Some of these questions were posted and answered on the National Association of College and University Attorneys (NACUA) listserv. All identifiers were removed, and permission sought (collectively) for use of same. Special thanks to Steve McDonald, General Counsel, Rhode Island School of Design, for his FERPA expertise. Steve is the editor of the 2nd edition of the Family Educational Rights and Privacy Act: A Legal Compendium, available from NACUA. For anyone who wants to know all of the ins and outs of FERPA, this guide is indispensable.
Some of these question were posted on a post webinar page after the January 2009 NACUA web seminar on the new FERPA regulations. Answers to these questions were posted by Steve McDonald and Peg O'Donnell (CUA). Institutions are free to use and adapt this material for educational purposes.
Q. When does HIPAA apply and when does FERPA apply?
A.FERPA applies to "education records." FERPA does not apply to medical records used only for treatment, (let's call those "unshared treatment records.") Once the medical records are shared outside the treatment sphere (let's call those "shared treatment records"), they become education records and are subject to FERPA. So, FERPA applies to education records, including shared treatment records, and does not apply to unshared treatment records.
HIPAA specifically excludes both education records, including shared treatment records, and unshared treatment records. (See 45 C.F.R. 160.103 definition of "Protected Health Information") It does not apply to any of the three
So, neither FERPA nor HIPAA applies to unshared treatment records.
However, State law regarding confidentiality of medical records applies to unshared treatment records and limits how they may be shared.
Answer courtesy of Nina Lavoie, Associate Counsel, University of Maine System
Q: The student health center orders lab work for students through an electronic interface. This includes the transmission of billing information and lab results. Are these covered transactions that would make the student health center a health care provider covered by HIPAA? The health center only serves students.
A. Billing can be a covered transaction or not depending on the entity billed and the transaction- and I only say that because billing for health services would include simply charging a credit card. But the covered transactions that are defined in HIPAA are regarding specific electronic transactions made to (primarily) health insurance companies. Generally, only the people doing billing would know about this invisible part of healthcare. 45 CFR 160.103 lists the covered transactions that make a healthcare entity into a "covered entity". These covered transaction include verifying that an individual has health insurance and submitting health claims to an insurance company or clearinghouse. If your student health center is billing for lab draws then they are probably performing both these transactions, along with these other electronic transactions: health care claim status, enrollment in a health plan, referral certification and health claims attachments because these are all involved in any one insurance claim. Most of these are performed automatically and are built into the practice management system. It is highly likely that your student health center is performing covered transaction and transmitting health information electronically, and therefore is a covered entity.
The practical effect is quite different for the student health center because it only sees students. The health center would be subject to the Transaction and Code Set Rule- which is how the entity must submit claims- but they are probably already following these rules since they are standard in the healthcare industry. What most concerns people, if they are a covered entity, is learning and becoming compliant with the Security and Privacy Rule contained in HIPAA. The Privacy Rule and the Security Rule would apply to any protected health information (PHI) that the student health center receives, creates or maintains; this is where compliance with these rules creates administrative costs in terms of training, auditing, policies and awareness of processes for storage and disclosure of PHI.
But through an odd relationship between FERPA and HIPAA, a student health center, even though a covered entity, does not create PHI as long as it only sees students. All the student records are excepted from being considered PHI (see 45 CFR 160.103 definition of PHI) and are defined as either education records or treatment records. Because these student records are not PHI, there is no PHI created at this student health center; and because there is no PHI, the Security and Privacy rules would not apply to any of the data created at the student health center. Any non-student health information would be PHI and would be subject to the Privacy Rule and the Security Rule. But if only students are seen, there is no PHI created.
So the answer is: yes, billing for lab services is a covered transaction; the student health center is a covered entity; and the Privacy and Security Rule and their regulations do not apply to your services or work flow.
Answer courtesy of James Francel JD, HIPAA/FERPA Compliance Officer, Idaho State University
Q. The August 24, 2016 "Dear Colleague" letter regarding FERPA and student medical records states (on the top of page 3) that a student's medical records become "education records" if the records are shared with the student. We have always understood that medical records become education records if shared with another office, but it seems to be a dramatic shift for records to lose "treatment record" status simply because the student has accessed his/her own records. We are would like to know how other institutions are responding to this new guidance, namely what new procedures are being implemented.
A. I don't think this is really a dramatic shift or even particularly consequential. The *only* reason that "treatment records" are classified separately from "education records" under FERPA is so that they're not subject to the "inspect and review" requirement, which means that student access to them is based on your state's general law on patient access to medical records rather than FERPA. The "treatment records" categorization provides them no other or special protection at all, and -- as far as FERPA is concerned -- you are free to share them under any of the exceptions applicable to "education records." So, for all intents and purposes (other than "inspect and review"), they really are "education records" to begin with.
That said, they *also* continue to be subject to state medical confidentiality laws (at least when in the hands of medical professionals). That's where the real protection for such records kicks in, and nothing in FERPA undermines or preempts that.
Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design
Q. A current student asked us whether or not an email that referenced the student between two professors is considered an education record under FERPA, and if so, would he/she have access to said email? If the professors discussed the student in the course of the academic process using college e-mail addresses, would this communication be considered an education record that said student would have access to?
