(6) The cost, if any, which will be charged to the parent or eligible student for reproducing copies of records under § 43.5.

(7) The categories of information which the institution has designated as "directory information" under § 43.20.

(c) The notice given to a parent or eligible student under this section shall be in a language considered by the institution to be understandable by the parent or eligible student.

$43.5 Access to records.

Educational institutions shall give parents of students or eligible students, who are or have been in attendance at the institutions, access to student records, except as stated in §43.6.

§ 43.6 Limitations on access.

Educational institutions are not required to make available to students the following materials:

(a) Financial records of the parents of the student or any information contained in those records.

(b) Confidential letters and statements of recommendations, which were placed in any student's record prior to January 1, 1975, and which are not used for purposes other than those for which they were specifically intended.

(c) Those records listed in §43.2(e) which are exempt from the definition of student records.

§ 43.7 Access rights.

The right of access specified in § 43.5 shall include:

(a) The right to obtain a list of the types of student records which are maintained by the institution.

(b) The right to inspect and review the content of those records.

(c) The right to obtain copies of those records, the cost, if any, not to exceed the actual cost to the educational institution of reproducing the copies.

(d) The right to a response from the institution to reasonable requests for explanations and interpretations of those records.

(e) The right to an opportunity for a hearing to challenge the content of records.

(f) If any material or document in the record of a student includes information on more than one student, the

right to inspect and review only that portion of such material or document as relates to that particular student or to be informed of the specific information contained in such part of such materials.

$43.8 Destruction of records.

This part does not prevent educational institutions from destroying any records, if not otherwise prevented by law. However, access shall be granted under § 43.5 before destroying student records where the parent or eligible student has requested access. Only records which are no longer relevant or necessary may be destroyed, subject to § 43.23(c).

§ 43.9 Procedures for granting access. Each educational institution shall establish appropriate procedures for granting a request by parents for access to the records of their children, or by eligible students for access to their own records within a reasonable period of time. In no case shall access be withheld more than forty-five (45) days after the request has been made.

$43.10 Right to challenge.

Each educational institution shall give parents of students and eligible students, who are or have been in attendance at the institution, an opportunity to challenge the content of the student's records to:

(a) Insure that the records are not inaccurate, misleading, or otherwise violating the privacy or other rights of students.

(b) Provide an opportunity for correcting or deleting any inaccurate, misleading, or otherwise inappropriate data in the record.

(c) Insert into such records a written comment by the parents or eligible students pertaining to the content of such records.

§ 43.11 Informal proceedings.

Educational institutions may attempt to resolve differences with the parent of a student or the eligible student regarding the content of the student's records through informal meetings and discussions with the parent or eligible student.

$43.12 Right to a hearing.

Upon the request of the educational institution, the parent, or eligible student, a hearing shall be conducted under the procedures adopted and published by the institution. Such procedures shall include at least the following elements:

(a) The hearing shall be conducted and decided within a reasonable period of time following the request for the hearing.

(b) The hearing shall be informal and a verbatim record of proceedings will not be required. Interpreters will be utilized when necessary.

(c) The hearing shall be conducted by an institutional official or other party who does not have a direct interest in the outcome of the hearing.

(d) The parents or eligible student shall be given a full and fair opportunity to present evidence relevant to the issues raised under § 43.10.

(e) Within a reasonable period of time after the hearing ends, the hearing official shall make his recommendation in writing to the head of the educational institution. Within 20 days after receipt of the recommendation, the head of the institution shall issue his decision in writing to the parent or eligible student.

§ 43.13 Right of appeal.

If any parent or eligible student is adversely affected by the decision of the head of the institution, that party shall have appeal rights as given in 25 CFR part 2. However, each official decision shall be issued within 30 days from receipt of the appeal.

§ 43.14 Consent.

Educational institutions shall not permit access to or the release of student records or personally identifiable information contained in them, other than directory information of students, without the written consent of the parents or of an eligible student, to any party other than the following:

(a) Local school officials, including teachers within the educational institution, who have been determined by the institution to have legitimate educational interests in the records.

