[Vcsa-announcements] SharePoint Forms and FERPA

Tue Mar 13 14:54:45 PDT 2012

All,

We have recently determined that many VCSA supported SharePoint website forms and data are accessible by individuals outside of the institution, as well as, by those within the institution that do not have a “legitimate educational interest” or “need to know”.  This is a critical FERPA concern and therefore, we are moving forward to implement necessary steps to rectify this situation.  It has been evaluated by Jim, LaRae, Robert and myself that the following two actions must be taken promptly 1) the VCSA Technology firewall will be upgraded to prevent access from any non-UCR IP addresses without a VPN connection and 2) some specifically identified forms are being disabled to the extent that they will no longer be functioning (a separate email is going to those specific departments).

Student Educational Records are protected under FERPA - Family Educational Rights and Privacy Act of 1974.  FERPA defines “Education Record” to include those records that are:

1. Directly related to a student; and

2. Maintained by the University or by a party acting for the University.

·        This definition is not limited to academic records. It also includes housing records,

disciplinary records, financial aid records, and all other records directly related to a

student (unless expressly carved out as an exception).

·        The term “maintained” is not defined, but should be interpreted broadly to include all

records in the possession, custody, or control of any employee or agent of the

University.

In most cases, we believe that the exposure of the confidential information was not known or intentional by staff, but we still must work together to rectify it.  Individuals must have a “legitimate educational interest” or “need to know” to be allowed access to Student Educational Records without the student’s written signature releasing the information.

CRITICAL TAKE AWAYS

1.      The change in the VCSA Firewall will require all staff to VPN into the network to be able to access division SharePoint sites and other VCSA staff sites.  If you need to access from a remote location, you can open a VCSATS service request and IT will work to get you set up.  Please be patient as they work through requests.  Your manager’s approval will be required, please include that in the Service Request.

2.      If you want to create a form that will have student submission and retention of data collected by that form, you must submit to Bracken Dailey, FERPA Compliance Officer, a review of the form to determine the FERPA impact.

the following information should be provided:

a.       Purpose of the form

b.      Who needs access to the data collected by the form?

c.       What data fields do you require on the form?

d.      Do you have students sign a FERPA release authorizing this information to be disclosed?

3.      Upon completion of a FERPA review of the form request, if the information is FERPA protected the form will need to be submitted to VCSA Technology Services to be prioritized and built by that team.

I understand that this action and the required follow-up steps may cause a hardship on your department; however, we must at all times put the security of our student records at the forefront of our actions.  We appreciate your cooperation and if you have any questions or need to move forward with the steps provided above, please don’t hesitate to contact me.

Thank you.

Bracken

[logo2]
Bracken Dailey | Registrar
900 University Avenue
2249 Student Services Building | Riverside, CA 92521-0118
Office: 951.827.3427 | Fax: 951.827.7368
E-mail: Bracken.Dailey at ucr.edu<mailto:Bracken.Dailey at ucr.edu> | Web: Registrar.ucr.edu<registrar.ucr.edu>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.ucr.edu/pipermail/vcsa-announcements/attachments/20120313/8d7fa650/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 16147 bytes
Desc: image001.png
Url : http://lists.ucr.edu/pipermail/vcsa-announcements/attachments/20120313/8d7fa650/attachment.png 