A. As long as a record is "directly related" (which is essentially to say personally identifiable) to a student and maintained by the institution or an agent for the institution, it is an "education record" for purposes of FERPA and is subject to the "inspect and review" right unless it falls within one of the two narrow exceptions to that, neither of which are likely to be applicable to the situation you have described. Also, because the e-mail is between two professors, it would not qualify for the "sole possession record" exception to the definition of "education records." That said, see the following case, which seems to have adopted the "registrar" theory of FERPA: S.A. v. Tulare County Office of Education, 2009 Westlaw 3126322 (E.D.Cal.), subsequent proceeding, 2009 Westlaw 3296653 (E.D. Cal.) ("Emails, like assignments passed through the hands of students, have a fleeting nature. An email may be sent, received, read, and deleted within moments. As such, Student's assertion -- that all emails that identify Student, whether in individual inboxes or the retrievable electronic database, are maintained 'in the same way the registrar maintains a student's folder in a permanent file' -- is 'fanciful.'Like individual assignments that are handled by many student graders, emails may appear in the inboxes of many individuals at the educational institution. FERPA does not contemplate that education records are maintained in numerous places. As the [Owasso] Court set forth above, 'Congress contemplated that education records would be kept in one place with a single record of access.'Thus, California DOE's position that [only those] emails that are printed and placed in Student's file are 'maintained' is accordant with the case law interpreting the meaning of FERPA and the IDEA.")
Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design
Q. A student has requested that he be provided with copies of all emails in which he may be named. Do education records include any, some or all of faculty email which reference this student? What about emails copied to legal counsel?
A. FERPA draws no distinction between paper and electronic records, so e-mails that (a) you "maintain" and (b) are "directly related" to a student do constitute "education records" unless they fall within one of the six "carve-outs" (sole possession records, treatment records, law enforcement records, employment records, alumni records, and peer grading records). Faculty and staff e-mail to or from a student or about a student generally will constitute education records, and none of the carve-outs seem to apply to them, at least not as a class.
That said, the student's right is to "inspect and review" her records, not to receive copies unless that's the only way she can exercise her "inspect and review" rights. See 34 CFR 99.10 (Also, you may withhold any records that truly are attorney-client privileged under your state law (but a "cc" to a lawyer is likely not enough, alone, to establish that). See June 1, 1999 FPCO letter to Clark College. And, while the dividing line is not at all clear, requesters are obligated to "clearly specify" what it is they want rather than making "blanket" requests, and you generally are required only to make a "reasonable" search for whatever is requested. See August 20, 2004 FPCO letter to Parent re Disclosure and FPCO July 29, 2002 letter. Note that nothing in FERPA requires the institution to retain emails about a student.
Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design
Q. The FERPA regs define a student as "any individual who is or has been in attendance at an educational ...institution." (34. C.F.R. 99.3). Admitted student comes on campus early for school related summer job (but not attending class), gets in trouble. Are related documents "Educational Records?" More broadly, do other universities treat records created prior to "attendance" (primarily admission documents) as Education Records? Before the student attends? Do the same records become Education Records after the student "attends"?"
A. Schools have discretion to determine when they first consider their students to be "in attendance" for purposes of FERPA, essentially at any reasonable point from the date they accept their offers of admission to the first day of classes. http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/vasexoffenderlaw081607.html
It generally doesn't make much difference, and most schools really don't even think about it, but public institutions sometimes go for the earlier dates, in order to avoid any argument that their student records are public records, and private institutions sometimes go for the later dates, so that their student records don't become subject to the "inspect and review" requirement any earlier than necessary.
FERPA does "reach back" and encompass the admission records of those applicants who do become students once they are "in attendance." It does not apply to the admission records of denied applicants or those applicants who are admitted but choose not to attend.
I haven't seen any guidance about pre-attendance employment records specifically, but student employment records are considered education records if the job requires the holder to be a student (e.g., work student, GTA, etc.). If that's not the case, it shouldn't matter whether the employment occurred before or after "attendance," because they wouldn't be considered education records regardless. If it is the case, my guess is that the records would be treated similarly to admission records, and thus become education records at the point of "attendance."
Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design
Q. Based on the definition of attendance, must we now assume that "continuing education" students and people in courses provided to employers are students for all FERPA purposes?
A.The outer limit of "student" is currently unclear, and I think that's intentional. FPCO tends not to like to make absolute pronouncements on an issue until it has really studied and understands the possible variations and implications. All we know for sure today is that someone can be a "student" even if he or she is not in a degree- or certificate-granting program. I hope that doesn't mean that everyone who attends a one-hour CLE program at your law school, or kids who attend a summer sports camp, and so forth are "students," because the implications are both unmanageable and absurd. Among other things, we'd have to give every one of them a copy of our annual notice and an opportunity to "opt out" of directory information, and, because they'd be "in attendance" at a college, the 10-year-olds in a junior baseball camp would control their own FERPA rights. However, the more something looks like your regular, degree-granting program (multiple-session CE classes on "academic" subjects, summer academic enrichment programs for high school students, and so forth), the more likely its participants are "students."
Q. How does FERPA apply to the records we maintain on students who have applied for admission, potentially been admitted, but not yet ENROLLED?
A. Until the student is in attendance at the institution the student does not have rights under FERPA. However, the FERPA protection does follow a record sent by a secondary school to the university. Although the applicant would not have a right to view that record, the record would have to be treated as confidential. See Jan. 30, 2001 FPCO opinion letter to Bill Reedy, Vermont Department of Education for definition of educational agency or institution.
