Guidelines to Protect the Privacy of Student Records at the University of Louisville: Home

These guidelines are intended to help UofL students, faculty, staff, and administrators comply with the federal Family Educational Rights and Privacy Act.

The Family Educational Rights and Privacy Act of 1974 (sometimes referred to as the Buckley Amendment, but more often by its acronym, FERPA) affords students certain rights concerning their education records. Under FERPA, UofL students have the right

• to inspect and review their education records;
• to seek to have their records amended; and
• to have some control over the disclosure of information from their records.

No one, not even a UofL student's parent or legal guardian, will have access to a student's education records, nor will their contents be disclosed, without the written consent of the student, except as provided by the Act.

UofL may release certain categories of "directory information," however, unless a student asks that some or all of that information not be disclosed.

FERPA, as amended, may be found at 20 U.S.C. 1232g; its final revised regulations may be found at 34 CFR 99. It is administered by the Family Policy Compliance Office of the U. S. Department of Education; for additional information, see the FPCO web site at:

FERPA obliges the University of Louisville to inform students of their rights and to follow procedures through which their rights can be exercised. The university intends to comply fully and fairly with the provisions of FERPA. Where necessary, the university has taken the provisions of KRS 164.183 and KRS 61.870-61.884 into account in formulating these guidelines.

The director of the University Archives and Records Center administers the university's student records policy. Copies of the Act, the annual "Notification of Students' Privacy Rights Under FERPA" statement, these guidelines, and other types of assistance can be obtained from the University Archives. Revisions and clarifications of the university's guidelines and procedures will be made as needed.

A UofL student's education records are those records maintained by UofL (or by a party acting for UofL) that are directly related to the student. Records containing a student's name, social security number, or other personally identifiable information, in whatever medium, unless identified in one of FERPA's excluded categories, are education records.

Directory information includes the following items, not generally considered harmful or an invasion of privacy if disclosed, about UofL students: name, postal addresses, e-mail address, telephone number, date (month and day only) and place of birth, major fields of study, classification (freshman, sophomore, etc.), enrollment status (full-time or part-time), enrollment unit (A&S, Medicine, Law, Music, etc.), residency status, participation in officially recognized activities and sports, weight and height of athletic team members, dates of attendance, degrees and awards received, and most recent previous educational institution attended.

UofL may release without written consent those items specified as public or directory information for students who are currently enrolled, provided the following conditions are met prior to disclosure: a) that UofL inform the students of items designated as public or directory information; b) that students be given the opportunity to refuse disclosures of directory information; and c) that the students be given a reasonable period of time in which to state such refusals in writing. UofL may also release without written consent those items designated as public or directory information on any student not currently enrolled unless that student, at his or her last opportunity as a student, requested otherwise.

Both current students and former students may direct the university not to disclose directory information and may also change their previous instructions to the university.

A student has the right to direct the university not to release directory information. A student can specify that only his or her address category (postal addresses, e-mail address, telephone number) be withheld or he or she can specify that all of his or her directory information items be withheld. The form requesting directory information to be withheld can be downloaded from the University Archives and Records Center website or procured from the University Archives and Records Center, which is on the fourth floor of the Ekstrom Library. If, at the student's last opportunity, he or she instructed UofL to withhold his or her directory information, UofL will continue to withhold it, even though now the person is a "former student," until the person directs otherwise. UofL will comply with a student's request for nondisclosure of directory information, although it may take as long as two business days for the university to process the change.

Students should be aware of potential undesirable consequences of withholding directory information. If a student has instructed UofL to withhold his or her directory information, UofL will not be able to send such information to potential employers and other interested parties without the student's written permission.

