PART 1: INTRODUCTION AND PURPOSE

The Family Educational Rights and Privacy Act (FERPA), codified at 20 U.S.C. §1232 (g), protects the privacy of NMSU students’ educational records, absent (1) the student giving proper written consent for disclosure or (2) circumstances which meet one of the exceptions in the law warranting disclosure without prior consent.  This rule is intended to provide guidance to the various NMSU entities to assist them in protecting students’ right of privacy consistent with FERPA and corresponding regulations published in 34 CFR Part 99.

FERPA also provides students and eligible parents the right to access and review educational records, as well as the right to seek amendment and/or supplement the student’s Education Records in the event they are alleged to be inaccurate, misleading or otherwise in violation of the student’s rights.  This rule provides the rules and procedures by which NMSU System students and eligible parents may invoke these rights, and notice of how to file a complaint should they believe their right under FERPA are not being honored.

PART 2: DEFINITIONS

1. Directory Information: Directory Information is defined for purposes of this rule as the student’s  name; NMSU Aggie ID number; class; college and major; dates of attendance; degree(s) earned; honors and awards received, including selection to the dean’s or president’s list, honorary organization, or the GPA range for the selection; address; local or contact telephone number; NMSU electronic mail address; most recent previous educational institution attended; participation in officially recognized activities and sports; and the weight and height and age of members of athletic teams. Directory Information also includes the following student employment and assistantships information: title; department, and departmental address and telephone number.
2. Education Records: Education Records are records that are maintained by NMSU in any form or format (e.g. paper, electronic, digital image, film, video, audio tape) which contain information directly related to a student and are personally identifiable to a student. Education Records do not include:
   1. Personal records of university employees that are in the sole possession of the maker (i.e. notes of conversations), are used as a personal memory aid, and are not accessible or revealed to any individual except to a successor in the position held;
   2. Records of the NMSU police department used for law enforcement purposes;
   3. Student medical and counseling records maintained and used only in connection with provision of medical treatment or counseling of the student and are made available only to the individuals providing the treatment;
   4. Employment records unrelated to the student’s status as a student;
   5. Records created or received after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student (i.e. alumni records); or
   6. Grades on peer-graded papers before they are collected and recorded by a faculty member.
3. Legitimate Educational Interest: In the context of this rule, refers to the work related and authorized need for access to an educational record (by a designated School Official) within the course and scope of the individual official’s employment or contract.
4. School Official: School Official means:
   1. An employee, agent or officer of the university acting in the employee’s official capacity;
   2. A person serving on university committees, boards, and/or councils, including an individual serving on a disciplinary or grievance committee;
   3. Another educational institution that requests records for a particular student who seeks or intends to enroll or where the student is already enrolled provided the disclosure is for purposes related to the student’s enrollment or transfer; and
   4. A person or company with whom the university has contracted (e.g. internship and clinical facilities, attorney, auditor, or collection agent) but limited to only the specific student information needed to fulfill the contract. The contracting entity, as the agent for NMSU, is required to protect the student’s educational records in compliance with FERPA’s regulations on the control, maintenance, use and re-disclosure of the information provided to it.
5. Student means an individual who is or has been in attendance at NMSU. For the purposes of this rule, “attendance” begins on the first day of class for any type of course or program offered by NMSU. It also includes any period during which an individual is working under a NMSU work-study program.

PART 3: PROCEDURES FOR INSPECTION OF STUDENT EDUCATIONAL RECORDS

1. The University Student Records Office has been designated by the university as the records custodian for student educational records. The University Student Records Office responds on behalf of the NMSU System to requests from students, eligible parents and others for access to and inspection of student Education Records.  When the requested records are housed at other campuses or offices the institution, the University Student Records Office will coordinate with the other NMSU entities to provide or respond to the request.
2. To ensure that the University Student Records Office receives the request, students are encouraged to submit their requests to view their educational records in writing.
3. Inspection shall be permitted within 45 calendar days from the date of the written request.
4. If the student is not able to review the records at the university, the records will be mailed or emailed to the student.
5. Students may be charged a reasonable copying fee, unless the fee would prevent the student from obtaining the copy, in which case, there shall be no charge.
6. As provided by FERPA, students shall not be permitted to inspect the following records:
   1. Financial information submitted by their parents;
   2. Confidential letters and recommendations associated with admissions, employment or job placement, or honors to which they have waived their rights of inspection and review;
   3. Education Records containing information about other students, in which case the institution will permit access only to that part of the record which pertains to the inquiring student; or
   4. Confidential letters and recommendations placed in their files prior to January 1, 1975, providing those letters were collected under established policies of confidentiality and were used only for the purposes for which they were collected.

PART 4: PROCEDURES TO AMEND OR SUPPLEMENT STUDENT EDUCATIONAL RECORDS

1. If a student or eligible parent believes that the educational record is inaccurate, misleading or otherwise in violation of the student’s rights, they may request an amendment of the record. If the proposed amendment is denied, the student or eligible parent may request a hearing by submitting to the University Student Records Office a Request for Hearing to Amend or Supplement Educational Record.
2. The University Student Records Office will schedule a hearing within twenty business days from receipt of a request for hearing, absent extenuating circumstances.
3. The University Student Records Office will give the student or eligible parent five business days advance notice of the date, time and place in of the hearing.
4. The hearing officer will be a representative of the Office of the Provost, or other member of senior management who does not have a direct interest in the outcome of the hearing.
5. The student or eligible parent shall receive a fair hearing, meaning that they will be given the opportunity to present evidence relevant to the issues raised.
6. The student or eligible parent may, at their own expense, be assisted or represented by one or more individuals of the student or eligible parent’s choice, including an attorney.
7. The hearing officer shall consider solely the evidence the evidence presented at the hearing, including any evidence which may be offered by university representatives, and deliver a written decision within fifteen business days from the date of the hearing. The written decision shall include a summary of the evidence and the reasons supporting the decision.

PART 5: STUDENT CONSENT REQUIRED TO DISCLOSE EDUCATIONAL RECORDS

The general rule is that student consent is required before a student’s educational records may be accessed or disclosed to a third party.  This Part describes how a student may provide that consent; Part 6 addresses exceptions from this general rule.

1. NMSU officials, through the University Student Records Office, may disclose student educational records with the student’s consent.
2. A student is deemed to have consented to disclosure of limited information, referred to as Directory Information, unless the student opts out of the university’s Directory. (See Part 6. A.)
3. Additionally, a student may wish to allow third parties access to student educational records, for a variety of reasons. A form to facilitate documentation of the student’s consent and waiver of privacy rights under FERPA is located at the mynmsu portal.   Any signed FERPA consent, release or waiver will be honored by the University Student Records Office upon receipt and verification that it was signed by the student.

PART 6: EXCEPTIONS TO REQUIREMENT FOR STUDENT CONSENT

FERPA permits the disclosure of educational records without the student’s consent when certain exceptions apply. These exceptions are described here:

1. The university may release student educational records without the student’s consent provided it is Directory Information (See Definitions, Part 2), and the student has not opted out of the directory. To opt out of the Directory, students must notify the University Student Records Office in writing.  A NON-RELEASE OF DIRECTORY INFORMATION form may be used to document the student’s intent to  opt out of the Directory.  This form is available at the mynmsu portal and also at http://records.nmsu.edu/forms/.  NMSU will not disclose Directory information without consent for students who have provided such written notice to the University Student Records Office.
2. The university may release student educational records without the student’s consent to university officials who have a Legitimate Educational Interest (See Definitions, Part 2)to access the records. If releasing educational records to a university contractor, NMSU shall ensure:
   1. that the contractor performs an institutional service or function for which NMSU would otherwise use employees;
   2. that the contractor is under the direct control of NMSU with respect to the use and maintenance of Education Records; and
   3. that the contractor shall be subject to FERPA’s use and re-disclosure requirements relating to personal identifiable information from student Education Records.
3. The university may also release student educational records without the student’s consent, if one of the additional exceptions set forth in the FERPA regulations applies. (See 34 C.F.R §§99.31) Depending upon the exception, briefly described below, the university may be required to make a reasonable attempt to notify the student in advance or to notate in the student’s educational record the details relating to a nonconsensual disclosure. (See Part 7 below)
   1. To another university or school in which the student seeks or intends to enroll, provided the disclosure is for purposes related to the student’s enrollment or transfer;
   2. In connection with financial aid for which the student has applied or which the student has received, as necessary and for certain purposes provided for in the Act;
   3. To parents of dependent students as defined in section 152 of the Internal Revenue Code of 1986;
   4. To protect the health and safety of any student or others in a health or safety emergency;
   5. To accreditation organizations or agencies;
   6. To authorized representatives of the US Comptroller General or the US Attorney General, the US Secretary of Education, state and local educational authorities for audit or evaluation of federal or state supported educational programs, or for the enforcement of or compliance with federal legal requirements that relate to those programs;
   7. To comply with a lawful judicial order or lawfully issued subpoena, provided that the university first makes a reasonable effort to notify the student or eligible parent of the order or subpoena, in advance of compliance, so that the student or parent as applicable may seek protective action, unless pursuant to 34 C.F.R. 99.31(a)(9)(ii) (A)-(C), the subpoena orders non-disclosure of the existence or contents of the subpoena, or information furnished in response;
   8. To support legal action in court as may be relevant to the issues being litigated;
   9. To organizations conducting studies for, or on behalf of, educational agencies or institution for the purpose of 1) developing, validating, or administering predictive tests; 2) administering student aid programs; or 3) improving instruction; provided the study is conducted pursuant to a written data sharing, use and destruction agreement as required by 34 C.F.R. §§ 99.31 (6) (iii) (C) (1)-(4);
   10. Disclosure of events involving drugs or alcohol to parents of students under age of 21:
       1. Unless there are extenuating circumstances, the university will not generally notify parents or legal guardians of students under the age of 21 of a first time alcohol violation. Parents and guardians will be notified if the student is determined by the university to be a danger to himself or herself, to others, or to property.
       2. The university may notify parents and legal guardians of students under the age of 21 of all second and subsequent alcohol violations. For purposes of determining what constitutes a second or subsequent violation, multiple related violations during a single incident will be treated as one offense.
       3. The university may notify parents or legal guardians of students under the age of 21 of any drug violations.
   11. To disclose the final result of a student judicial proceeding to the alleged victim in which the alleged perpetrator/student was charged with violating university policies or rules relating to a crime of violence or non-forcible sex offense;
   12. To disclose the final result of a student judicial proceeding to a third party related to university charges filed associated with a crime of violence or non-forcible sex offense, if the student was found to be responsible for violating the university’s rules or policies. Disclosure is limited to the name of the violator, the type of violation found to have occurred, and the sanction imposed by the university; and
   13. To disclose information about sex offenders and other individuals required to register under section 170101 of the Violent Crime Control and Law Enforcement Act of 1994, 42 U.S.C. 14071, and the information was provided to the university under 42 U.S.C. 14071 and applicable federal guidelines.

PART 7: REPORTING REQUIREMENTS FOR DISCLOSURES WITHOUT PRIOR CONSENT

1. FERPA require schools to record all requests for access to, and all disclosures of personal identifiable information (PII) from student educational records, EXCEPT FOR 1) disclosures to School Officials with Legitimate Educational Interest; 2) disclosures in response to certain judicial orders or lawfully issued subpoenas (See Part 6. C. 7. above); 3) disclosures of Directory Information for students who have not opted out of the directory; and 4) disclosures directly to the student or eligible parent.
2. NMSU shall maintain these records with the student’s Education Records for as long as the student’s records are maintained.
3. The recorded information shall include the parties who have requested or received PII from student educational records and their legitimate interests in requesting or obtaining the information.
4. Students and eligible parents have a right to inspect and review the record of disclosures. See 34 CFR § 99.32 for the full list of recordation requirements.

PART 8: PREVENTION OF FERPA PROTECTED DATA BREACHES; PROTOCOLS IN EVENT OF BREACH

1. Data Security: NMSU shall establish and maintain information security policies and procedures to protect the privacy of student educational data, including data located on personally owned equipment which connects to the NMSA enterprise and data moved to personal devices.  NMSU will refer to the recommended practices by the Privacy Technical Assistance Center (PTAC) from The U.S. Department of Education for guidance in its administration of FERPA and corresponding regulations.
2. Training: The University Student Records Office, in coordination with the NMSU IT Compliance and Privacy Office, will ensure that NMSU administration, faculty, staff and contractors as appropriate, receive FERPA and data security training at least biennially in order to raise awareness of this rule and the university’s obligation to meet the requirements of FERPA and its regulations.
3. Data Breach or Compromise
   1. NMSU employees and contractors who access student educational records and data in the course and scope of their employment shall report any suspected, minor, accidental or other data compromise that they know about, or reasonably should know about, to the University Student Records Office or IT Compliance Officer for proper review and resolution.
   2. Reports of possible or actual data security breaches, no matter what size, must be made to itcompliance@nmsu.edu and ciso@nmsu.edu.
   3. Upon receipt of a report of a possible or actual data security breach, preliminary review and analysis will be conducted by the IT Compliance Officer, and appropriate action will follow. Depending upon the nature of the breach, such action may involve a formal investigation, which shall be conducted in an objective, prompt and thorough manner. The factual findings of the preliminary review and the formal investigation, if any, shall be documented, and proper notifications made to affected individuals and internal and/or external entities, as appropriate, including but not limited to the Family Policy Compliance Office (FPCO) of the U. S. Department of Education.

PART 9: COMPLAINT PROCESS FOR ALLEGED VIOLATION(S) OF FERPA

If a student or eligible parent is denied access to inspect student educational information; information is wrongly released or disclosed without consent or exception from the requirement for consent; a request to supplement or amend the student’s educational record is denied; or any other violation of FERPA is alleged, the student or eligible parent may file a complaint with: 1) The university’s chief academic officer, the Office of the provost and chief academic officer, or 2) The federal Office of Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Ave. SW; Washington D.C. 20202-5901 (202) 260-3887.