Skip to main content

Student Privacy and Release of Information (Policy 2250)

University Policy 2250

Download a Printable Version of Policy 2250

Effective Date

July 1987

Last Revision Date

April 04, 2024

Responsible Party

Office of Institutional Compliance and Ethics, (208) 426-1258

Scope and Audience

This policy applies to all University faculty, staff, and students.

Additional Authority

  • Family Educational Rights and Privacy Act of 1974 (“FERPA”) – 20 U.S.C. § 1232g
  • Idaho State Board of Education Policy, Section III.P.4. (Students – Student Records)
  • University Policy 1065 (Sexual Harassment, Sexual Misconduct, Dating Violence, Domestic Violence, and Stalking)

1. Policy Purpose

To comply with the Family Educational Rights and Privacy Act of 1974 that provides privacy protection for student records.

2. Policy Statement

Boise State University is committed to protecting student privacy and student rights with respect to their Education Records, ensuring responsible data handling, and clearly outlining the university’s procedures to promote trust and accountability in compliance with the Family Educational Rights and Privacy Act.

3. Definitions

3.1 Access

The right of students to review and inspect their Education Record and to control the review and inspection of the Education Records by third parties

3.2 Attendance

A student is considered to be in attendance: 1.) upon registering for a course and 2.) during the period in which they are working under a work-study program.

3.3 Directory Information

Information contained in an Education Record of a Student that would not generally be considered harmful or an invasion of privacy if disclosed (see section 6).

3.4 Disclosure

To permit Access to or the release, transfer, or other communication of Personally Identifiable Information contained in Education Records by any means, including oral, written, or electronic means, to any party except the party who provided or created the record.

3.5 Education Records

Records maintained by Boise State University or by a person/party acting on behalf of Boise State University that directly relates to a Student (see section 5).

3.6 Financial Aid

A payment of funds provided to an individual (or a payment in-kind of tangible or intangible property to the individual) that is conditioned on attendance of the individual at the University.

3.7 Legitimate Educational Interest

An interest in Education Records by a University Official where the information is:

  • Necessary to perform appropriate tasks that are specified in a University Official’s position description or by a contract agreement;
  • Used within the context of University business and not for purposes extraneous to the University Official’s areas of responsibility;
  • Relevant to the accomplishment of an official task or to a determination about the student; and/or
  • Used consistently with the purposes for which the information is maintained.

3.8 Parent

A natural parent, a guardian, or an individual acting as a parent in the absence of a parent or a guardian. The determination of whether an individual is acting as a parent for purposes of this definition must be made by the Office of Institutional Compliance and Ethics. Generally, if a Student is living in the care of an individual on a day-to-day basis, that individual may be considered a parent for purposes of this policy.

3.9 Personally Identifiable Information

Information that can be used to distinguish or trace an individual’s identity either directly or indirectly through linkages with other information. This excludes Directory Information.

3.10 Student

Any individual who is formally admitted and is or has been in attendance at Boise State University. Does not include applicants for admission nor persons who have been admitted but have not yet registered.

3.11 University Officials

A University administrator; faculty; professional staff; academic advisor; clerical or support employee, including the Department of Public Safety; volunteer; person or companies with whom the University has contracted as its agent, acting with a Legitimate Educational Interest, to provide a service instead of using University employees or officials (such as an auditor, collection agent, or service provider); staff in the Alumni Association; staff at the University Foundation; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another University Official in performing their tasks.

4. Student Rights

a.  The Family Educational Rights and Privacy Act is a federal law that gives Students certain rights with respect to their Education Records. FERPA provides the right for Students to:

  • Inspect and review their Education Records within forty-five (45) days of the day the University receives a request for Access (see section 9 of this policy for more detail);
  • Request the amendment of their Education Records that they believe are inaccurate or misleading (see section 9 of this policy for more detail);
  • Consent to Disclosures of Personally Identifiable Information contained in their Education Records, except to the extent that FERPA authorizes Disclosure without consent (see section 8 of this policy for more detail); and
  • File a complaint with the U.S. Department of Education concerning alleged failures on the part of the university to comply with the requirements of FERPA (see section 11 of this policy for more detail).

b.  Under guidance provided by the Department of Education, all FERPA rights transfer from a Parent to a Student when a Student begins their postsecondary education, even if the Student is a minor.

