United StatesStudent Assistance General Provisions, limits on student information shared with a third-party servicer or financial institution for title IV payments
34 CFR 668.164(e)(2)(ii) and (f)(4)(i)
In force since .
A sensitive categories rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Consent, Prohibition
What it requires
- If you are an institution in a Tier one arrangement (a contract with a third-party servicer that processes direct payments of title IV funds to accounts offered to students, or communicated to them by the servicer or its affiliate), limit the personally identifiable information about a student that you share with the servicer before the student selects an account to directory information, a unique student identifier that does not include a Social Security number, the disbursement amount, a password, PIN code or other shared secret, and any additional items the Secretary specifies in a Federal Register notice (34 CFR 668.164(e)(2)(ii)(A)).
- Ensure that information is used solely for activities that support making direct payments to the student and not for any other purpose, and is not shared with any other affiliate or entity except for that purpose (34 CFR 668.164(e)(2)(ii)(B) and (C)).
- Take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that the requirements of 34 CFR 668.164 are met for all accounts offered under a Tier one arrangement (34 CFR 668.164(e)(2)(x)).
- If you are a third-party servicer that an institution contracts with to process direct payments of title IV funds, use the personally identifiable student information shared with you before the student selects an account solely for activities that support making direct payments to the student, and do not share it with any other affiliate or entity except for that purpose, including after the student is no longer enrolled (34 CFR 668.1(a); 668.164(e)(2)(ii)(B) and (C) and (e)(3)).
- If you are an institution in a Tier two arrangement (a contract with a financial institution, or an entity that offers financial accounts through one, under which accounts are offered and marketed directly to students), obtain the student's consent to open the financial account before you provide, or permit a third-party servicer to provide, any personally identifiable information about the student to the financial institution or its agents, other than directory information disclosed under 34 CFR 99.31(a)(11) and 99.37 (34 CFR 668.164(f)(4)(i)(A)).
- The Tier two duty applies if you have at least one student with a title IV credit balance in each of the three most recently completed award years (34 CFR 668.164(f)(2)).
These lines are LexLint's reading of the law's text.
What this law does
In a Tier one arrangement, an institution that contracts with a third-party servicer to process direct payments of title IV funds must ensure that personally identifiable information about a student shared with the servicer before the student selects an account is limited to directory information, a unique student identifier that does not include a Social Security number, the disbursement amount, a password, PIN code or other shared secret, and any items the Secretary specifies in a Federal Register notice.
That information must be used solely for activities that support making direct payments to the student and not for any other purpose, and must not be shared with any other affiliate or entity except for that purpose. Those limits on use and sharing continue to apply after the student is no longer enrolled at the institution.
The institution must take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that the section's requirements are met for all accounts offered under a Tier one arrangement.
To the extent that an institution contracts with a third-party servicer to administer any aspect of its participation in a title IV program, the rules of Part 668 also apply to that servicer, and the institution's use of a servicer does not alter its own responsibility for compliance.
In a Tier two arrangement, an institution must ensure that the student's consent to open the financial account has been obtained before the institution provides, or permits a third-party servicer to provide, personally identifiable information about the student to the financial institution or its agents, other than directory information.
The Tier two information duties apply to an institution that has at least one student with a title IV credit balance in each of the three most recently completed award years, and in full to an institution with an average of 500 or more such students, or five percent or more of its enrolled students, in those years. The regulations are effective .
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .