FERPA
Definition of Education Record
Disclosure to the Student pursuant to the Student's Request
Disclosure to a Third Party with the Student's Consent
Disclosure Without Consent to a Third Party
Legitimate Educational Interest
Directory Information
Pursuant to Judicial Order
Release to Parents Without a Student's Consent
Corrections to the Record
Digital Issues
Some of these questions were posted and answered on the National Association of College and University Attorneys (NACUA) listserv. All identifiers were removed, and permission sought (collectively) for use of same. Special thanks to Steve McDonald of Ohio State University for his FERPA expertise. Steve is the editor of the recently published 2nd edition of the Family Educational Rights and Privacy Act: A Legal Compendium, available from NACUA. For anyone who wants to know all of the ins and outs of FERPA, this guide is indispensable. All of these questions and answers were edited by the Office of General Counsel at The Catholic University of America. Institutions are free to use and adapt this material for educational purposes.
Definition of Education Record
Q Are the employment records of a student employee governed by FERPA?
A Student employment records are part of education records only if the employment is dependent on the student's status as a student. Therefore, records of graduate teaching or research assistants, work-study students, etc., are education records, not regular employment records and FERPA clearly applies. Access to and release of those records are governed by FERPA.
Q Are medical records covered under FERPA?
A Records made or maintained by a physician, psychiatrist, psychologist, or other paraprofessional, if the records are used only for treatment of a student and made available only to those persons providing the treatment, are not considered education records under FERPA. These records are governed by strict confidentiality provisions of other laws, as well as canons of professional ethics. Note that once such medical records are disclosed to someone other than "those persons providing treatment," then the records are no longer considered medical records that are excluded from FERPA, and the student is entitled to access the records.
Q We have been asked to provide advice to our College's Counseling Center on what student medical information the Center can share with College officials on a need-to-know basis. They want to know what they can disclose and when they should do so. Can anyone please direct me to a good discussion or analysis of this topic?
A Student medical information and records are exempt from HIPAA and are instead governed by FERPA. When used solely for treatment purposes, they are exempt from the coverage of FERPA and HIPAA. When used for any other purpose within the university, such as academic decisions about medical withdrawal from class or an academic disability accommodation, they are education records and FERPA rules apply. FERPA would allow you to release them to a legitimate educational official within your university who has a legitimate interest in the records without the student's permission. Those terms should be defined in your FERPA policy.
BUT, and this is a big caveat, state laws usually also govern these records and particularly with regard to mental health records, will place restrictions on whether you can release them outside of the treatment context without permission. You will almost always be allowed to release them to appropriate officials for health and safety reasons under most statutory schemes, and sometimes will be compelled to do so, depending on your state's common law and statutes.
Answer courtesy of Jeffery L. Graves, Associate Vice President for Institutional Compliance and Legal Affairs, The University of Texas at Austin, April 2006.
Q Are statements by student witnesses gathered in connection with a university investigation included in FERPA's definition of "education records"?
A Depending on the nature of the university's investigation, the documents might well be considered education records. FERPA defines this term very broadly, to constitute "those records . . . which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution . . .." 20 U.S.C. § 1232g(a)(4)(A). There is no requirement that the records be related to the student's education. There is an exception, however, for "records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement." 20 U.S.C. § 1232g(a)(4)(B)(i). Thus, if the investigation was conducted by a campus police department and the purpose of the investigation was to enforce the law, rather than to pursue an internal disciplinary proceeding, the records in question would not be "education records" under FERPA.
Q Is a student's assignment (written or perhaps a video production), once handed in to a professor, an education record protected by FERPA?
A In a September 1, 1993, opinion letter to the American Library Association, LeRoy Rooker, the Director of the Family Policy Compliance Office, stated the following:
Generally, any written examination or paper that is prepared by a student
and that reveals or discloses a student's identity would be considered an
'education record' under [the regulatory] definition (so long as it is maintained
by the institution). That is, in ordinary circumstances FERPA prevents an
institution from disclosing or publishing a student's written examination or
paper without prior written consent, except in accordance with the specific
exceptions set forth in 34 C.F.R. § 99.31." 34 CFR 99.31 lists a number of
exceptions, including disclosure to other school officials with a legitimate
educational interest; disclosure in connection with financial aid for certain
purposes; stated and local educational authorities; and to accrediting
organizations among others.
Q Are "outgoing" letters of recommendations for current students education records? Even if not so defined, can the recommendation include personally identifiable information (such as grade in a specific course) without getting the student's written consent to the disclosure?
A We advise obtaining written consent for the release of education data in letters of recommendation. One practical way to avoid requiring written consent may be to have the faculty member give the letter of recommendation to the student and to let the student release the data to the prospective employer. Obviously, this approach may raise other concerns, and is not an option in many situations.
Q When are application materials of students protected under FERPA?
A FERPA defines student as any individual who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records. 34 CFR § 99.3. In interpreting this definition with respect to application materials, the Family Policy Compliance Office (FPCO) has generally taken the position that records sent by the student to the university are not protected as education records unless/until the student matriculates. In contrast, because records about a student sent directly from the high school to the university would be covered as education records by virtue of their status as records of the high school, the FPCO views these materials as covered under FERPA regardless of whether or not the student matriculates. Finally, The FPCO has stated that educational testing agency records sent about a student would not be protected unless the student matriculates, as the student was not in attendance at the agency, and thus the FERPA confidentiality provision did not attach at the time of taking the test, unlike the case with records created by a high school. (See Jan. 30, 2001 FPCO opinion letter to Bill Reedy, Vermont Department of Education for definition of educational agency or institution.)
