Record Keeping, Privacy, & Electronic Processes

Schools must maintain detailed records to show that Title IV funds are disbursed in the correct amounts to eligible students. These records must be retained for a certain amount of time and made available to authorized parties in the course of audits, program reviews, or investigations. Personally identifiable information (PII) in these records must be safeguarded and may only be released to other parties under certain conditions specified in all applicable laws, regulations, and policies. You may wish to share the contents of this chapter with your school’s IT office or provider.

A school must keep comprehensive, accurate program and fiscal records related to its use of Title IV program funds. Complete and accurate records are important. Program and fiscal records must demonstrate the school is capable of meeting the administrative and fiscal requirements for participating in Title IV programs. Records must demonstrate proper administration of Title IV program funds and show a clear audit trail for Title IV program expenditures. For example, records for each Title IV recipient must clearly show that the student was eligible for the funds received and that the funds were disbursed according to program regulations.

In addition to the general institutional record keeping requirements discussed here, a school must also comply with all program-specific record keeping requirements contained in the individual Title IV regulations.

If a school closes, stops providing educational programs, is terminated or suspended from the Title IV programs, or undergoes a change in ownership that results in a change of control, it must provide for the retention of required records. It must also provide for access to those records for inspection and copying by the Department. A school that formerly participated in the FFEL Program must also provide access for the appropriate guaranty agency.

If a school has an additional location or branch that closes, the school should maintain its loan records beyond the end of the three-year record retention requirement to respond to the Department or to refute borrower claims of eligibility for discharge.

A school must establish and maintain on a current basis any application the school submitted for Title IV funds. Other program records that must be maintained include:

A school must keep records that substantiate the eligibility of students for Title IV funds, such as:

As part of meeting its fiduciary responsibilities, a school must maintain accounting and fiscal records to demonstrate its proper use of Title IV funds. A school’s fiscal records must provide a clear audit trail that shows that funds were received, managed, disbursed, and returned in accordance with federal requirements.

The fiscal records a school must maintain include but are not limited to the following:

A school must also maintain records that support data appearing on required reports, such as, but not limited to:

There are special record keeping requirements in the Direct and FFEL loan programs. A school must maintain

A school must keep records relating to a student or parent borrower’s eligibility and participation in the Direct Loan or FFEL program for three years after the end of the award year in which the student last attended the school. A school must keep all other records relating to the school’s participation in the Direct Loan or FFEL program for at least three years after the end of the award year in which the records are submitted.

Schools participating in the Campus-Based Programs must keep the FISAP and any records supporting the data used to create it (e.g., the source data for the income grid) for three years from the end of the award year in which the FISAP is submitted. Consider the Fiscal Operations Report for 2024–2025 and Application to Participate for 2026–2027. It is submitted during the 2025–2026 award year by September 30, 2025. That award year ends on June 30, 2026, so schools must retain the data used to create that FISAP until at least June 30, 2029 (three years from June 30, 2026).

See Volume 6, Chapter 1, for a discussion of the record-keeping requirements for the FWS and FSEOG programs, and see Chapter 3 of that volume about record keeping for Perkins Loans.

Schools must retain all required records for a minimum of three years from the end of the award year. However, the starting point for the three-year period is not the same for all records. For example, FFEL and Direct Loan reports must be kept for three years after the end of the award year in which they were submitted, while borrower records must be kept for three years from the end of the award year in which the student last attended.

Different retention periods are necessary to ensure enforcement and repayment of Perkins Loans, which are normally held by the school. Perkins Loan repayment records, including cancellation and deferment records, must be kept for three years from the date that the loan was assigned to the Department, cancelled, or repaid. Perkins original promissory notes and original repayment schedules must be kept until the loan is satisfied or needed to enforce the obligation.

A school may retain records longer than the minimum period required. Moreover, a school may be required to retain records involved in any loan, claim, or expenditure questioned in any Title IV program review, audit, investigation, or other review, for more than three years (see Chapter 8 for information on program reviews and audits). If the three- year retention period expires before the issue in question is resolved, the school must continue to retain all records until resolution is reached.

