What All College Personnel Should Know About FERPA
Wallace State Community College
Hanceville, AL
1
(Family Educational Rights And Privacy Act of 1974)
Family Educational Rights And Privacy Act of 1974 - Defined
2
“A Federal Law designed to protect the
privacy of education records, to establish
the right of students to inspect and review
their education records, and to provide
guidelines for the correction of inaccurate
and misleading data through informal and
formal hearings.”
Family Educational Rights And Privacy Act of 1974 - Enforcement
This act is enforced by the Family Policy Compliance Office, U.S. Department of Education, Washington, D.C.
3
Family Policy Compliance OfficeLeRoy Rooker, Director
U.S. Department of Education
400 Maryland Ave., SW
Washington, D.C. 20202-5920
(202) 260-3887
When do FERPA rights begin?
A FERPA-related college education record
begins for a student when he or she
becomes 18 or enrolls in a higher education
institution at any age.
4
Basic Rights of Students
Be notified of their FERPA rights at least annually.
Inspect and review their records.
Amend an incorrect record.
Consent to disclosure (with exceptions).
5
The Essence of FERPA
School officials may not disclose personally
identifiable information about students nor
permit inspection of their records without
written permission unless such action is covered
by certain exceptions permitted by the Act.
6
What is an “Education Record “?
If a record is:
• maintained by your institution
• personally identifiable to a student (directly related to a student and from which a student can be identified)
• not one of the excluded categories of records…
Then, it is an education record and it is subject to
FERPA!
7
“Education Record” Defined
Any record, with certain exceptions, maintained by an institution that is directly related to a student or students. This record can contain a student’s name(s) or information from which an individual student can be personally (individually) identified.
These records include: files, documents, and materials in whatever medium (handwriting, print, tapes, disks, film, microfilm, microfiche) which contain information directly related to students and from which students can be personally (individually) identified.
8
“Personally Identifiable” - Defined
Personally Identifiable means data or information
which includes:
1. The name of the student, the student’s parent, or other family members;
2. The student’s campus or home address;
3. A personal identifier (such as a social security number or student number);4. Personal characteristics or other information
which would make the student’s identity easily traceable.
9
Under FERPA, when you encounter requests for and/or execute releases of personally identifiable records information, you must record:
• the date the information was released;
• to whom the information was released;
• what records were released; and
• the purpose of the request.
10
Requests for Personally Identifiable Records
An Education Record is NOT Defined as:
Sole Possession notes
Law enforcement unit records
Records maintained exclusively for individuals in their capacity as employees
Records of individuals who are employed as a
result of their status as students.
Doctor-patient privilege records
Alumni Records
11
“Sole Possession” Notes - Defined
• This term has always been narrowly defined.
• Notes taken in conjunction with any other person are not sole possession notes (counselor’s notes, interview notes).
• Sharing these notes with another person, or placing them in an area where they can be viewed by others makes them “education records” and subject to FERPA.
• Best advice: If you don’t want it reviewed, don’t write it down.
12
Sole Possession notes are made by one person as an individual observation or recollection, are kept in the possession of the maker, and are only shared with a temporary substitute.
Inspection and Review of a Student’s Education Record
Students have the right to see everything in
their “education record” except:
Information about other students,
Financial records of parents,
Confidential letters of recommendation if they waived their right of access (which cannot be required).
13
14
Quiz Question 1 – True or False?
“ Education Records” include only those records contained in a permanent file.
15
Quiz Question 1 – True or False?
“ Education Records” include only those records contained in a permanent file. FALSE
With specific exceptions, “education records,” are those maintained by the institution with any format that are identifiable to the student.
“School Official” Defined
A school official can be any of the following:
1. College Employee - (administrative, supervisory, academic, research, or support staff including law enforcement and health staff personnel),
2. Elected to the Board of Trustees,
3. Company employed by or under contract to the college (attorney, auditor, or collection agency, or student serving on an official committee) , or assisting another school official in performing his or her tasks.
16
Requirements for Compliance
Provide annual notification to students of their right to know that:
• school officials within the institution may obtain information from education records without obtaining prior written consent,
• the criteria for determining who will be considered school officials and
• what legitimate educational interest will entitle school officials to have access to in education records.
17
“Legitimate Educational Interest”
The demonstrated need to know by those officials of an
institution who act in the student’s educational interest,
including faculty, administrators, clerical and professional
employees, and other persons who manage student record
information.
Although FERPA does not define “legitimate educational
interest”, it states that institutions must specify the criteria for
determining it.
18
“Legitimate Educational Interest” is specific to each college, but is generally defined as:
A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.
19
Legitimate Educational Interest / School Officials
20
Schools must define “legitimate educational
interest.”
School personnel acting within their professional
responsibilities generally have legitimate
educational interests.
School officials may review records without
consent.
When is Prior Consent Not Required?
The institution may release records without consent, but is not required to do so.
Some examples of the exceptions for having a release include:
• “School officials” with a “legitimate educational interest”/ “need to know”. Employees and legal agents have access to education records in order to perform their official, educationally-related duties;
• Disclosure to parents of dependent students (IRS definition);
• To comply with a judicial order or lawfully issued subpoena; and
• Disclosure for a health/safety emergency .
21
22
Quiz Question 2 – True or False?
An advisor does not have to allow a student to inspect and review her personal notes about the student that are held in a file in the desk of the advisor’s office.
23
Quiz Question 2 – True or False?
An advisor does not have to allow a student to inspect and review her personal notes about the student that are held in a file in the desk of the advisor’s office. True
“Sole Possession” records are the exception to the definition of education records and are, therefore, not accessible by the student.
Technological Issues Relative to FERPA
• Facultye-mailstudents
• Posting grades
• Distance learning
• E-signatures
• PIN’s
• E-mail transcript requests
• Tracking/logging
• Annual notification via the web
24
25
Recent FERPA Questions in Our System
Q. Once the student submits an online application, can the
school immediately display the student’s randomly generated ID?
A. On-line applicants are not yet considered students in
attendance.
Q. Can the school inform the student that his / her default
password will be his / her date of birth formatted as MM/DD/YYYY? (The default can be changed once one logs into an account.)
A. “Student” is defined as any individual who is or has been in attendance at an educational agency or institution.
26
Recent FERPA Questions in Our System
Q. For institutions that assign email accounts, can defaults
be jstudent1234@school.edu (the first initial of the first
name, the last name and last four digits of the student ID?)
A. Until the student is enrolled or in attendance as
defined by the school, the school can display a
number for the student to use while applying
on line. Once someone becomes a student, the
number is afforded the protections of FERPA.
27
To ensure that schools disclose education records only to authorized individuals, schools must authenticate
identity using information known or possessed only by
the authorized user.
In person, college staff can review photo IDs to authenticate.
Schools can distribute PINs via U.S. Mail or use other factors.
Technological Issues Relative to FERPA
28
Other factors of authentication include biometric scanners, smartcards, or tokens.
Randomly generated passwords are permitted if they are securely provided to students.
If U.S. mail is not used, PINs can be sent via secure email to students. PINs distributed on line or via email must be done
through a secure method such as encryption.
Technological Issues Relative to FERPA
29
On-line PIN changes are permitted if changes occur based on authentication methods known only to the students.
(Example- along with a secret question known only to
student.) Secret questions are set up when accounts are
established.
Unencrypted email, by itself, is not considered secure for FERPA purposes.
Sample rulings:
http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/ryanuillinois.html
http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/uwisc.html
Technological Issues Relative to FERPA
30
Technological Issues Relative to FERPA
FERPA protections are afforded to those defined as Students.
Staff should authenticate disclosures of records whether it is done personally or electronically.
PINs must be securely distributed to students. On-line changes may be done using secret
questions.
Unencrypted email is not FERPA compliant.
31
Quiz Question 3 – True or False?
E-mail addresses can be considered directory information?
32
Quiz Question 3 – True or False?
E-mail addresses can be considered directory information? True
Without the student’s written permission you can only release what we identify as “directory information;” and you can release this information at your discretion. Even directory information can be released only if the student has a “Y” release on his or her record.
Non-directory information can be released without written
permission of the student if the release falls under one of the exceptions to written permission in FERPA (34 c.f.r. 99.31).
33
Questions and/or Comments?
Please contact the Human Resources Department at (256) 352-8295 or the
Vice-President for Students’ Office at
(256) 352-8233.
FERPA Certificate