5. Education Records

a. The following are considered Education Records:

  • Data contained on an academic transcript;
  • Papers, exams, and other coursework submitted by the student;
  • Recorded learning activities which contain information directly related to a student
  • Academic advising notes;
  • Supporting documentation related to academic transactions (e.g., copies of forms used to enroll students);
  • Student email;
  • Student conduct records; and
  • Student financial information.

b. The following are not considered Education Records:

  • Records by a University official which are in the sole possession of the maker of the records, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the records (e.g., notes regarding a telephone or face-to-face conversation made by a University Official depending on the nature and content of the notes);
  • Records created and maintained by the University Department of Public Safety for the purpose of law enforcement;
  • Except records relating to student employees which are their Education Records, records related to the employment of a person at Boise State University where those records are maintained in the normal course of business and relate exclusively to that person in their capacity as an employee, and are not available for use for any other purpose; and
  • Records maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in their professional or paraprofessional capacity, or assisting in that capacity, which are made, maintained, or used only in connection with the provision of treatment to the student and are not available to anyone other than the persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice. These records are known as “treatment records.” (Note that if a treatment record is disclosed to anyone, including the student themselves, for any purpose other than for the purpose of providing treatment to the student, such records will cease being considered treatment records and will become Education Records.)
  • Records created or received by the University after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student.
  • Grades on peer-graded papers before they are collected and recorded by a faculty member.

6. Student Directory Information

The following information is defined as Directory Information at Boise State University:

  • Student’s name
  • Student’s local, and permanent addresses
  • Student’s telephone listing
  • Student’s photograph
  • Major field of study
  • Dates of attendance
  • Degrees and awards received, and
  • Most recent previous educational agency or institution attended by the student

7. Records Retention

a. Records must be retained for the minimum period required to serve the basic official functions of the office involved (see University Policy 1020 – Public Records Management).

b. At the end of the required minimum retention period, such records should be disposed of in a manner that will not violate their confidential nature. Records of a sensitive and/or confidential nature must be destroyed by shredding, incineration, or in such a manner that they cannot be retrieved or recreated using reasonable means. Departments may request disposal of records by the University warehouse by submitting a Document Disposal Request.

8. Disclosure of Education Records

8.1 Disclosure of Directory Information

A student has the right to restrict the University from disclosing their Directory Information by notifying the University that they do not wish for their Directory Information to be disclosed without their written consent. Instructions on how a Student may make this restriction are available at Update FERPA Restrictions.

8.2 Authorized Disclosure (“Release”)

A Student may sign a Release Form to allow Disclosure of their Education Records. Such release will generally indicate specific individuals or organizations that the Student wishes to receive information, and the Student has the right to specify which information that they want to be disclosed. A Release may be rescinded through the submission of a subsequent Release Form. Release Forms are available on the Registrar’s Office website.

8.3 Permitted Disclosure

A Student’s Education Records or other Personally Identifiable Information (other than that contained in the Directory Information) generally must not be released without the written consent of the Student. However, the University may disclose Educational Records and/or other Personally Identifiable Information without a Student’s consent if the Disclosure meets one of the following conditions:

a. The Disclosure is to other University Officials who have been determined by the University to have a Legitimate Educational Interest.

b. The Disclosure is to an official of another institution of postsecondary education where the Student seeks or intends to enroll, or where the Student is already enrolled, so long as the Disclosure is for purposes related to the Student’s enrollment or transfer, upon condition that the Student be notified of the transfer, receive a copy of the record if desired, and have an opportunity for a hearing to challenge the content of the record.

c. The Disclosure is to authorized representatives of the Comptroller General of the United States, the Secretary of Education, state educational authorities, or authorized representatives of the Attorney General (for law enforcement purposes) where Education Records may be necessary in connection with an audit and evaluation of federally-supported education programs, or in connection with the enforcement of the federal legal requirements which relate to such programs.

d. The Disclosure is in connection with a Student’s application for, or receipt of, Financial Aid if the information is necessary for such purposes as to:

  • Determine eligibility for the aid;
  • Determine the amount of the aid;
  • Determine the conditions for the aid; or
  • Enforce the terms and conditions of the aid.

e. The Disclosure is to state and local officials or authorities to whom such information is specifically allowed to be reported or disclosed pursuant to State statute adopted –

(i.) Before November 19, 1974, if the allowed reporting or Disclosure concerns the juvenile justice system and such system’s ability to effectively serve the Student whose records are released, or

(ii.) After November 19, 1974, if –

  • The allowed reporting or Disclosure concerns the juvenile justice system and such system’s ability to effectively serve, prior to adjudication, the Student whose Education Records are released; and
  • The officials and authorities to whom such information is disclosed certify in writing to the University that the information will not be disclosed to any other party except as provided under State law without the prior written consent of the Student.

f. The Disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating, or administering predictive tests, administering Student aid programs, and improving instruction, if such studies are conducted in such a manner as will not permit the personal identification of Students and their Parents by persons other than representatives of such organizations and such information will be destroyed when no longer needed for the purpose for which it is conducted, and there is a written agreement with the organization conducting the study that:

  • Specifies the purpose, scope, and duration of the study or studies and the information to be disclosed;
  • Requires the organization to use Personally Identifiable Information from Education Records only to meet the purpose or purposes of the Student as stated in the written agreement;
  • Requires the organization to conduct the study in a manner that does not permit personal identification of Students and Parents by anyone other than representatives of the organization with Legitimate Educational Interests; and
  • Requires the organization to destroy all Personally Identifiable Information when the information is no longer needed for the purposes for which the study was conducted and specifies the time period in which the information must be destroyed.

g. The Disclosure is to accrediting organizations in order to carry out their accrediting functions.

h. The Disclosure is to appropriate authorities in the case of an emergency where the Disclosure of information is necessary to protect the health or safety of the Student or other persons.

