4-Exhibit E - FERPA.pdf

EXHIBIT E

FERPA CONFIDENTIALITY AND SECURITY ADDENDUM

This FERPA Confidentiality and Security Addendum (Addendum) is made and entered into effective as of ________________,2026 (Effective Date) by and between The University of Texas Health Science Center at San Antonio, a state agency and institution of higher education established under the laws of the State of Texas (University) and [ ] (Contractor), (collectively, Parties). The purpose of this Addendum is to provide the terms under which Contractor is required to maintain the confidentiality and security of any and all University records subject to the Family Educational Rights and Privacy Act, 20 United States Code §1232g (FERPA) which Contractor will create, receive, or maintain on behalf of University pursuant to _______________________(Underlying Agreement).

1. FERPA. The Parties understand and agree that:

1.1 As part of the work (Work) that Contractor will provide pursuant to the Underlying Agreement, Contractor is expected to create, receive or maintain, records or record systems from or on behalf of University that (a) are subject to FERPA or (b) contain personally identifiable information from “Education Records” as defined by and subject to FERPA (collectively, FERPA Records) namely:

Student Data. FERPA Records include all data in any form whatsoever, including electronic, written and machine readable form.

1.2 Notwithstanding any other provision of the Underlying Agreement, this Addendum or any other agreement, all FERPA Records created, received or maintained by Contractor pursuant to the Underlying Agreement will remain the sole and exclusive property of University.

2. FERPA Compliance. In connection with all FERPA Records that Contractor may create, receive or maintain on behalf of University pursuant to the Underlying Agreement, Contractor is designated as a University Official with a legitimate educational interest in and with respect to such FERPA Records, only to the extent to which Contractor (a) is required to create, receive or maintain FERPA Records to carry out the Underlying Agreement, and (b) understands and agrees to all of the following terms and conditions without reservation:

2.1 Prohibition on Unauthorized Use or Disclosure of FERPA Records: Contractor will hold University FERPA Records in strict confidence. Contractor will not use or disclose FERPA Records received from or on behalf of University, including any FERPA Records provided by a University student directly to Contractor, except as permitted or required by the Underlying Agreement or this Addendum.

2.2 Maintenance of the Security of FERPA Records: Contractor will use the administrative, technical and physical security measures, including secure encryption in the case of electronically maintained or transmitted FERPA Records, approved by University and that are at least as stringent as the requirements of UT System Information and Resource Use & Security Policy, UTS165 at http://www.utsystem.edu/board-of-regents/policy-library/policies/uts165-information-resources-use-and-security-policy, to preserve the confidentiality and security of all FERPA Records received from, or on behalf of University, its students or any third party pursuant to the Underlying Agreement.

http://uscode.house.gov/view.xhtml?req=(title:20%20section:1232g%20edition:prelim)%20OR%20(granuleid:USC-prelim-title20-section1232g)&f=treesort&edition=prelim&num=0&jumpTo=true http://www.utsystem.edu/board-of-regents/policy-library/policies/uts165-information-resources-use-and-security-policy http://www.utsystem.edu/board-of-regents/policy-library/policies/uts165-information-resources-use-and-security-policy

2.3 Reporting of Unauthorized Disclosures or Misuse of FERPA Records and Information: Contractor, within one (1) day after discovery, will report to University any use or disclosure of FERPA Records not authorized by this Addendum. Contractor’s report will identify: (i) the nature of the unauthorized use or disclosure, (ii) the FERPA Records used or disclosed, (iii) who made the unauthorized use or received the unauthorized disclosure, (iv) what Contractor has done or will do to mitigate any deleterious effect of the unauthorized use or disclosure, and (v) what corrective action Contractor has taken or will take to prevent future similar unauthorized use or disclosure. Contractor will provide such other information, including written reports, as reasonably requested by University. For purposes of this Section 2.3, an unauthorized disclosure or use includes any access or use of an “Education Record” (as defined by FERPA) by a Contractor employee or agent that the employee or agent does not require to perform Work or access by any employee or agent that does not involve the provision of Work.

2.4 Right to Audit: If University has a reasonable basis to believe that Contractor is not in compliance with the terms of this Addendum, University may audit Contractor’s compliance with FERPA as Contractor’s compliance relates to University’s FERPA Records maintained by Contractor.

2.5 Five Year Exclusion for Improper Disclosure of Education Records. Under the federal regulations implementing FERPA, improper disclosure or redisclosure of personally identifiable information from University’s “Education Records” (as defined by FERPA) by Contractor or its employees or agents may result in Contractor’s complete exclusion from eligibility to contract with University for at least five (5) years.

3. Return or Secure Destruction of FERPA Records. Contractor agrees that no later than 30 days after expiration or termination of the Underlying Agreement or this Addendum for any reason, or within thirty (30) days after University’s written request, Contractor will halt all access, use, creation, or processing of FERPA Records and will return to University or Securely Destroy all FERPA Records, including any copies created by Contractor or any subcontractor; and Contractor will certify in writing to University that all FERPA records have been returned to University or Securely Destroyed. Secure Destruction, Securely Destroy and Securely Destroyed mean shredding, erasing or otherwise modifying a record so as to make it unreadable or indecipherable.

4. Disclosure. Contractor will restrict disclosure of FERPA Records solely to those employees, subcontractors, or agents of Contractor that have a need to access the FERPA Records in order for Contractor to perform its obligations under the Underlying Agreement or this Addendum. If Contractor discloses any FERPA Records to a subcontractor or agent, Contractor will require the subcontractor or agent to comply with restrictions and obligations that align with the restrictions and obligations imposed on Contractor by the Underlying Agreement and this Addendum, including requiring each subcontractor or agent to agree to the same restrictions and obligations in writing.

5. Termination. This Addendum will remain in effect until the earlier of (a) expiration or termination of the Underlying Agreement, or (b) the date University terminates this Addendum by giving Contractor sixty (60) days’ written notice of University’s intent to terminate. Sections 2, 3, 4, and 6 of this Addendum will survive expiration or termination of the Underlying Agreement and this Addendum.

6. Breach. In the event of a breach, threatened breach or intended breach of this Addendum by Contractor, University (in addition to any other rights and remedies available to University at law or in equity) will be entitled to preliminary and final injunctions, enjoining and restraining such breach, threatened breach or intended breach.

7. Governing Law. The validity, construction, and performance of this Addendum are governed by the laws of the State of Texas, and suit may be brought in Bexar County, Texas to enforce the terms of this Addendum.

8. Non-Assignment. The rights and obligations of the Parties under this Addendum may not be sold, assigned or otherwise transferred.

AGREED TO AND SIGNED BY THE PARTIES.

The University of Texas Health Science [Contractor] At San Antonio

By: ____________________________ By: ____________________________

Name: _________________________ Name: _________________________

Title: __________________________ Title: ___________________________

Date: __________________________ Date: __________________________