The following types of records are not included in the term "education records" and are not subject to inspection or review by students:

1. Records of instructional, supervisory, and administrative personnel that are in the sole possession of the maker thereof and are not accessible or revealed to any other individual (except a substitute who performs on a temporary basis the duties of the individual who made the records).
2. Records maintained by the UofL Department of Public Safety (DPS) that were created by DPS for the purpose of law enforcement. Such records must always be kept separate from student education records. If such a record is sent to another university official outside DPS or is placed in an area where it could be reviewed by other university officials, it becomes an education record subject to inspection by the student. Some DPS records, however, are subject to inspection by students and others under the Kentucky Open Records Act.
3. Records relating to individuals who are employed by the University of Louisville that are made and maintained in the normal course of business, relate exclusively to individuals in their capacity as employees, and are not available for use for any other purpose. It is possible that such records could be made available under KRS 61.872. It should be noted that records of an individual in attendance at UofL who is employed as a result of his or her status as a student (e.g., a work-study student) are education records and as such may be inspected by the student.
4. Records relating to a student that are 1) created or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional, acting in his or her professional capacity or assisting in a paraprofessional capacity; 2) used solely in connection with the provision of treatment to the student; and 3) not disclosed to anyone other than individuals providing such treatment. However, these records can be personally reviewed by a physician or other appropriate professional of the student's choice. "Treatment" in this context does not include remedial educational activities or activities which are part of the program of instruction at the University of Louisville. Such records must always be kept separate from student education records. If such a record is sent to another university official outside the recognized professional or is placed in an area where it could be reviewed by other university officials, it becomes an education record subject to the student's inspection.
5. Records that contain only information relating to a person after that person is no longer a student at UofL (e.g., information gathered on the accomplishments of alumni).

A UofL student is a person who has been in attendance at UofL, including cooperative, correspondence, distance education, and international programs. FERPA does not apply to records of applicants for admission to UofL who are not accepted or who are accepted but do not attend. A student who is enrolled in one UofL college, school, or division, but who is denied admission by another UofL unit, does not have any FERPA rights in the unit which denied admission to him or her.

Disclosure means permitting access to or the release, transfer or other communication of education records of the student or the personally identifiable information contained therein to any party, orally, in writing, by electronic means, or by any other means.

Financial Aid means a payment of funds to an individual (or a payment in kind of tangible or intangible property to the individual) that is conditioned on the individual's attendance at the University of Louisville.

Personally Identifiable means data or information which include 1) the name of the student, the student's parent, or other family member; 2) the student's address; 3) a personal identifier such as a social security number or student number; or 4) a list of personal characteristics, or other information that would make the student's identity easily traceable.

Student Right-to-Know Act of 1990 (SRTK) requires colleges and universities to report graduation rates to current and prospective students.

Solomon Amendment of 1996 requires institutions to provide certain directory-type information on students, at least seventeen years of age, upon request from representatives of the Department of Defense for military recruiting purposes.

USA PATRIOT Act of 2001 requires institutions to provide student education records or other tangible items to the U. S. Attorney General or his or her designee in response to an ex parte court order related to a terrorism investigation.

UofL must notify its current students annually of their FERPA rights. Former students do not have to be notified. The director of the University Archives and Records Center oversees the publication of UofL's"Notification of Students' Privacy Rights under FERPA" on the university's web pages and in its catalogs and at least annually in its class schedules, and, if possible, in the Cardinal.

A UofL student has the right to inspect and review his or her education records within forty-five days of the day the university receives the request for access. The student should submit a written request identifying the record(s) he or she wishes to inspect to one of the following university officials: the registrar, the dean of the college or school in which the student is enrolled, the vice president for student affairs, or the director of the University Archives and Records Center. The university will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the university official to whom the student submitted the request, that official shall advise the student of the person to whom the request should be addressed. The university official who receives a student's written request to inspect his or her records must send a copy of the request to the director of the University Archives and Records Center upon receipt of the request.

A UofL student has the right to inspect and review all education records about him or her except (1) financial information submitted by his or her parents; (2) confidential letters and recommendations placed in his or her files prior to January 1, 1975, provided these letters were collected under established policies of confidentiality and were used only for the purposes for which they were specifically collected; (3) confidential letters and statements of recommendation placed in the records after January 1, 1975, which he or she has waived the right to inspect and review and that are related to the student's admission, application for employment or job placement, or receipt of honors; and (4) education records containing information about more than one student; however, in such cases UofL will permit access to that part of the records pertaining only to the inquiring student.

UofL students may waive any or all of their rights to review confidential letters and statements of recommendation under FERPA. The right of waiver is subject to the following conditions: (1) That UofL does not require waivers. (2) That no UofL service or benefit is denied students who fail to supply waivers (although UofL is free to request waivers). (3) That the documents which students have waived the right to access are used only for the purposes for which they were collected. If used for other purposes, the waivers are void and the documents may be inspected by the students. Instruments used by UofL units for soliciting recommendations and evaluations must contain only requests for information that will be used for the specifically-intended purposes. (4) That the waivers are in writing and signed by the students. Students may waive their rights to inspect and review either individual documents or classes of documents (e.g., part or all of an admission or job placement file). They may revoke the waiver in writing, but, by revoking it, they do not have the right to inspect and review documents collected while the waiver was in force. Note: when "applicants" who waive their rights to access documents become students, they may specifically request and be given the names of all individuals who submitted letters and statements of recommendation for them.

Once students have requested access to their education records, such students' records cannot be destroyed until inspection and review have been provided. In addition, two additional items must not be destroyed unless the records to which they pertain are destroyed: a) "explanations" placed in the records by students as a result of a request for amendment that has been denied, as long as the original document that was the subject of the dispute is maintained, and b) records of disclosures and requests for disclosures.

At the University of Louisville, undergraduate and graduate admissions files, including letters of recommendation, may be destroyed five years after graduation or date of last attendance. Professional school admissions files, which may include letters of recommendation, are retained permanently.

Students have the right to view their education records wherever these records are maintained on campus. Although it is the university's policy to honor requests to inspect records as promptly as possible, once a student has submitted a request to inspect his or her records, UofL has forty-five days in which to comply. The official to whom the student makes the request may require the student to submit the request in writing. The student may request and receive an explanation or interpretation of his or her record from a responsible official. In cases where a student is not within commuting distance of campus, and therefore is unable to be present to view the record on campus, UofL will try to make other arrangements for the student to obtain access, either through photocopies or by using an appropriate third party. Questions or problems regarding these matters should be referred to the director, University Archives and Records Center, for resolution.

UofL must obtain written consent from a student before disclosing any personally identifiable information from his or her education records, apart from directory information, with the exceptions noted below. Such written consent must a) specify the records to be released, b) state the purpose of the disclosure, c) identify the party or class of parties to whom disclosure may be made, and d) be signed and dated by the student. While the student's consent must be made in writing (oral consent is not sufficient) a UofL official may accept a fax or e-mail consent, provided the official is reasonably certain that the fax or e-mail constitutes a bona fide consent.

UofL may disclose personally identifiable information from a student's education records to a third party if the eligible student has signed and dated a written consent form which is presented to a university official by the third party, provided the official is reasonably certain that the form constitutes a bona fide consent.

UofL should inform parties to whom personally identifiable information is released that recipients, as a general rule, are not permitted to disclose the information to others without the written consent of the student. An example of such wording follows: "The attached information has been forwarded to you at the request of the student with the understanding that it will not be released to other parties. The Family Educational Rights and Privacy Act of 1974 as amended prohibits release of this information without the student's written consent. Please return this material to us if you are unable to comply with this condition of release." In certain circumstances (see 34 CFR 99.33), the recipient of the information may legally redisclose the information. If a third party rediscloses personally identifiable student information in violation of FERPA, however, UofL shall be prohibited from permitting access to education records to that third party for a period of not less than five years.

UofL must obtain written consent from a student before disclosing any personally identifiable information from his or her education records, apart from directory information, with the exceptions noted below. Such written consent must a) specify the records to be released, b) state the purpose of the disclosure, c) identify the party or class of parties to whom disclosure may be made, and d) be signed and dated by the student. While the student's consent must be made in writing (oral consent is not sufficient) a UofL official may accept a fax or e-mail consent, provided the official is reasonably certain that the fax or e-mail constitutes a bona fide consent.

UofL may disclose personally identifiable information from a student's education records to a third party if the eligible student has signed and dated a written consent form which is presented to a university official by the third party, provided the official is reasonably certain that the form constitutes a bona fide consent.

UofL should inform parties to whom personally identifiable information is released that recipients, as a general rule, are not permitted to disclose the information to others without the written consent of the student. An example of such wording follows: "The attached information has been forwarded to you at the request of the student with the understanding that it will not be released to other parties. The Family Educational Rights and Privacy Act of 1974 as amended prohibits release of this information without the student's written consent. Please return this material to us if you are unable to comply with this condition of release." In certain circumstances (see 34 CFR 99.33), the recipient of the information may legally redisclose the information. If a third party rediscloses personally identifiable student information in violation of FERPA, however, UofL shall be prohibited from permitting access to education records to that third party for a period of not less than five years.

UofL may disclose education records to the following persons without the student's consent:

1. Authorized representatives of the following officials for audit or evaluation of federal- and state-supported programs, or for enforcement of or compliance with federal legal requirements which relate to those programs: the Comptroller General of the United States; the Secretary of the Department of Education; educational authorities of the Commonwealth of Kentucky.
2. Veterans Administration officials.
3. UofL officials with legitimate educational interests. A university official is a person employed by the university in an administrative, supervisory, academic or research, or support staff position (including the student grievance officer, law enforcement unit personnel, and health staff); a person or company with whom the university has contracted (such as an attorney, auditor, or collection agent); a person serving on the board of trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another university official in performing his or her tasks. A university official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. Although a person may be regarded as a "university official," he or she does not have inherent rights to any and all education record information. The university official must demonstrate a legitimate educational interest to the records custodian as opposed to a personal or private interest and such determination must be made on a case-by-case basis. When necessary, this determination is made by the director, University Archives and Records Center, who shall use the following criteria: a) is the person performing appropriate tasks that are specified in his or her position description or by a contract agreement; b) performing a task related to a student's education; c) performing a task related to the discipline of a student; d) providing a service or benefit relating to the student or student's family, such as health care, counseling, job placement, or financial aid. Disclosure to a university official having a legitimate educational interest does not constitute authorization to share that information with a third party without the student's written permission. Furthermore, such information, when it has fulfilled its originally specified purposes, should be properly destroyed or returned to the originating office for appropriate disposition. Appropriate UofL units must establish procedures for initially instructing and periodically reminding university officials of FERPA's confidentiality requirements before giving them access to computer systems containing student education records. These university officials must also be informed of the university's criteria for determining legitimate educational interest and their responsibility for assuring that access is not abused.
4. Upon request of another school in which a student seeks or intends to enroll, the university may disclose his or her education records without consent to the appropriate officials of that school.
5. Organizations providing financial aid to students, or determining financial aid decisions concerning eligibility, amount, condition, and enforcement of terms of said aid.
6. Organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, and administer predictive tests, to administer student aid programs or to improve instruction. Before such an organization is given access, it must submit its written agreement that it will not disclose personally identifiable information on students and that information secured will be destroyed when no longer needed for its projects.
7. Accrediting organizations carrying out their accrediting functions.
8. Persons in compliance with a judicial order or a lawfully issued subpoena, provided that the university makes a reasonable attempt to notify the student in writing in advance of compliance. NOTE: UofL is not required to, nor should it, notify the student if a federal grand jury subpoena, or any other subpoena issued for a law enforcement purpose, orders the institution not to disclose the existence or contents of the subpoena. If UofL initiates legal action against a student, no subpoena would be required if UofL made a reasonable effort to notify the student in advance of its intent to disclose information from education records in a court of law.
9. The U. S. Attorney General or his or her designee in response to an ex parte court order related to a terrorism investigation, pursuant to the USA PATRIOT Act of 2001. If so ordered, the university will not inform the student.
10. Persons in an emergency, if the information is in fact necessary to protect the health or safety of students or other persons. In accordance with the Act, this wording "shall be strictly construed." If necessary, the determination of what is an emergency will be made by the director, University Archives and Records Center, or a designee, and shall be made scrupulously and with respect for the privacy rights of the student whose records are involved, after consideration of the following factors: a) the seriousness of the threat to the health or safety of the student or other individuals; b) the need for the information to meet the emergency; c) whether the parties to whom the information is disclosed are in a position to deal with the emergency; and d) the extent to which time is of the essence in dealing with the emergency.
11. An alleged victim of a crime of violence or a nonforcible sex offense of the final results of any UofL disciplinary proceeding against the alleged perpetrator of that crime with respect to that crime (pursuant to the federal Campus Security Act of 1990 as amended).
12. Parents or legal guardians of a student under the age of 21, but only of incidents involving drug and alcohol violations in which the student is found to be responsible, pursuant to the federal Higher Education Amendments of 1998. Otherwise, except for directory information, the university does not release a student's education records to his or her parents without the student's written permission.

