Administrative Policies

AD11 University Policy on Confidentiality of Student Records

Policy Status: 


Subject Matter Expert: 

Robert Kubat, 814-863-3681,

Policy Steward: 

Senior Vice President and Chief of Staff



The Family Educational Rights and Privacy Act (FERPA) is a federal law that governs the privacy of student education records and provides students with certain rights to protect, access, and request amendments to, their education records. 

The purpose of this Policy is to describe the University’s policy on the confidentiality of student education records; to inform students of their rights under FERPA; and to inform anyone who may maintain, access, or use education records on behalf of the University (including employees, students, volunteers, and other third parties) of their responsibilities as it relates to student education records.


"University officials" are employees in an administrative, supervisory, academic, research, or support staff position (including Police and Public Safety and University Health Services); members of the Board of Trustees; students and alumni who serve on official University committees or assisting other University officials in performing their tasks; and volunteers or third parties who perform an institutional service or function for which the University would otherwise use its own employees and who is are under the direct control of the University with respect to the use and maintenance of the education records.  Access by these officials is restricted where practical, and only to that portion of the student record necessary for the discharge of assigned duties.

"Legitimate educational interest" is defined as the need to review an education record in order for a University official to carry out their responsibilities on behalf of the University, such as performing an administrative task outlined in the official’s duties, performing a supervisory or instructional task directly related to the student’s education, or providing a service or benefit relating to the student.   

“Education records” are defined as records, files, documents, data and other materials that contain information directly related to a student and are maintained by the University or by a person acting on behalf of the University.  Education records do not include:

  • records that are in the sole possession of the maker, used only as a personal memory aid, and that are not accessible or revealed to any other person except a temporary substitute of the maker;

  • records created and maintained by University Police and Public Safety for law enforcement purposes;

  • records relating to an individual who is employed by the University that are made and maintained in normal course of business, related exclusively to the individual in that individual’s capacity as an employee and not available for use for any other purpose;

  • records made, maintained, and used by professionals (e.g., physician, psychiatrist, psychologist, counselor, other similar paraprofessionals) in connection with providing treatment to a student; and

  • alumni records (i.e., records created or received by the University after a person is no longer a student and that does not directly relate to the student’s attendance at the University).

“Student”, as used in this Policy, is defined as an individual currently or previously enrolled in any academic offering of the University. For newly admitted students, this policy becomes effective on the first day of classes for those students who have scheduled at least one course. A student who accepted an admission offer but did not schedule at least one course, or a newly admitted student who canceled his/her registration either before or after the semester begins, is not a “student” under this Policy.


The following University officials are designated as responsible for student education records within their respective areas:

  • Provost,

  • Chancellors,

  • Office of Budget and Finance,

  • Deans,

  • Vice Provosts,

  • Vice Presidents,

Each of these officials is responsible for making available a listing of student records within his/her area of responsibility indicating the purpose, storage, security, and disposition of each student record.


The University will not disclose or permit access to personally identifiable information in a student’s education records except as provided in this Policy.


The University may disclose or permit access to personally identifiable information from a student’s education record without the student’s consent if the disclosure is to a University official with a legitimate educational interest. 


FERPA permits the University to make available to the public certain information, referred to as “directory information”, about a student without their written consent.  While the University is not required to release directory information, it has designated the following information as directory information that may be released:

  1. Name

  2. Address (local, permanent, and electronic mail)

  3. Telephone number

  4. Class level (semester classification or level: freshman, sophomore, junior, senior, etc)

  5. Major

  6. Student activities including athletics

  7. Weight and height (members of athletic teams only)

  8. Dates of attendance

  9. Enrollment status (full-time, part-time, or not enrolled)

  10. Date of graduation

  11. Degrees, honors, and awards received

  12. Most recent educational institution attended

Currently enrolled students are entitled to request that this information not be made publicly available. Such requests must be made in accordance with the procedures established by the University Registrar.  For more information, please visit: The directory hold will remain in effect until it is rescinded by the student in written instructions filed with the University Registrar.

Prior to disclosing any directory information, all University units must verify the status of a directory block or check with the University Registrar.  


With the exception of Directory Information, the University will not disclose information from a student's education record to a person or entity outside of the University without the student’s written consent, or as specifically authorized by law.    