  • In determining whether such Disclosure is necessary, the totality of the circumstances will be considered including, but not limited to 1.) the seriousness of the threat to the health or safety of the Student or other individual; 2.) the necessity of gaining the information to deal with the emergency; 3.) the ability of the parties to whom the information is disclosed to deal with the emergency; and 4.) the extent to which time is of the essence in dealing with the emergency.
  • The Vice President for Student Affairs and Enrollment Management or their designee are the only individuals authorized to make this determination on behalf of the University.

i. The Disclosure is to comply with a judicial order or lawfully issued subpoena. The University will comply only after making a reasonable effort to notify the Student of the order or subpoena in advance of compliance so that the Student may seek protective action unless the Disclosure is in compliance with:

  • A Federal grand jury subpoena and the court has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed.
  • Any other subpoena issued for a law enforcement purpose where the court or other issuing agency has ordered that the existence or the contents of the subpoena, or the information furnished in response to the subpoena, not be disclosed.
  • An ex parte court order obtained by the United States Attorney General (or designee not lower than an Assistant Attorney General) concerning investigations or prosecutions of an offense listed in 18 U.S.C. § 2332b(g)(5)(B) or an act of domestic or international terrorism as defined in 18 U.S.C. § 2331.

j. The Disclosure is made to the court where:

  • The University initiates legal action against a Student or their Parent, where such Education Records are relevant for the University to proceed with the legal action as plaintiff; or
  • A Student or their Parent initiates legal action against the University, where such Education Records are relevant for the University to defend itself.

k. The Disclosure is to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense (see University Policy 1065 – Sexual Harassment, Sexual Misconduct, Dating Violence, Domestic Violence, and Stalking). The Disclosure may only include the final results of the disciplinary proceeding conducted by the University with respect to that alleged crime or offense. The University may disclose the final results of the disciplinary proceeding, regardless of whether the institution concluded a violation was committed.

l. The Disclosure is in connection with a disciplinary proceeding at the university – the university will only disclose the final results of the disciplinary proceeding and only if it determines that:

  • The Student is an alleged perpetrator of a crime of violence (as defined in 34 CFR § 99.39) or non-forcible sex offense; and
  • It has been found, with respect to that allegation, that the Student committed a violation of University rules or policies.

m. The Disclosure is to a Parent of a Student regarding the Student’s violation of any federal, state, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance if:

  • The University determines that the Student has committed a disciplinary violation with respect to that use or possession; and
  • The Student is under the age of 21 at the time of the Disclosure to the Parent.

n. The Disclosure concerns sex offenders and other individuals required to register under § 170101 of the Violent Crime Control and Law Enforcement Act of 199, 42 U.S.C. § 14071, and the information was provided to the University under 42 U.S.C. § 14071 and applicable federal guidelines.

o. Additional Disclosure may be permitted as allowed under FERPA and accompanying regulations. Education Records may also be disclosed where there is written consent from the Student and such consent 1.) specifies the records that may be disclosed, 2.) states the purpose of the Disclosure, and 3.) identifies the party or class of parties to whom the Disclosure applies.

8.4 Maintenance of Student Education Record Requests and Disclosures

The university will maintain a record of each request for Access to, and each Disclosure of Personally Identifiable Information from, the Education Records of each Student, as well as the names of state and local educational authorities and agencies that have received Student records and may make further Disclosures of a Student’s Personally Identifiable Information from their Student records without consent. This record shall be maintained with a Student’s Education Records for as long as the Education Records are maintained. Since Education Records are created and maintained on many different areas of campus, all University Officials must forward a copy of the request or Disclosure to the Office of the Registrar so that request or Disclosure may be centrally maintained.

a. For each request or Disclosure, the record must include:

  • The name(s) of the parties who have requested or received Personally Identifiable Information from the Student records; and
  • The Legitimate Educational Interests the parties had in requesting or obtaining the information.

b. For each Disclosure of Personally Identifiable Information from Education Records that the University makes under the health or safety emergency exception, the University must record the following information:

  • The articulable and significant threat to the health or safety of a Student or other individual that formed the basis for the Disclosure; and
  • The parties to whom the University disclosed the information.
  • Since the only people authorized to make this type of Disclosure are the Vice President for Student Affairs and Enrollment Management or their designee, they must ensure that this required information is forwarded to the Office of the Registrar so such Disclosure information may be centrally maintained.