A videotape made by the university of an audition required as part of the application process for the School of Music is not an education record unless/until the student matriculates. The School is advised to make prospective applicants aware that the videotape will be made and used for admission and financial aid decisions only.
Note also that certain state laws provide protection for student applicant data above and beyond what might be protected by FERPA. For a case on this topic that is controlling only in Wisconsin, see J. Marshall Osborn and Center for Equal Opportunity v. Bd. of Regents of the University of Wisconsin, 2002 WI 83, 00-2861 (decided July 2, 2002).
Q We are about to start recruiting from among our current students for a few to participate in a grant that will give them some tuition money. Once they have indicated an interest in the special program, can we just automatically use their admission materials or do we have to ask their permission to use things from those materials such as transcripts and names of references? Their applications for this special tuition program will be reviewed by the dean, a faculty member and an outside expert in the discipline involved.
A There are two slightly different perspectives students might have on this. First, if they look at it as a FERPA "confidentiality of student records" issue, the admissions materials are indeed "education records" for enrolled students (to the extent you retain the admissions materials in your files) and thus are protected by FERPA. You would have a right to look at them if you have a release from the student or for any "legitimate educational interest" reason. It is likely that this purpose would qualify as a legitimate interest. Second, however, as a practical matter you have to anticipate the students' expectations. Did they think when they initially applied that their admissions reference letters would ever be used for some other purpose? The safest way is to get their permission for whatever you use. It would be sufficient, as part of the application process for this grant program, to say something like, "applicants acknowledge that materials accompanying their application for admission to the School, including but not limited to letters of reference, writing samples, test scores and transcripts, may be considered by the School in determining whether to make an award under the special grant program."
Q If a record is not protected by FERPA, does this mean the record is not confidential?
A Not necessarily. It is important to realize that other laws and CUA policies govern the release of records that are not education records. For example, employment records are protected by CUA personnel policies. Issues related to the release of information from other records will be addressed in future bulletins.
Q Are records of campus disciplinary proceedings protected under FERPA?
A Yes. Narrow exceptions exist, however, permitting results of a disciplinary proceeding to be disclosed to the victim of a crime of violence, and requiring (under the Student Right-to-Know and Campus Security Act) results of a disciplinary proceeding to be disclosed to a victim and the accused when the proceeding involves a sex offense.
Q Do any special rules apply to transcripts or social security numbers?
A Yes. Although FERPA does not address transcripts separately, registrars are very careful about release of transcripts, and CUA policy is that only the Registrar is authorized to issue transcripts, and an official transcript is issued only when requested by the student in writing. Parents of dependent students may obtain transcripts without written permission from the student. Social Security numbers are personally identifiable and contain private information. They must be treated as education records. See also the Gramm Leach Bliley Act for futher information on security requirements with respect to social security numbers that are obtained pursuant to financial transactions.
Q Do you consider faculty evaluation forms filled out and signed by students to be a part of that student's education record under FERPA?
A. It's not clear exactly what information is in those forms, but if (a) you "maintain" them, and (b) they're "directly related" to a student, then they're education records. However, just because a portion of a record that you maintain is directly related to a student doesn't necessarily mean that the entire record is an education record. In a February 10, 1995 guidance letter to Hugo Sonnenschein at the University of Chicago (p. 339 of the Compendium), FPCO stated as follows:
Ordinarily, an institution is expected to provide access to an entire document, or group of documents, that contains information directly related to a student, and not just the parts that are, in fact, directly related to the student. In other words, FERPA generally enables parents and students to know about the context in which the directly related information is maintained, rather than limiting them to viewing only the directly related information itself.
We recognize that it may be appropriate in certain circumstances to segregate and remove those parts not directly related to a student to provide the student full access to his or her education records. . . .This Office believes that this 'principle of segregation' may apply with equal force where the institution seeks to protect the records of an employee, rather than the education records of a student.
Note, however, that the analysis is not entirely clear and that FPCO subsequently stated that it was "reevaluating" its position, although apparently for other, unrelated reasons. (Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design.)
Q. Are records of applicants who do not matriculate protected as "education records" under FERPA?
A. The Family Policy Compliance Office has generally taken the position that records sent by the student to the university are not protected as education records unless/until the student matriculates. In contrast, records about a student sent directly from the high school to the university would be covered as education records regardless of whether or not the student matriculates. Finally, educational testing agency records sent about a student would not be protected unless the student matriculates, as the student was not in attendance at the agency, and thus the FERPA confidentiality provision did not attach at the time of taking the test, unlike the case with records created by a high school. See the Jan. 30, 2001 FPCO opinion letter to Bill Reedy, Vermont Department of Education for definition of educational agency or institution.
Return to Top of Page
Disclosure to the student pursuant to the student's request
Q This is a question regarding letters of recommendation in a student's file and whether we will give the student a copy or forward the copy to Law School Admissions Committee(LSAC) of another school. Must we (or even may we) give a copy a. to the student or b. to LSAC or any other outside entity that the student designates?
