§ 99.32 What recordkeeping requirements exist concerning requests and disclosures?
(a)

(1) An educational agency or institution must maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student, as well as the names of State and local educational authorities and Federal officials and agencies listed in § 99.31(a)(3) that may make further disclosures of personally identifiable information from the student's education records without consent under § 99.33(b).

(2) The agency or institution shall maintain the record with the education records of the student as long as the records are maintained.

(3) For each request or disclosure the record must include:

(i) The parties who have requested or received personally identifiable information from the education records; and

(ii) The legitimate interests the parties had in requesting or obtaining the information.

(4) An educational agency or institution must obtain a copy of the record of further disclosures maintained under paragraph (b)(2) of this section and make it available in response to a parent's or eligible student's request to review the record required under paragraph (a)(1) of this section.

(5) An educational agency or institution must record the following information when it discloses personally identifiable information from education records under the health or safety emergency exception in § 99.31(a)(10) and § 99.36:

(i) The articulable and significant threat to the health or safety of a student or other individuals that formed the basis for the disclosure; and

(ii) The parties to whom the agency or institution disclosed the information.

(b)

(1) Except as provided in paragraph (b)(2) of this section, if an educational agency or institution discloses personally identifiable information from education records with the understanding authorized under § 99.33(b), the record of the disclosure required under this section must include:

(i) The names of the additional parties to which the receiving party may disclose the information on behalf of the educational agency or institution; and

(ii) The legitimate interests under § 99.31 which each of the additional parties has in requesting or obtaining the information.

(2)

(i) A State or local educational authority or Federal official or agency listed in § 99.31(a)(3) that makes further disclosures of information from education records under § 99.33(b) must record the names of the additional parties to which it discloses information on behalf of an educational agency or institution and their legitimate interests in the information under § 99.31 if the information was received from:

(A) An educational agency or institution that has not recorded the further disclosures under paragraph (b)(1) of this section; or

(B) Another State or local educational authority or Federal official or agency listed in § 99.31(a)(3).

(ii) A State or local educational authority or Federal official or agency that records further disclosures of information under paragraph (b)(2)(i) of this section may maintain the record by the student's class, school, district, or other appropriate grouping rather than by the name of the student.

(iii) Upon request of an educational agency or institution, a State or local educational authority or Federal official or agency listed in § 99.31(a)(3) that maintains a record of further disclosures under paragraph (b)(2)(i) of this section must provide a copy of the record of further disclosures to the educational agency or institution within a reasonable period of time not to exceed 30 days.

(c) The following parties may inspect the record relating to each student:

(1) The parent or eligible student.

(2) The school official or his or her assistants who are responsible for the custody of the records.

(3) Those parties authorized in § 99.31(a) (1) and (3) for the purposes of auditing the recordkeeping procedures of the educational agency or institution.

(d) Paragraph (a) of this section does not apply if the request was from, or the disclosure was to:

(1) The parent or eligible student;

(2) A school official under § 99.31(a)(1);

(3) A party with written consent from the parent or eligible student;

(4) A party seeking directory information; or

(5) A party seeking or receiving records in accordance with § 99.31(a)(9)(ii)(A) through (C).