COMPLIANCE AUDIT REPORTS

Section 3: Comprehensive Standard 3.9.2

The institution protects the security, confidentiality, and integrity of student records and maintains special security measures to protect and back up data.

Statement of Compliance: Dyersburg State Community College is in compliance with Comprehensive Standard 3.9.2.

Rationale for Judgment of Compliance:

Dyersburg State Community College (DSCC) protects the security, confidentiality, and integrity of its student academic records in accordance with the 2003 Academic Record and Transcript Guide [Ref 1] published by the American Association of Collegiate Registrars and Admissions Officers (AACRAO) and as required by the Tennessee Board of Regents (TBR) Policy 3:02:03:00 [Ref 2] and Guideline S-020 [Ref 3]. Both the TBR policy and the TBR guideline address the confidentiality of student records.   

Complying with the Family Educational Rights and Privacy Act (FERPA) [Ref 4], DSCC provides students certain rights with respect to their educational records. Information about the confidentiality of student records is listed in two places in the annual catalog and student handbook [Ref 5] and in the schedule of classes [Ref 6].

In accordance with FERPA [Ref 4], directory information concerning students is treated as public information and is released to the public unless otherwise requested by the student. "Directory information" includes the following: the student's name, address, telephone listing, e-mail address, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, enrollment status, degrees and awards received, and the most recent previous educational agency or institution attended by the student. The opportunity to restrict disclosure of the designated directory information is available to each student and instructions for restricting disclosure are outlined in the annual catalog and student handbook
[Ref 5] and in each semester’s schedule of classes [Ref 6].

Access to student records is limited to college officials or other DSCC employees who have a genuine need to know based on a legitimate educational interest. A message concerning the disclosure of information is displayed when DSCC employees who have authorized access to student records log into DSCC’s Student Information System (SIS Plus) [Ref 7]. At the beginning of each fall and spring term, employees with access to SIS Plus are asked to review the FERPA Online Guide [Ref 8] at the beginning of each fall and spring term.

In addition to the security afforded students by FERPA, DSCC has implemented a Code for Computer Resource Use [Ref 9], which addresses access to computerized resources and is applicable to DSCC students, faculty, staff and off-campus constituents. Access to these resources is obtained from the Vice President for Technology and is granted with the understanding that the resources will be used as stated in the request and in keeping with the idea that one’s interest ceases when it invades the rights of personal and/or institutional privacy, results in the destruction of personal and/or institutional property, demonstrates a potential for loss, creates the possibility for the embarrassment of litigation to the individual and/or institution or because of an otherwise irresponsible use of a limited resource.

Web-based access to student academic records is available through Faculty and Advisor Self-Serve [Ref 10], which provides faculty access to student records for inquiry and for entering grades. Access which is controlled by the Assistant Vice President for Academic Affairs [Ref 11] is tied to the instructor’s social security number or campus-wide ID and a personal identification number (PIN). Additionally, access to Student Self-Serve [Ref 12], which allows students to access their academic transcript and other personally-identifiable information, is also controlled by the Assistant Vice President for Academic Affairs [Ref 11]. As with Faculty and Advisor Self-Serve, access is based on the student’s social security number or campus-wide ID and personal identification number (PIN).

Student academic records are physically stored in the vault in the Office of Admissions and Records in the Eller Administration Building, but computer storage of these records is in SIS Plus [Ref 13]. Access, however, is only available via three levels of password security: network password, alpha account password, and online operator password. Special security measures to protect and back up data are outlined in DSCC’s Data Processing Standards and Procedures Manual [Ref 14]. One security component includes a nightly full-system dump. On every night but Friday night, the data is written to a “daily tape.” Two complete sets of “daily tapes” exist for both of the Alpha systems. These are alternated so the tapes are used every other week. On Friday nights, the data is either written to a weekly or a monthly tape. Monthly tapes are used on the last Friday of the month and weekly tapes are used for the other Friday nights. All “daily tapes” are kept on-campus in the DSCC Computer Center, located in the Eller Administration Building.

There are three sets of “weekly tapes” for both Alpha systems. Each “weekly tape” is used for the Friday backup every third week except for the last Friday of the month when the monthly tape is used. After the disks are dumped onto it, they are stored in the closet of the media room in the LRC. The tapes from the closet that contain one-week-old data are carried to First Citizens National Bank in Dyersburg and stored in their vault. The tapes from the vault that contain two-week-old data are returned to the Computer Center. The tapes containing the most recent data are kept on campus, since they are more frequently used to restore information to a disk. All other tapes are kept on-campus in the Computer Center.

On the last Friday of each month, a tape is created. Monthly tapes are saved for one year. A full set of 12 tapes exists for both of the alpha systems. After the month‑end tapes are created, they are stored in the closet of the media room in the LRC. They remain there until the next month-end tapes are created. At that time, the most recent month-end tapes are stored in the closet of the media room in the LRC and the previous month's month-end tapes are returned to the Computer Center. All other month-end tapes are kept in the Computer Center.

An archival tape of quiet Sungard Higher Education system data is made after the end of each month that contains month-end data for the Financial Records System (FRS), month-end data for the Human Resource System (HRS), current data for the Student Information System (SIS Plus) and current data for Z-Support Software (ZSS). These tapes also contain all source code, command procedures and executables for each of the administrative systems. In addition to local storage procedures, tapes are taken monthly to another TBR institution for storage. All other tapes are kept in the Computer Center for three years.

In the event of a full-system failure that requires a system reload, the recovery procedures shall be utilized. DSCC has in place a preventative disaster and recovery plan for Computer Services [Ref 15].

Further protection of the integrity of student records is afforded by DSCC’s adherence to the Gramm-Leach-Bliley Act (GLBA), which sets forth the standards for developing, implementing, and maintaining reasonable administration, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer (student) information. DSCC’s GLBA policy [Ref 16] addresses security of student records for those DSCC employees in Computer Services, Admissions and Records, and Financial Aid.

The Financial Aid Office maintains records for financial aid awards and supporting documents for all types of financial aid and scholarships in addition to records of college work-study students. Access is restricted to Financial Aid employees, and each is required to sign a confidentiality statement pertaining to the release of information. Files are secured in filing cabinets outside the public area of the Financial Aid Office, and the office is locked except during normal business hours.

The Office of the Dean of Student Services maintains discipline records in accordance with FERPA guidelines.

Retention and disposal of student academic records is completed in accordance with TBR Guideline G-070, Disposal of Records [Ref 17] and AACRAO’s Guide for Retention and Disposal of Student Records (2000 Update) [Ref 18].

Financial aid records are retained and disposed of in accordance with Section 668.24 [Ref 19] of the Federal Regulations regarding Title IV funds.

Authored by Mr. J Dan Gullett in coordination with the SACS Leadership Team

Documentation: