OAR 589-004-0750: Recordkeeping Requirements

(1) A college shall maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student: (a) The college shall maintain the record with the education records of the student as long as the records are maintained; (b) For each request or disclosure the record must include: (A) The parties who have requested or received personally identifiable information from the education records; and (B) The legitimate interests the parties had in requesting or obtaining the information; (c) Colleges that maintain electronic records may flag those records to refer to disclosure information which applies to all students; (d) For purpose of ongoing submission of records to OCCURS, a single record or electronic flag referring to OCCURS policy on data elements collected and transmitted shall constitute appropriate recordkeeping. (2) If a college discloses personally identifiable information from an education record with the understanding authorized under section (1) of this rule, the record of disclosure required under this section must include: (a) The names of the additional parties to which the receiving party may disclose the information on behalf of the college; and (b) The legitimate interests under OAR 589-004-0500 which each of the additional parties has in requesting or obtaining the information. (3) A college is not required to keep records of disclosures when the disclosure is to: (a) The student who is the subject of the record; (b) A college official with a legitimate educational reason under OAR 589-004-0500(1); (c) A party with written consent from the student; or (d) A party seeking directory information.