Privacy of Student Records

The University adheres to all applicable federal, Commonwealth and local regulations concerning the privacy or confidentiality of student records, including, but not limited to the Family Educational Rights and Privacy Act (FERPA). Faculty members are required to strictly comply with the University’s FERPA policy in their administration and use of student record.

The Family Educational Rights and Privacy Act of 1974 (FERPA)

For the purposes of this policy, Ponce Health Sciences University has used the following definition of terms.

Student

Any duly registered person who attends or has attended any of the Ponce Health Sciences University academic programs.

Educational Records

Any record (in handwriting, print, tapes, film or other medium) maintained by Ponce Health Sciences University is an agent of the school, which is directly related to a student, except:

A personal record kept by a staff member if kept in the sole possession of the maker of the record; the record must not be accessible or revealed to another person, expect a temporary substitute for the maker of the record.
Records created and maintained by the Ponce Health Sciences University to comply with the federal rules and regulation a privacy preservation concerns.
An employment record of an individual, whose employment is not contingent on their student’s status, provided the record is used only in relation to the individual’s employment.
Records made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional if the records are used only for treatment of a student and made available only to those persons providing the treatment.
Alumni records containing student(s) information after they are no longer in attendance at the Ponce Health Sciences University, and which do not relate to the person as a student.

(Note: A college or university is required. by Section 99.7 of the FERPA regulations to provide students annual notification of their FERPA* rights. Its policy must include the method it will use to inform students.)

Students will be notified of their FERPA rights annually by publication in the student handbook.
Students will be notified of FERPA rights annually by publication in the student bulletin; or
Students will be proved a statement of their FERPA rights in their registration packets.

Procedure to Inspect Education Records

Students may inspect and review their own academic records upon approval of the Registrar.
Students should submit to the Registrar or Record Officer a written request, which identifies precisely as possible the record or records he or she wishes to inspect.
The Record Custodian or an appropriate University staff person will make the needed arrangements for access as promptly as possible and notify the student of the time and place where the records may be inspected. Access must be given in 15 days or less from receipt of the request.
When a record contains information about more than one student, the student may inspect and review only the record related to the student.

* The Family Educational Rights and Privacy Act of 1974

Right of University to Refuse Access

Ponce Health Sciences University reserves the rights to refuse to permit a student to inspect the following records:

Letters and statements of recommendation for which the student has waived the right of access, or which were placed in the file before, January 1, 1975.
Records connected with an application to attend Ponce Health Sciences University it that application was denied.
Those records which are excluded from the FERPA definition of education records.

Refusal to Provide Copies

(Note: With an understanding that if cannot deny students access to their records, Ponce Health Sciences University is required to describe the circumstances in which it may deny students a copy of their education records.)

Ponce Health Sciences University reserves the right to deny transcripts or copies of records not required to be made available by FERPA in any of the following situations:

The student has an unpaid financial obligation to the University.
There is an unresolved disciplinary action against the student.

Fees for Copies or Records

The fee for copies will be charged as stipulated in the Tuition & Fees. (Note: A college or university may not charge for search and retrieval of the records; however, it may charge for copying time and postage).

Types, Locations and Custodians of Educations of Records

(Listing required. Types, Locations and Custodians are examples)

The following is a list of the types of records that Ponce Health Sciences University maintains their locations and their custodians.

Types	Location	Custodian
Applicants Records	Admission's Office	Vice President of Student Affairs
Admissions Records of Matriculated Students	Registrar's Office	Registrar
Cumulative Academic Records (Current Students, after graduation, withdrawals and transferred students)	Registrar's Office	Registrar
disciplinary Records	Student Affairs Office	Vice President of Student Affairs
Documents for Financial Aid	Financial Aid Office	Director of Financial Aid

Disclosure of Education Records

Ponce Health Sciences University will disclose information from a student’s education records only with the written consent of the student, except:

The school officials who have a legitimate educational interest in the records. A college or university is required to specify the criteria for school officials and for legitimate educational interest. The following are Ponce Health Sciences University criteria: A school official is:
- A person employed by the University in an administrative, supervisory, academic or research, or support staff position.
- A person elected to the Board of Trustees.
- A person employed by or under contract to Ponce Health Sciences University to perform a special task, such as the attorney or auditor.
- A school official has a legitimate educational interest if the official is:
  - Performing a task that is specified in his or her position description or by a contract agreement.
  - Performing a task related to a student’s education.
  - Performing a task related to the discipline of the student.
  - Providing a service of benefit relating to the student or student’s family, such as health care, counseling, job placement, or financial aid.
To officials of another school, upon request, in which a student seeks or intends to enroll. FERPA requires a college or university to make a reasonable attempt to notify the student of the transfer unless it states in its policy that is intends to forward records on request.
To certain official of the U.S. Department of Education, the Comptroller General and state and local educational authorities, in connection with certain state or federally supported education programs.
In connection with a student’s request for or receipt of financial aid as necessary to determine the eligibility, amount, or conditions of the financial aid, or to enforce the terms and conditions of the aid.
If required by a state law requiring disclosure that was adopted before November 19, 1974.
To organizations conducting certain studies for or behalf of the Ponce Health Sciences University.
To accrediting organizations to carry out their functions.
To parents of an eligible student who claim the student as a dependent for the income tax purposes.
To comply with a judicial order or a lawfully issued subpoena.
To appropriate parties in a health or safety emergency.
Directory information so designated by Ponce Health Sciences University.
The result of any disciplinary proceeding conducted by the Ponce Health Sciences University against an alleged perpetrator of a crime of violence to the alleged of that crime.
PHSU complies with the FERPA USA Patriot Act: Public Law 107-56: DCL April 12, 2002, Section 507. PHSU follows the provisions outlined in the regulations as follows: PHSU only discloses personally identifiable information from an education record to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health and safety of the student or other individuals.

