Compliance Status

Louisiana State University and A&M College is in compliance with this principle.

Narrative

Louisiana State University and A&M College (LSU) protects the security, confidentiality, and integrity of all records containing personally identifiable information (including student records) and maintains special security measures to protect and back up data as described in detail below.

Student Records Defined

The university defines student records to mean all educational records within the scope of the Family Educational Rights and Privacy Act (FERPA) [1].  For this purpose, the university broadly defines student records to mean all records, files, documents, and other materials containing information directly related to a student and maintained by a person acting on behalf of the university [1].

Educational records do not include the following:

• Sole possession records – records kept in the sole possession of the maker that are used only as a personal memory aid and are not accessible or reviewed by any other person except a temporary substitute for the maker of the record;
• Employment records, provided that employment is not contingent upon being a student;
• Law enforcement records; or
• Records collected about an individual after that person is no longer a student.

Compliance with All Applicable Laws Concerning Student Records

The university has adopted a comprehensive set of policies and procedures designed to comply with federal laws and regulations protecting personally identifiable information. In most cases, the protection provided by these university policies and procedures extends beyond student records. The discussion below, however, focuses on the student records aspects of those policies and procedures.

The laws and policies addressed by these university policies and procedures include the following:

Federal

• Family Educational Rights and Privacy Act [2]
• Health Insurance Portability and Accountability Act [3]
• Gramm-Leach-Bliley Act [4]
• Digital Millennium Copyright Act [5]

State of Louisiana

• Title 44. Public Records and Recorders [6]
• Data Security Breach Notification Law [7]
• Louisiana State Office of Information Technology Security Policies [8].

Louisiana State University Board of Supervisors Policy 

As a member institution of the Louisiana State University System, LSU must enforce policies and procedures in compliance with the information security standards set by the Board of Supervisors and with applicable federal and state laws.  The LSU System information security standards are outlined in Permanent Memorandum 36 (PM-36) – Louisiana State University System Information Security Plan [9]. Additional details are provided in the attachments to PM-36:

• PM-36 Attachment 1, Table of contents and chapters 1-12 [10]
• PM-36 Attachment 2, Glossary of terms [11]
• PM-36 Attachment 3, References to PM-36 [12]
• PM-36 Attachment 4, Business Associate Contract Addendum [13].

Louisiana State University Policies and Procedures

The university’s compliance with law and Board of Supervisors policy in this important area is accomplished through education of the university community, inventory of university assets covered by the policies, adoption of unit-level policies designed to meet the unique needs of the unit, and regular review of units to verify compliance.

Campuswide

LSU has adopted the following policies to ensure the security and confidentiality of student records:

• PS-30 Student Privacy Rights

The purpose of this policy is to inform all concerned of the rights and prerogatives of students under the Family Educational Rights and Privacy ACT of 1974 (FERPA)[14];

• Annual FERPA Notification

The purpose of the notification is to advise students about their rights with respect to FERPA, outline procedures for those students who wish to inspect and review their educational records, and provide students with limited control over the release of their education records [1]; and

• PS-113 Social Security Numbers

This policy governs the collection, maintenance, use and disclosure of Social Security Numbers and establishes the LSUID number [15].

LSU and Information Technology Services (ITS)

As records management practices have changed, electronic records have increasingly become the focus of information security efforts. Accordingly LSU, and in particular Information Technology Services, maintains a number of policies, each designed in part to address the security, confidentiality, and integrity of electronic data (including student records):

•  PS-06.05 (PS-107) Computer Users' Responsibilities;

This policy statement establishes important guidelines and restrictions regarding any and all use of computing resources at, for, or through LSU [16];

• PS-06.10 (PS-114) Security of Computing Resources

This policy outlines the role and authority of ITS in supporting and upholding the security and integrity of the LSU information technology environment [17];

• PS-06.15 Use of Electronic Mail (E-mail) Revised Version*

This policy applies to all users of the LSU e-mail system and establishes important guidelines and restrictions regarding any and all use of e-mail at LSU, including retention and retraction of e-mail [18];

• PS-06.20 Security of Data [19]

This policy outlines the responsibilities of all users in supporting and upholding the security of data at LSU regardless of the user’s affiliation or relation with the university, and irrespective of where the data is located, utilized or accessed;

• Data Classification

The data is classified into three categories:

• Confidential
• Private
• Public [20];

• PS-06.25 Privacy of Computing Resources

This policy seeks to facilitate teaching, research, and the overall mission of the university through the authorized use of computing resources and data consistent with the university’s need for limited access by persons other than the account holder when necessary to serve or protect operations within the university or to meet legal requirements; the policy applies to all authorized users of computing resources at LSU regardless of user’s affiliation or relationship with the university and irrespective of where the resources are located, utilized, or accessed [21]; 

• Draft LSU Information Security Program Summary

This document is a summary of the Information Security Plan of LSU; its purpose is to protect the information systems and resources at the university from malicious attack or misuse and thus ensure the confidentiality, integrity, and availability of those institutional assets [22];

• ITS Disaster Recovery (and Backup) Document

This document describes ITS' disaster recovery plan and backup procedures [23];

• ITS Incident Categories

This document describes the six categories of IT security incidents [24]; and

• ITS Incident Response Flowchart

This document supplements PS-06.20 (Security of Data) with respect to incident and breach responses [25].

