Rights Concerning Student Records

Colorado Early Colleges (CEC) is committed to protecting the confidentiality of student information obtained, created and/or maintained by CEC. Student privacy and CEC’s use of confidential student information are protected by federal and state law, including the Family Educational Rights and Privacy Act (FERPA) and the Student Data Transparency and Security Act (the Act). CEC will manage its student data privacy, protection, and security obligations in accordance with this policy and applicable law.

In recognition of the confidential nature of student education records, no person or agency may access student education records without prior written consent from the student’s parent/guardian or the eligible student, except as set forth in law and this policy.

Definitions

  • Student education records include records related directly to a student and maintained by CEC in all formats and media, including, but not limited to, photographic and electronic, Student education records may contain, but are not limited to, the following: identifying data; academic work completed; level of achievement (grades and standardized test scores); attendance data; standardized intelligence, aptitude or psychological test scores; interest inventory results; health and medical information; family background information; teacher or counselor ratings and observations; reports of serious or recurrent behavior patterns; and Individualized Education Program (IEP) or 504 plans.
  • Student Personally Identifiable Information (student PII) means information that, alone or in combination, personally identifies an individual student or the student’s parent or family, and is collected, maintained, generated, or inferred by CEC, either directly or through a school service, or by a school service contract provider or school service on-demand provider.
  • A security breach means the unauthorized disclosure of student education records or student PII by a third party.
  • Directory information means information contained in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed. Directory information which may be released includes but is not limited to the student’s name; telephone number; address; photograph; major field of study; participation in officially recognized sports and activities; height and weight of members of athletic teams; dates of attendance; grade level; enrollment status; degrees, honors, and awards received; the most recent previous education agency or institution attended by the student; and other similar information. Directory information also includes a student identification number or other unique personal identifier used by the student to access or communicate in electronic systems, but only if the identifier cannot be used to gain access to student education records except when used in conjunction with one or more factors that authenticate the user’s identity, such as a password known only by the authorized user.

 

The following terms used in this policy shall be as defined by the Student Data Transparency and Security Act (“Act”): “school service,” “school service contract provider,” and “school service on-demand provider.”

Content and Custody of Student Education Records

The Admissions office is the official custodian of student education records.

Nothing in this policy shall prevent administrators, teachers, or staff from disclosing information derived from personal observation, not derived from a student’s education records, and not personal notes stored in a place where others can access them.

In accordance with applicable law, requests for inspection and review of student education records, requests for copies of such records, and disclosure of student PII requiring prior approval shall be maintained as a part of each student’s education record.

School personnel shall use reasonable methods to authenticate the identity of parents/guardians, eligible students, school officials, and any other parties to whom they disclose student education records.

Authentication of identity prior to the disclosure of electronic records, through passwords or other security measures, shall be required.

Access to Student Education Records within the CEC Network

CEC shall follow applicable law and CEC policy in accessing, collecting, and sharing student educational records. CEC employees shall ensure that confidential information in student educational records is disclosed only to those with a legitimate educational interest and/or in accordance with all applicable laws.

Access to Student Education Records by Parents and Eligible Students

A parent/ guardian has the right to inspect and review their student’s education records without written consent if the student is under 18 years of age. If a student is 18 years old or older (“eligible student”), the student may inspect or review their own education records and provide written consent for disclosure of such records and PII. However, the parents/guardians are entitled to access their student’s education records if the eligible student is a dependent for federal income tax purposes or the disclosure is in connection with a health or safety emergency.

Request to Amend Student Education Records

A parent/guardian has the right to inspect/review, request corrections to, and request paper or electronic copies of their student’s PII, including that which is maintained by any service contract provider.

A parent/guardian or eligible student may ask CEC to amend a student’s education record if they believe it is inaccurate, misleading, or otherwise violates the student’s privacy rights. Student grades cannot be challenged pursuant to this policy.

Disclosure with Written Consent

Whenever CEC is required by law or policy to obtain written consent prior to disclosing PII from a student’s education record, CEC will provide the parent/guardian or eligible student with the following:

  • The specific records to be disclosed;
  • The specific reasons for such disclosure;
  • The specific identity of any person, agency, or organization requesting such information and the intended uses of the information;
  • The method or manner by which the records will be disclosed; and
  • The right to review or receive a copy of the records to be disclosed.

 

The parent’s/guardian’s, or eligible student’s, consent shall be valid only for the specific instance noted in the disclosure notification. Consent for a student to participate in any course, school activity, special education program, or any other school program shall not constitute the specific written consent required by this policy.

Disclosure Without Written Consent

CEC may disclose student education records or PII contained therein without the written consent of the parent/guardian or eligible student if the disclosure meets one of the following conditions:

  • The disclosure is to a school official having a legitimate educational interest in the student’s education record or the PII contained therein. In accordance with law, only those school officials who have a legitimate educational interest as described in this policy shall be permitted access to specific student education records.
    • For purposes of this policy, a “school official” is a person employed by CEC as an administrator, supervisor, teacher, or support staff member (including health or medical staff, campus culture/security staff, administrative personnel); a person serving on the CEC Board; a person or company with whom CEC has outsourced services it would otherwise use its own employees to perform (such as an attorney, auditor, consultant or therapist); a parent or student serving on an official committee; or a parent, student or other volunteer assisting a CEC employee in performing their job duties.
    • A school official has a “legitimate educational interest” if disclosure to the school official is: necessary for that official to perform appropriate tasks that are specified in their job description or contract agreement; used within the context of official school business and not for purposes extraneous to the official’s areas of responsibility; relevant to the accomplishment of some task or to a determination about the student; and consistent with the purposes for which the data are maintained; to conduct fundraising activities.
  • The disclosure is to officials of another school, school system, or postsecondary institution that has requested the records and in which the student seeks or intends to enroll or has enrolled. Records sent during the student’s application or transfer period may be supplemented, updated, or corrected as necessary.
  • The disclosure is to authorized representatives of the Comptroller General of the United States, the Attorney General of the United States, the Secretary of the U.S. Department of Education, or state and local educational authorities.
  • The disclosure is in connection with a student’s application for, or receipt of, financial aid.
  • The disclosure is to state and local officials and concerns the juvenile justice system’s ability to effectively serve, prior to adjudication, the student whose records are disclosed as provided under the Colorado Open Records Act and Colorado Children’s Code. Such records and PII shall only be disclosed upon written certification by the officials that the records and information will not be disclosed to any other party, except as specifically authorized or required by law, without the prior written consent of the parent or eligible student.
  • The disclosure is to organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate or administer predictive tests; to administer student aid programs; or to improve instruction.
  • The disclosure is to accrediting organizations for accrediting functions.
  • The disclosure is to the parent of an eligible student and the student is a dependent for IRS tax purposes.
  • The disclosure is in connection with an emergency if the information is necessary to protect the health or safety of the student or others.
  • The disclosure is to comply with a judicial order or lawful subpoena. CEC shall make a reasonable effort to notify the parent/guardian or eligible student prior to complying with the order or subpoena unless:
    • The court order or subpoena prohibits such notification; or
    • The parent/guardian is a party to a court proceeding involving child abuse and neglect or dependency matters, and the court order is issued in the context of that proceeding.
  • The disclosure is to the Secretary of Agriculture, or an authorized representative from the USDA Food and Nutrition Service or contractors acting on behalf of the USDA Food and Nutrition Service, for the purposes of conducting program monitoring, evaluations, and performance measurements of state and local educational agencies receiving funding or providing benefits of program(s) authorized under the National School Lunch Act or Child Nutrition Act.
  • The disclosure is to an agency caseworker or other representative of a state or local child welfare agency or tribal organization who has the right to access the student’s case plan because such agency or organization is legally responsible, in accordance with applicable state or tribal law, for the care and protection of the student.
  • The disclosure is of “directory information.” Directory information may be disclosed without the written consent of the parent/guardian or eligible student. The parent/guardian or eligible student has the right to refuse to permit the designation of any or all of the categories of directory information if such refusal is submitted in writing to the school.

Disclosure of Disciplinary Information to School Personnel

In accordance with state law, the Head of School/Principal, or designee, shall communicate disciplinary information concerning any student enrolled in their school to any teacher who has direct contact with the student in the classroom and to any mental health staff member who has direct contact with the student. Any teacher or mental health staff member to whom disciplinary information is reported shall maintain the confidentiality of the information and shall not communicate it to any other person.

State law requires the Head of School/Principal, or designee, to inform the student and the student’s parent/guardian when disciplinary information is communicated and to provide a copy of the shared disciplinary information.

Disclosure to Military Recruiting Officers

Names, addresses, and home telephone numbers, as well as directory information, of high school students shall be released to military recruiting officers within 90 days of the request, unless a parent/guardian or student submits a written request that such information not be released.

