# Appendix D Confidentiality {#appendix-d-confidentiality .Appendix-Title}

**CONFIDENTIALITY AGREEMENT**

**2007--2008 National Postsecondary Student Aid Study (NPSAS:08)**

**(RTI Under Contract No. ED-05-CO-0033)**

[Safeguards for Individuals Against Invasion of Privacy]{.underline}: In
accordance with the Privacy Act of 1974 (5 United States Code 552a), the
Education Sciences Reform Act of 2002 (Public Law 107-279), the Federal
Statistical Confidentiality Order of 1997, the E-Government Act of 2002
(Public Law 107-347), the Computer Security Act of 1987, the National
Center for Education Statistics' (NCES') *Restricted Use Data Procedures
Manual*, and NCES' *Standards and Policies*, RTI International (RTI) and
all its subcontractors are required to comply with the applicable
provisions of the legislation, regulations, and guidelines and to
undertake all necessary safeguards for individuals against invasions of
privacy.

To provide this assurance and these safeguards in performance of work on
this project, all staff, consultants, and agents of RTI, and its
subcontractors who have any access to study data, shall be bound by the
following assurance.

[Assurance of Confidentiality]{.underline}

1\. In accordance with all applicable legislation, regulations, and
guidelines, RTI assures all respondents that the confidentiality of
their responses to all information requests will be maintained by RTI
and NCES, and that no information obtained in the course of this
activity may be disclosed in a manner in which the individual is
identifiable, unless the individual has consented to such disclosure, to
anyone other than authorized staff, consultants, agents, or
representatives of RTI, its subcontractors, and NCES.

2\. The following safeguards will be implemented to assure that
confidentiality is protected by all employees, consultants, agents, and
representatives of RTI and all subcontractors and that physical security
of the records is provided:

> a\. All staff with access to data will take an oath of nondisclosure
> and sign an affidavit to that effect.
>
> b\. At each site where these items are processed or maintained, all
> confidential records that will permit identification of individuals
> shall be kept in a safe, locked room when not in use or personally
> attended by project staff.
>
> c\. When confidential records are not locked, admittance to the room
> or area in which they reside shall be restricted to staff sworn to
> confidentiality on this project.
>
> d\. All electronic data shall be maintained in secure and protected
> data files, and personally identifying information shall be maintained
> on separate files from statistical data collected under this contract.
>
> e\. All data files on network or multi-user systems shall be under
> strict control of a database manager with access restricted to project
> staff sworn to confidentiality, and then only on a need-to-know basis.
>
> f\. All data files on single-user computers shall be password
> protected and all such machines will be locked and maintained in a
> locked room when not attended by project staff sworn to
> confidentiality.
>
> g\. External electronically stored data files (e.g., tapes on
> diskettes) shall be maintained in a locked storage device in a locked
> room when not attended by project staff sworn to confidentiality.
>
> h\. Any data released to the general public shall be appropriately
> masked or perturbated such that linkages to individually identifying
> information are not possible and individual identification cannot be
> disclosed.
>
> i\. Data or copies of data may not leave the authorized site for any
> reason.

3\. Staff, consultants, agents, or RTI and all its subcontractors will
take all necessary steps to ensure that the letter and intent of all
applicable legislation, regulations, and guidelines are enforced at all
times through appropriate qualifications standards for all personnel
working on this project and through adequate training and periodic
follow-up procedures.

By my signature affixed below, I hereby swear and affirm that I have
carefully read this statement and fully understand the statement as well
as legislative and regulatory assurances that pertain to the
confidential nature of all records to be handled in regard to this
project, and will adhere to all safeguards that have been developed to
provide such confidentiality. As an employee, consultant, agent, or
representative of RTI or one of its subcontractors, consultants, agents,
or representatives, I understand that I am prohibited by law from
disclosing any such confidential information to anyone other than staff,
consultant, agents, or representatives of RTI, its subcontractors, or
agents, and NCES. I understand that any willful and knowing individual
disclosure or allowance of disclosure in violation of the applicable
legislation, regulations, and guidelines is punishable by law and would
subject the violator to possible fine or imprisonment.

[/ / /]{.underline}(Signature) (RTI Employee ID Number) (Date)

[/ / /]{.underline}(Supervisor\'s Signature) (RTI Employee ID Number)
(Date)

**AFFIDAVIT OF NONDISCLOSURE**

**2007--2008 National Postsecondary Student Aid Study (NPSAS:08)**

**(RTI Under Contract No. ED-05-CO-0033)**

  ------------------------------------------------------------------- --------------------------------
  ^(Name)^                                                            

                                                                      

  ^(Job\ Title)^                                                      

                                                                      

  ^(Date\ of\ Assignment\ to\ NPSAS:08\ Project)^                     

                                                                      

  ^(Organization,\ State,\ or\ Local\ Agency\ or\ Instrumentality)^   

                                                                      

  ^(Address)^                                                         
  ------------------------------------------------------------------- --------------------------------

I,
**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**,
do solemnly swear (or affirm) that when given access to any **2007-2008
National Postsecondary Student Aid Study (NPSAS:08)** project-related
data bases or files containing individually identifiable information, I
will not:

(i) use or reveal any individually identifiable information furnished,
    acquired, retrieved or assembled by me or others, under the
    provisions of Section 183 of the Education Sciences Reform Act of
    2002 (PL 107-279) and Title V, subtitle A of the E-Government Act of
    2002 (PL 107-347) for any purpose other than statistical purposes
    specified in the NCES survey, project or contract;

(ii) make any disclosure or publication whereby a sample unit or survey
     respondent could be identified or the data furnished by or related
     to any particular person under this section could be identified; or

(iii) permit anyone other than the individuals authorized by the
      Commissioner of the National Center for Education Statistics to
      examine the individual reports.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

(Signature)

(The penalty for unlawful disclosure is a fine of not more than
\$250,000 \[under 18 U.S.C. 3571\] or imprisonment for not more than 5
years \[under 18 U.S.C. 3559\], or both. The word \"swear\" should be
stricken out wherever it appears when a person elects to affirm the
affidavit rather than to swear to it.)

State of \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

County of \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Subscribed and sworn/affirmed before me,
**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**, a Notary
Public in and for
**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**County, State of
**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,** on this date,
**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_**.

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

> Notary Public

My commission expires:
**\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_.**

![](media/image1.png){width="6.048611111111111in"
height="1.2270833333333333in"}

November 14, 2023

Institution Coordinator

Title

Institution Name

Address

Address

Dear Dr. Coordinator,

I am writing to provide you with important information regarding the
confidentiality of the data collected for the 2008 National Study of
Postsecondary Student Aid, which is being conducted for the National
Center for Education Statistics, U.S. Department of Education.

I want to assure you that this data request is in full compliance with
all applicable federal laws protecting the confidentiality of students,
as detailed in the information enclosed.

RTI International (RTI), as contracted by NCES, has been given the
authority to collect information from institutional records under the
provisions of the *Family Educational Rights and Privacy Act of 1974*
(FERPA) \[20 U.S.C. 1232g\], the *Education Sciences Reform Act of 2002*
(P.L. 107-279), and its predecessor, the *National Education Statistics
Act of 1994 (P.L. 103-382*). FERPA allows the release of institutional
record information to the Secretary of Education or his agent without
prior consent of survey members \[20 U.S.C. 1232g (b) (3)\]. Since RTI
is an authorized representative of the Secretary of Education,
compliance with RTI's official request for information constitutes
compliance with FERPA and the *General Education Provisions Act*.

Privacy and confidentiality are always of concern to institutions and
offices that maintain student and employee records. Both NCES and RTI
follow strict confidentiality procedures to protect the privacy and
confidentiality of study participants. A description of our security
arrangements is enclosed, but let me underscore that these data will be
combined to produce reports for Congress and other policymakers.
Individually identifiable data will be available only to a limited
number of qualified researchers, who will be pledged, under penalty of
law with severe fines and imprisonment, to maintain the confidentiality
of the data.

Your cooperation with RTI in this important study is greatly
appreciated. For further information or questions, please contact Dr.
James Griffith, the NCES Project Director at 1--202--502--7387 or Dr.
John Riccobono, the RTI Project Director, at 1--919-541-7006.

![](media/image2.wmf){width="1.0125in"
height="0.45902777777777776in"}Sincerely,

Mark Schneider

Commissioner

NCES

Attachments:

Fact Sheet: Confidentiality Law and the 2008 National Postsecondary
Student Aid Study

Selected pages from the Family Education Rights and Privacy Act of 1974
(FERPA) \[34 CFR Part 99\]

![](media/image3.png){width="6.479861111111111in"
height="0.43194444444444446in"}

**CONFIDENTIALITY LAW FACT SHEET**

**for**

**THE 2008 NATIONAL POSTSECONDARY STUDENT AID STUDY**

Your institution has been selected to participate in the 2008 National
Postsecondary Student Aid Study (NPSAS:08). NPSAS is designed to provide
information on how students and their families meet the cost of
education beyond high school. Lists of students provided by institutions
will be used to select a smaller sample of students who will be asked to
complete a questionnaire online.

**Data Collected for NPSAS**

The information collected for students includes demographic information
used for sampling (such as race/ethnicity), contact information used to
inform respondents of the survey request (such as address and telephone
number) and personal identifiers (such as Social Security numbers and
student ID), which are used to unduplicate lists of students and to
match students against federal financial aid records. The security of
this information is, of course, of paramount importance to the U.S.
Department of Education's National Center for Education Statistics
(NCES) and its contractors, as well as to participating institutions and
respondents. It is important for each institution sampled to be fully
aware of the federal laws that both authorize the release of student
information, and protect the confidentiality of record data and survey
responses.

**Data Collected for NPSAS is Authorized by Congress**

The Education Sciences Reform Act (ESRA) of 2002 (P.L. 107-279), and its
predecessor, the National Education Statistics Act (NESA) of 1994 (P.L.
103-382), authorizes NCES to collect, acquire, compile, and disseminate
full and complete statistics on the condition and progress of education,
including postsecondary education. The provisions of ESRA can be found
at the following website:
[http://www.ed.gov/policy/rschstat/leg/edpicks.jhtml?src=ln]{.underline}.

**Federal Law Strictly Protects the Confidentiality of Data Collected
for NPSAS**

Strict confidentiality of all information obtained from NPSAS:08 is
assured by current federal laws and regulations. The Education Sciences
Reform Act of 2002 (ESRA) (Public Law 107-279) establishes that NCES and
its contractors, under penalty of law, must keep all records on
individuals confidential. Researchers are subject to fines and
imprisonment for misuse or disclosure of individual data. Procedures
have been implemented to ensure confidentiality and privacy of all
information obtained.

Individual responses are safeguarded by the following laws that protect
the confidentiality of individually identifiable information collected
by NCES: The Family Educational Rights and Privacy Act (FERPA) (20
U.S.C. 1232g; 34 CFR Part 99), the Privacy Act of 1974 (5 United States
Code 552a), the Education Sciences Reform Act of 2002 (ESRA) (Public Law
107-279), its predecessor, the National Education Statistics Act of 1994
(NESA) (Public Law 103-382) as amended by the USA PATRIOT Act of 2001
(Public Law 107-56), and the E-Government Act of 2002 (Public Law
107-347).

A summary of the laws that cover the confidentiality of personally
identifiable information collected by NCES can be found at the following
website: [http://nces.ed.gov/statprog/conflaws.asp]{.underline}.

**Federal Law Authorizes Release of Personally Identifiable Information
to NCES and Its Agents and Assures Confidentiality**

NPSAS:08 seeks both directory and personally identifiable information on
students from institutions. The Education Sciences Reform Act of 2002
(P.L. 107-279), and its predecessor, the National Education Statistics
Act of 1994 (P.L. 103-382), authorizes NCES, and its contractor, RTI
International, to periodically gather information from students on
pivotal areas of national concern.

**CONFIDENTIALITY LAW FACT SHEET**

**for**

**THE 2008 NATIONAL POSTSECONDARY STUDENT AID STUDY---CONTINUED**

The data request for NPSAS fully conforms to the requirements of the
Family Education Rights and Privacy Act of 1974. (FERPA) \[20 U.S.C.
1232g; 34 CFR Part 99\]. FERPA is designed to protect the privacy rights
of students and their families, by providing consistent standards for
the release of personally identifiable student and family information.
NCES and its agent, RTI International, are explicitly authorized under
an exception to FERPA's general consent rule (in which the right to
consent is held by the student, regardless of age) to obtain student
level data from institutions. This exception provides for the collection
of data on any eligible student, without prior consent if the disclosure
is to an organization conducting studies for, or on behalf of
educational agencies or institutions. The data are subject to strict
confidentiality protections, which must be adhered to by both NCES and
RTI.

FERPA requires educational institutions to maintain a record of the
disclosure of student information to NCES (see 34 CFR 99.32). The record
of disclosure must include 1) the parties who have requested or received
personally identifiable information records (NCES/RTI) and 2) the
legitimate interests the parties had in obtaining the information (the
2008 National Postsecondary Student Aid Study). A sample disclosure
notice is enclosed. Institutions may use this notice or develop their
own.

For questions regarding the applicability of FERPA to this study, school
officials may contact the Family Policy Compliance Office (FPCO) at this
email address: FERPA@ed.gov. The provisions of FERPA may be found at the
following website:
[http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html]{.underline}.

**Review Processes to Protect Privacy Rights of Respondents**

In addition to being authorized by legislation to collect personally
identifiable information, NPSAS:08 is subject to several detailed
reviews, including review by the U.S. Department of Education's
Regulatory Information Management Group and the Office of Management and
Budget.

The study and all related instruments and procedures are also reviewed
by RTI's own Institutional Review Board, which maintains strict
standards for the protection of human subjects (including respondents to
surveys). Questions about RTI's review procedures regarding the rights
and protections of study participants may be directed to Dr. Wendy A.
Visscher at 1-866-214-2043.

A plan for ensuring confidentiality of this project has been developed
by NCES and RTI. This plan includes signed confidentiality agreements
obtained from all personnel who will have access to individual
identifiers, personnel training regarding the meaning of
confidentiality, and controlled access to computer files.

All electronic data from institution records and students will be
carefully protected. Computer accounts used to access electronic data
will be password protected. Only project staff members with clearance
from the study database manager will be able to log on to these
accounts. Personally identifying variables (e.g., name, address, and
phone numbers) will be kept separate from data variables such as
educational experience or financial aid. Backups and inactive files will
be maintained on tape or CD-ROM in locked storage.

All hardcopy records will be maintained in locked storage cabinets. A
unique study identification variable (not the Social Security number or
student ID) will be created and maintained for each survey participant
to protect against inadvertent disclosure of confidential data. Any data
released to the general public (for example, statistical tables) will be
tailored so that it is not possible to identify specific individuals or
institutions.

CADE Disclosure Notice

![](media/image4.jpeg){width="6.697916666666667in"
height="5.040277777777778in"}