maintain definition of Category 1 data under the university’s Data Risk Classification Policy.

• Distribute the Consumer Information pertaining to student rights under FERPA.

• Review student and faculty requests for student information for the purposes of conducting research, ensuring compliance with FERPA and providing disaggregated data as appropriate.

• Maintain a compliance system/process by which students can submit compliance complaints.
• Coordinate investigations of these reports.

• Manage university efforts related to FERPA education and awareness.
• Manage the process by which students provide consent for disclosure to certain parties designated by the student.
• Manage the process by which students designate non-disclosure of their directory information.
• Manage the process by which the university maintains its FERPA request and disclosure logs.
• Oversee the process for student inspection of educational records.
• Conduct hearings to determine whether alleged errors in educational records are misleading, inaccurate, or in violation of the student’s FERPA rights.

• Read the annually provided Consumer Information pertaining to FERPA.
• Provide consent for disclosure to certain parties and submit requests for non-disclosure of directory information.

• Maintain, protect, and release educational records in accordance with FERPA and this policy.

• Provide guidance to data custodians regarding what constitutes a legitimate educational interest.
• Determine whether an individual has a legitimate educational interest and information. should/should not be released under this policy when the request falls outside of the provided guidance.
• Interpret federal FERPA policy and advise regarding its application to the university.

1. Amendment Request

A student may request amendment of an education record that the student believes is inaccurate, misleading, or otherwise in violation of the student’s rights under FERPA.

• The request must identify the specific portion of the education record at issue.
• The request must include a written explanation stating why the information is alleged to be inaccurate, misleading, or in violation of FERPA.
• If the request follows an initial denial, the student must address the stated basis for the denial for each disputed item.

2. Initial Review

The university will review the amendment request within a reasonable period of time.

• If the university determines that the record should be amended, it will do so and notify the student in writing.
• If the university determines that the record will not be amended, the student will be notified in writing of the decision and of the right to a hearing.

3. Hearing

Upon request, the university will provide the student an opportunity for a hearing.

• The hearing will be conducted within a reasonable period of time after the request for a hearing is received.
• The student will receive reasonable advance notice of the date and time of the hearing.
  • In person hearings may be conducted remotely or via submission/correspondence at the discretion of the university;
• The hearing will be conducted by a hearing officer who does not have a direct interest in the outcome.

4. Hearing Scope and Procedure

The hearing will be limited to whether the challenged information is inaccurate, misleading, or otherwise in violation of FERPA.

• The student will be afforded a full and fair opportunity to present relevant evidence and arguments.
• The student may be supported/assisted by an individual of the student’s choosing, at the student’s own expense. Only the student will be permitted to speak on their own behalf.

5. Decision

The hearing officer will issue a written decision based solely on the evidence presented at the hearing.

• The decision will include a brief summary of the evidence and the reasons for the determination.
• The decision will be provided to the student within a reasonable period of time following the hearing.
• The decision will be final and not subject to further review or appeal.

6. Amendment or Statement of Disagreement

• If the decision favors the student, the university will amend the education record accordingly and notify the student in writing.
• If the decision does not favor the student, the student will be informed of the right to place a written statement of disagreement in the education record.
• Any statement of disagreement will be maintained with the contested portion of the record and disclosed whenever that portion is disclosed.