Disclosure to Medicaid

In all cases in which a student is enrolled in the Colorado Medicaid program, CEC shall release directory information consisting of the student’s name, date of birth, and gender to Health Care Policy and Financing (Colorado’s Medicaid agency) to verify the Medicaid eligibility of students. CEC shall obtain annual written consent from a parent/guardian before the release of any non-directory information required for billing.

Disclosure to the Colorado Commission on Higher Education (CCHE)

On or before December 31 of each school year, the CEC shall disclose to the CCHE the names and mailing addresses of those students enrolled in the eighth grade for use in mailing the notice of postsecondary educational opportunities and higher education admission guidelines as required by state law.

Contract Providers, In-Demand Providers, or other Third Parties

Student education records are to be disclosed to persons and organizations outside CEC only as authorized by applicable law and CEC policies. The term “organizations outside the network” includes school service on- demand providers and school service contract providers. Acquisition and use of any third-party apps and services that use student data in any capacity must be pre-approved by CEC. Staff must follow the procedure to secure approval before using the contract provider or on-demand provider. CEC will identify specific programs or apps that are approved for school and teacher use and make that list available on the CEC website.

Any contract between CEC and a school service contract provider shall include the provisions required by the Act, including provisions requiring the school service contract provider to safeguard the privacy and security of student PII and imposing penalties for noncompliance with the contract. In accordance with the Act, CEC shall post the following on its website:

  • A list of the school service contract providers and a copy of each contract.
  • A clear explanation of what student PII CEC collects.
  • A list of school service on-demand providers that CEC uses to the extent practicable.
  • Privacy and security standards.
  • CDE data inventory index.
  • That the security of student education records maintained by CEC is a high priority.
  • Security breach or other unauthorized disclosure.

 

Staff members who disclose student education records or student PII in a manner inconsistent with applicable law and CEC policy may be subject to disciplinary action, up to and including termination. Any discipline imposed shall be in accordance with applicable law and CEC policy.

Employee concerns about possible security breaches shall be reported immediately to the Head of School/Principal/CEC Student Data Privacy Administrator. If the Head of School/Principal/CEC Student Data Privacy Administrator is the person alleged to be responsible for the security breach, the staff member shall report the concern to CEC’s Chief Executive Officer (CEO).

When CEC determines that a school service contract provider has committed a material breach of its contract and that such material breach involves the misuse or unauthorized release of student PII, CEC shall follow this policy in addressing the material breach. CEC will not enter into or renew a contract with a service contract provider or on-demand provider that refuses to abide by the required contract terms/requirements.

Data Retention and Destruction

CEC shall retain and destroy student education records in accordance with applicable law and network-approved procedures.

Security Videos

As with any other “education records,” a photo or video of a student is an education record and is subject to specific exclusions when the photo or video is directly related to a student and is maintained by an educational agency or institution, or by a party acting for the agency or institution. (20 U.S.C. 1232g(a)(4)(A); 34 CFR § 99.3 “Education Record”)

FERPA regulations do not define what it means for a record to be “directly related” to a student. In the context of photos and videos, determining if a visual representation of a student is directly related to a student (rather than just incidentally related to the student) is often context-specific and will be examined on a case-by-case basis to determine if it is directly related to any of the students depicted therein. Among the factors that may help determine if a photo or video should be considered “directly related” to a student are:

  • CEC uses the photo or video for disciplinary action (or other official purposes) involving the student, including the victim of any such disciplinary incident.
    • The photo or video contains a depiction of an activity that:
      • results in CEC’s use of the photo or video for disciplinary action (or other official purposes) involving a student or, if disciplinary action is pending or has not yet been taken, that would reasonably result in use of the photo or video for disciplinary action involving a student; and/or
      • shows a student in violation of local, state, or federal law.
  • The photo or video shows a student getting injured, attacked, victimized, ill, or having a health emergency.
  • The person or entity taking the photo or video intends to make a specific student the focus of the photo or video (e.g., ID photos or a recording of a student presentation).
  • The audio or visual content of the photo or video otherwise contains PII contained in a student’s education record.

 

A photo or video should not be considered directly related to a student if the student’s image is incidental or captured only as part of the background, or if a student is shown participating in school activities that are open to the public and without a specific focus on any individual.