Q. Are student photos stored in the student information system (used now by public safety, the President, campus ministry and various student life folks) "education records?" Are they "directory information?"
A. Photos are now defined in CUA policy as directory information. Please use common sense in disclosing and call the Office of General Counsel or the Office of Enrollment Management with questions about use.
Q Are the employment records of a student employee governed by FERPA?
A Student employment records are part of education records only if the employment is dependent on the student's status as a student. Therefore, records of graduate teaching or research assistants, work-study students, etc., are education records, not regular employment records and FERPA clearly applies. Access to and release of those records are governed by FERPA.
Q Are medical records covered under FERPA?
A Records made or maintained by a physician, psychiatrist, psychologist, or other paraprofessional, if the records are used only for treatment of a student and made available only to those persons providing the treatment, are not considered education records under FERPA. These records are governed by strict confidentiality provisions of other laws, as well as canons of professional ethics. Note that once such medical records are disclosed to someone other than "those persons providing treatment," then the records are no longer considered medical records excluded from FERPA, and the student is entitled to access the records.
Q We have been asked to provide advice to our College's Counseling Center on what student medical information the Center can share with College officials on a need-to-know basis. They want to know what they can disclose and when they should do so. Can anyone please direct me to a good discussion or analysis of this topic?
A Student medical information and records are exempt from HIPAA and are instead governed by FERPA. When used solely for treatment purposes, they are exempt from the coverage of FERPA and HIPAA. When used for any other purpose within the university, such as academic decisions about medical withdrawal from class or an academic disability accommodation, they are education records and FERPA rules apply. FERPA would allow you to release them to a school official within your university who has a legitimate interest in the records without the student's permission. Those terms should be defined in your FERPA policy.
BUT, and this is a big caveat, state laws usually also govern these records and particularly with regard to mental health records, will place restrictions on whether you can release them outside of the treatment context without permission. You will almost always be allowed to release them to appropriate officials for health and safety reasons under most statutory schemes, and sometimes will be compelled to do so, depending on your state's common law and statutes.
Answer courtesy of Jeffery L. Graves, Associate Vice President for Institutional Compliance and Legal Affairs, The University of Texas at Austin, April 2006.
Q Are statements by student witnesses gathered in connection with a university investigation included in FERPA's definition of "education records"?
A Depending on the nature of the university's investigation, the documents might well be considered education records. FERPA defines this term very broadly, to constitute "those records . . . which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution . . .." 20 U.S.C. § 1232g(a)(4)(A). There is no requirement that the records be related to the student's education. There is an exception, however, for "records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement." 20 U.S.C. § 1232g(a)(4)(B)(i). Thus, if the investigation was conducted by a campus police department and the purpose of the investigation was to enforce the law, rather than to pursue an internal disciplinary proceeding, the records in question would not be "education records" under FERPA.
Q Is a student's assignment (written or perhaps a video production), once handed in to a professor, an education record protected by FERPA?
A In a September 1, 1993, opinion letter to the American Library Association, LeRoy Rooker, the Director of the Family Policy Compliance Office, stated the following: "Generally any written examination or paper that is prepared by a student and that reveals or discloses a student's identity would be considered an 'education record' under [the regulatory] definition (so long as it is maintained by the institution). That is, in ordinary circumstances FERPA prevents an institution from disclosing or publishing a student's written examination or paper without prior written consent, except in accordance with the specific exceptions set forth in 34 C.F.R. § 99.31." 34 CFR 99.31 lists a number of exceptions, including disclosure to other school officials with a legitimate educational interest; disclosure in connection with financial aid for certain purposes; stated and local educational authorities; and to accrediting organizations among others."
Q Are "outgoing" letters of recommendations for current students education records? Even if not so defined, can the recommendation include personally identifiable information (such as grade in a specific course) without getting the student's written consent to the disclosure?
A We advise obtaining written consent for the release of education data in letters of recommendation. One practical way to avoid requiring written consent may be to have the faculty member give the letter of recommendation to the student and to let the student release the data to the prospective employer. Obviously, this approach may raise other concerns, and is not an option in many situations.
Q When are application materials of students protected under FERPA?
A FERPA defines student as any individual who is or has been in attendance at an educational agency or institution and regarding whom the agency or institution maintains education records. 34 CFR § 99.3. In interpreting this definition with respect to application materials, the Family Policy Compliance Office (FPCO) has generally taken the position that records sent by the student to the university are not protected as education records unless the student matriculates. In contrast, because records about a student sent directly from the high school to the university would be covered as education records by virtue of their status as records of the high school, the FPCO views these materials as covered under FERPA regardless of whether or not the student matriculates. Finally, The FPCO has stated that educational testing agency records sent about a student would not be protected unless the student matriculates, as the student was not in attendance at the agency, and thus the FERPA confidentiality provision did not attach at the time of taking the test, unlike the case with records created by a high school. (See Jan. 30, 2001 FPCO opinion letter to Bill Reedy, Vermont Department of Education for definition of educational agency or institution.)
A videotape made by the university of an audition required as part of the application process for the School of Music is not an education record unless the student matriculates. The School is advised to make prospective applicants aware that the videotape will be made and used for admission and financial aid decisions only.
