Protecting & Ensuring Student Privacy

As colleges and universities work hard to protect and ensure the privacy of records, they must consider their entire information management program. That means they should shepherd student records and information throughout a life cycle, beginning when a record is created and continuing through its usage, storage, retrieval and maintenance. At the final stage of the life cycle is disposition and destruction or permanent retention of material in accordance with FERPA or applicable state laws for record retention.

Properly managing records and the information life cycle is the best enabler of cybersecurity as well. This helps a higher education institution determine where its information/data resides, their value and how to effectively manage them throughout the life cycle.

The benefits of such a life-cycle approach are significant and include:

By utilizing the cooperative contract through OMNIA Partners, Iron Mountain can help you take these key steps to ensure and protect student privacy on your campus, while saving time and resources throughout your purchasing processes:

Establish a framework

Developing an information management framework is the first step in the process. It enables colleges and universities to address requirements associated with risk management, retention and compliance early on, providing added control over the information from the point of creating a record to its final disposition.

You should first inventory all your institutional data and develop an information map of the databases related to your institution’s systems, applications and repositories; where those databases are located; and who is responsible for managing them. That will give you a better understanding of your college or university’s information, systems and records -- allowing you to identify sensitive information, monitor the use of assets and gain analytical insights.

Implement access controls

Once you’ve put a framework in place, you’ll need to protect the data and information by enforcing access controls to it. Utilizing secure, off-site storage options can be a creative and cost-saving solution. Suitable facilities will provide physical security capabilities and should feature controls like access-controlled security cages and other internal measures; controlled parking, loading dock access and external safeguards; and fire, water, temperature and other environmental protections. Such off-site facilities help to limit risks associated with lost, damaged or stolen records, while enhancing records-retention practices and making information readily accessible.

Maintain a chain of custody

Maintaining a strong chain of custody for your information and data, from ingestion and cataloging to subsequent preservation and distribution, is the next challenge. A chain of custody is the complete, documented, chronological history of the possession and handling of a piece of information or a record. It includes a set of procedures that assigns a distinct identifier to each asset in order to enable it to be tracked constantly, no matter where it is along its life cycle. Whenever an item is retrieved, accessed or distributed, this information goes into the permanent, unique record for that item, allowing a college or university to have real-time knowledge of a record’s location and status. Having a strict chain-of-custody process helps prevent the loss or damage of a record, as well as more effectively protects student privacy.

Manage records and information over the entire cycle

Educational institutions should develop an enterprise strategy that applies to all digital and physical information, both current and future. That means establishing long-term processes for inbound and outbound record storage and retrieval services; archiving and preservation; pickup of newly created records; digitization of records; and disposition requirements including accession, archiving or destruction of documents.

As the focus on student privacy continues to be one of the most important, as well as challenging, issues today, educational institutions must focus more time and resources on information management. And that starts with protecting the myriad student records generated each day on your campus. By taking a more detailed and managed approach, one that considers the entire information life cycle, your institution will be in a much better position to do just that. To learn more about these steps, please read the original whitepaper from Iron Mountain: