FERPA interpretation and granularity of controls

["Tom N. Jagatic" <tnj () BU EDU>]

Greetings,

Boston University is in the process of re-implementing of our degree audit[1] solution using Sunguard's DegreeWorks[2]. 
 Our current degree audit implementation has very granular controls which are closely coupled with our mainframe.  
We're striving to limit our dependency on the mainframe, as our strategic vision in the next 5-7 years is to move away 
from the mainframe to a more modern/robust student information system.

Questions (most applicable to other research schools with large student populations):

- Other than the student, who has access to view audits in your institution? Are there any limitations on which audits 
people can view and update? How do you limit access – can an advisor in one school actually update a student who is in 
a different school?  Can they see all students?

- If you have multiple divisions using Degree Audit, how is it secured?

Data included in a degree audit includes name, student id number, grades, GPA, courses, and degree requirements.  The 
spirit of the above two questions is better understand what measures/controls other peer institutions are using to 
control access to this information.  While implementation details are helpful, we really seek insight to how tightly 
controlled other institutions are with degree audit records.

Best Regards,

Tom


Footnotes:

[1] A degree audit is a computer-generated analysis that enables the student and his/her adviser to assess the 
student's academic progress and unfulfilled baccalaureate, associate degree, or minor requirements. The audit is a 
valuable tool for academic planning and course selection, because it matches the courses that the student has taken 
with the requirements of his/her degree program or anticipated program.

[2] http://www.sungardhe.com/Solutions/DegreeWorks/

-- 
Tom N. Jagatic
Information Security Engineer
Boston University
PGP KeyID 0x74D1ABBF