A. As to this specific former student, the letter of recommendation is an "education record" and therefore the student has a right to see it. (CUA Student Records policy IV.F Student Access to Records provides in part, "A student may receive a copy of any and all records to which he or she has lawful access...[except transcripts from another school]." Further, the policy says that documents written or solicited after January 1, 1975 can be confidential (and thus not disclosed to the student) only if the student has waived access to the letter in writing. So, the first thing is to check and see whether the student waived access to the letter. If he did, he can't see it; he'll have to ask the author for another letter or have the author provide written or email notice to us directly (not through the student) with permission to give the student a copy of the letter. Likewise, if he did waive access, we can't provide the letter to any other outside entity, such as LSAC, without the author's written permission to specifically disclose the letter to that entity. If the student did not waive access to the letter, he's entitled to a copy. In that case, whether you want to forward it to others on his behalf is up to you -- I'd just send him the copy and let him do with it what he wants.
Q A student has requested to review her records, a term I read to be defined very broadly, to include not only her "official" record, maintained by the dean's office in her school, but also files maintained by individuals, and a lot of other things in writing about her created by employees of the institution. In this case, the files in question contain some highly critical comments by faculty in the form of letters to the dean, and to faculty committees charged with reviewing her progress toward her (Ph.D.) degree. Must these documents be released to the student?
A Unless these are letters of recommendation, used only for the intended purpose, and as to which the student waived her right of review, or notes maintained by the writer and not shown to anyone else or placed in the student's file, she's entitled to see those letters.
Q A student at a private university requests a copy of the tape recording of his own recently concluded disciplinary hearing. The University Code of Conduct states that hearings are tape recorded but is silent on their use and availability. Is the tape recording an "education record" requiring the University to give the student a copy? If it is, must the University erase testimony from another student because that testimony is also considered part of that student's education record, or require the requesting student to obtain a subpoena?
A FERPA applies to electronic records as well as paper ones (see 34 CFR 99.3), and (putting aside the possible implications of the Owasso case,) your tape is therefore an "education record" as long as it is "directly related to a student" (which basically means is personally identifiable to a student) and you "maintain" it, which seems likely. If so, FERPA gives the student the right to *review* the tape, but *not* to a copy of it, unless "circumstances effectively prevent the . . . student from exercising the right to inspect and review" (see 34 CFR 99.10), as, for example, if the student has moved across country. Ordinarily, you must redact information that is personally identifiable to other students before allowing the student to review the tape (see 34 CFR 99.12), but FERPA does not "override any federally protected due process rights" that the student may have to that other information (see Revised OCR Sexual Harassment Guidance. See also 8/31/94 FPCO letter to Pete Swan at p. 225 of the NACUA FERPA Compendium (2d ed.); 2/10/95 FPCO letter to Hugo Sonnenschein, id. at p. 339 ; and follow-up letter, id. at p. 346. (answer from Steven J. McDonald, NACUANET 12-19-02)
Q If a career center offers a letter of recommendation service (basically holding copies of recommendations and then mailing them out to the institution specified by the student), would the career center violate FERPA by requiring students to waive their rights to review the records as a condition to using the service provided?
A Schools may require a student to waive his/her right to inspect and review letters of recommendation in this instance. Although there is language in the regulation (34 CFR 99.12 (c)) stating that a waiver cannot be required of the student as a condition for receipt of a service or benefit from the school, when the activity in question is an extracurrcular activity not basic to the education, a waiver can be required. The student can then either choose to use this service or choose not to use the service.
Return to Top of Page
Disclosure to a Third Party with the Student's Consent
Q What rights does FERPA give to students?
A FERPA grants students the right to inspect and review their records, except for those portions of the record that are not considered "education records." For example, a student would not have a right to review his or her medical records, as these are not covered under FERPA. (CUA policy allows the student to have medical records reviewed by a physician or another appropriate professional of the student’s choice.) The student is not allowed access to those portions of a record that contain information about students other than the requesting student, to financial records of the student’s parents submitted in confidence, or to confidential letters of recommendation to which the student has waived access. The student is also not allowed access to records connected with an application to attend CUA or a component unit of CUA if that application is denied.
Q What if I receive a fax from a student asking me to send records? Do I need an original ink signature?
A CUA policy is to grant student inspection of records only upon written request, presented in person with appropriate identification, and made in the presence of the designated personnel of the office maintaining the records. However, CUA does honor faxed requests for transcripts if the fax contains the student's authentic signature. In April of 2004, the Department of Education issued final regulations authorizing schools to establish a process for release of education records to a third party pursuant to digital signatures.
Q Does FERPA require the disclosure of records in the following situation: two students are named in one record, and the disclosure of the record would identify each student even with the redaction of names, addresses, and other identifiable information?
A The Family Policy Compliance Office has advised that if a misconduct record that involved two students must be disclosed to Student A, when disclosure would necessarily reveal information about Student B, even when the name of Student B was redacted, the best choice is to err on the side of privacy for the Student B rather than provide access to Student A. The regulation at 34 C.F.R. § 99.12(a) allows oral disclosure of the information to the student, and this is an alternative where redaction might not be feasible.
Q A student who has dropped out of a graduate program wants copies of all e-mail received by or sent from his student e-mail account. Should he get them?
