University of Utah employees authorized to access student records receive virtually no training on privacy issues.
Once a user gains access to the school's Master Academic Records System (MARS), he or she has access to every student record.Users are not required to enter a log each time they look at students' grades, according to a memorandum to U. President J. Bernard Machen from U. attorneys John Morris and Michele Ballantyne.
Once employees achieve access to the databases, "there is no current policy or practice of terminating access to the MARS databases when a person transfers or concludes employment in a particular position," the memo states.
A review was launched after the academic records of a student journalist were accessed by parks and tourism professors John Crossley and Gary Ellis. They reportedly took offense to a column by Utah Daily Chronicle reporter Brandon Winn, who opined that fans of the Tampa Bay Buccaneers were "about as bright as a Parks and Tourism major."
Crossley and Ellis then wrote a letter to Chronicle business manager Robert McOmber criticizing Winn's academic performance. The professors were subsequently reprimanded.
In response to concerns about unauthorized access to student records, Machen this week named an ad hoc Committee to Ensure the Privacy of University Student Records.
The committee will study the Family Educational Right to Privacy Act Compliance Review conducted by the U.'s Office of General Counsel. It also will recommend administrative steps to ensure protection of student records.
Committee members include graduate student Richard B. Evans; undergraduate students Eva Michelle Hunter and David Richards; Kay Harward, associate vice president for student affairs; Clifton McIntosh, associate professor of philosophy and assistant dean, College of Humanities; and Lee Teitelbaum, dean of the College of Law. Teitelbaum will be committee chairman.
Asked about Machen's decision to form the committee, Winn said, "I guess all I have to say is, it's about time. He's never actually talked to me about this. He's never made the time to talk to me about this."
The U. is installing a new administrative software that can keep track of users who access student records. In addition, a field can be created that requires a user to explain his or her reason for accessing the database.
The new software, PeopleSoft, is expected be up and running this fall.
Despite the controls in the new technology, Winn's concerns persist, he said.
If someone wants access, they can gain entry if they know what to tell the computer, he said.
"I think if a person wants to get into a students' records, they'll be able to do it. It comes down to the person, not the software," Winn said.
"I'm not confident this will help anything."
The memo states that records keeping and access varies across the university. The College of Law, for instance, assigns a custodian of its records. Anyone who wants access signs a log and states their reason for access.
The School of Education has implemented a warning screen on the MARS database that cautions users about appropriate use.
The 1974 Family Education and and Privacy Act permits access to student records for legitimate educational or counseling purposes.
The act provides no remedies for people whose records are improperly accessed, but some courts have held they may bring civil claims.