5500 Student Records Policy and Regulation

ICHABOD CRANE 5500

STUDENT RECORDS 

The Board of Education recognizes its legal responsibility to maintain the confidentiality of  student records. As part of this responsibility, the Board will ensure that eligible students and  parents/guardians have the right to inspect and review education records, the right to seek to  amend education records and the right to have some control over the disclosure of information  from the education record. The procedures for ensuring these rights will be consistent with state and federal law, including the Family Educational Rights and Privacy Act of 1974 (FERPA) and  its implementing regulations. 

The Board also recognizes its responsibility to ensure the orderly retention and disposition of the district’s student records in accordance with Schedule LGS-1 as adopted by the Board in policy 1120. 

The District will use reasonable methods to provide access to student educational records only to  those authorized under the law and to authenticate the identity of the requestor. The district will  document requests for and release of records, and retain the documentation in accordance with  law. Furthermore, pursuant to Chapter 56 of the Laws of 2014, the district will execute  agreements with third-party contractors who collect, process, store, organize, manage or analyze  student personally identifiable information (PII) to ensure that the contractors comply with the  law in using appropriate means to safeguard the data. 

The Superintendent of Schools is responsible for ensuring that all requirements under law and the Commissioner’s regulations are carried out by the district. 

Definitions 

Authorized Representative: an authorized representative is any individual or entity designated by a State or local educational authority or a Federal agency headed by the Secretary, the  Comptroller General or the Attorney General to carry out audits, evaluations, or enforcement or  compliance activities relating to educational programs. 

Education Record: means those records, in any format, directly related to the student and maintained by the district or by a party acting on behalf of the district, except: 

(a) records in the sole possession of the individual who made it and not accessible or revealed to any other person except a substitute (e.g. memory joggers); 

(b) records of the district’s law enforcement unit; 

(c) grades on peer-graded papers before they are collected and recorded by a teacher. Eligible student: a student who has reached the age of 18 or is attending postsecondary school.

Legitimate educational interest: a school official has a legitimate educational interest if they need to review a student’s record in order to fulfill their professional responsibilities. 

Personally identifiable information (PII): as it pertains to students, is information that would allow a reasonable person in the school or its community, who does not have personal  knowledge of the relevant circumstances, to identify the student with reasonable certainty. Such  data might include social security number, student identification number, parents’ name and/or  address, a biometric record, etc. This term is fully defined in federal regulations at 34 CFR 99.3. 

School official: a person who has a legitimate education interest in a student record who is  employed by the district as an administrator, supervisor, instructor or support staff member (including health or medical staff and law enforcement unit personnel); a member of the Board  of Education; a person or company with whom the district has contracted to perform a special  task (such as attorney, auditor, medical consultant or therapist); or a parent or student serving on an official committee, such as disciplinary or grievance committee, or assisting another school  official performing their tasks. 

The district prohibits volunteers from accessing student information. The district expects that if volunteers discover any information about students in the course of their volunteer duties, they will not disclose such information to anyone other than a school official with a legitimate  educational interest. 

Third party contractor: is any person or entity, other than an educational agency (which  includes schools, school districts, BOCES, or the State Education Department), that receives  student or teacher/principal PII from an educational agency pursuant to a contract or other  written agreement for purposes of providing services to such educational agency, including but  not limited to data management or storage services, conducting studies for or on behalf of such  educational agency, or audit or evaluation of publicly funded programs. This includes  educational partnership organizations that receive student or teacher/principal PII from a school  district to carry out responsibilities under Education Law §211-e (for persistently lowest achieving schools or schools under registration review) and is not an educational agency. This  also includes not-for-profit corporations or other nonprofit organizations, other than an  educational agency. 

Annual Notification 

At the beginning of each school year, the district will publish a notification that informs parents,  guardians and students currently in attendance of their rights under FERPA and New York State  Law and the procedures for exercising those rights. A ‘Parents’ Bill of Rights for Data Privacy and Security’ will be posted on the district website and included in any agreements with third party contractors.(see Parent’s Bill of Rights) The notice and ‘Bill of Rights’ may be published  in a newspaper, handbook or other school bulletin or publication. The notice and ‘Bill of Rights’  will also be provided to parents, guardians, and students who enroll during the school year.

The notice and Parents’ Bill of Rights will include a statement that the parent/guardian or  eligible student has a right to: 

  1. inspect and review the student’s education records; 
  2. request that records be amended to ensure that they are not inaccurate, misleading, or  otherwise in violation of the student’s privacy rights; 
  3. consent to disclosure of personally identifiable information contained in the student’s  education records, except to the extent that FERPA authorizes disclosure without  consent; and 
  4. file a complaint with the United States Department of Education alleging failure of the  district to comply with FERPA and its regulations; and/or file a complaint regarding a  possible data breach by a third party contractor with the district and/or the New York  State Education Department’s Chief Privacy Officer for failure to comply with state law. 

The annual notice and Parents’ Bill of Rights will inform parents/guardians and students: 

  1. that it is the district’s policy to disclose personally identifiable information from student  records, without consent, to other school officials within the district whom the district has  determined to have legitimate educational interests. The notice will define ‘school  official’ and ‘legitimate educational interest.’ 
  2. that, upon request, the district will disclose education records without consent to officials  of another school district in which a student seeks to or intends to enroll or is actually  enrolled. 
  3. that personally identifiable information will be released to third party authorized  representatives for the purposes of educational program audit, evaluation, enforcement or  compliance purposes. 
  4. that the district, at its discretion, releases directory information (see definition below)  without prior consent, unless the parent/guardian or eligible student has exercised their  right to prohibit release of the information without prior written consent. The district will  not sell directory information. 
  5. that, upon request, the district will disclose a high school student’s name, address and  telephone number to military recruiters and institutions of higher learning unless the  parent or secondary school student exercises their right to prohibit release of the  information without prior written consent. 
  6. of the procedure for exercising the right to inspect, review and request amendment of student records. 
  7. that the district will provide information as a supplement to the ‘Parents’ Bill of Rights’  about third parties with which the district contracts that use or have access to personally  identifiable student data. 

The district may also release student education records, or the personally identifiable information  contained within, without consent, where permitted under federal law and regulation. For a  complete list of exceptions to FERPA’s prior consent requirements see accompanying regulation  5500-R, Section 5. 

The district will effectively notify parents, guardians and students who have a primary or home  language other than English.

In the absence of the parent or secondary school student exercising their right to opt out of the  release of information to the military, the district is required to, under federal law, release the  information indicated in number five (5) above. 

Directory Information 

The district has the option under FERPA of designating certain categories of student information  as “directory information.” The Board directs that “directory information” include a student’s:

  • Name
  • Major course of study
  • Participation in school activities or sports
  • Weight and height if a member of an athletic team
  • Dates of attendance,
  • Degrees and awards received
  • Most recent school attended
  • Grade level
  • Photograph
  • Enrollment status

Information about a homeless student’s living situation will be treated as a student educational  record, and will not be deemed directory information. A parent/guardian or eligible student may  elect, but cannot be compelled, to consent to release of a student’s address information in the  same way they would for other student education records. The district’s McKinney-Vento  liaison will take reasonable measures to provide homeless students with information on educational, employment, or other postsecondary opportunities and other beneficial activities.  

Social security numbers or other personally identifiable information will not be considered directory information. 

Students who opt out of having directory information shared are still required to disclose their student ID cards. 

Once the proper FERPA notification is given by the district, a parent/guardian or student will  have 14 days to notify the district of any objections they have to any of the “directory information” designations. If no objection is received, the district may release this information  without prior approval of the parent/guardian or student for the release. Once the student or  parent/guardian provides the “opt-out,” it will remain in effect after the student is no longer  enrolled in the school district. 

The district may elect to provide a single notice regarding both directory information and  information disclosed to military recruiters and institutions of higher education. 