A Routine e-mail probably falls outside of FERPA. Individual messages, such as a post between a professor and a student discussing course performance, may qualify, due to content of the record rather than its form. Anticipated advice from the Family Policy Compliance Office may clarify this in the near future.
Q Does an undergraduate who applies to graduate school at the same institution have access to his application file?
A The applicant is not considered a "student" in the graduate school until he or she is accepted and enrolled. In the interim, the application file is not an education record under FERPA.
Q May a faculty member refuse to provide a copy (as opposed to merely allowing a review) of a final exam to a student who has made an inspection request under FERPA?
A The main provision governing this issue is 34 C.F.R. § 99.10(a) which provides that a student must be given an opportunity "to inspect and review the student's education records." However, section 99.10(d) provides that if -- and apparently only if -- "circumstances effectively prevent the . . . student from exercising the right to inspect and review the student's education records, the educational institution . . . shall (1) provide the . . . student with a copy of the records requested; or (2) make other arrangements for the . . . student to inspect and review the records under this section." This exception has been applied primarily in circumstances in which the student is a considerable geographical distance from campus and, even then, the student is not entitled to a copy if you can make "other arrangements."
Q A doctoral student has asked to review memoranda between faculty members and administrators concerning her comprehensive exams. Among the documents responsive to this request are documents in which faculty members discuss the student's exams but then go on to discuss unrelated topics, including commentary critical of other faculty members and administration. Keeping in mind that FERPA defines an education record as a record directly related to a student, should the department: (a) refuse to produce those documents that include discussions of other topics because the entire document is not directly related to the student, (b) redact the unrelated topics from the documents and produce the portions relating to the student, or (c) produce the entire document?
A Option (a) would violate FERPA. Option (b) will fully satisfy FERPA's disclosure requirement.
Q In the law school, when students come to the faculty office and ask to see their exam paper (which they are allowed to do), does the record custodian have to ask them for an ID?
A The safe answer would be, yes. However, law students are bound by the ABA's Rules of Professional Conduct for Law Students. Thus, when law students log in to see an exam, list the date, and their confidential exam number, they are presumed to be truthful in representing that they have the right to see a particular exam. Furthermore, the exam number process would make it difficult to fraudulently obtain the exam of another student.
Q If a student requests a copy of a transcript from another institution that happens to be in our university's file, does the student have a right to a copy of that transcript?
A You can choose to give a student a copy of that transcript, but to prevent possible misuse, it is recommended that the transcript from the other institution be stamped "Not an official copy." The institution only needs to give the student an opportunity to review and inspect records, and thus they are not entitled to an actual copy, unless failure to honor the request for the copy would deprive them of the right to view the record. AACRAO recommends telling the student to make their transcript request directly to the original institution. Guidelines for Postsecondary Institutions for Implementation of the Family Educational Rights and Privacy Act of 1974 as Amended, rev. ed. 1998, American Association of Collegiate Registrars and Admissions Officers. The reasons for this recommendation are to prevent fraud, and as a professional courtesy to institutions that may not be issuing a transcript to a student who has a delinquent account.
Q May I charge a copying fee for the student record?
A Yes, in response to an authorized request for a copy of a student’s education records, CUA may charge a reasonable fee for the copy.
Q How can the staff of Student Accounts verify that they are speaking with a particular student when the conversation is on the telephone as opposed to in person?
A The office should work out some protocol whereby you ask enough questions of the student on the phone to satisfy you that you are speaking with the student and not with someone else - such as social security number, home address, major course of study, or other specific information that the student would know.
Q What limits apply to subsequent disclosure of the educational record information once the information has been disclosed to someone other than the student?
A Records may be disclosed to a party outside the institution only if the student has given written permission for the additional disclosure, or if the disclosure meets one of the provisions under FERPA for disclosure. In addition, the party to whom the records are transmitted should be notified of the obligation to not further disclose the records. See the transmittal form OGC has drafted for this situation. Internally, a subsequent disclosure may occur if a legitimate educational interest exists, or if written permission has been obtained. This limitation does not apply to directory information.
Q Do you need to require an original signature on a FERPA request for records?
A The requirement of a "signature" is so the institution can reasonably verify that the student is the one making the request or giving authorization, e.g. for release of records. If the "signature" (original, copied or faxed) is suspicious, then the institution should take steps to verify it before release. The university prefers the original ink signature, but will accept copies of releases if it is satisfied that the signature on the release is genuine. See also other answers on this page regarding when digital signatures may be honored for release of records to a third party.
Return to Top of Page
Disclosure Without Consent to a Third Party
Q. An on-campus speaker was videotaped, and the sponsoring department wants to put the video up on its website (i.e., non-commercial use). The videographer was in plain sight. The speaker's consent was obtained, but not those of students who asked questions (mostly off-camera). Anyone have a problem with posting the video?
A. If any of the students are "personally identifiable" (under FERPA's broad definition), I think you'd need FERPA consent. In a similar context, FPCO has stated that the transcript of a hearing that was held open at the student's request is still an "education record" and therefore can't be released without the student's consent. You can include photographs in your list of directory information, but I doubt FPCO would agree to audio, at least generically.
Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design.
Q If a student is studying at the school and a third party is paying for the student to attend the school, (for example, an employer) can information about the student's grades or academic progress be released to the payor without the student's consent?
A The financial aid exception at 34 CFR § 99.31(a)(4) allows disclosure if it is necessary to determine: eligibility for the aid, the amount of the aid, or the conditions for the aid, or to enforce the terms and conditions for the aid. If this provision is to be used as the basis for a disclosure, there should be some way to know the student has agreed to the conditions. This will generally be a written document.
Q What should I do if someone calls from the media and asks for a copy of a student's transcript from her college years at the university?
A FERPA protects former students as well as current students and, thus, this information could not be released without written permission from the student. When the former student is deceased, the policy at CUA (which is set by the Provost) is that education records will not be released until 50 years after the person's death. Requests for exceptions must be addressed to the Office of General Counsel.
Q Is there any exception to the FERPA privacy restrictions for foreign students when the inquiry relates to their application for admission? For example, what about a long distance telephone call from a friend or relative calling on behalf of a prospective student (because the applicant may not speak English very well) asking for information about the status of the student's application?
A FERPA regulations suggest that there is no exception for foreign nationals. (Note that immigration law requires reporting certain information to the INS.) However, FERPA does not apply to prospective students who have not yet been admitted and thus nothing in FERPA prevents the institution from disclosing whether or not the foreign national has been admitted.
Q Does FERPA permit us to disclose education records to the spouse of a student? If so, under what statutory or regulatory authority?
A There are no spousal exceptions or rights under FERPA. In other words, the spouse has no right to the student's records.
Q Can professors require that student papers be submitted electronically to a commercial website to see if they are plagiarized? The paper being checked will also be stored in the web site's electronic data bank, and future papers will be checked against it.
A The commercial vendor is probably acting as an agent of the university in performing this service. This is most likely allowable under FERPA. Consider having students sign consent to have their papers turned over to the service. May serve as a notice and deterrent.
Q Under the USA PATRIOT ACT provisions applicable to FERPA, can a school disclose student records without the student's consent in a situation where it believes, for example, that a chemistry student may be acquiring dangerous and volatile chemicals and the school wants to share with the FBI some of the emails the school exchanged with the student regarding these acquisitions?
A An excellent answer to this question, suggested by FERPA expert Steve McDonald, legal counsel at the Rhode Island School of Design, is that while the USA PATRIOT act exception to FERPA requires a court order (and so wouldn't be of much immediate import in this situation), the health and safety emergency exception to FERPA might be useful. See the discussion on the Department of Education site, and also the Family Policy Compliance Office "Dear Colleague" letter from April 2002. Also note that if the information came to the school official through some other source, such as the official's personal knowledge of ads the student had posted on a website, then while the emails would be education records under FERPA, the "information" in the mind of the official would not be an education record and could be disclosed.
Q Does the FERPA exception to the consent requirement for information related to financial aid apply in the case of financial aid received from a foreign government? For example, Canadian financial aid agency requests information from a US institution regarding students who have received aid from the agency.
A As long as it meets the provision in 99.31(a)(4)(ii) - that is, it is truly "aid" and is conditioned on the student's attendance at the school. If they have to make a certain grade, then that counts, too.
Q The FERPA regulations at 99.31 refer to a "crime of violence" or "non-forcible sex offense". What is the definition of these terms?
A See the chart for the definitions of these terms. The definitions come from the Appendix to the July 6, 2000 final rule implementing changes to the law allowing disclosures to parents and the public in certain instances.
Q Can the university alumni office send information from the education record, including social security numbers, to an outside firm to track down lost alumni? What about an internal transfer from one unit of the university to the on campus alumni office for the same purpose?
A. There should be no problem transferring student information to your alumni office, as long as it is a component of your institution and not an outside entity (and also presuming your definitions of "school official" and "legitimate educational interest" are broad enough to allow that). See the March 1999 FPCO letter to the University of Arizona on this issue. There also would be no problem transferring it to an outside entity that is acting as your agent or for that entity to use that information internally, again presuming your definitions are sufficient broad to allow that. See the Oct. 2006 FPCO letter on transfer of data to alumni search associations. You would remain responsible for the outside entity's compliance, which, among other things, means that it could not redisclose the information to others who don't fall within an applicable exception, unless you first obtain the relevant student's consent. The paragraph on the top of page 3 of this October 2006 letter seems to caution against *redisclosure* by providing a "bare" SSN to a database to see what comes back from the search. See the April 2004 FPCO letter, as well as the August 2004 letter re the National Student Loan Clearinghouse.
(Answer courtesy of Steven McDonald, General Counsel at RISD, with some paraphrasing by MLO)
Return to Top of Page
Legitimate Educational Interest
Q May a career counselor have access to a student database that contains records on students other than the students to whom the counselor is providing guidance?
A You may, consistent with FERPA, be able to permit access to the entire database for the counselor, provided that he/she is instructed not to access records of any student other than those who have given consent.
FERPA prohibits an institutional policy of "releasing" information, which does not necessarily include mere accessibility. Under FERPA, an official of an institution who has access to all student records (such as the Registrar) does not have the right to browse records that he/she has no job-related reason to view. It is the actual perusal of the record, not simply the ability to access it, that triggers FERPA. Obviously, there are concerns whenever any person has the potential to see records that he/she should not be looking at, but some level of trust has to exist in any system of confidential recordkeeping. The open question at this time is whether or not a computer information system must track access by those at the school with a legitimate educational interest.
Q What is a "legitimate educational interest"?