Record of Request for Disclosure

Ponce Health Sciences University will maintain a record of all requests or disclosure of information from student’s education records. The record will indicate the name of a party making the request, any additional party to whom it may be re-disclosure and the legitimate interest the party had in requesting or obtaining the information. The record may be requested and reviewed by the parent or eligible student.

Directory Information

(Note: Disclosure of Directory Information is optional. If the opinion is exercised, a college or university is required to list the items it has designated as Directory information).

Ponce Health Sciences University designated the following items as Directory Information: student name, address, telephone number, date and place of birth, major field of study, participation in officially recognized activities and previous school attendance and photograph, email, height and weight, honors, education. Ponce Health Sciences University may disclose any of those items without prior written consent, unless notified in writing to the contrary by the student.

The following are not considered as part of the directory information: social security number, religion, ID Number, gender, race, grades, nationality, and GPA.

Correction of Education Records

(Note: Ponce Health Sciences University includes in its policy a procedure for the correction of records).

Students have the right to ask to have records corrected that they believe are inaccurate, misleading, or in violation of their privacy rights. Following are the procedure to correct a record:

A student must ask the official Ponce Health Sciences University to amend a record. They should write Ponce Health Sciences University official responsible for the record, clearly identify the part of the record they want changed and specify why it is inaccurate or misleading.
Ponce Health Sciences University, registrar, or Record Officer may comply with the request, or it may decide not to comply. If it decides not to comply, Ponce Health Sciences University, registrar, or Record Officer, will notify the student of the decision and advise them of their right to a hearing to challenge the information believed to be inaccurate, misleading, or in violation of the student’s rights.
Upon request, Registrar of Ponce Health Sciences University, will arrange for a hearing and notify the student, reasonable in advance, of the date, place, and time of the hearing.
The hearing will be conducted by a Hearing Committee of three members who are disinterest parties; however, the hearing committee members may be officials of the Institution. The student shall be afforded a full and fair opportunity to present evidence relevant to the issued raised in the original request to amend the student’s education record. The student may be assisted by one or more individuals, including an attorney.
Ponce Health Sciences University Hearing Committee will prepare a written decision based on the evidence presented at the hearing and it will be submitted to the President to take the corresponding action. The decision will include a summary of the evidence presented and the reason for the decision.
If the President decides that the challenged information is not inaccurate, misleading, or in violation of the student’s right of privacy, it will be notifying the student that they have a right to place in the record a statement commenting on challenged information or a statement setting forth reasons for disagreeing with the decision.
The statement will be maintained a part of the student’s education records as long as the contested portion is maintained. If Ponce Health Sciences University discloses the contested portion of the record, it must also disclosure the statement.
If the President decides that the information is inaccurate, misleading, or in violation of the student’s right of privacy, the President will order the registrar to amend the record and notify the student, in writing, that the record has been amended.

The Solomon Amendment and FERPA

The Solomon Amendment requires institutions to provide directory-type information on students who are 17 years of age or older upon request of representatives of the Department of Defense for military recruiting purposes. This information- “student recruiting information” – includes student’s name, address, telephone listing, date and place of birth, level of education, academic major, degrees received and the most recent previous education institution at which the student was enrolled.

A request for student recruiting information under Solomon must be honored unless there is an exception in the law which precludes the institution from providing the requested information. The most important exceptions are that the university:

Have a long-standing policy of pacifism based on historical religious tradition.
Certify that such information is not collected by the institution.
Certify that each student concerned has formally requested to withhold “directory information “under FERPA from third parties.

The definitions of the terms “directory information” (FERPA) and “student recruiting information” (Solomon) are not synonymous.

All students have the right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA.

Use and Management of Social Security Number Policy

PONCE HEALTH SCIENCES UNIVERSITY (PHSU) is committed to maintaining the privacy and confidentiality of Social Security numbers (SSNs). PHSU is cognizant of the risk the improper disclosure of SSNs can have on individuals who have entrusted the information to PHSU, including the risk of identity theft. The collection, management and display of SSNs be controlled and that the use of an SSN as an identification number is limited. An SSN may not be used as a primary identifier in a university system and never be used on any public list.