There are also additional record retention requirements that apply to schools granted waivers of the audit submission requirements.

A school must maintain all required records in a systematically organized manner. Unless a specific format is required, a school may keep required records in:

Record retention requirements for the Institutional Student Information Record (ISIR) are discussed here. All other record information, regardless of the format used, must be retrievable in a coherent hard copy format (for example, an easily understandable printout of a computer file) or in a media format acceptable to the Department.

Any document that contains a signature, seal, certification, or any other image or mark required to validate the authenticity of its information must be maintained in its original hard copy or in an imaged media format. This includes tax returns, verification statements, and FAFSA Submission Summaries used to determine eligibility, and any other document when a signature, seal, etc., contained on it is necessary for the document to be used for the purposes for which it is being retained.

A school may maintain a record in an imaged media format only if the format is capable of reproducing an accurate, legible, and complete copy of the original document. When printed, the copy must be approximately the same size as the original document.

Please note that promissory notes that are signed electronically must be stored electronically and the promissory note must be retrievable in a coherent format. Because Direct Loan MPNs are stored in COD, this requirement can be satisfied through COD.

The requirement providing for other media formats acceptable to the Department allows for the use of new technology as it is developed. The Department will notify schools of acceptable media formats; schools should not apply for approval of a media format.

Special maintenance and availability requirements apply for FAFSA Submission Summaries and ISIRs used to determine eligibility. It is essential that these basic eligibility records be available in a consistent, comprehensive, and verifiable format for program review and audit purposes.

Hard copies of FAFSA Submission Summaries that students submit to schools must be maintained and available in their original format or in an imaged media format. The ISIR, an electronic record, must be maintained and available in its original format (e.g., as it was archived using EDExpress software supplied to the school). A school that uses EDExpress has the ability to preserve the ISIR data that it has maintained during the applicable award year by archiving the data to a disk or other computer format.

A school must make its records readily available to the Department at a location of the school designated by the Department. These include any records of transactions between the school and the financial institution where it deposits Title IV funds.

A school is not required to maintain records in any specific location. For example, it may be more appropriate for a school to maintain some records in the financial aid office while maintaining others in the business office, the admissions office, or the office of the registrar. The responsible administrator in the office maintaining the records should be aware of all applicable record retention requirements.

A school that participates in any Title IV program and the school’s third-party servicers, if any, must cooperate with the agencies and individuals involved in conducting any audit, program review, investigation, or other review authorized by law. See Chapter 4 for more information on independent audits and Chapter 8 for information on program reviews. A school must also provide this cooperation to its accrediting agency and to any guaranty agency in whose program the school participates.

Cooperation must be extended to the following individuals and their authorized representatives: an independent auditor, the Secretary of the Department of Education, the Department’s Inspector General, and the Comptroller General of the United States. See Electronic Announcement GEN-23-56 about nondisclosure agreements improperly limiting or prohibiting employee communications with the Department.

A school must cooperate by providing

If requested by the Department, a school or servicer must provide promptly any information the school or servicer has regarding the last known address, full name, telephone number, enrollment information, employer, and employer address of a recipient of Title IV funds who attends or attended the school. A school must also provide this information, upon request, to a lender or guaranty agency in the case of a borrower under the FFEL Program.

The Family Educational Rights and Privacy Act of 1974 (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of students’ education records, which are records that are: (1) directly related to a student; and (2) maintained by an education agency or postsecondary institution or by a party acting for the agency or institution. The law generally applies to all schools that receive funds under an applicable program of the U.S. Department of Education. The student records of a housing facility owned by a third party that has a contract with a school to provide housing for its students are considered under the control of the school (whether the rent is paid directly by the student or by the school on their behalf). Records maintained by the third party or the school related to students living in that housing are subject to FERPA. Note: Do not confuse FERPA with the Privacy Act of 1974 that governs the records kept by government agencies, including the application records in the federal processing system.

At the postsecondary level, FERPA affords eligible students with certain rights. FERPA defines an “eligible student” as a student who has reached 18 years of age or is attending an institution of postsecondary education at any age. With exceptions such as those noted in this section, FERPA affords postsecondary students the right to inspect and review their education records, the right to seek to have their records amended, and the right to have some control over the disclosure of personally identifiable information from their education records.

These rules apply to all education records a school maintains, including admissions records (only if the student was admitted), academic records, and any financial aid records pertaining to the student. Therefore, the financial aid office is not usually the office that develops a school’s FERPA policy or the notification to students, although it may have some input.

You can read the FERPA model notification that the Department has posted online. The Department has issued a technical assistance document that provides information on FERPA and HEA legal requirements related to preparing for and addressing situations that threaten the health or safety of the campus community. The Department’s Student Privacy Policy Office (SPPO) administers FERPA; for more information, see the Protecting Student Privacy website.

Sole possession records are exempted from the definition of education record and thus are not subject to FERPA. They are kept in the sole possession of the maker of the record and are

A school must provide a student with an opportunity to review his or her education records within 45 days of the receipt of a request. A school is only required to provide the student with copies of education records or make other arrangements to provide the student access to the records if a failure to do so would effectively prevent the student from obtaining access to the records. A case in point would be a situation in which the student does not live within commuting distance of the school. While the school may not charge a fee for retrieving the records, it may charge a reasonable fee for providing copies of the records, provided that the fee would not prevent access to the records.

While the rights under FERPA have transferred from a student’s parents to the student when the student attends a postsecondary institution, FERPA does permit a school to disclose a student’s education records to his or her parents if the student is a dependent student under IRS rules.

Note that the IRS definition of a dependent is quite different from that of a dependent student for Title IV purposes. For IRS purposes, students are dependent if they are listed as dependents on their parent’s income tax returns. (If the student is a dependent as defined by the IRS, disclosure may be made to either parent, regardless of which parent claims the student as a dependent.)

There are other situations in which information about a student may be disclosed to his or her parents. A school official may

Except under one of the special conditions described in this section, a student must provide written consent before an education agency or institution may disclose personally identifiable information from the student’s education records.

The written consent must state the purpose of the disclosure, specify the records that may be disclosed, identify the party or class of parties to whom the disclosure may be made, and be signed and dated.

If the consent is given electronically, the consent form must identify and authenticate a particular person as the source of the electronic consent and indicate that person’s approval of the information contained in the electronic consent.

The FERPA regulations include a list of exceptions where the school may disclose personally identifiable information from the student’s education records without prior written consent. Several of these allowable disclosures are of particular interest to the financial aid office since they are likely to involve the release of financial aid records.

Some of these disclosures may be made to officials at your school under certain conditions. Typically, these might include disclosures of admissions records, grades, or financial aid records. Disclosure may be made to other school officials, including teachers, within the school whom the school has determined to have legitimate educational interests. Third-party servicers that your school has contracted with to perform Title IV functions are considered school officials under FERPA provided they:

A school official may disclose personally identifiable information from student education records to a third-party servicer who meets the above criteria if the official determines that the third-party servicer has a “legitimate educational interest.” Your school must include in its annual notification of rights under FERPA the criteria for determining who is a school official and what constitutes a legitimate educational interest. A school official typically has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. Also, for such servicers to receive disclosures without student consent as though they were school officials, they must not use that personal information to set up a bank account or maintain a credit balance for students.

FERPA permits an institution to disclose education records to officials of another postsecondary institution where the student seeks or intends to enroll or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer. [34 CFR 99.31(a)(2) & 34 CFR 99.34.]

If your school routinely discloses information to other schools where students seek to enroll, it should include this information in its annual privacy notification to students, or, if not, your school must make a reasonable attempt to notify students at their last known address.

