Information Security Policy and Procedure

SWTC is committed to maintaining reasonable and appropriate administrative, technical, and physical safeguards to ensure the integrity and confidentiality of federal student aid information, including the safeguards required by the Federal Trade Commission Standards for Safeguarding Customer Information (16 CFR Part 314) and by FERPA (20 U.S.C. § 1232g, 34 CFR Part 99). All student financial aid records are collected, accessed, processed, used, transmitted, stored, and disposed of by the Financial Aid Coordinator. Access to this information is restricted to the Financial Aid Coordinator and other authorized personnel or as requested by independent auditors during annual reviews to ensure compliance with federal, state, and institutional policies. All student financial aid records are kept on-site in a locked cabinet within a locked room with access by authorized personnel only. All electronic records are kept on secure private servers in an on-site locked server room with access by authorized personnel only. Service providers for financial aid records are limited to the U.S. Department of Education's software programs of ED Express, NSLDS, and COD. Financial Aid records are not reported or recorded in SWTC's student accounting software system. The secure disposition of the shredding of paper records is handled by authorized personnel only. Additional information can be found in this handbook in the section titled "Confidentiality and Inspection of Financial Aid Records", as well as "Length of Time to Maintain Student Records."

Cybersecurity and the Gramm-Leach-B fley Act (GLBA)

As a post-secondary educational institution entrusted with student financial aid information, SWTC continues to develop ways to address cybersecurity threats and to strengthen our cybersecurity infrastructure. Under the U.S. Department of Education's Program Participation Agreement and the Gramm-Leach-Biley Act (GLBA) (15 U.S. Code § 6801), SWTC protects student financial aid information, with particular attention to information provided to SWTC by the U.S. Department of Education or otherwise obtained in support of the administration of the Title IV Federal student financial aid programs. This includes, but is not limited to, developing, implementing, and maintaining a security program, limiting access to authorized users, and conducting risk assessments.

Identity Theft Prevention

SWTC strives to ensure compliance with the Fair and Accurate Credit Transaction Act, 15 USC. §1601 et seq. and the Federal Trade Commission's rules regarding Identity Theft (the "Red Flag Rules"). The technology center is subject to the Red Flag rules if it is a "Creditor." The technology center is a Creditor if it provides any goods or services for a fee and as a matter of course extends credit to its customers by offering them the ability to pay for those goods and services after they are provided as opposed to requiring prepayment or contemporaneous payment. The technology center is a creditor with respect to limited areas involving a low risk of identity theft. Areas in which the technology center allows a debtor to defer payment owed the technology center include, but are not limited to, adult education tuition, facility use charges, and similar accounts. SWTC has developed an Identity Theft Program designed to detect, prevent, and mitigate identity theft in connection with any covered accounts.

This information is presented as a summary and is intended to serve as a guideline for students and parents. Any questions should be referred to the Office of the Chief Financial Officer. Copies of the complete policy are available upon request and can be obtained in the Administrative/Business Office, Financial Aid Office, and the Counselor's Office. For detailed information regarding the SWTC IDENTITY THEFT PREVENTION POLICY, please see the SWTC Board of Education Policy Manual available on our website atwww.swtech.edu.

Family Educational Rights and Privacy Act (FERPA)

Southwest Technology Center maintains an educational record for each student who is or has been enrolled at the technology center in the Administrative/Business Office. In accordance with the Family Educational Rights and Privacy Act of 1974, as amended, the following student rights are covered by the Act and afforded to all eligible students at Southwest Technology Center.

All rights and protections given to parents under FERPA and this policy transfer to the student when he or she reaches age 18 or enrolls in a postsecondary school. The student then becomes an "eligible student."

Notification of Rights Under FERPA

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that affords parents of minor students and "eligible students" over 18 years of age certain rights with respect to the student's education records. They are:

1. The right to inspect and review the student's education records within 45 days from the day the technology center receives a request for access.
   
   Parents of minor students or eligible students must submit a written request to the Chief Operations Officer or appropriate technology center official that identifies the record(s) they wish to inspect. This administrator will make arrangements for access to the education records and will notify the parent of a minor student or eligible student of the time and place where these records may be inspected.