(b) Officials of other schools or school systems at which a student is

interested in enrolling. The student or parent must be notified of such release except in cases involving Bureau of Indian Affairs schools. All Bureau of Indian Affairs schools are considered to be components of one school system whether operated under contract or otherwise.

(c) Persons having official involvement with a student's application for or grant of financial aid.

(d) Parents of a dependent student as defined in section 152 of the Internal Revenue Code of 1954, as amended.

(e) Accreditation agencies in order to carry out their accrediting functions.

(f) U.S. Office of Education officials and other governmental education officials when deemed necessary by the institution to carry out their official functions.

(g) An education testing center or similar institution as a part of its validation research which has been authorized by the school.

(h) In an emergency, any person to whom the information is necessary in the discretion of the school's administration in order to protect the student's health and safety, subject to § 43.17.

(i) Indian groups, contractors, grantees, professional social service organizations and personnel performing professional services, when necessary to carry out an official function authorized by the Bureau of Indian Affairs.

(j) Pursuant to the order of a court of competent jurisdiction; however, the parent or eligible student must be notified of such order in advance of compliance therewith by the educational institution.

§ 43.15 Content of consent.

The consent of a parent or eligible student requested under this part for the release of student records shall be in writing, signed and dated by the person giving the consent. The consent shall include:

(a) A specification of the records to be released.

(b) The reasons for release.

(c) The names of the parties to whom the records will be released.

health or safety emergencies. (a) Educational institutions may release information from student records to appropriate persons in an emergency if the information is necessary to protect the health or safety of a student or other person. The factors to be used in determining whether records may be released under this section include the following:

(1) The seriousness of the threat to the health or safety of the student or other persons.

(2) The need for those records to meet the emergency.

(3) Whether the persons to whom the records are released are in a position to deal with the emergency.

(4) The extent to which time is of the essence in dealing with the emergency.

§ 43.18 Record of access.

(a) Each educational institution shall maintain a record kept with the student records of each student, which will indicate all parties other than those specified in §43.14 which have requested or obtained access to those records and which will indicate specifically the legitimate interest that each party had in obtaining this information.

(b) A record of access shall be available only to:

(1) Parents or eligible students. (2) The school official and his or her assistants who are responsible for the custody of such records.

(3) Persons or organizations authorized in and under the conditions of § 43.14.

§ 43.19 Transfer of information by third parties.

(a) Educational institutions shall not release personal information on a stu

dent except on the condition that the party to which the information is being transferred will not permit any other party to have access to the information without the written consent of the parents or of the eligible students.

(b) With any information released to a party under paragraph (a) of this section, educational institutions shall include a written statement which informs the party of the requirement in paragraph (a) of this section.

§ 43.20 Directory information.

(a) Any educational institution making public directory information shall make a reasonable effort to individually notify the parent or eligible student of the categories of information which it has designated as directory information. The institution shall allow a reasonable period of time after notice has been given for a parent or eligible student to inform the institution that any or all of the information designated should not be released without the prior consent of the parent or eligible student.

(b) Directory information may include the following: A student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student, tribe, agency, area, name of parent, sex, and classification (grade). No other information may be included. Educational institutions have the right to limit the content of directory information.

completeness as is reasonably necessary to assure fairness to the student in making the determination.

(c) Information which may be used in determining a student's rights, benefits, and privileges under Federal programs shall be collected directly from the student or his parents, to the greatest extent practicable. In deciding whether collection of information from a parent or eligible student, as opposed to a third-party source is practicable, the following factors among others may be considered:

(1) Whether the nature of the information sought is such that it can only be obtained from a third party.

(2) Whether the cost of collecting the information from the parent or student is unreasonable, when compared with the cost of collecting it from a third party.

(3) Whether there is a risk that information collected from third parties, if inaccurate, could result in an adverse determination to the student concerned.

(4) Whether the information, if supplied by the parent or student, would have to be verified by a third party.