SSNs may only be requested in certain cases, such as when required by law or for business purposes with certain third-party providers, with appropriate disclosure of its use.
On-line and off-line systems that maintain SSN data must have adequate security controls implemented to protect its confidentiality and integrity.
PHSU Primary ID (“UPI”) number will serve as the primary identification number for university students, faculty and staff. A UPI is assigned to all persons affiliated with the University and is displayed on the University’s ID Card.

Violations of this policy are to be reported to the University’s Compliance Officer.

Scope

This policy sets forth the framework for PHSU’S collection, management and use of Social Security numbers (SSN) and is applicable to all PHSU units.

This policy will not apply to clinical and patient systems maintained by PHSU that are required to use the SSN for billing and healthcare coordination purposes.
SSNs are considered an identifier under the Health Insurance Portability and Accountability Act (HIPAA).

Requirements for Appropriate Use and Management of Social Security Numbers (“SSNs”)

1. Collection of SSNs for University records

SSNs may be collected and recorded when needed by federal or state governmental agencies or by outside third parties mandated to collect SSN information (example: health care providers, students’ loans, etc.).

1.2 PHSU employees authorized to collect SSNs may request an SSN during the execution of their duties if a primary means of identification, such as the UPI number, is not known or available.

1.3 PHSU employees may not collect SSNs, except for those purposes noted below. Enrollment: Those wishing to enroll in academic offerings at the

1.3.1 PHSU- both credit and non-credit – may be required to provide a SSN for secondary identification purposes. IRS regulations require PHSU request a SSN as a Taxpayer ID number for use in tax reporting. In addition, any student applying for Financial Aid must provide a SSN to the University. If a person enrolling in PHSU academic offering – credit or non- credit – cannot provide a SSN, certain services, such as transcripts, enrollment verification, tax reporting and financial aid may not be available to the individual and the University cannot guarantee a complete academic record for the individual.

1.3.2 Immigration Law: An SSN may be collected as necessitated by immigration law or regulations.

1.3.3 Certification Exams/Cooperative Experiences/Internships: A SSN is required to be collected and reported for students who are taking certification exams if mandated by the certifying agency. Students participating in internships OR Coop experiences may also require the student to provide a SSN for the other entity.

1.3.4 Employment: Any person employed by PHSU must provide a SSN as the taxpayer ID number as directed by the IRS. This includes all employees, including part-time and student employees. Providing the SSN is a condition of employment. Applicants for employment must also provide a SSN, if requested, for mandatory background checks.

1.3.5 Employee Benefits: If required by a benefits provider, the SSNs of dependents may be collected to receive service. PHSU may also release an employee’s SSN to benefit providers.

1.3.6 Payment for Personal or Professional Services: Any person providing services to PHSU as an independent contractor, invited speaker (honorarium) or research subject for which payment will be made, must provide a SSN as the taxpayer ID number per IRS regulations. These taxpayer ID numbers will be stored in the Finance Department as part of the vendor record.

1.3.7 Other Entities: The SSN may be released to entities outside PHSU where required by federal or state law, regulation, or procedure, or if the individual grants permission.

2. Maintaining the Security and Privacy of SSNs
2.1 All records containing SSNs, whether on or off-line, will be considered confidential information and should be maintained appropriately to protect the confidentiality and integrity of this information.

2.2 PHSU will take reasonable precautions to protect SSNs for all individuals who provide it.

2.3 An SSN may not be used as a primary identifier in PHSU system.

2.4 When records including SSNs are no longer needed, disposal of the records must follow University information retention and destruction policies and procedures.

2.5 SSNs are confidential data and may not be used for purposes of data mining.

2.6 SSN’s may not be used, in part or in whole, as a user ID or password for accessing a computer system or for generating any type of identifier.

2.7 SSNs in their entirety or in any portion may not be used nor posted where they can be exposed to the public, including timecards, class rosters, grade rolls and bulletin board announcements.

2.8 SSNs may not be used as an identifier for the collection of data for research or academic purposes.

3. Security Controls for Computer Systems Maintaining SSNs

3.1 Systems storing SSNs must contain security controls that protect the integrity and confidentiality of this information. Controls must include:

3.1.1 Authorization controls that require a user ID and password and that restrict access to information on the system based on an individual’s job responsibilities.

3.1.2 Network security controls, in which any system with SSNs must be protected by a network firewall and any other security control ordered by IT Department.

4. SSNs Shared with Third Parties

4.1 SSNs may not be shared with third parties, with the exceptions of:

4.1.1 As required or permitted by law.

4.1.2 With the consent of the individual.

4.1.3 Where the third party is an agent or contractor for the University and has demonstrated that controls are in place to prevent unauthorized distribution.

Sanctions

It shall be the responsibility of each unit/Department of PHSU to meet the requirements set forth in this policy. Violation of this policy may result in disciplinary action up to and including termination of employment. Violation may also result in civil and criminal penalties based on state and federal privacy statutes. PHSU acknowledges that a violation of this Policy is subject to administrative penalties from the Consejo de Educación Superior not less than $500 up to $5,000. (Law 186 for 2006, Article 2.)

Additional Information

For additional information about this policy, or to file a report, contact the University’s Compliance Officer.

Search

RESOURCES FOR