There are two different FERPA provisions concerning the release of records relating to a violent crime. One concerns the release to the victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense. The disclosure may only include the final results of the disciplinary proceeding conducted by the school. The school may disclose the final results of the disciplinary proceeding, regardless of whether the school concluded a violation was committed [34 CFR 99.31(a)(13)]. A separate provision permits a school to disclose to anyone the final results of any disciplinary hearing against an alleged perpetrator of a crime of violence or a non-forcible sex offense only when that student was found in violation of the school’s policy on the offense [34 CFR 99.31(a)(14)].

Records created and maintained by a school’s law enforcement unit are exempt from the privacy restrictions of FERPA. A school may disclose information from these “law enforcement unit records” to anyone—including parents or federal, state, or local law enforcement authorities— without the student’s consent pursuant to school policy and/or state law.

Disclosures may be made for audit, evaluation, and enforcement purposes to authorized representatives of the U.S. Department of Education, which include employees of the Department—such as those of the National Center for Education Statistics and the offices of Federal Student Aid, Postsecondary Education, Inspector General and Civil Rights—as well as firms under contract to the Department to perform certain administrative functions or studies.

In addition, disclosure may be made if it is in connection with financial aid the student has received or applied for. Such disclosure may only be made if the student information is needed to determine the amount of the aid or the conditions or student’s eligibility for the aid or to enforce the terms or conditions of the aid.

Schools may, without violating FERPA, release personally identifiable information on nonimmigrant students with an F, J, or M visa to U.S. Immigration and Customs Enforcement in compliance with the Student Exchange Visitor Information System program.

FERPA permits schools to disclose personally identifiable information from a student’s education records without the student’s prior written consent to comply with a lawfully issued subpoena or court order. In most cases the school must make a reasonable effort to notify the student who is the subject of the subpoena or court order before complying so that he may seek protective action. However, the school does not have to notify the student if the court or issuing agency has prohibited such disclosure if certain conditions are met.

A school may also disclose information from education records, without the consent or knowledge of the student, to representatives of the U.S. Department of Justice in response to an ex parte order issued in connection with the investigation of crimes of terrorism. “Terrorism” and “crimes of terrorism” are defined in 18 USC 2331 and 2332b(g)(5)(B).

A school does not have to record requests for access made by the eligible student, a school official who has a legitimate educational interest, some court orders or subpoenas, or a party seeking directory information or who has written consent from the eligible student.

Otherwise, a school must keep a record of each request for access and each disclosure, including any anticipated redisclosures, of personally identifiable information from a student’s education records to other parties. The record of the request and disclosure must identify the parties who requested the information and their legitimate interest in the information. This record must be maintained with the student’s education records as long as the education records themselves are kept. [34 CFR 99.32]

The HEA and Internal Revenue Code (IRC) also provide limitations on the uses of data. The FAFSA Simplification Act and the FUTURE Act amended the HEA and IRC in significant ways that affect this data use. There is a key distinction between the federal tax information (FTI) that the Department receives from the IRS and the FAFSA data that students and other contributors enter in the application or that is derived from the application. The HEA explains how both types of data can be used, whereas the provisions of the IRC apply more specifically to the FTI that is received by the Department and further disclosed to schools, state higher education agencies, and designated scholarship organizations.

Under Section 483, the HEA speaks to the use of data based on the entity that received the data. For schools, FAFSA data and FTI may be used for the application, award, and administration of financial aid to the applicant. A school may also use FAFSA data—but not FTI—for research that does not release any individually identifiable information on any applicant to promote college attendance, persistence, and completion. Lastly, the ISIR may not be shared with any other entity without the explicit written consent of the applicant.

For state higher education agencies, FAFSA data and FTI may be used for the application, award, and administration of financial aid to the applicant. A state agency may also use FAFSA data—but not FTI—for research that does not release any individually identifiable information on any applicant to promote college attendance, persistence, and completion. Identifying information only, as provided by applicants on the FAFSA, may be used in coordination with local educational agencies (LEAs) or secondary schools to determine whether graduating secondary students have filed the FAFSA and to encourage them to complete the application.

Except for disclosing identifying information on the FAFSA to LEAs and secondary schools for FAFSA completion efforts, a state agency may only share FAFSA data, excluding FTI, with explicit written consent of the applicant with federal, state, or local government agencies or tribal organizations to help the student in applying for financial or non-monetary assistance from such entities for any component of the student’s cost of attendance.

Any entity the receives FAFSA data from schools or state higher education agencies shall not sell, share, or otherwise use applicant information other than for the purposes outlined in Section 483 and consistent with Section 494 of the HEA.

Lastly, unchanged by amendments to the HEA by the FUTURE Act and FAFSA Simplification Act, the HEA also prohibits nongovernmental researchers or policy analysts from accessing PII from NSLDS and prohibits the use of NSLDS data for marketing purposes. It is important to note that these prohibitions are applicable to all NSLDS data, including NSLDS data received by institutions via the ISIR.

The IRC restricts the use of FTI solely for three purposes, and the FTI that may be used varies in each case: (1) Determining eligibility and amounts for federal student financial aid; (2) Determining eligibility for, or repayment obligations under, income-driven repayment plans under Title IV; and (3) For the purpose of (and to the extent necessary in) monitoring and reinstating Title IV loans that were discharged based on a total and permanent disability. As noted above, schools and state higher education agencies are permitted to use FTI for the application, award, and administration of student aid programs (i.e., institutional, and state-based aid programs).

See Section 494 of the HEA for details regarding the access of FAFSA information, including situations where FTI is implicated and written consent of the applicant and/or contributor is further required. That section also explains what statements such consent must contain.

Also, see the Department's May 12, 2023, Electronic Announcement: (GENERAL-23-34) Access and Use of Federal Tax Information (FTI) for Federal Student Aid Programs Beginning with the 2024-25 FAFSA Processing Cycle (Updated April 18, 2024) for more information on the programmatic and systems changes affected by FTI and the new labelling of FTI as controlled unclassified information (CUI) and the consequent safeguarding requirements and penalties.

The Electronic Signatures in Global and National Commerce Act (E-Sign Act) provides, in part, that a signature, contract, or other record relating to a transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form or because an electronic signature or electronic record was used in its formation. The E-Sign Act permits lenders, guaranty agencies, and schools to use electronic signatures and electronic records in place of traditional signatures and records that, under the HEA and underlying regulations, otherwise must be provided or maintained in hard-copy format.

Unless a statute or regulation specifically requires a school to provide or maintain a record or document on paper, obtain a pen and paper signature, or send a notification or authorization via U.S. mail, your school may, respectively,

For additional information on electronic transactions involving student loans, see Section 2 of Standards for Electronic Signatures in Electronic Student Loan Transactions, in Dear Colleague Letter: GEN-01-06.

Before using electronic transactions to communicate with a recipient of Title IV funds, the recipient must affirmatively consent to the use of an electronic record. The recipient’s consent must be voluntary and based on accurate information about the transactions to be completed. This consent to participate in electronic transactions is required for all financial information provided or made available to student loan borrowers and for all notices and authorizations to Title IV recipients required under 34 CFR 668.165—Notices and Authorizations. See Volume 4 for more information on notices and authorizations for disbursements.

The consent must be obtained in a manner that reasonably demonstrates that the person can access the information to be provided in an electronic form. For example, if you are going to send financial information by email, you could send a request for consent to the recipient via email, require the recipient to respond in a like manner, and maintain a record of that response.

Any time a school uses an electronic process to record or transmit confidential information or obtain a student’s confirmation, acknowledgment, or approval, the school must adopt reasonable safeguards against possible fraud and abuse. Reasonable safeguards a school might take include password protection, password changes at set intervals, access revocation for unsuccessful logins, user identification and entry-point tracking, random audit surveys, and security tests of the code access.

If your school uses an electronic process to provide notices, make disclosures, and direct students to a secure website, it must provide notice of this each year to each student, whether via email, campus mail, or the traditional mail of the U.S. Postal Service.

