FERPA Basics for Faculty/Instructional Staff

The Essence

• Federal law designed to protect the privacy of education records. It also provides guidelines for appropriately using and releasing student education records.
• It is intended that students’ rights be broadly defined and applied. Therefore, consider the student to be the“owner” of his or her education record, and the institution as the “custodian” of that record.

Key Terms/Definitions

Education Records: Include any record maintained by the institution that is related to the student (in whatever format or medium) with some narrowly defined exceptions:

• Records in the “sole possession of the maker” (e.g., private advising notes).
• Law enforcement records created by a law enforcement agency for that purpose.
• Employment records (unless the employment is based on student status). The employment records of student employees (e.g., work-study, wages, graduate teaching associates) are part of their education records.
• Medical/psychological treatment records (e.g., from a health or counseling center).
• Alumni records (i.e., those created after the student was enrolled).

Directory Information: Those data items that are publicly releasable, so long as the student does not have a “No Release” on his or her record. Each institution establishes what it considers to be directory information. Common examples include: name, address (local, home and e-mail), telephone (local and home), academic program of study, dates of attendance, date of birth, most recent educational institution attended, and degrees and awards received.

• Directory information cannot include: race, gender, SSN, grades, GPA, country of citizenship, or religion.
• Every student must be given the opportunity to have even directory information suppressed from public release. That is referred to as a “No Release.” Everyone within the institution must respect a student’s No Release on his or her record.

Parent: With reference to FERPA, the term “parent” refers to either parent if the student is financially dependent (IRS definition).

When do FERPA rights begin?

A FERPA-related college education record begins for a student when he or she becomes 18 or enrolls in a higher education institution at any age.

Basic Rights of Students

• Be notified of their FERPA rights at least annually.
• Inspect and review their records.
• Amend an incorrect record.
• Consent to disclosure (with exceptions).

Inspection and Review

Students have the right to see everything in their “education record,” except:

• Information about other students,
• Financial records of parents,
• Confidential letters of recommendation if they waived their right of access (which cannot be required).

There is no records retention policy under FERPA. It does not state what records you must make or how long you must keep them. Those are institutional decisions. You cannot destroy records once requested.

Right to Consent to Disclosure

Start with the premise that the student has the right to control to whom his or her education record is released. Then, there are several exceptions when that permission is not required.
Historically, we had to have a signed release. Regulations now provide more flexibility for utilizing electronic signatures.

When is prior consent not required?

The institution may release records without consent but is not required to do so. Some examples of the exceptions for having a release include:

• “School officials” with a “legitimate educational interest”/“need to know;” Employees and legal agents have access to education records in order to perform their official, educationally-related duties.
• Disclosure to organizations conducting studies to improve instruction, or to accrediting organizations;
• Disclosure to parents of dependent students (IRS definition); Check to see how your institution expects parents to show that dependent status;
• To comply with a judicial order or lawfully issued subpoena;
• Disclosure for a health/safety emergency;
• Disclosure of directory information.

Some Specific Issues for Faculty and Instructional Staff

• Posting Grades: Since grades can never be directory information, it is generally inappropriate to post grades in a public setting. However, if the instructor posts grades in such a manner that only the instructor and the individual student know the posted grade (e.g., with a personal ID; however not any portion of an SSN or institutional Student ID Number), that is acceptable. It is recommended that such a posted list not be in the same order as the class roster or in alphabetical order.
• Course Web Sites: In this age of increasing technology, many courses are supported by class Web sites and/or discussion groups. Only directory information can be available to the general public and other class members, so it is recommended that such Web sites have a security layer such that only class members and instructors can access appropriate information.