8.5 Limits on Re-disclosure

a. The University will disclose a Student’s Personally Identifiable Information from Education Records only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior written consent of the Student unless otherwise allowable under section 8.2 above. Personally Identifiable Information disclosed to an agency or organization may be used by that agency or organization’s officers, employees, and agents for the purposes for which the Disclosure was made. The limitations on re-Disclosure are known as Third Party Restrictions.

b. The following is an example of the type of Third-Party Restrictions statement that the University will place on records released to agencies or organizations:

“Information contained herein is for the intended purpose only and it is not to be used for any other purpose or released to any other person or organization without the written consent of the Student whose name appears herein or as otherwise allowable under Boise State Policy 2250 (Student Privacy and Release of Information). In accordance with the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g, if you are unable to comply you must return this record immediately to Boise State University’s Office of the Registrar.”

9. Student Rights

9.1 Right to Inspect and Review Education Records

a. Students have the right to inspect and review their Education Records. The University will provide Students with this Access within 45 (forty-five) days of their request. Such inspection and review must take place during business hours. Students should contact the Office of the Registrar at (208)426-4249. No Education Records may be destroyed if there is an outstanding request to inspect and review the Education Records.

b. The University is not required to release to the Student the following information from the Student’s Education Record:

(i.) The parent or guardian’s financial records and statements or any related information.

(ii.) Confidential letters and statements of recommendation if the Student:

  • Waived their right to inspect and review those letters and statements; and
  • Such letters and statements are related to the Student’s admission to the University, application for employment, or receipt of an honor or honorary recognition.

c. The waiver must be in writing and signed by the Student. The waiver must not be a condition of admission to or receipt of a benefit or service from the University. Even if a Student has signed a waiver, the Student must be given, upon request, the names of persons providing the recommendations.

d. A Student may inspect and review only the specific information that pertains to them if the Education Record contains information on more than one Student.

9.2 Request to Amend Education Records

a. A Student who believes that any information in their Education Record is misleading, inaccurate, or is a violation of their privacy rights, may request that the University amend such records. Such a request should be made at the level closest to the source of the information. Informal meetings and discussions with the faculty member or other University Official responsible for the record should be utilized first.

b. If an informal attempt is unsuccessful, a Student may make a formal request to the Office of Institutional Compliance and Ethics for a hearing to challenge the information in their   Education Records on the grounds that such information is inaccurate, misleading, or in violation of their privacy rights.

c. The Office of Institutional Compliance and Ethics will hold the requested hearing within forty-five (45) days of receiving the formal request from the Student. The Student will be given notice of the date, time, and place reasonably in advance of the hearing. A hearing officer (a University employee who does not have a direct interest in the outcome of the hearing) will conduct the hearing. The Office of Institutional Compliance and Ethics will select the hearing officer.

d. The Student will be provided with a full and fair opportunity to present evidence relevant to the request and may, at their own expense, be assisted or represented by one or more individuals of the Student’s choice, including an attorney.

e. Following the hearing, the hearing officer will issue a written decision within forty-five (45) days of the hearing. Such a decision must be based solely on the evidence presented at the hearing and must include a summary of the evidence and the reasons for the decision. If the hearing officer determines that the information in the Student’s Education Record is inaccurate, misleading, or otherwise a violation of the Student’s privacy rights, the hearing officer will amend the record accordingly.

f. If the hearing officer determines that the Student’s Education Records will not be changed, their written decision will inform the Student of their right to place a statement in the record commenting on the contested information in the Education Records and/or stating why the Student disagrees with the hearing officer’s decision. Such a statement will be maintained in the Student’s Education Records alongside the contested information and will be maintained for as long as the Education Records are maintained. If the contested information is ever disclosed, the University must disclose the Student’s statement along with that information.

10. Required Employee Training

All employees with access to student records (electronic or hardcopy) in the course and scope of their job duties must complete required FERPA training within the first thirty (30) days upon appointment to their position and thereafter every three (3) years. Failure to complete required FERPA training may result in the suspension of an employee’s access to student records and may include corrective and/or disciplinary action up to and including dismissal from employment.

11. File a FERPA Violation Complaint

Complaints regarding allegations of FERPA violations may be made by submitting a FERPA Concern Report Form or by emailing the Office of Institutional Compliance and Ethics at complianceandethics@boisestate.edu.

A student may also file a written complaint with:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue S.W.
Washington, D.C. 20202
Complaint Form

12. Forms

Student FERPA Rights, Information, and Forms

U.S. Department of Education FERPA Complaint Form

U.S. Department of Education

Revision History

January 1994; July 1995; May 2016; February 2017; April 04, 2024