The annual individual notice must

The Federal Trade Commission (FTC) has ruled that most colleges are subject to the provisions of the Financial Services Act’s Security Provisions (also known as the Financial Services Modernization Act). In the regulation, the commission created a definition of financial institutions that includes most colleges on the basis of the financial relationships they have with students, donors, and others. Consequently, colleges must adopt an information security program and draft detailed policies for handling financial data covered by the law, such as parents’ annual income, and take steps to protect the data from falling into the wrong hands. For specific requirements, see the discussion under "FTC Standards for Safeguarding Customer Information" later in this chapter.

While colleges have flexibility in choosing a system that provides for electronic requests for release of personally identifiable information, they must ensure that their systems provide adequate safeguards. Also, the FTC requirements apply to Title IV third-party servicers, so colleges must use servicers that are capable of maintaining such safeguards and must require servicers by contract to implement and maintain those safeguards.

Under their Program Participation Agreement (PPA) and the Gramm-Leach-Bliley Act (Public Law 106-102), schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.

The GLBA requires institutions to, among other things,

Presidents and chief information officers of institutions should have, at a minimum, evaluated and documented their current security posture against the requirements of GLBA and have taken immediate action to remediate any identified deficiencies.

The Department is incorporating the GLBA security controls into the Annual Audit Guide in order to assess and confirm schools’ compliance with the GLBA. The Department will require the examination of evidence of GLBA compliance as part of schools’ annual student aid compliance audit.

See Dear Colleague Letter GEN-15-18 on protecting student information. It gives suggestions and resources for following industry standards and best practices on managing information systems. GEN-16-12 offers more information. On February 9, 2023, the Department posted DCL GEN-23-09, providing an overview and resources for updates to GLBA requirements under the FTC’s Final Rule amending the Standards for Safeguarding Customer Information (Safeguards Rule), published December 9, 2021. The deadline for institutions to comply with these standards was June 9, 2023.

On August 2018, the Department issued a warning about a malicious phishing campaign that sought access to student accounts via student portals. That announcement identified single-factor authentication as a weakness exploited in these cyberattacks and recommended that colleges use two- or multi-factor authentication to reduce the likelihood of such security breaches. To report incidents or get answers to questions about cybersecurity, send an email to FSA_IHECyberCompliance@ed.gov.

As data breaches increase, it is vital that schools protect controlled unclassified information (CUI) used in the administration of the federal student aid programs. Since 2018 many schools have adopted some or all of the recommended requirements of National Institute of Standards and Technology (NIST) Special Publication 800–171. We further encourage use of NIST 800–171 Rev. 2, Controlled Unclassified Information in Non- federal Systems, to help mitigate risks related to CUI.

A school must implement written plans to effectively combat the unauthorized distribution of copyrighted material by users of the school’s network without unduly interfering with educational and research use of the network.

These plans must include the use of one or more technology-based deterrents and procedures for handling unauthorized distribution of copyrighted material (including disciplinary procedures). Technology- based deterrents include bandwidth shaping, traffic monitoring, accepting and responding to Digital Millennium Copyright Act (DMCA) notices, and commercial products designed to reduce or block illegal file sharing. See GEN-10-08. No particular technology measures are favored or required for inclusion in the school’s plans, and each school has the authority to determine its own plans, including those that prohibit content monitoring.

The school’s plans must also include measures to educate its community about appropriate versus inappropriate use of copyrighted material, including the information described under the student consumer information rules in Chapter 6. These mechanisms may include any additional information and approaches that the school determines will contribute to the effectiveness of the plans. For instance, the school might include pertinent information in student handbooks, honor codes, and codes of conduct in addition to email and/or paper disclosures.

The school must have a written plan for the periodic review of the effectiveness of these measures, using relevant assessment criteria.

The school must, in consultation with its chief technology officer (or other designated officer), periodically review the legal alternatives for downloading or otherwise acquiring copyrighted material (and disseminate the results, as described in Chapter 6) and offer legal alternatives for downloading or otherwise acquiring copyrighted material (to the extent practicable and as determined by the school).

The Department anticipates that individual institutions, national associations, and commercial entities will develop and maintain up-to-date lists that may be referenced for compliance with this provision.