Office of the University Registrar                                      

The Office of the University Registrar (OUR) is responsible for the security, confidentiality, and integrity of the official student education records of the university and the maintenance of special procedures to protect that data [1] [14].

The office maintains a series of internal procedures to assure that the security, confidentiality, and integrity of student records is protected. These include the following:

• Access to the Student Records and Registration database is strictly limited to staff whose job duties require access [1];
• Student academic records are released only upon execution of a written release by the student or in compliance with applicable law [1]; and
• Student academic records are retained and destroyed in accordance with the OUR Records Retention Schedule [26].

The university registrar also has final responsibility for the implementation and interpretation of the provisions of PS-30 (Privacy Rights of Students) [14].

Representative Examples of Policies and Practices of Other University Units

Because of the unique functions of the university’s many academic and support units, each unit must adopt its own procedures and practices to implement the previously described institutional policies in a manner designed to fit the exact role of that unit. The following examples are representative of the manner in which the laws described above, LSU System policies, and institutional policies are applied at the unit level. These units are representative because they are large units that handle sensitive data and serve all students.

Student Health Center

Because of the highly sensitive nature of the data received in the course of its daily operations, the Student Health Center (SHC) maintains and enforces a comprehensive set of policies, procedures, and guidelines to assure the security, confidentiality, and integrity of all sensitive data (including student records) [27]. These policies, procedures, and guidelines assure appropriate access to data, release of data only in appropriate circumstances, and compliance with the laws, system policies, and university policies. The following policies, procedures, and guidelines accomplish these purposes:

• Notice of Privacy Practices for Protected Health Information;
• Guidelines Pertaining to Confidentiality (of patient information);
• Patient Bill of Rights; and
• Patient Privacy [27].

Dean of Students

The Code of Student Conduct (Section 7.9) contains guidance regarding the access to students’ disciplinary records and the maintenance of those records [28].   The Office of Student Advocacy and Accountability maintains an internal policy with respect to student records [29] and follows departmental policy with respect to the destruction of student records [30].

Division of Continuing Education

The Division of Continuing Education’s Online Distance Learning program protects the privacy of student education records in accordance with PS-30 and FERPA [31].

Public Dissemination of Information about Student Records

Detailed information about students’ rights concerning their education records is widely disseminated to students. Sources include the following:

• LSU General Catalog [1];
• Registration Schedule of Classes Booklets [32];
• Office of the University Registrar Website

Annual FERPA Notification [33];

FERPA for Students Tutorial [34];

FERPA for Faculty & Staff Tutorial [35];

FERPA for Parents Tutorial [36];                      

• Office of the University Registrar Bookmark for Faculty and Staff [37];
• Office of the University of Registrar Bookmark for Parents [38];

• PS-30 presentations to faculty and staff. [39]; and
• FERPA presentations at parent orientations [40].

Mechanisms Established to Assure Compliance with University Policies and Procedures

The Office of the University Registrar takes the following steps to ensure compliance: 

• Provides an online tutorial concerning FERPA for faculty and staff [35];
• Provides PS-30 (Privacy Rights of Students) bookmarks to faculty and staff [37];
• Makes PS-30 presentations to faculty and staff each year [39];
• Employs an overlay screen regarding PS-30 that users view the first time they access the Student Records and Registration database each day [41]; 
• Reminds faculty using Moodle each semester, via e-mail, about their responsibilities with respect to the security and privacy of student records [42]; and 
• Provides myLSU messages on class rosters [43].     

University Processes Implemented to Identify Potential Areas of Risk

Enterprise Risk Management (ERM) 

The Office of Risk Management (ORM) “seeks to identify and mitigate potential risks throughout the university using the ERM process.”  ERM involves “integrating risk discussions into strategic deliberations and identifying the interrelations of risk factors across activities.  Specific characteristics of ERM include:

• Assessing risk in the context of strategic objectives;
• Viewing risk holistically, not functionally; and
• Covering all risk types: compliance, operations, financial, strategic, and mega [44].

LSU ERM reinforces efforts to minimize risks by providing:

• A central risk focus;
• Access to useful information (e.g., Websites, newsletters);
• Simple but effective tools (e.g., risk maps, metrics, self‐assessment approaches); and
• Opportunities for leaders and subject matter experts to deliberate on risk, integrity, and compliance issues [44].

• LSU System Internal Audit:  LSU System Internal Audit conducts an annual risk assessment for audit planning purposes.  More specifically, information technology is one of the key components analyzed during the assessment process [45].

• Policy/Audit:  During 2006-2008, a campus-wide project to assess the locations of sensitive data, most specifically SSNs, was undertaken in conjunction with the promulgation of a new policy addressing the use and storage of SSNs at LSU [15].  At that time, the location and use of SSNs were inventoried and replaced by an LSU-assigned unique identifier in every instance possible, and strict access rules and procedures were placed on the use of the remaining occurrences of SSNs.  In addition, procedures were put in place to govern and restrict any future uses or right to store SSNs.  LSU Policy Statement 113 (PS-113) contains the specific text that guided those efforts [15]. More information on PS-113 can be found in the GROK knowledgebase [46].

• Scanning:  The IT Security & Policy Office offers scanning tools to the campus community effective in identifying sensitive information on devices (e.g., desktops, laptops, and servers) [47].

• IT Security Reviews:  The IT Security & Policy Office performs security reviews (i.e., risk assessments) for various entities on campus to recommend changes to improve the IT security environment and establish best practices [48].

• External IT Security Reviews:  The Flagship Information Technology Strategy Action Item 5.01 states that “ITS should maintain a standard schedule for periodic external audit of the University’s IT security infrastructure, policies and practices to ensure the integrity of the environment and protection of LSU’s information” [49].  In 2005, 2008, and 2011, the university engaged an outside group of IT security/policy experts from the higher education community to conduct security reviews of the IT environment. The reviews provided an independent, objective assessment of risks/threats at the university.  To date, the university has received reports stating that the IT security/policy environment at the university is “very good” when compared to peer institutions [50]. In addition, the reports have provided recommendations for further enhancing the IT security/policy environment at the institution. The recommendations, however, are confidential and, therefore, not included in this document. 

Data Backup, Continuity Planning, and Disaster Recovery

Business Continuity and Disaster Recovery Plans are the responsibilities of the individual departments and units across campus.  Information Technology Services (ITS) works to backup mission-critical facets required for the effective functioning of the university [23]. A hot-site has been contracted for restoring mainframe data and processing and some Web applications [23].

Responding to Security Breaches

The chief IT policy and security officer complies with state law and university policy with respect to security breaches [8] [17].

Physical Security of Records Storage

Non-electronic records include those maintained in hard copy and on microfilm.  Physical security of such records is accomplished by securing work areas and securing documents in locked work and storage areas. 

Office of the University Registrar

OUR maintains all academic records from the 1870s through 1985 on microfilm.  Copies of the microfilm are stored at the Louisiana State Archives Building.  The original hard copy academic records (student academic ledgers) are stored on site.

The university activated the Student Records and Registration (SRR) database with the fall 1982 semester.  From 1982 through the summer 1985 term, the office maintained hard copy academic ledgers for enrolled students and maintained their records electronically in the SRR database. 

Until 1997, OUR microfilmed all enrolled students’ admission papers and academic source documents (e.g., grade sheets, grade corrections forms, drop/add forms, resignation forms, etc.).  Beginning in 1997 and continuing through the spring 2013 semester, OUR has imaged these documents and stored them on a network-attached storage (NAS) unit in the Frey Building on the LSU campus.  OUR also has imaged all of the hard copy academic records.

Beginning with the summer 2013 term, OUR no longer imaged the admissions papers, as Undergraduate Admissions assumed this responsibility.  See below.

Office of Enrollment

For the purposes of this certification, units in the Office of Enrollment will be addressed separately.      

Undergraduate Admissions:  Undergraduate Admissions is responsible for maintaining files regarding applicants. Files of applicants who do not enroll are maintained for one year after the application term. After one year, the office destroys these records.   Through the spring 2013 semester, the office transferred the custody of the records of applicants who enrolled to OUR. During the fall 2012 and spring 2013 semesters, the office implemented the Nolij imaging system.  All admission documents are now imaged when received. Beginning with the summer 2013 term, the office will transfer the custody of the imaged records to OUR. The Office of Undergraduate Admissions retains student records in accordance with the Enrollment Management Records Retention Schedule [51].

• Student Aid:  This office is responsible for maintaining the records of students who apply for financial aid. The office maintains the records for five years in accordance with federal regulations and the Enrollment Management Records Retention Schedule [51].Until implementation of the Nolij imaging system during the fall 2012 and spring 2013 semesters, the records were hard copy.  With implementation of Nolij, the records are imaged. These security measures are also relevant to student aid associated with Title IV programs covered in Federal Requirement 4.7.

• Orientation Office:  The office is responsible for maintaining the records of admitted students who attend orientation. In accordance with the Enrollment Management Records Retention Schedule, the office maintains the placement profiles and exam schedules for the duration of the students’ orientation sessions [51].