Cross-ref:  
1120, School District Records 
4321, Programs for Students with Disabilities Under IDEA and Part 89
4532, School Volunteers 
5151, Homeless Children 
8635, Information and Data Security, Breach and Notification 

Ref:  
Family Educational Rights and Privacy Act, as amended, 20 USC 1232g; 34 CFR Part 99 No Child Left Behind Act, 20 USC §7908 (Military Recruiter Access) 
10 USC §503 as amended by §544 of the National Defense Reauthorization Act for FY 2002 Education Law §§ 2-a; 2-b; 2-c; 2-d; 225; 
Public Officers Law §87(2)(a) 
Arts and Cultural Affairs Law, Article 57-A (Local Government Records Law) 8 NYCRR Part 121 (Data Privacy) 
8 NYCRR §185.12 (Appendix I) Records Retention and Disposition, Schedule ED-1 for Use by School Districts and BOCES 
“Guidance for Reasonable Methods and Written Agreements,”  
http://www2.ed.gov/policy/gen/guid/fpco/pdf/reasonablemtd_agreement.pdf
Parents’ Bill of Rights for Data Privacy and Security, July 29, 2014:  
http://www.p12.nysed.gov/docs/parents-bill-of-rights.pdf 
Family Policy Compliance Office/Student Privacy Policy Office website: http://www2.ed.gov/policy/gen/guid/fpco/index.html 

Effective Date: February 2, 2021

ICHABOD CRANE 5500-R

STUDENT RECORDS REGULATION

It is recognized that the confidentiality of student records must be maintained. The terms used in this regulation are defined in the accompanying policy. The following necessary procedures have been adopted to protect the confidentiality of student records. 

Section 1. Pursuant to the Family Educational Rights and Privacy Act (FERPA) and state law it is the policy of this school district to permit parents/guardians and eligible students to inspect and review any and all official records, files and data directly related to that student, including all materials that are incorporated into each student’s cumulative record folder.  

The rights created by FERPA and state law transfer from the parents/guardians to the student once the student attains eligible student status. However, districts can disclose information to parents of eligible students under certain circumstances, including when the student is a dependent under the IRS tax code, when the student has violated a law or the school’s rules regarding alcohol or substance abuse (and the student is under 21); when the information is needed to protect the health or safety of the student or other individuals. 

Section 2. Parents/guardians or the eligible student will have an opportunity for a hearing to  challenge the content of the student’s school records, to insure that the records are not inaccurate,  misleading, or otherwise in violation of the privacy or other rights of the student, and to provide  an opportunity for the correction or deletion of any such inaccurate, misleading, or otherwise  inappropriate data contained therein. 

Section 3. A letter will be sent annually to parents/guardians of students currently in attendance  and students currently in attendance informing them of their rights pursuant to FERPA and state  law, and will include a Parents’ Bill of Rights. The district will effectively notify parents,  guardians and students who have a primary or home language other than English. 

Section 4. To implement the rights provided for in sections 1 and 2, the following procedures are  adopted: 

  1. A parent/guardian or an eligible student who wishes to inspect and review student  records must make a request for access to the student’s school records, in writing,  to the Building Principal. Upon receipt of such request, once the district verifies  the identity of the parent/guardian or eligible student, arrangements will be made  to provide access to such records within 45 days after the request has been  received. If the record to which access is sought contains information on more  than one student, the parent/guardian or eligible student will be allowed to inspect  and review only the specific information about the student on whose behalf access  is sought. 
  2. Before providing access to student records, the district will verify  the identity of the parent/guardian or eligible student.
  3. The district may provide the requested records to the  

parent/guardian or eligible student electronically, as long as the  parent/guardian or eligible student consents. The district will transmit PII  electronically in a way that maintains its confidentiality, using safeguards  such as encryption and password protection. 

  1. A parent/guardian or an eligible student who wishes to challenge the  contents of the student’s school records must submit a request, in writing, to the  Building Principal identifying the record or records which they believe to be  inaccurate, misleading or otherwise in violation of the privacy or other rights of  the student together with a statement of the reasons for their challenge to the  record. 
  2. Upon receipt of a written challenge, the Building Principal will provide a  written response indicating either that they: 
  3. finds the challenged record inaccurate, misleading or otherwise in  violation of the student’s rights and that the record will be corrected or  deleted; or 
  4. finds no basis for correcting or deleting the record in question, but  that the parent/guardian or eligible student will be given an opportunity for  a hearing. The written response by the Building Principal will be provided  

to the parent/guardian or eligible student within 14 days after receipt of the  written challenge. The response will also outline the procedures to be  followed with respect to a hearing regarding the request for amendment. 

  1. Within 14 days of receipt of the response from the Building Principal, a  parent/guardian or eligible student may request, in writing, that a hearing be held to review the determination of the Building Principal. 
  2. The hearing will be held within 10 days after the request for the hearing  has been received. The hearing will be held by the Superintendent of Schools,  unless the Superintendent has a direct interest in the outcome of the hearing, in  

which case the Superintendent will designate another individual who does not  have a direct interest in the outcome of the hearing to hold the hearing. 6. The parent/guardian or eligible student will be given a full and fair  opportunity to present evidence at the hearing. The parent/guardian or eligible  student may, at their own expense, be assisted or represented by one or more  individuals of their own choice, including an attorney. 

  1. The Superintendent or other individual designated by the Superintendent  will make a decision in writing within 14 days after the hearing. 8. After the hearing, if the Superintendent or the individual designated by the  Superintendent decides not to amend the record, the district will inform the  parent/guardian or eligible student that they have the right to place a statement in  the record commenting on the contested information or stating why they disagree  with the decision of the district. Any statement placed in the record will be  maintained with the contested part of the student record for as long as the record 

is maintained. Further, the statement will be disclosed by the district whenever it  discloses the portion of the record to which the statement relates. 

Section 5. Except to the extent that FERPA authorizes disclosure of student records without  consent, student records, and any material contained therein which is personally identifiable, are  confidential and will not be released or made available to persons other than parents/guardians or  eligible students without the prior written consent of the parents/guardians or eligible student. 

Exceptions to FERPA’s prior consent requirement include, but are not limited to disclosure: 

  1. To other school officials within the district who have been determined to have legitimate  educational interests. 
  2. To officials of another school, school system or post-secondary institution where the  student seeks or intends to enroll. 
  3. To authorized representatives of the Comptroller General of the United States, the U.S.  Secretary of Education, the U.S. Attorney General, or state and local education  authorities in connection with an audit or evaluation of a federal- or state-supported  education program or in compliance with legal requirements related to those programs. 
  4. In connection with the student’s application for or receipt of financial aid. 5. To state and local officials or authorities in compliance with state law that concerns the  juvenile justice system and the system’s ability to effectively serve, prior to adjudication,  the student whose records are being released. 
  5. To organizations conducting studies for, or on behalf of, education agencies or  institutions, in order to develop tests, administer student aid, or improve instruction. 7. To accrediting organizations to carry out their accrediting functions. 
  6. To parents of a dependent student, as defined by the Internal Revenue Code. 9. To comply with a judicial order or lawfully issued subpoena, including ex parte court  orders under the USA Patriot Act. Prior to complying with a judicial order or subpoena,  the district will make a reasonable effort to notify the parent/guardian or eligible student,  unless the district has been ordered not to disclose the existence or content of the order or  subpoena, or unless the parent is the subject of a court proceeding involving child  dependency or child abuse and neglect matters, and the order is issued in context of that  proceeding. 
  7. In connection with a health or safety emergency, the district will disclose information  when, taking into account the totality of circumstances, a determination is made that there  is an articulable and significant threat to the health or safety of the student or other  individuals. 
  8. To teachers and school officials in other schools who have legitimate educational  interests in the behavior or the student when the information concerns disciplinary action  taken against the student for conduct that posed a significant risk to the safety or well being of that student, other students, or other members of the school community. 
  9. To provide information that the district has designated as “directory information.” 13. To provide information from the school’s law enforcement unit records. 14. To a court, when the district is involved in legal action against a parent or student, those  records necessary to proceed with the legal action.
  10. To the U.S. Secretary of Agriculture, its authorized representatives from the Food and  Nutrition Service, or contractors acting on its behalf, to monitor, evaluate and measure  performance of federally-subsidized school food programs, subject to certain privacy  protections. 
  11. To any caseworker or representative of a state or local child welfare agency or tribal  organization who has the right to access a student’s case plan, where the agency or  organization is legally responsible for the care and protection of that student, not to be  disclosed except as permitted by law. 

The district will use reasonable methods to provide access to student educational records to only  those authorized under the law and to authenticate the identity of the requestor. The district will  use an array of methods to protect records, including physical controls (such as locked cabinets),  technological controls, and administrative procedures. The district will document requests for  and release of records, and retain the documentation in accordance with law. 

If the district enters into a contract with a third party that calls for receipt of student PII by the  contractor, the agreement will include a data security and privacy plan that includes a signed  copy of the Parents’ Bill of Rights and addresses the following, among other contractual  elements: 

  1. training of vendor employees regarding confidentiality requirements; 
  2. limiting access to PII to those individuals who have a legitimate educational interest or  need access to provide the contracted services; 
  3. prohibiting the use of PII for any other purpose than those authorized under the contract; 4. prohibiting the disclosure of PII without the prior written consent of the parent/guardian  or eligible student, unless it is to a subcontractor in carrying out the contract, or unless  required by statute or court order, in which case they must provide notification to the  district (unless notice is prohibited by the statute or court order); 
  4. maintaining reasonable administrative, technical and physical safeguards to protect PII; 6. using encryption technology to protect PII while in motion or in its custody to prevent  unauthorized disclosure; 
  5. breach and notification procedures. 

The district will, via written agreements, designate authorized representatives who have access to  educational records. The written agreement will specify how the work falls within the exception,  what personally identifiable information is to be disclosed, how the educational record will be  used, and that the records will be destroyed by the authorized representative once they are no  longer needed for that purpose or the agreement expires. 

Section 6. Whenever a student record or any material contained therein is to be made available to  third persons, other than those covered by the exceptions authorized by FERPA, the  parent/guardian or eligible student must file a written consent to such action. The written  consent must specify the records to be released, the reasons for such release, and to whom. If the  parent or eligible student so requests, the district will provide them with a copy of the records  disclosed. In addition, if the parent of a student who is not an eligible student so requests, the  district will provide the student with a copy of the records disclosed.

Section 7. Unless specifically exempted by FERPA, all persons requesting access to such records  will be required to sign a written form which indicates the legitimate educational interest that such person has in inspecting the records. Such form will be kept with the student’s file and will  be maintained with the student’s file as long as the file is maintained. 

Additional Rights Under New York State Law Related to the Protection of Student Data and  Third Party Contractors 

New York State Law offers parents additional rights beyond FERPA in regard to third party  contractors and student PII. The district will post on its website and distribute a ‘Parents’ Bill of  Rights for Data Privacy and Security.’ The ‘Parents’ Bill of Rights’ will establish the following: 

  • Educational purpose: The use of student personally identifiable information (PII) is for  educational or related purposes only.
  • Transparency: Disclosure of third party contracts and their privacy provisions.
  • Authorization: Assurance that proper authorization will be secured prior to the release of  PII.
  • Security: A description of the measures in place to protect PII, without compromising  the security plan.
  • Data Breach Notification: An explanation of the procedures in the event of a data breach.
  • Complaint Procedure: The district offers a complaint procedure in the event that a parent  suspects a breach of student data by a third party contractor and provides information  about lodging a complaint with the New York State Education Department’s Chief  Privacy Officer.

See policy 8635 (and regulation 8635-R), Information and Data Privacy, Security, Breach and  Notification for more information on data security and breaches of PII, and 8635-E for the  Parent’s Bill of Rights for Data Privacy and Security. 

Retention and Disposition of Student Records 

The Board has adopted the Records Retention and Disposition Schedule ED-1 issued pursuant to  Article 57-A of the Arts and Cultural Affairs Law, which contains the legal minimum retention  periods for district records. The Board directs all district officials to adhere to the schedule and  all other relevant laws in retaining and disposing of student records. In accordance with Article  57-A, the district will dispose of only those records described in the schedule after they have met  the minimum retention periods set forth in the schedule. The district will dispose of only those  records that do not have sufficient administrative, fiscal, legal or historical value to merit  retention beyond the established legal minimum periods. 

Effective Date: February 2, 2021