A A school official has a legitimate educational interest if the official is performing a task that is specified in his or her position description or contract agreement, performing a task related to a student’s education or to discipline of a student, providing a service or benefit related to the student or student’s family, or maintaining the safety and security of campus. An example would be an academic advisor to a student reviewing the student’s record on what courses have been completed. This is related to the task of advising the student. The advisor would not be authorized to view records that are not relevant to the task at hand.
Q If the Vice President for Student Life asks me for a copy of a student's transcript, do I need to ask her why she needs the records, or can I presume a legitimate educational interest?
A Not everyone who asks for a record needs to be asked why they want it. The law requires that we assure that employees who access records have a legitimate educational interest in doing so. For administrators like the Provost, vice provosts, deans, assistant and associate deans, vice president for Student Life, you may presume that they can access student records within their province (e.g., all students for the Provost, all students in their schools for a dean) and that they are doing so with a legitimate educational interest. If a dean asked to see the record of a student outside of her school, you should ask why (and presumably she might say, “because the student has applied to transfer into my program”). Assume they have a legitimate educational interest until you have some information that causes you to think they might not. Even though everyone is supposed to have been trained on FERPA, it wouldn’t hurt every once in awhile to ask them to assure you that they have a “legitimate educational interest,” it reminds them of that requirement. Abuse, if it occurs at all, is probably most likely to occur with faculty who are not administrators, so push hardest to have departmental and deans office secretaries be asking that question of faculty.
Q My computer grants me access to student records. Does this mean I am authorized to view all the available records and do not need to follow FERPA?
A No. The confidentiality provisions of FERPA still apply, and a school official should only access a student’s record if a legitimate educational interest exists with respect to that student, and only as to those portions necessary.
Return to Top of Page
Directory Information
Q Does FERPA require the release of directory information?
A FERPA does not require the release of directory information, but allows the university to designate certain information as information that may be released without seeking written permission of the student. CUA has chosen to designate the following as directory information: name of student, address (both loca,, including e-mail address, and permanent), telephone number (both local and permanent), date of registered attendance, school or division of enrollment, major field of study, nature and dates of degrees and awards received, participation in officially recognized activities and sports, and weight and height of members of athletic teams. Note that each student is given an opportunity at registration to check a form indicating that they do not want any directory information released. Thus, before releasing directory information on a student, record custodians need to check the computer database to see if a file is flagged for non-release of directory information when responding to requests for same.
Q I have received a request to release a list of all law students to a professional organization soliciting memberships and subscriptions. The organization promises not to release the list or sell it to any for-profit agencies. Can a list be released?
A As a legal matter, a list with directory information only, can be released except for the names of those students who have requested that not even directory information be released. To whom the university releases such lists is a policy question. It certainly seems reasonable to release a list to the non-profit professional association for a graduate discipline that wishes to use the list to advertise their organization to students in that discipline.
Q We have received a request from the NAACP for a printout of all CUA 4th year students who are African-America. May we comply with this request?
A No. Race is not considered directory information, and release of this information, even for a benign purpose, would violate the law (Brown v. City of Oneonta, 106 F. 3d 1125 (2nd Cir. (1997)).
Q What are the rights of alumni with respect to holds on directory information?
A The key here is when the request is made. If a student, within the specified time period during his or her last opportunity as a student in attendance, requests under section 99.37 that directory information not be disclosed (i.e., the request is made while the person is still enrolled as a student), the institution must honor that request until otherwise notified. Thus, the student's request for non-disclosure must be honored even once the student graduates. For example, if the alumni office wants to disclose some of the former student's "directory information," it may not do so. However, an institution is not required by FERPA to honor a request by a former student that directory information not be disclosed when that request is made after the person is no longer an enrolled student and is made in the person's status as an alumnus. Further, the directory information provision does not apply to former students who attended institutions prior to the passage of FERPA in 1974, because they could not have such a hold in place on their records (i.e., the right to have non-disclosure didn't exist at the time they were a student) (information in answering this question was obtained from a 1991 presentation by LeRoy S. Rooker and re-published in "The Family Educational Rights and Privacy Act: A Legal Compendium" edited by Steven J. McDonald and published by the National Association of College and University Attorneys). NOTE FOR CATHOLIC UNIVERSITY: by policy, we do allow former students to ask the registrar, in writing, to request non-disclosure of directory information.
Return to Top of Page
Pursuant to Judicial Order
Q The University was presented yesterday with a search warrant for college records of a
former student. We explained FERPA and the carve out of advanced notification under CFR 99.31 (a) (9)(I & ii)(A) & (B). We thought we would get an amended warrant with the magic language. Instead the County Attorney is calling and insisting that the search warrant trumps and is not a "court order" nor a subpoena and we must comply without prior notification to the student (who is in jail on serious charges). He points out that you can't quash a search warrant prior to the search. He says that he does not have in his arsenal any power to issue a subpoena for investigation and the search warrant is his only tool. How do we proceed?
A. Mr. Rooker contacted our office and agreed that in this situation with the search warrant, the suggested solution of giving the former student shortened notice (we notified the student in jail by fax on Wednesday that he has until this Friday at 8:30 am) would meet the requirements of notification. The justification for such a short (or shorter) time span is that the legal system does not provide for pre-search warrant relief (such as a motion to quash) - instead relief is found after the warrant has issued and been carried out.
