2.C.4 Student Records
The institution’s policies and procedures regarding the secure retention of student records must include provisions related to confidentiality, release, and the reliable backup and retrievability of such records.
UAF takes the secure retention of student records very seriously. Most records have shifted to digital storage, as discussed below. Paper files, as well as microfiche from past use, are maintained in locked cabinets in a secure area.
Secure retention of student records. UAF uses Banner as its student information system and uses the OnBase platform for individual student records. Both Banner and OnBase are supported by the UA System Office and require specific permissions for access. Instructions on the use of OnBase, as well as document are provided on the UA System’s website, are overseen by the , and conform to and the corresponding .
UAF uses a separate document management system, Maxient, for disciplinary records, and publishes information about the retention of, access to, and disclosure of disciplinary records on the Office of Rights, Compliance, and Accountability (ORCA) website. Maxient is also used for Title IX records, for which UAF follows the . Some programs must also track student information for specialized accreditation purposes. Those programs are held to to ensure that all records are secure, whether they are physical or electronic. If a specialized electronic database is used for coordinating and tracking student placements, the software is reviewed for FERPA compliance prior to purchase and implementation. Access to student records is limited and by permission only, depending on the employee’s role. All university employees with access to student data, no matter how limited, are expected to annually complete FERPA training (available through the ).
Backup and retrievability — cyber protocols for student records data systems. The UA system has a shared IT operating model in which systemwide services such as the Student Information System (SIS) and related services are supported by the , while university-specific IT services, including the student Learning Management System (LMS) Canvas, are supported by UAF’s Nanook Technology Services (NTS). Information/cyber security is managed by the System Office’s OIT department, which publishes systemwide on its website. Specific security incidents, including those related to student records and data, are guided by OIT’s . The below enterprise-wide examples address the two major systems in which student records are maintained.
The Banner student information system is hosted by Ellucian in its Amazon Web Services private cloud. As part of its cloud service, Ellucian employs security controls addressing perimeter security, vulnerability management, patch management, monitoring, alerting, physical access, backups, disaster recovery, encryption technology, and data privacy. Backup is scoped to data and configuration file backups. Ellucian conducts regular, point-in-time backups of all customer data, with the retention cycle separated into daily and monthly components. Ellucian retains the past seven daily and past three monthly backups. On an ad hoc basis, the university can request restorations to address: 1) data deleted in error; and 2) table or record deleted or updated erroneously. which it tests annually. The recovery time objective is 24 hours, and there is a recovery point objective of two hours for any restorative services in a disaster.
The OnBase platform is hosted by the in the primary Data Center in the UA System Office on the UAF campus. The Data Center is staffed 24/7 and all access is restricted, monitored, and audited. The OnBase system consists of an Oracle Database server and application servers, and this is monitored by Oracle Cloud Control and uses Oracle's Recovery Manager (RMAN) for backups. The database uses a combination of archive/redo logs and full backups so that recovery to any point in time is possible. The database data, archive logs, and full backups are stored on volumes on the primary enterprise storage array, a pair of NetApp FAS8300s. The volumes are encrypted and configured to replicate out to a paired NetApp Cloud Volumes OnTAP instance in AWS for offsite disaster recovery purposes. The full backups and offsite syncs are done weekly on Sundays and the status of the backups are monitored and alert on failure. The application servers are virtual machines that are backed up daily at 6:15 p.m., and 14 days’ worth of backups are retained. The application servers or individual files can be restored from the backups using NetApp's SnapCenter plugin for VMWare vCenter.
Confidentiality and release. UAF publishes its policy on student records and confidentiality in the , on the . In addition, a separate FERPA notification is emailed to every registered student each semester. The UAF policy covers the right to inspect and review one’s education records, the right to request an amendment to one’s education records, the right to provide written consent before the university discloses personally identifiable information from one’s education records, and the right to file a complaint with the U.S. Department of Education concerning alleged failures by the university to comply with the requirements of FERPA. The policy also outlines what is considered directory information, that the student can request that directory information not be released, and in what cases the disclosure of personally identifiable information from students’ education records is allowed without the prior written authorization of the student. UAF’s policy aligns with , which defines what constitutes an education record and includes provisions related to confidentiality, release, and notification.
The university registrar serves as the university’s FERPA compliance officer, and a student-focused Privacy and FERPA website is maintained by the Office of the Registrar. Students may authorize the release of specified information from their student records using UAF’s FERPA Release Form, which is available from the Office of the Registrar student forms website. Students may enable or disable a directory hold on their records through the student portal (UAOnline) at any time.
As it relates to confidentiality, the , the , and the UAF Canvas Use Policy address appropriate access to and use of different technology platforms. The UAF Electronic Mail Policy addresses appropriate use and informs students about public records and privacy.