Note also that certain state laws provide protection for student applicant data above and beyond what might be protected by FERPA. For a case on this topic that is controlling only in Wisconsin, see J. Marshall Osborn and Center for Equal Opportunity v. Bd. of Regents of the University of Wisconsin, 2002 WI 83, 00-2861 (decided July 2, 2002).
Q We are about to start recruiting from among our current students for a few to participate in a grant that will give them some tuition money. Once they have indicated an interest in the special program, can we just automatically use their admission materials or do we have to ask their permission to use things from those materials such as transcripts and names of references? Their applications for this special tuition program will be reviewed by the dean, a faculty member and an outside expert in the discipline involved.
A There are two slightly different perspectives students might have on this. First, if they look at it as a FERPA "confidentiality of student records" issue, the admissions materials are indeed "education records" for enrolled students (to the extent you retain the admissions materials in your files) and thus are protected by FERPA. You would be permitted to look at them if you have a release from the student or for any "legitimate educational interest" reason. It is likely that this purpose would qualify as a legitimate interest. Second, however, as a practical matter you have to anticipate the students' expectations. Did they think when they initially applied that their admissions reference letters would ever be used for some other purpose? The safest way is to get their permission for whatever you use. It would be sufficient, as part of the application process for this grant program, to say something like, "applicants acknowledge that materials accompanying their application for admission to the School, including but not limited to letters of reference, writing samples, test scores and transcripts, may be considered by the School in determining whether to make an award under the special grant program."
Q If a record is not protected by FERPA, does this mean the record is not confidential?
A Not necessarily. It is important to realize that other laws and CUA policies govern the release of records that are not education records. For example, employment records are protected by CUA personnel policies.
Q Are records of campus disciplinary proceedings protected under FERPA?
A Yes. Narrow exceptions exist. The regulations at 34 CFR 99.31(a)(14) permit results of a disciplinary proceeding to be disclosed regarding a crime of violence or a non-forcible sex offense if the perpretator has violated the school's policies and is found to be an alleged perpretator of a crime of violence or a non-forcible sex offense. The School may not disclose the names of any other student, including a victim or witness, without prior written consent of the student. The law requires (under the Campus Sexual Assault Victim Bill of Rights) results of a disciplinary proceeding to be disclosed to a victim and the accused when the proceeding involves a sex offense.
Q Do any special rules apply to transcripts or social security numbers?
A Yes. Although FERPA does not address transcripts separately, registrars are very careful about release of transcripts, and CUA policy is that only the Registrar is authorized to issue transcripts, and an official transcript is issued only when requested by the student in writing. Parents of dependent students may obtain transcripts without written permission from the student. Social Security numbers are personally identifiable and contain private information. They must be treated as education records. See also the Gramm Leach Bliley Act for futher information on security requirements with respect to social security numbers that are obtained pursuant to financial transactions.
Q Do you consider faculty evaluation forms filled out and signed by students to be a part of that student's education record under FERPA?
A. It's not clear exactly what information is in those forms, but if (a) you "maintain" them, and (b) they're "directly related" to a student, then they're education records. However, just because a portion of a record that you maintain is directly related to a student doesn't necessarily mean that the entire record is an education record. In a February 10, 1995 guidance letter to Hugo Sonnenschein at the University of Chicago (p. 339 of the Compendium), FPCO stated as follows:
Ordinarily, an institution is expected to provide access to an entire document, or group of documents, that contains information directly related to a student, and not just the parts that are, in fact, directly related to the student. In other words, FERPA generally enables parents and students to know about the context in which the directly related information is maintained, rather than limiting them to viewing only the directly related information itself.
We recognize that it may be appropriate in certain circumstances to segregate and remove those parts not directly related to a student to provide the student full access to his or her education records. . . .This Office believes that this 'principle of segregation' may apply with equal force where the institution seeks to protect the records of an employee, rather than the education records of a student.
Note, however, that the analysis is not entirely clear and that FPCO subsequently stated that it was "reevaluating" its position, although apparently for other, unrelated reasons. (Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design.)
Q. Are records of applicants who do not matriculate protected as "education records" under FERPA?
A. The Family Policy Compliance Office has generally taken the position that records sent by the student to the university are not protected as education records unless/until the student matriculates. In contrast, records about a student sent directly from the high school to the university would be covered as education records regardless of whether or not the student matriculates. Finally, educational testing agency records sent about a student would not be protected unless the student matriculates, as the student was not in attendance at the agency, and thus the FERPA confidentiality provision did not attach at the time of taking the test, unlike the case with records created by a high school. See the Jan. 30, 2001 FPCO opinion letter to Bill Reedy, Vermont Department of Education for definition of educational agency or institution.
Q May we respond to a student's request for his/her own records if the request was sent via the student's institutional e-mail account (thereby identifying and authenticating the student)? I realize that 34 CFR § 99.30(d) doesn't apply to a student requesting access to his/her own records.
A. If you are sending the records of the student to the student at his/her home address, I don't see a problem, as there is no potential for unauthorized disclosure here. If you are sending the records to the requester by email, then I see a possible problem for an unauthorized disclosure if it turns out someone else created a fake email request making it look like it came from the student. This is actually pretty easy to do. So I would allow students to submit email requests as you suggest, but advise that the disclosure will be made by US mail to their home address.
Q This is a question regarding letters of recommendation in a student's file and whether we will give the student a copy or forward the copy to Law School Admissions Committee(LSAC) of another school. Must we (or even may we) give a copy a. to the student or b. to LSAC or any other outside entity that the student designates?
A. As to this specific former student, the letter of recommendation is an "education record" and therefore the student has a right to see it. (CUA Student Records policy IV.F Student Access to Records provides in part, "A student may receive a copy of any and all records to which he or she has lawful access...[except transcripts from another school]." Further, the policy says that documents written or solicited after January 1, 1975 can be confidential (and thus not disclosed to the student) only if the student has waived access to the letter in writing. So, the first thing is to check and see whether the student waived access to the letter. If he did, he can't see it; he'll have to ask the author for another letter or have the author provide written or email notice to us directly (not through the student) with permission to give the student a copy of the letter. Likewise, if he did waive access, we can't provide the letter to any other outside entity, such as LSAC, without the author's written permission to specifically disclose the letter to that entity, as well as the student's consent under 34 CFR § 99.30. If the student did not waive access to the letter, he's entitled to a copy. In that case, whether you want to forward it to others on his behalf is up to you -- I'd just send him the copy and let him do with it what he wants.
Q A student has requested to review her records, a term I read to be defined very broadly, to include not only her "official" record, maintained by the dean's office in her school, but also files maintained by individuals, and a lot of other things in writing about her created by employees of the institution. In this case, the files in question contain some highly critical comments by faculty in the form of letters to the dean, and to faculty committees charged with reviewing her progress toward her (Ph.D.) degree. Must these documents be released to the student?
A Unless these are letters of recommendation, used only for the intended purpose, and as to which the student waived her right of review she's entitled to see those letters.
Q A student at a private university requests a copy of the tape recording of his own recently concluded disciplinary hearing. The University Code of Conduct states that hearings are tape recorded but is silent on their use and availability. Is the tape recording an "education record" requiring the University to give the student a copy? If it is, must the University erase testimony from another student because that testimony is also considered part of that student's education record, or require the requesting student to obtain a subpoena?
A FERPA applies to electronic records as well as paper ones (see 34 CFR 99.3), and (putting aside the possible implications of the Owasso case,) your tape is therefore an "education record" as long as it is "directly related to a student" (which basically means is personally identifiable to a student) and you "maintain" it, which seems likely. If so, FERPA gives the student the right to *review* the tape, but *not* to a copy of it, unless "circumstances effectively prevent the . . . student from exercising the right to inspect and review" (see 34 CFR 99.10), as, for example, if the student has moved across country. Ordinarily, you must redact information that is personally identifiable to other students before allowing the student to review the tape (see 34 CFR 99.12), but FERPA does not "override any federally protected due process rights" that the student may have to that other information (see Revised OCR Sexual Harassment Guidance. See also 8/31/94 FPCO letter to Pete Swan at p. 225 of the NACUA FERPA Compendium (2d ed.); 2/10/95 FPCO letter to Hugo Sonnenschein, id. at p. 339 ; and follow-up letter, id. at p. 346. (answer from Steven J. McDonald, NACUANET 12-19-02)
Q If a career center offers a letter of recommendation service (basically holding copies of recommendations and then mailing them out to the institution specified by the student), would the career center violate FERPA by requiring students to waive their rights to review the records as a condition to using the service provided?
A Schools may require a student to waive his/her right to inspect and review letters of recommendation in this instance. Although there is language in the regulation (34 CFR 99.12 (c)) stating that a waiver cannot be required of the student as a condition for receipt of a service or benefit from the school, when the activity in question is an extracurrcular activity not basic to the education, a waiver can be required. The student can then either choose to use this service or choose not to use the service.
Q. When a student's fill out a written consent form allowing the University to disclose records to a third-party, they identify a "secret word" that the third-party should be able to produce if the third-party requests information from the student's records. If a third-party sends a request for records via e-mail to the University that contains the "secret word," is the University allowed to respond to the e-mail?
A. I don't think this approach would necessarily violate FERPA. However, while it isn't required by FERPA, the school may want to include a notice on the form that the student should take care to protect the confidentiality of the secret code word as the code word is the only element needed to obtain information from education records. The student's completion and signature on the form would be agreement with that condition.
Q. What is the relationship between FERPA and the NCAA, which requests and maintains all sorts of information in its investigations and in its routine, required reporting?
A.Student athletes sign a release allowing sharing of the education record information with the NCAA.
Q What rights does FERPA give to students?
Q What rights does FERPA give to students?
A FERPA grants students the right to inspect and review their records, except for those portions of the record that are not considered "education records." For example, a student would not have a right to review his or her medical records, as these are not covered under FERPA. (CUA policy allows the student to have medical records reviewed by a physician or another appropriate medical professional of the student's choice.) The student is not allowed access to those portions of a record that contain information about students other than the requesting student, to financial records of the student's parents submitted in confidence, or to confidential letters of recommendation to which the student has waived access. The student is also not allowed access to records connected with an application to attend CUA or a component unit of CUA if that application is denied.
Q What if I receive a fax from a student asking me to send records? Do I need an original ink signature?
A CUA policy is to grant student inspection of records only upon written request, presented in person with appropriate identification, and made in the presence of the designated personnel of the office maintaining the records. However, CUA does honor faxed requests for transcripts if the fax contains the student's authentic signature. In April of 2004, the Department of Education issued final regulations authorizing schools to establish a process for release of education records to a third party pursuant to digital signatures.
Q Does FERPA require the disclosure of records in the following situation: two students are named in one record, and the disclosure of the record would identify each student even with the redaction of names, addresses, and other identifiable information?
A The Family Policy Compliance Office has advised that if a misconduct record that involved two students must be disclosed to Student A, when disclosure would necessarily reveal information about Student B, even when the name of Student B was redacted, the best choice is to err on the side of privacy for the Student B rather than provide access to Student A. The regulation at 34 C.F.R. § 99.12(a) allows oral disclosure of the information to the student, and this is an alternative where redaction might not be feasible.
Q A student who has dropped out of a graduate program wants copies of all e-mail received by or sent from his student e-mail account. Should he get them?
A Routine e-mail probably falls outside of FERPA. Email could be an education record if it is directly related to a student, and maintained by the school. For example, individual messages, such as a post between a professor and a student discussing course performance, may qualify, due to content of the record rather than its form.
Q Does an undergraduate who applies to graduate school at the same institution have access to his application file?
A The applicant is not considered a "student" in the graduate school until he or she is accepted and enrolled. In the interim, the application file is not an education record under FERPA.
Q May a faculty member refuse to provide a copy (as opposed to merely allowing a review) of a final exam to a student who has made an inspection request under FERPA?
A The main provision governing this issue is 34 C.F.R. § 99.10(a) which provides that a student must be given an opportunity "to inspect and review the student's education records." However, section 99.10(d) provides that if -- and apparently only if -- "circumstances effectively prevent the . . . student from exercising the right to inspect and review the student's education records, the educational institution . . . shall (1) provide the . . . student with a copy of the records requested; or (2) make other arrangements for the . . . student to inspect and review the records under this section." This exception has been applied primarily in circumstances in which the student is a considerable geographical distance from campus and, even then, the student is not entitled to a copy if you can make "other arrangements."
Q A doctoral student has asked to review memoranda between faculty members and administrators concerning her comprehensive exams. Among the documents responsive to this request are documents in which faculty members discuss the student's exams but then go on to discuss unrelated topics, including commentary critical of other faculty members and administration. Keeping in mind that FERPA defines an education record as a record directly related to a student, should the department: (a) refuse to produce those documents that include discussions of other topics because the entire document is not directly related to the student, (b) redact the unrelated topics from the documents and produce the portions relating to the student, or (c) produce the entire document?
A Option (a) would violate FERPA. Option (b) will fully satisfy FERPA's disclosure requirement.
Q In the law school, when students come to the faculty office and ask to see their exam paper (which they are allowed to do), does the record custodian have to ask them for an ID?
A The safe answer would be, yes. However, law students are bound by the ABA's Rules of Professional Conduct for Law Students. Thus, when law students log in to see an exam, list the date, and their confidential exam number, they are presumed to be truthful in representing that they have the right to see a particular exam. Furthermore, the exam number process would make it difficult to fraudulently obtain the exam of another student.
Q If a student requests a copy of a transcript from another institution that happens to be in our university's file, does the student have a right to a copy of that transcript?
A You can choose to give a student a copy of that transcript, but to prevent possible misuse, it is recommended that the transcript from the other institution be stamped "Not an official copy." The institution only needs to give the student an opportunity to review and inspect records, and thus they are not entitled to an actual copy, unless failure to honor the request for the copy would deprive them of the right to view the record. AACRAO recommends telling the student to make their transcript request directly to the original institution. Guidelines for Postsecondary Institutions for Implementation of the Family Educational Rights and Privacy Act of 1974 as Amended, rev. ed. 1998, American Association of Collegiate Registrars and Admissions Officers. The reasons for this recommendation are to prevent fraud, and as a professional courtesy to institutions that may not be issuing a transcript to a student who has a delinquent account.
Q May I charge a copying fee for the student record?
A Yes, in response to an authorized request for a copy of a student's education records, CUA may charge a reasonable fee for the copy.
Q How can the staff of Student Accounts verify that they are speaking with a particular student when the conversation is on the telephone as opposed to in person?
A The office should work out some protocol whereby you ask enough questions of the student on the phone to satisfy you that you are speaking with the student and not with someone else - such as what grade did he/she get in a certain class, who was your professor for Politics, or other specific information that generally only the student would know.
Q What limits apply to subsequent disclosure of the educational record information once the information has been disclosed to someone other than the student?
A Records may be disclosed to a party outside the institution only if the student has given written permission for the additional disclosure, or if the disclosure meets one of the provisions under FERPA for disclosure. In addition, the party to whom the records are transmitted should be notified of the obligation to not further disclose the records. See the transmittal form OGC has drafted for this situation. Internally, a subsequent disclosure may occur if a legitimate educational interest exists, or if written permission has been obtained. This limitation does not apply to directory information.
Q Do you need to require an original signature on a FERPA request for records?
A The requirement of a "signature" is so the institution can reasonably verify that the student is the one making the request or giving authorization, e.g. for release of records. If the "signature" (original, copied or faxed) is suspicious, then the institution should take steps to verify it before release. The university prefers the original ink signature, but will accept copies of releases if it is satisfied that the signature on the release is genuine. See also other answers on this page regarding when digital signatures may be honored for release of records to a third party.
Q. What is the intersection between Title IX and FERPA, for example, when a party to a Title IX complaint seeks information that would be protected by FERPA?
From 2011 DCL:
As discussed in the 2001 Guidance, if the complainant continues to ask that his or her name or other identifiable information not be revealed, the school should evaluate that request in the context of its responsibility to provide a safe and nondiscriminatory environment for all students. Thus, the school may weigh the request for confidentiality against the following factors: the seriousness of the alleged harassment; the complainant’s age; whether there have been other harassment complaints about the same individual; and the alleged harasser’s rights to receive information about the allegations if the information is maintained by the school as an “education record” under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g; 34 C.F.R. Part 99.15
FN 15: For example, the alleged harasser may have a right under FERPA to inspect and review portions of the complaint that directly relate to him or her. In that case, the school must redact the complainant’s name and other identifying information before allowing the alleged harasser to inspect and review the sections of the complaint that relate to him or her. In some cases, such as those where the school is required to report the incident to local law enforcement or other officials, the school may not be able to maintain the complainant’s confidentiality.
The complainant and the alleged perpetrator must be afforded similar and timely access to any information that will be used at the hearing. 29
FN 29: Access to this information must be provided consistent with FERPA. For example, if a school introduces an alleged perpetrator’s prior disciplinary records to support a tougher disciplinary penalty, the complainant would not be allowed access to those records. Additionally, access should not be given to privileged or confidential information. For example, the alleged perpetrator should not be given access to communications between the complainant and a counselor or information regarding the complainant’s sexual history.
Due to the intersection of Title IX and FERPA requirements, OCR recognizes that there may be confusion regarding what information a school may disclose to the complainant.32
FN 32: … The Department interprets this provision to mean that FERPA continues to apply in the context of Title IX enforcement, but if there is a direct conflict between the requirements of FERPA and the requirements of Title IX, such that enforcement of FERPA would interfere with the primary purpose of Title IX to eliminate sex-based discrimination in schools, the requirements of Title IX override any conflicting FERPA provisions. See 2001 Guidance at vii.
FERPA generally prohibits the nonconsensual disclosure of personally identifiable information from a student’s “education record.” However, as stated in the 2001 Guidance, FERPA permits a school to disclose to the harassed student information about the sanction imposed upon a student who was found to have engaged in harassment when the sanction directly relates to the harassed student. This includes an order that the harasser stay away from the harassed student, or that the harasser is prohibited from attending school for a period of time, or transferred to other classes or another residence hall.33 Disclosure of other information in the student’s “education record,” including information about sanctions that do not relate to the harassed student, may result in a violation of FERPA.
Further, when the conduct involves a crime of violence or a non-forcible sex offense,34 FERPA permits a postsecondary institution to disclose to the alleged victim the final results of a disciplinary proceeding against the alleged perpetrator, regardless of whether the institution concluded that a violation was committed.35 Additionally, a postsecondary institution may disclose to anyone—not just the alleged victim—the final results of a disciplinary proceeding if it determines that the student is an alleged perpetrator of a crime of violence or a non-forcible sex offense, and, with respect to the allegation made, the student has committed a violation of the institution’s rules or policies.
Q. ICE agents on campus are asking for information on a former student. What about FERPA?
A. You need only release information on F, M, and J students which is listed at 8 CFR 214.3(g), and other regulations to which it makes reference. ICE is not "exempt" from FERPA. Section 641(c)(2) of IIRAIRA gave the Attorney General (now Secretary of Homeland Security) the unlimited authority to abrogate FERPA to the extent necessary to operate an electronic system to monitor the entry and stay of international students (thus the information in the previously mentioned regulation, which schools are required to release to DHS). The "system" mentioned in the statute eventually became SEVIS. However, such exceptions to FERPA may only be implemented via a valid rulemaking in the Federal Register, and not on an ad-hoc basis by agencies or individual agents. As an aside, DHS is planning a rulemaking to add data elements to 214.3(g) in order to implement "SEVIS II", a reengineering of SEVIS.
The FERPA exception at 214.3(g) only affects F's, M's and J's who are or who have been covered by the SEVIS system. It does not affect FERPA protections for other nonimmigrants, F dependants attending school part time, or the undocumented. Also, it should be noted that this FERPA exception only permits release of information to DHS employees, not to other law enforcement, such as the FBI, DEA, ATF, local or state police, and so on.
Answer courtesy of David Ware, Attorney at Law, Ware/Gasparian, Metaire, Louisiana
Q. My institution has migrated to Google for email and now is interested in making Google Docs available to the community. The idea is that faculty and students will be able to collaborate on documents using Google Docs which would make the learning environment richer. I am concerned that this "sharing" may inadvertently lead to the inappropriate disclosure of FERPA protected information especially the information of those students who have opted out of disclosing "directory information". I would love to learn what other institutions have done to deal with this issue.
A. The first thing to figure out is whether your contract with Google (which typically covers both e-mail and apps together) is FERPA-compliant to begin with. Google doesn't "volunteer" that, so chances are it isn't, which raises issues as to whether you can disclose information even to Google.
To the extent that the "docs" are accessible only to students enrolled in a particular class, I believe that your faculty have some leeway to discuss students and their work -- much as they do in a physical class.
(For example, FPCO has stated that students have no right under FERPA to remain anonymous in class, and, as one Justice noted in the Owasso case, much to the dismay of law students everywhere, FERPA does not prohibit use of the Socratic method.) However, if the "docs" are accessible more broadly, your faculty could not post anything that would constitute an education record without the student's consent, and it's worth thinking through, from a policy perspective, whether faculty should be allowed to require students to post things directly to an open site.
Another issue to think through is copyright. While most of the commercial CMS systems are now capable of facilitating TEACH compliance easily, through integration with your SIS, my understanding of Google Apps is that it currently would require each individual faculty member to take all of the necessary steps manually.
Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design.
Q. An on-campus speaker was videotaped, and the sponsoring department wants to put the video up on its website (i.e., non-commercial use). The videographer was in plain sight. The speaker's consent was obtained, but not those of students who asked questions (mostly off-camera). Anyone have a problem with posting the video?
A. If any of the students are "personally identifiable" (under FERPA's broad definition), I think you'd need FERPA consent. In a similar context, FPCO has stated that the transcript of a hearing that was held open at the student's request is still an "education record" and therefore can't be released without the student's consent. You can include photographs in your list of directory information, but I doubt FPCO would agree to audio, at least generically.
Answer courtesy of Steven J. McDonald, General Counsel, Rhode Island School of Design.
Q If a student is studying at the school and a third party is paying for the student to attend the school, (for example, an employer) can information about the student's grades or academic progress be released to the payor without the student's consent?
A The financial aid exception at 34 CFR § 99.31(a)(4) allows disclosure if it is necessary to determine: eligibility for the aid, the amount of the aid, or the conditions for the aid, or to enforce the terms and conditions for the aid. If this provision is to be used as the basis for a disclosure, there should be some way to know the student has agreed to the conditions. This will have to be a written document. You should request a copy of the aid application with the student's signature if there is not one in the file.
Q What should I do if someone calls from the media and asks for a copy of a student's transcript from her college years at the university?
A FERPA protects former students as well as current students and, thus, this information could not be released without written permission from the student. When the former student is deceased, the policy at CUA (which is set by the Provost) is that education records will not be released until 50 years after the person's death. Requests for exceptions must be addressed to the Office of General Counsel.
Q Is there any exception to the FERPA privacy restrictions for foreign students when the inquiry relates to their application for admission? For example, what about a long distance telephone call from a friend or relative calling on behalf of a prospective student (because the applicant may not speak English very well) asking for information about the status of the student's application?
A FERPA regulations suggest that there is no exception for foreign nationals. (Note that immigration law requires reporting certain information to the INS.) However, FERPA does not apply to prospective students who have not yet been admitted and thus nothing in FERPA prevents the institution from disclosing whether or not the foreign national has been admitted.
Q Does FERPA permit us to disclose education records to the spouse of a student? If so, under what statutory or regulatory authority?
A There are no spousal exceptions or rights under FERPA. In other words, the spouse has no right to the student's records.
Q Under the USA PATRIOT ACT provisions applicable to FERPA, can a school disclose student records without the student's consent in a situation where it believes, for example, that a chemistry student may be acquiring dangerous and volatile chemicals and the school wants to share with the FBI some of the emails the school exchanged with the student regarding these acquisitions?
A An excellent answer to this question, suggested by FERPA expert Steve McDonald, legal counsel at the Rhode Island School of Design, is that while the USA PATRIOT act exception to FERPA requires a court order (and so wouldn't be of much immediate import in this situation), the health and safety emergency exception to FERPA might be useful. See the discussion on the Department of Education site, and also the Family Policy Compliance Office "Dear Colleague" letter from April 2002. Also note that if the information came to the school official through some other source, such as the official's personal knowledge of ads the student had posted on a website, then while the emails would be education records under FERPA, the "information" in the mind of the official would not be an education record and could be disclosed.
Q Does the FERPA exception to the consent requirement for information related to financial aid apply in the case of financial aid received from a foreign government? For example, Canadian financial aid agency requests information from a US institution regarding students who have received aid from the agency.
A As long as it meets the provision in 99.31(a)(4)(ii) - that is, it is truly "aid" and is conditioned on the student's attendance at the school. If they have to make a certain grade, then that counts, too. You should ask for a copy of the student's application used to obtain the aid.
Q The FERPA regulations at 99.31 refer to a "crime of violence" or "non-forcible sex offense". What is the definition of these terms?
A See the chart for the definitions of these terms. The definitions come from the Appendix to the July 6, 2000 final rule implementing changes to the law allowing disclosures to parents and the public in certain instances.
Q As part of a periodic report to our Law School's accrediting agency, we are producing a table showing information about students who have been re-admitted to the law school (following academic exclusion) over the past seven years. Can we show the name of each such student if we are required to do so by the accreditor or if we think it's necessary?
A. Yes, the CUA student records policy would permit the release of student names to an accreditor, but in the interests of protecting student privacy, names should not be released if they are not required for purposes of understanding the particular table being developed or for some other important need of the accreditation team. In this case, it's hard to imagine why the accreditors would have to know individual student names and why the School could not instead substitute initials or a number for each student name.
updated 10-14-16 mlo