2. The right to request correction of the student's education records that the parent of a minor student or eligible student believes inaccurate, misleading or otherwise in violation of the student’s privacy rights.
   
   Parents of minor students or eligible students may ask the technology center to amend a record they believe is inaccurate, misleading or otherwise in violation of the student’s privacy rights. They must submit a written request to the Chief Operations Officer or appropriate technology center official, clearly identify the part of the record they want changed, and specify why it is inaccurate, misleading or otherwise in violation of the student’s privacy rights.
   
   If the technology center decides not make changes in the record as requested, the technology center must notify the minor student’s parent or eligible student of the decision and advise them of their right to a hearing regarding the request for correction. Additional information about hearing procedures will be provided to the minor student’s parent or eligible student at the time of this notification.

3. The right to consent to disclosures of personally identifiable information contained in the student's education records, except to the extent that FERPA authorizes disclosure without consent (34 CFR § 99.31).
   
   Technology center officials with legitimate educational interests are permitted disclosure without consent. An official is a person employed by the technology center as an administrator, supervisor, instructor, or support staff member, including health or medical staff and law enforcement unit personnel; a person serving on the board of education; a person or company with whom the technology center has contracted to perform a special task, such as an attorney, auditor, medical consultant or therapist; or a parent or student serving on an official committee, such as a disciplinary or grievance committee, or assisting another official in performing his or her tasks.
   
   An official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.
   
   Upon request, the technology center will disclose education records without consent to officials of another technology center in which a student seeks or intends to enroll.
   
   Technology centers may disclose, without consent, "directory" information; however, the technology center must inform parents and eligible students about directory information, allowing them a reasonable amount of time to request that the technology center not disclose directory information about that student.
   
   Technology centers must notify parents of minor students and eligible students annually of their rights under FERPA by means of a special letter, bulletin, student handbook and/or other means left to the discretion of each technology center.

4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the technology center to comply with the requirements of FERPA. The name and address of the Office that administers FERPA are:
   
   Family Policy Compliance Office

   U.S. Department of Education

   400 Maryland Avenue, SW

   Washington, D.C. 20202-5901

Directory Information Notice

The Family Educational Rights and Privacy Act (FERPA), a federal law, requires that the technology center, with certain exceptions, obtain your written consent prior to the disclosure of personally identifiable information from your or your minor child's education records. However, the technology center may disclose appropriately designated "directory information" without written consent, unless you have advised the technology center to the contrary in accordance with technology center procedures. The primary purpose of directory information is to allow the technology center to include this type of information from education records in certain school publications. Examples include:

1. Recognition lists

2. Graduation programs

3. Press releases

Two federal laws require local educational agencies (LEAs) receiving assistance under the Elementary and Secondary Education Act of 1965 (ESEA) to provide military recruiters, upon request, with three directory information categories - names, addresses and telephone listings - unless parents have advised the LEA that they do not want their minor child's information disclosed without their prior written consent. Directory information will not be released to outside organizations for commercial or non-commercial purposes.

If you do not want the technology center to disclose directory information from your or your minor child's education records without your prior written consent, you must notify the superintendent in writing. The technology center has designated the following information as "directory information," and it will disclose that information without prior written consent:

1. The student's name

2. The student's address

3. The student's telephone listing

4. The student's date and place of birth

5. The student's dates of attendance

6. The student's grade level (i.e., 11" grade, 12 grade, etc.)

7. The student's degrees, honors and awards received

8. The most recent educational agency or institution attended

9. The student's photograph

10. The student's electronic mail address

This information is presented as a summary and is intended to serve as a guideline for students and parents. Any questions concerning the student's rights and responsibilities under the Family Educational Rights and Privacy Act should be referred to the Office of the Chief Operations Officer. The FERPA policy in its entirety can be viewed in the SWTC Board of Education Policy Manual. Copies of the complete Family Educational Rights and Privacy Act policy are available upon request and can be obtained in the Administrative/Business Office, Financial Aid Office, Counselor's Office and on our website at www.swtech.edu. For detailed information regarding the SWTC STUDENT RECORDS POLICY including FERPA, please see Section 9 of the SWTC Board of Education Policy Manual available on our website at www.swtech.edu