(1)A college shall maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student:
(a)The college shall maintain the record with the education records of the student as long as the records are maintained;
(b)For each request or disclosure the record must include:
(A)The parties who have requested or received personally identifiable information from the education records; and
(B)The legitimate interests the parties had in requesting or obtaining the information;
(c)Colleges that maintain electronic records may flag those records to refer to disclosure information which applies to all students;
(d)For purpose of ongoing submission of records to OCCURS, a single record or electronic flag referring to OCCURS policy on data elements collected and transmitted shall constitute appropriate recordkeeping.
(2)If a college discloses personally identifiable information from an education record with the understanding authorized under section (1) of this rule, the record of disclosure required under this section must include:
(a)The names of the additional parties to which the receiving party may disclose the information on behalf of the college; and
(b)The legitimate interests under OAR 589-004-0500 (Exceptions to Prior Consent Requirement) which each of the additional parties has in requesting or obtaining the information.
(3)A college is not required to keep records of disclosures when the disclosure is to:
(a)The student who is the subject of the record;
(b)A college official with a legitimate educational reason under OAR 589-004-0500 (Exceptions to Prior Consent Requirement)(1);
(c)A party with written consent from the student; or
(d)A party seeking directory information.
Rule 589-004-0750 — Recordkeeping Requirements,