Confidentiality of Student, Medical, and Personnel Records
HR-07-20
About This Policy
- Date of Last Review/Update:
- 06-01-2022
- Responsible University Office:
- Human Resources
- Responsible University Administrator:
- Vice President and Chief Human Resources Officer
- Policy Contact:
- IU Human Resources
askHR@iu.edu
- Policy Feedback:
- If you have comments or questions about this policy, let us know with the policy feedback form.
Policy Statement
- Employees cannot use confidential information for personal reasons. For example, employees cannot use someone's address to seek political contributions or to present information about a sales campaign.
- A federal law, Family Educational Rights and Privacy Act (FERPA), classifies most student record information as private. This information cannot be released to third parties (including parents) without signed consent from the student.
- Personal health information created or used by employee-sponsored health plans has special protection under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
- Upon request, a university employee or their designated representative will have timely access to all information found in the employee's own personnel and medical files.
- Employees are to follow any additional policies and procedures specific to their position and any work applications used in the position.
Procedures
- Employees who receive requests for confidential information must follow the specific policy that applies to that request. For policy clarification and details, employees are to consult departmental procedures and an expert in the respective area of information.
- Proper handling of confidential information includes not releasing such information to anyone unless that person has authorization.
Employee Access to Their Own Files
- If the designated representative of an employee requests access to the employee's personnel and medical files, the representative must present a written authorization signed by the employee that clearly and specifically describes the information the representative may inspect or copy.
- At no time during the access of an employee's file will the file be out of the direct supervision of the university recordkeeper.
Definitions
Confidential information refers to nonpublic information about students, faculty, and employees. Some examples of confidential information include grades, financial aid, performance evaluations, family data, and medical records.
Sanctions
The consequences of mishandling confidential information (intentionally or unintentionally) range from receiving instruction on proper handling of such information to corrective action or discipline.