THE FUNDAMENTALS OF FUNDAMENTAL FERPA Steven J. McDonald General Counsel Rhode Island School of Design

1. THE FUNDAMENTALS OF FUNDAMENTAL FERPA Steven J. McDonald General Counsel Rhode Island School of Design

2. FERPA • The Family Educational Rights and Privacy Act of 1974 • A.K.A. the Buckley Amendment

3. FERPA's Big Three • College students have the right, in general, to: • Control the disclosure of their "education records" to others • Inspect and review their own "education records" • Seek amendment of their "education records"

4. So, What's an "Education Record"? • "'Education records' . . . means those records that are: (1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution"

5. So, What's an "Education Record"? • "'Education records' . . . means those records that are: (1) Directly related to a student; and (2) Maintained by an educational agency or institution or by a party acting for the agency or institution"

6. So, What's an "Education Record"? • "'Educational . . . institution' means any public or private . . . institution" that receives funds "under any program administered by the Secretary [of Education]"

7. So, What's an "Education Record"? • "'Record' means any information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche" • N.B.: Does not include information that is not "recorded" – that is, personal knowledge

8. So, What's an "Education Record"? • "'Student' . . . means any individual who is or has been in attendance at an educational . . . institution" • "'Attendance' includes, but is not limited to . . . [a]ttendance in person or by correspondence"

9. So, What's an "Education Record"? • A record is "directly related" to a student if it contains "personally identifiable information" about that student • "'Personally identifiable information' includes, but is not limited to:" name, address, personal identifiers (such as SSNs or campus ID numbers), "a list of personal characteristics that would make the student's identity easily traceable", and "other information that would make the student's identity easily traceable"

10. So, What's an "Education Record"? • "Maintain" is . . .

11. So, What's an "Education Record"? • "Maintain" is not defined! • Supreme Court: • "FERPA implies that education records are institutional records kept by a single central custodian, such as a registrar." • "The ordinary meaning of the word 'maintain' is 'to keep in existence or continuance; preserve; retain.'"

12. We Don't Need No "Education" • "Education records" certainly includes transcripts, exams, papers, and the like • But it also includes: • SSNs, ID numbers, and driver license numbers • Attendance and absence records • Discipline records, including complaints • Disability accommodation records • Records that are publicly available elsewhere • Records of information that the student has publicly revealed • Pretty much everything!

13. Except for These: • "Sole possession" records • As long as not shared or accessible • "Law enforcement" records • But only the law enforcement office's copy • "Employment" records • Unless student status is a job requirement • "Treatment" records • Only if not shared • "Alumni" records • But not if they "relate back"

14. The Metaphysics of Medical Records • HIPAA: Protected health information excludes individually identifiable health information in: • (i) Education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g; [and] • (ii) Records described at 20 U.S.C. 1232g(a)(4)(B)(iv) [that is, treatment records] • But state medical confidentiality rules still apply (to medical professionals)

15. Except for These: • "Sole possession" records • As long as not shared or accessible • "Law enforcement" records • But only the law enforcement office's copy • "Employment" records • Unless student status is a job requirement • "Treatment" records • Only if not shared • "Alumni" records • But not if they "relate back"

16. Disclosure • Before disclosing education records – or information from education records – an institution must obtain a signed and dated written consent from all relevant students, specifying: • The records that may be disclosed • The purpose for which they may be disclosed • The persons or classes to whom they may be disclosed

17. Except for Disclosures: • To "school officials . . . whom the . . . institution has determined to have legitimate educational interests" • Each institution specifies its own standards • "School officials" can include students serving on committees and outside contractors • "Legitimate educational interests" can include what is needed to do one's job • Institution, not individual, makes the determination

18. A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff ); a person or company with whom the University has contracted (such as an attorney, auditor or collection agent); a person serving on the Board of Visitors; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.

19. Except for Disclosures: • To "school officials . . . whom the . . . institution has determined to have legitimate educational interests" • Each institution specifies its own standards • "School officials" can include students serving on committees and outside contractors • "Legitimate educational interests" can include what is needed to do one's job • Institution, not individual, makes the determination

20. Recent Guidance • "FERPA does not require a postsecondary . . . institution to make education records available to anyone other than an eligible student. Therefore, nothing in FERPA would prevent the University from adopting a policy that a faculty member may not have access to these records", regardless of the faculty member's "educational interest".

21. Except for Disclosures: • Of "directory information" • