Serves colleges and universities, in Pennsylvania

22 Pa. Code § 31.33 · Read the law's page

• If you are a postsecondary institution authorized to award college credits or grant degrees in Pennsylvania, other than a community college, adopt a plan for the collection, maintenance and dissemination of student academic, counseling, health and other records, keep copies of the plan, and update it periodically to ensure compliance with all Federal, State and local laws (section 31.33(a)).
• Make the plan conform to the Federal, State and local laws, regulations and directives identified in guidelines issued by the Department of Education, and keep student records in a readily accessible format (section 31.33(a)).
• Define appropriate standards of confidentiality for student records in your college policies and official publications and administer them accordingly (section 31.33(a)).
• Grant students the right of access, under the requirements of law, to their official records (section 31.33(a)).

24 P.S. § 20-2003-J (Act 16 of 2019) · Read the law's page

• If you are a postsecondary institution (an institution located in Pennsylvania that is authorized to grant an associate or higher academic degree), establish and maintain an online reporting system to receive complaints of sexual harassment and sexual violence from students and employees; the system must permit anonymous reports, and you may not refuse to investigate a report because it is anonymous (section 2003-J(a) and (b)).
• Give each student or employee who makes a report information about who will receive and have access to the reports filed, how the information gathered through the system will be used, and contact information for on-campus and off-campus organizations serving victims of sexual harassment and sexual violence (section 2003-J(c)).
• Post the system's policy on reports and investigations of sexual harassment and sexual violence prominently on the system and encourage individuals to review it (section 2003-J(d)).
• Limit access to the data collected, created or maintained through the system to only the data subject and to individuals with explicit authorization from the institution (section 2003-J(e)(1)).
• Limit each authorized individual's ability to enter, update, access, share or disseminate the data through role-based access that corresponds to the individual's official duties or training level and the institutional authorization that grants access (section 2003-J(e)(2)).
• Record in a data audit trail each action in which the data are entered, updated, accessed, shared or disseminated outside the institution (section 2003-J(e)(3)).
• Immediately and permanently revoke the authorization of an individual determined to have willfully entered, updated, accessed, shared or disseminated data in violation of the section (section 2003-J(e)(4)).