A third party requesting access or copies of student education record must provide a prior written consent from the student. The third party is to be reminded that he/she should not permit additional access to the information by an additional person without further written consent of the student prior to such an additional transfer of information.

When information on a student must be shared outside the University, all persons, agencies, or organizations desiring access to the records of a student shall be required to sign a written form to be kept permanently with the file of the student indicating specifically the legitimate educational or other interest in seeking this information. This form will be available solely to the student and to the University official responsible for the record as a means of auditing the operation of the record system.


In certain circumstances, FERPA permits the University to disclose information from a student’s education record to a third party without the student’s written consent.  These exceptions include but are not limited to: 

  1. Third-Party Contractors

Disclosure of information to third parties without prior written consent of the student is permitted in cases where the third party is under contract with the University to provide institutional services or functions on behalf of the University and is under direct control of the University with respect to the use and maintenance of the records. The contractual arrangement between the third party and the University must require the third party to:

  • Protect the information at the same level as required of the University by law, existing contract, and institutional policy;

  • use the information only the purposes for which University grants access to the information;

  • not share the information with any other entity or person without the student’s written consent;

  • destroy the information within sixty (60) days of the conclusion of any contractual arrangement with the University and retain no copies of the information; and

  • provide adequate administrative, electronic, and physical safeguards to assure the confidentiality, integrity, and accessibility of the information at a level specified in the contract between the University and the third party.

  1. Other Educational Institutions

Disclosure may be made to officials of other educational institutions to which the student has applied and where he/she intends to enroll or is currently enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer.  

  1. Certain Federal, State, and Accrediting Authorities

This policy shall not preclude access to student records by authorized federal and state officials in connection with the audit and evaluation of federally supported education programs, or in connection with the enforcement of federal and state legal requirements that relate to such programs. Information may also be released to accrediting organizations in order to carry out their accrediting functions.  Except when collection of personally identifiable data is specifically authorized by federal and state law, any data collected and reported with respect to an individual student shall not include information (including Social Security number) that would permit the personal identification of such student.

  1. Relating to Financial Aid

Disclosure of information may be made in connection with the student's application for, or receipt of, financial aid, so long as the information is necessary for determining eligibility of aid, amount of aid, conditions of aid, or to enforce the terms and conditions of the aid.

  1. Research Studies

Disclosure of information to third parties conducting research studies for, or on behalf of, the University is permitted if the study is to develop, validate, or administer predictive tests; administer student aid programs; or improve instruction.  The University must also agree with the purpose of the study and execute a written agreement with the research organization. The written agreement must reflect the five bullet points outlined above for third party contractors, and must set forth the purpose, scope, and duration of the study, among other provisions. Whenever possible, it is preferable to provide only de-identified data to the research organization.

  1. Disclosure to Parent of a Dependent Student

Disclosure may be made to parents, legal guardians, or other persons acting as a parent in the absence of a parent or guardian, of a dependent student as defined by Section 152 of the Internal Revenue Code of 1986.  Prior to disclosure, units must verify that the student is listed as a dependent of the parent or guardian for tax purposes as defined by the IRS.

  1. Pursuant to Judicial Order or Legal Action

Disclosure may be made in order to comply with a judicial order or lawfully issued subpoena.  Unless prohibited by the order, subpoena, or law, the University will make a reasonable effort to notify the student of the order or subpoena in advance of compliance.

If the student initiates legal action against the University, the University may disclose to the court, the student’s education records that are relevant for the University to defend itself. 

  1. Health or Safety Emergency

Disclosure of information in connection with an emergency may be made to the appropriate parties if knowledge of the information is necessary to protect the health or safety of the student or other individuals.  The University is responsible for making this determination, which is made on a case-by-case basis and temporally limited to the period of the emergency.  If it is determined that disclosure is appropriate, the University must maintain a record demonstrating (i) the articulable and significant threat to the health or safety of a student or other individuals that formed the basis for the disclosure; and (ii) the parties to whom the University disclosed the information. 

  1. Results of Disciplinary Proceedings

The final results of a disciplinary proceeding may be disclosed to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense. 

  1. Disclosure to Parents regarding Student’s violation of law or policy

If the University determines that a student has committed a disciplinary violation with respect to the use or possession of alcohol or controlled substance and the student is currently under the age of 21, disclosure may be made the parent of the student regarding the student’s violation of law, rule, or institutional policy governing the use or possession of alcohol or a controlled substance. 

  1. Disclosures concerning registered sex offenders

Information concerning registered sex offenders may be released in a manner consistent with federal and state regulations.


Each record-keeping unit at the University must maintain a record of each request for access to and each disclosure of personally identifiable information from a student’s education records (including the names of State and local educational authorities and Federal officials and agencies listed Section II.B.3 of this Policy that may make further disclosures without consent).  The record must include (i) the parties who requested or received personally identifiable information from the student records; and (ii) the legitimate interests the parties had in requesting or obtaining the information. 

This record keeping requirement does not apply to disclosures made (a) to the student; (b) to a university official with a legitimate educational interest; (c) pursuant to a student’s written consent; (d) involving directory information only; and (e) in response to a lawfully issued subpoena or judicial order where the grand jury, issuing court, or issuing agency has ordered that the contents of the order not be disclosed. 


The student has the right to inspect and review his/her educational records and may do so by making a written request that identifies the specific record to the appropriate University official responsible for custody of the record. The official must respond within forty-five (45) days of the request by arranging an appointment for the student to review the record. If circumstances prevent the student from inspecting the record, the University may provide the student with a copy of the requested record or make other arrangements.  The University may charge a reasonable fee for providing copies of education records.  The student has the right to request an explanation or interpretation of information contained in their education records.

Students may not have a right to inspect and review the following records:

  • financial records of their parents or any information contained in such statements;

  • confidential letters and statements of recommendation dated before January 1, 1975 (provided the statements were used only for the purposes for which they were intended);

  • confidential letters and statements of recommendation relating to the student’s admission to an educational institution, application for employment, or receipt of an honor or honorary recognition, provided the student has waived their right to do so; and

  • Portions of their education records that contain information relative to another student.

In order to waive their right to inspect and review a confidential letter or statement of recommendation, the waiver must be in writing and signed by the student.  Students must be notified of the names of the individuals providing the letters and statements, and the letters and statements must only be used for the purpose for which they were intended.  Such waivers may not be required as a condition for admission to, receipt of financial aid from, or receipt of any other services or benefits from such agency or institution.

Each record-keeping unit of the University will establish procedures for accommodating requests for access to student records that is consistent with this Policy.


Students have the right to request the University to amend a record that they believe contains information that is inaccurate, misleading, or in violation of the student’s rights of privacy.  The academic judgment of a faculty member about a student's work, expressed in grades and/or evaluations, is not within the purview of this request to amend.

The request should be submitted to the appropriate University official (see "University Officials Responsible for Student Records," above) in whose area of responsibility the applicable record is kept. If the University official determines that the information is inaccurate, misleading, or otherwise violates the student’s privacy rights, it may amend the record and so notify the student in writing.

If the University official decides not to amend the records as requested, the student has a right to request an opportunity for a hearing to challenge the content of the student's education record(s) on the grounds that the information is inaccurate, misleading, or in violation of the student’s privacy rights. The hearing will be held within a reasonable time after the request is received, and the student will be notified as to the time, date, and place of the hearing reasonably in advance of the hearing.

A hearing officer will be designated by the Vice President and Dean for Undergraduate Education and the student will be afforded a full and fair opportunity to present evidence relevant to the issues noted above. The student may, at their own expense, be assisted or represented by an adviser of his/her choice, including an attorney. The student will be furnished, within a reasonable time following the hearing, a written decision from the designated hearing officer. The decision will be based solely on the evidence presented at the hearing and will include a summary of the evidence and the reasons for the decision.

If after the hearing, the University determines that the record is not inaccurate, misleading, or otherwise in violation of the student’s privacy rights, it will inform the student of their right to place a statement in the record commenting upon the challenged information in the educational records and/or stating why they disagree with the University’s decision.  The University will maintain the statement along with the contested part of the record for so long as the education record is maintained and will disclose the statement whenever it discloses the portion of the record to which the statement relates.


Students have the right to file a complaint with the U.S. Department of Education concerning alleged failures of the University to comply with the requirements of FERPA.  The office which administers FERPA is the Family Policy Compliance Office and their contact information is:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue, SW

Washington, DC  20202-5901


For questions or further information regarding this policy, please contact the Office of General Counsel or the University Registrar. 