Photographs and Media Release

Students may occasionally appear in photographs and videos taken by CEC employees, other students, or other individuals authorized by the Head of School/Principal, or other CEC employees. A parent/guardian must give CEC consent to use their student’s picture in, but not limited to, school newsletters, social media posts, videos, and yearbook, identified by name or not, by indicating “yes” or “no” for both media release and yearbook during the enrollment process. This consent is valid for the tenure of the student’s time at CEC and may be revoked at any time by the parent/guardian notifying the Director of Admissions in writing.

Annual Notification of Rights

CEC shall notify parents/guardians and students of their rights pursuant to this policy at the beginning of each academic year. For notice to parents or students who are disabled or whose primary or home language is other than English, the format or method of notice will be modified so it is reasonably likely to inform them of their rights.

Parents/Guardians and students can access the Family Educational Rights and Privacy Act, and this policy is posted on the CEC website.

Oversight and Review

The CEC Student Data Privacy Administrator, or designee, shall be responsible for ensuring compliance with this policy and required privacy and security standards. The CEC Student Data Privacy Administrator, or designee, shall annually review this policy to ensure it remains current and adequate to protect the confidentiality of student education records in light of advances in data technology and dissemination.

The Head of School/Principal will ensure their staff is aware and trained regarding the process and procedures for Student Records and Student PII rights.

Governing Law

CEC shall comply with the Family Educational Rights and Privacy Act (FERPA) and its regulations as well as state law governing the confidentiality of student education records. CEC shall be entitled to take all actions and exercise all options authorized under the law.

In the event this policy does not address a provision in applicable state or federal law or is inconsistent with or in conflict with applicable state or federal law, the provisions of applicable state or federal law shall take precedence.

Special Education Records

CEC will maintain a management and information system that provides for the collection, documentation, aggregation, and reporting of student data. The storage of records will be maintained according to state and federal laws, and all original records will be maintained and be made available for inspection upon request. CEC assures that student PII will be held confidential and protected. CEC assures that the parent(s) have the right to inspect and review their student’s education records, as this term is defined in IDEA and FERPA.

Contract Breach by School Service Contract Provider

Within a reasonable amount of time after CEC determines that a service contract provider or on-demand provider has committed a material breach of its contract/agreement, and that such material breach involves the misuse or unauthorized release of student PII, the CEO or designee shall make a decision regarding whether to terminate the CEC’s contract with the service contract provider in accordance with the following procedure.

CEC shall notify the service contract provider of the basis for its determination that the service contract provider has committed a material breach of the contract. The service contract provider may submit a written response to the CEO regarding the material breach. If the CEO finds the breach valid, the contract will be terminated. If the contract provider or community member wants to appeal the CEO’s decision, they may follow the grievance procedures outlined within this policy.

Parent/Guardian Complaints

In accordance with this policy, the parent/guardian of a CEC student may file a written complaint with the CEC Student Data Privacy Administrator, or designee, if the parent/guardian believes CEC failed to comply with the Act.

  • The parent’s/guardian’s complaint shall specifically state each of the Act’s requirements that the parent/guardian believes CEC has violated and its impact on their student.
  • The CEC Student Data Privacy Administrator, or designee, shall respond to the parent’s/guardian’s written complaint within 30 calendar days of receiving the complaint.
  • Within 10 calendar days of receipt of CEC’s response, the parent/guardian may appeal to the CEO. Such an appeal must be in writing and submitted to the CEO. The CEO shall respond to the parent’s/guardian’s written complaint within 30 calendar days of receiving the complaint.
  • Within 10 calendar days of receipt of CEO’s response, the parent/guardian may appeal to the CEC Governing Board. The Board shall review the parent’s complaint and CEC’s response at a regular or special meeting. A CEC employee and the parent/guardian may make brief statements to the Board, but no new evidence or claims may be presented. The Board may choose to conduct the appeal in executive session, to the extent permitted by law.
  • The Board shall make a determination regarding the parent’s/guardian’s complaint that CEC failed to comply with the Act within 60 days of the Board meeting.
  • If the parent/guardian files a complaint regarding their student’s educational records, CEC shall follow its procedures governing access to and review of student education records, in accordance with FERPA, applicable state law, and CEC’s Network Grievance policy.

FERPA Consent to Release Student Information

Questions?

CEC encourages staff, students, parents, and all members of the CEC community to become familiar with our policies and procedures. For questions or comments regarding our policies and procedures, please contact:

Melissa Talan, MBA
Executive Office Administrator

SECTION: Students
Rights Concerning Student Records
Approved: 10/2021