(5) Whether provisions can be made for verification by the parent of student of information collected from third parties.

(d) Each individual parent or eligible student who is asked to supply information about himself which will be added to a system of student records shall be notified of the basis for requesting the information, how it may be used, and what the consequences, if any, are of not supplying the information. At a minimum, the notice to the parent or eligible student must state:

(1) The authority (whether granted by statute or Executive Order of the President) which authorizes requesting the information and whether disclosure of such information is mandatory or voluntary.

(2) The principle purpose or purposes for which the information is intended to be used.

(3) The routine uses which may be made of the information.

(4) The effects, if any, of not providing all or any part of the requested information.

(e) When information is collected on a standard form, the notice to the parent or eligible student shall be on the form or on a tear-off sheet attached to the form or on a separate sheet, whichever, is most practical.

(f) When information is collected by an interviewer, the interviewer shall provide the parent or eligible student with a written notice which the individual may retain. If the interview is conducted by telephone, however, the interviewer may summarize the notice for the individual and need not provide a copy to the individual unless the individual requests that a copy be mailed to him.

(g) A parent or eligible student may be asked to acknowledge, in writing, that he has been given the notice required by this section.

(h) No student records may be maintained describing how any individual exercises rights guaranteed by the first amendment to the Constitution unless:

(1) Expressly authorized by statute or by the individual about whom the student record is maintained; or

(2) Pertinent to and within the scope of an authorized law enforcement activity.

§ 43.22 Assuring integrity of records.

(a) Student records shall be maintained with appropriate administrative, technical and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained.

(b) When maintained in manual form, student records shall be maintained, at a minimum, subject to the following safeguards, or safeguards giving comparable protection:

(1) Areas in which the student records are maintained or regularly used shall be posted with an appropriate warning, stating that access to the records is limited to authorized persons. The warning shall also summarize the requirements of $43.23 and state that employees may be subject to a criminal penalty for the unauthorized disclosure of student records.

(2) During working hours, the area in which the student records are maintained or regularly used shall be occupied by authorized personnel, or access to the student records shall be restricted by their storage in locked metal file cabinets or a locked room.

(3) During nonworking hours, access to the student records shall be restricted by their storage in locked metal file cabinets or a locked room.

(4) Where a locked room is the method of security provided for a system, the educational institution responsible for the system shall, no later than December 31, 1978, supplement that security by:

(i) Providing lockable file cabinets or containers for the student records, or

(ii) Changing the lock or locks for the room so that they may not be opened with a master key. For the purpose of this paragraph, a master is a key which may be used to open rooms other than the room containing student records, unless those rooms are used by officials or employees authorized to have access to the student records.

(c) When maintained in computerized form, student records shall be maintained, at a minimum, subject to safeguards based on those recommended in the National Bureau of Standards' booklet, "Computer Security Guidelines for Implementing the Privacy Act of 1974" (May 30, 1975), and any supplements to it, which are adequate and appropriate to assure the integrity of records in the system.

(d) The education institution responsible for a system of student records shall be responsible for assuring that specific procedures are developed to assure that the student records in the system for which it is responsible are maintained with security meeting the regulations in this section. These procedures shall be in writing and shall be

posted or otherwise periodically brought to the attention of employees working with the student records contained in the system.

$43.23 Conduct of employees.

(a) Employees whose duties require handling of student records shall, at all times, take care to protect the integ

rity, security, and confidentiality of these records.

(b) No employee of the educational institution may disclose student records unless disclosure is permitted under §43.14 or made to the parent of the student or eligible student to whom the record pertains.

(c) No employee of the educational institution may alter or destroy a student record, unless:

(1) Alteration or destruction is properly undertaken in the course of the employee's regular duties, or

(2) Alteration or destruction is required by an authorized administrative decision or the decision of a court of competent jurisdiction.

(d) The educational institution responsible for a system of student records shall be responsible for assuring that employees with access to the system are made aware of the requirements of this section.