Q Once the institution has complied with a subpoena for law enforcement purposes, where does the institution store the subpoena itself? Should the subpoena be kept in the student file (where the student could eventually see it) or should the subpoena be forever kept separate? Should the subpoena be kept separate for a period of time with eventual placement in the student file?
A All subpoenas at CUA are handled by the Office of the General Counsel and stored there, along with related documents (e.g., correspondence related to the subpoena). The subpoena should not be placed in the student's file.
Return to Top of Page
Release to Parents Without a Student's Consent
Q How can an institution capture dependent status of a student without asking for copies of a parent's income tax returns?
A The school can simply ask the student at the time of registration or even application for an incoming freshman or for transfer students. A Family Policy Compliance Office opinion letter dated October 29, 1993 and addressed to Mr. Robert Bienstock, Associate General Counsel at the University of New Mexico states the following:
Additionally, nothing in FERPA would preclude a university from requiring students to identify their status at the time of registration or even application for incoming freshman and transfer students. If an institution elects to adopt such a requirement, we believe that students should be advised of the reason why they are asked about their tax status as dependents and suggest the following or a similar statement to students:
Under FERPA, the University may disclose to parents information from the education records of a student who is "dependent" under the Federal tax laws without the student's consent. Have you been claimed by your parents as a dependent for Federal tax purposes?
Q Does FERPA prevent the release of information that is not gleaned from the student’s education record? For example, a resident assistant advises the Vice President for Student Life that a student has attempted suicide. Can the VP relay this information to the student’s parents?
A This information did not come from the student’s written education record and thus is not covered by FERPA. An independent analysis separate from the FERPA analysis must be conducted before relaying information about students that might be considered confidential or sensitive. Note also that an educational agency or institution may disclose personally identifiable information from an education record to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.
Q If a parent calls me up on the phone to discuss how his child is doing in my class, should I ask them for a copy of their tax return before talking to them?
A FERPA, as noted above, does not prevent a general conversation about the student covering topics about which you have general knowledge. Two caveats, however. First, you should obtain enough information from the parent to verify that you are indeed talking to who you think you are talking to. You can always take a phone number and return the call if you need extra time to make this verification. Second, to the extent you are releasing information form the education record rather than from your personal knowledge, then you must verify the child is a dependent. Assistance on verifying dependency is available form the Registrar or the General Counsel. Note that release to the parents is always discretionary on the part of the institution, and no "right to access" exists for the parents of a dependent student at the postsecondary level.
Q Can an institution permit students and their parents to have electronic access to their school records by giving students and parents an access code consisting of the student's social security number plus a PIN which the institution initially establishes as the student's birth date? Students are advised that if they wish they can change the PIN so that only they (the students) have electronic access to their records.
A Automatic access for parents is not advised. If a parent sends or faxes the Registrar or General Counsel a copy of their most recent income tax return verifying that the student is a dependent, then the university may grant the parent access to the student's records. With respect to PIN numbers, the computer system at the university should generate a unique number for the student, and only the student should have access to that number. The University does not give out PINs over the phone, as it is too difficult to verify identity in this manner.
Q If high school students enroll in distance education courses through the university to obtain high school credit, are those students considered "eligible students" under FERPA such that their consent is required to release their grades and other records held by the university to parents and other requestors? Is the fact that they are receiving high school credit (as opposed to college credit) relevant?
A Regardless of the age of the student, the fact of enrollment in higher education is what determines what rules apply. Parents of the minor aged students who enroll with a college (either for college or high school credit) do not have automatic access to the student records as they do in the Elementary and Secondary years. The higher education institution needs to have students sign release forms allowing the parent to be advised of grades or show proof of dependency (tax).
Return to Top of Page
Corrections to the Record
Q If the student does not agree with the accuracy of the records, does the student have any recourse?
A The student needs to make a request to the appropriate official at the school to amend the records. If that request is denied, then the student is afforded a hearing under FERPA to challenge what he or she believes is a violation of his or her privacy rights, or to ask for a correction of an inaccurate or misleading record. The challenge may only be made to the correctness of the grade, and not the appropriateness of a grade. In other words, FERPA does not provide a cause of action or right to a hearing with respect to grades unless the basis for the challenge is ministerial error.
Return to Top of Page
Digital Issues
Q We have received a subpoena where the requesting party is seeking to obtain all correspondence sent from a student's AOL account over the school's network. Is the correspondence education records protected by FERPA?
A If you have copies of that e-mail correspondence in your possession (which is not clear from your inquiry, though it seems there is a good chance that you do not) and it is personally identifiable to the student (which, given the specificity of the request, it would seem to be regardless of whether it contains any such information on its face; simply turning it over will identify whose correspondence it is), then it meets the definition of "education records" and is subject to FERPA and its requirement that you give the student advance notice of compliance. There is no additional requirement that the correspondence be "educational". Answer courtesy of Steven McDonald, General Counsel, Rhode Island School of Design.
Q Can a student provide a FERPA waiver to release records via email?
A The general consensus is that a simple email would not suffice under FERPA as written consent for the release of education records. See the final guidance on electronic signatures issued by the Family Policy Compliance Office in April 2004. See also the Paper by CUA Assistant General Counsel Margaret O'Donnell on this topic for an in depth discussion of the issue..