UofL offices must maintain records of requests for and disclosures of personally identifiable information. The records of requests, whether granted or not, shall include the names and addresses of the person(s) who requested the information and their legitimate interests in the information. Records of requests and disclosures do not have to be maintained for:

1. Those requests made by students for their own use;
2. Those disclosures made with the written consent of students;
3. Those disclosures made to university officials under the conditions that allowed such disclosures; or
4. Those disclosures made to a party seeking directory information.

Examples of instances where the university must maintain records of requests and disclosures:

1. In response to a lawfully issued court order or subpoena;
2. For external research purposes where individual students have been identified;
3. In response to an emergency.

The records of disclosures and requests for disclosures are considered a part of the student's education records; therefore, they must be retained as long as the education records to which they refer are retained by the university.

The records of requests and disclosures must include:

1. The parties who have requested or obtained personally identifiable information from the education records of a student, and
2. The legitimate interests these parties had in requesting or obtaining the information.

These records must be made available for inspection to students, responsible institutional officials, state and federal auditors, and others, as prescribed by law.

A UofL student has the right to request the amendment of his or her education records that he or she believes are inaccurate or misleading. To ask the university to amend a record the student believes is inaccurate or misleading, the student should write the university official responsible for the record, clearly identify the part of the record he or she wants changed, and specify why it is inaccurate or misleading. The responsible official shall decide, as soon as possible, but not longer than forty-five days from the date of the request, whether or not to amend the challenged record. The responsible official may amend the record. If the university decides not to amend the record as requested, the university will notify the student of the decision and advise him or her of the right to a hearing regarding his or her request for amendment. The student must also be informed that if he or she wishes to receive a hearing, he or she must make this request in writing to the director, University Archives and Records Center, who will provide additional information regarding the hearing procedures to the student. The director will assemble an appropriate hearing panel and will inform the student of the date, place and time of the hearing. The hearing will have present the student, the official responsible for the question (where appropriate), and all other necessary parties. The student will be afforded a full and fair opportunity to present evidence relevant to the issue raised. The student may be assisted or represented at the hearing by one or more persons of his or her choice, including an attorney, at the student's expense. The judgment of the panel shall be final, based solely on the evidence presented at the hearing, and the record shall be changed or retained as recommended. The panel will issue a written statement summarizing the evidence and stating the reasons for the decisions which will be delivered to all parties concerned who have a legitimate educational interest.

If the panel decides against the requested change, it shall inform the student that he or she shall have the opportunity to place with the education record a statement commenting upon the information in the record and/or setting forth any reasons for disagreeing with the decision of the hearing. This statement shall be maintained as part of the record for as long as the record is held by the university, and shall be provided to all persons to whom the questioned record is provided.

The disposition of records held by UofL pertaining to a deceased person is not a FERPA issue but a matter of institutional discretion. UofL officials may exercise their own judgment in deciding whether, and under what conditions, information should be disclosed to survivors or other third parties. Guidance may be obtained from the director, University Archives and Records Center.

Destruction of university records of any sort may occur only in accordance with the university's records disposition policies. Furthermore, UofL officials may not destroy any education records if there is an outstanding request to inspect and review the records.

Nothing in FERPA allows the university to discuss a student's education records publicly, even if a lawsuit has made the information a matter of public record. A university official may not assume that a student's public discussion of a matter constitutes an implied consent for the official to disclose anything other than directory information in reply. The official who wishes to respond to the media under these circumstances should ask the student for a properly executed consent form.

The public posting of grades by the student's name, student ID number, social security number, or any other identifier that would make it possible to discern confidential student information is a violation of FERPA.

If a student has questions about the provisions of FERPA, these guidelines, or related matters, he or she may contact the Open Records Officer, University Archives and Records Center, 502.852.8787.

If a student believes that the university has not complied with the Act, he or she may direct comments concerning this to the Open Records Officer, University Archives and Records Center, who will try to help resolve the matter in question.

If a student believes that the university has not complied with the Act, he or she may file a written complaint with the Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue S.W., Washington DC 20202-4605.