Other Policies should also be referenced, especially the following:

AD43 - Statement on HIV/AIDS

AD95 - Information Assurance and IT Security

ADG06 - Appropriate Use of Student Data

HR56 - Answering Personnel Inquiries

SY03 - Emergencies Involving Students

Most Recent Changes:

  • January 6, 2023 - Changed Corporate Controller's Office to Office of Budget and Finance

  • August 31, 2021 - Complete policy re-write.

Revision History (and effective dates):

  • June 10, 2019 - Removed "Budget Officer of the University" from the list of University Officers Responsible for Student Records

  • August 24, 2018 - Editorial changes to update cross reference from AD20 to AD95.

  • June 22, 2016 - Editorial changes made in the STUDENT RECORD POLICY and POLICY ON DISCLOSURE OF STUDENT RECORDS sections, updating the link to the Student Consent for Release of Information to Third Parties Form, needed when third parties request student information.

  • April 1, 2013 - Editorial change made in the STUDENT RECORD POLICY section, clarifying the types of staff personnel who assist University officials to include student employees.

  • June 25, 2012 - In the POLICIES ON DISCLOSURE OF STUDENT RECORDS, Part B. Disclosure of Informations to Third Parties, revised the 4th bullet, removing the words "or return" from the previous verbiage which said "Destroy or return the information within 60 days of the conclusion of any contractual arrangement with the University and retain no copies of the information. " Information is NOT returned, just destroyed.

  • February 24, 2012 - In the POLICIES ON DISCLOSURE OF STUDENT RECORDS, B. Disclosure of Informations to Third Parties, revised the Template - Written Agreement With External Research Organizations that is linked in the policy (under "written agreement") to reflect changes in FERPA requirements that now require that records be destroyed when the contract or research study ended, and to provide Penn State with a certificate confirming the date of destruction of the data (in the past there was an option to "return" such records).

  • February 24, 2011 - Minor changes to the PUBLIC INFORMATION REGARDING STUDENTS section (removed 'date and place of birth' and 'name and address of parents, guardian, spouse' as information that may be made available without prior consent; added 'class level'). Revised the POLICIES ON DISCLOSURE OF STUDENT RECORDS section, removing Disclosure to Parents of Dependent Students verbiage.

  • November 4, 2009 - Minor changes made in these sections: Student Record Policy, Student Educational Records, Definition of Student, Public Information Regarding Students, and University Officers Responsible for Student Records. Significant additions made to Disclosure of Information to Third Parties and Disclosure Under Emergency Conditions sections. Addition of a new section entitled Disclosures Concerning Sex Offenders. Reference added, with appropriate link in "Cross References" for new Administrative Guideline ADG06, Appropriate Use of Student Data.

  • January 17, 2008 - Editorial changes in "Student Record Policy" and "Disclosure of Information to Third Parties" sections; links have been added that direct users to the form/instructions used to collect written consent from a student to release a portion(s) of their education record to third parties.

  • November 16, 2007 - Updated "Student Record Policy" section, adding the terms 'University Police personnel' and 'health staff' to the list of appropriate areas who serve as the University's "school officials" with "legitimate educational interest" in accordance with FERPA regulations.

  • January 31, 2007 - Editorial changes to "University Officers Responsible for Student Records" section. Replaced Campus Executive Officers with Chancellors, and Vice President for Outreach and Cooperative Extension with Vice President for Outreach.

  • June 14, 2006 - Revision History added.

  • January 27, 1998 - Position Title Updates.

  • August 11, 1995 - Multiple changes throughout Policy.

  • November 3, 1994 - Changes to "Preamble" and "Student Record Policy" sections. Addition of "Cross References" section.

  • November 10, 1989 - Revised section titled "University Offers Responsible for Student Records."

  • February 25, 1988 - Major Revisions.

  • December 14, 1984 - Department Title Changes.

  • November 9, 1983 - Position Title Changes.

  • December 9, 1981 - Revisions throughout entire policy, per revisions in 1981-82 Student Handbook.

  • January 3, 1975 - Release of Interim Policy, per directive of President Oswald.

Date Approved: 

February 21, 2011

Date Published: 

February 24, 2011

Effective Date: 

February 24, 2011