Q Do FERPA restrictions apply to foreign nationals who are taking e-courses from a University while residing in their home country? We have requests from foreign governments and/or corporations who are paying for their employees to take such courses, and would like the University to provide information on grades/progress.
A Nothing in FERPA draws distinctions based on the location of the student. If the student is in attendance or has been in attendance at the institution ("attendance" not having a physical presence component), he/she is covered. Let these employers know that they may require employees to sign a privacy release for educational records as a condition for employer payment for the courses. FERPA does not permit educational institutions to require students to waive their rights as a condition of attendance, but it does not apply to employers who wish to impose such a requirement.
Q Our Student Records Office is contemplating allowing students/alumni to order and pay for transcripts over the web so long as the name on the credit card is the same as the name on the transcript (or there is a change of name form completed in the file for individuals who have gotten married or divorced or otherwise changed their name since attending the university). Currently, transcripts can be ordered in person or by mail, but a signature is required. Is anyone currently allowing ordering of transcripts with electronic payment, or considering it, and are there any thoughts on FERPA implications?
A This use of technology is compliant with FERPA if the transcript is being sent to the student and not to a third party. Current FPCO interpretation of FERPA is that in order to send information to a third party, a student signature is required. This can be a digital signature if the school has a process in in place for digital signatures as required by the regulations. Note that if the transcript is to another school the student seeks to enroll in, then there is an exception in the regulations at 34 CFR 99.31(a) (2) that would allow the system described above. The university should have system in place to make sure person ordering the transcript is actually the student.
Q Can a PIN be used by a student to authorize release of a transcript to a third party?
A Over the years the Department of Education has received numerous inquiries as to whether some form of electronic consent and signature, including email, satisfies FERPA's written consent requirement. Final regulations effective May 21, 2004 were issued by the Department of Education. The regulations are technology neutral and offer guidance on when schools may accept electronic signatures from students for release of education records to third parties. The DOE plans to issue further guidance that will include examples of what might be an acceptable process under the regulations.
The final regulations adopted by the Department of Education on electronic signatures provide as follows:
Sec. 99.30 Under what conditions is prior consent required to
disclose information?
* * * * *
(d) "Signed and dated written consent'' under this part may include a record and signature in electronic form that--
(1) Identifies and authenticates a particular person as the source of the electronic consent; and
(2) Indicates such person's approval of the information contained in the electronic consent.
Note that the written consent requirements in § 99.30 do not apply, however, when eligible students obtain access to their own records. Indeed, when an institution is authorized to disclose information from education records without a signed and dated written consent, including disclosures to eligible students under § 99.31(a)(12), FERPA does not specify or restrict the method of disclosure. See 34 CFR § 99.31. In addition, the guidance below from the Department of Education would still be considered applicable to the safeguards that should apply when PINs are used to disclose information to students:
Institutions and agencies have long been required to establish and monitor reasonable and appropriate physical, technical, and administrative safeguards to protect against the unauthorized access to or disclosure of information from education records and to maintain the integrity of information in those records. FERPA does not mandate any specific method, such as encryption technology, for achieving these standards with electronic storage and disclosure of information from education records. However, reasonable and appropriate steps consistent with current technological developments should be used to control access to and safeguard the integrity of education records in electronic data storage and transmission, including the use of e-mail, Web sites, and other Internet protocols.
This Office has advised previously that an institution may use a PIN combined with the student identification number to authorize disclosure of information from education records directly to the eligible student, but only so long as the institution allows only the eligible student to have access to the PIN. If the institution allows anyone else, including administrative staff, to have access to a student's PIN, there can be no assurance that the disclosure will be made only to an authorized party as required under FERPA. Regardless of the methods an institution uses to allow students to obtain access to their records, the primary consideration is whether there is reasonable assurance that the information is accessible only to the student.
The integrity and security of data storage and transmission are essential to ensure that information is disclosed only to those who are authorized to receive it. In this regard, institutions are responsible for ensuring that the policies or practices they employ are in compliance with FERPA. (Click here for full letter)
Q Campus Programs has a message they want to send out to all students, and they ask the Systems Administrator to provide e-mail addresses for all students. What precautions should be taken in this instance to make sure there is FERPA compliance?
A If the list message is to reach all students, the person sending out the list should be reminded about the provisions in FERPA and university policy for placing a hold on directory information, which may include e-mail addresses if e-mail addresses are identified as directory information under the university student records policy. If e-mail is directory information, it does not matter if the e-mail addresses of the student recipients appear on the list along with the message as long as no student on the list requested a hold on such directory information. If the e-mails are not identified in the policy as directory information, the e-mail address may be considered personally identifiable information that is not subject to release without written permission from the student.
Q The Assistant Dean of the Law School wants to post live streaming video of the Atrium of the Law School on the Law School’s web site. Students routinely spend time hanging out in the Atrium. Is there a FERPA privacy issue here?
A As long as the School is not maintaining a record of this video, it would not be an education record under FERPA. Common law privacy principles or state privacy law might apply, and the best approach would be to give all Law School students (or others who might utilize the Atrium) notice of the practice of streaming this video on the web.
Return to Top of Page
OGC updated 10/4/04
updated 2/22/06 to clarify Q and A about career service and waivers
updated 4/05/06 to include medical records disclosure Q pth
links updated 6/29/08 rab
Last Revised 25-Jul-08 01:39 PM.
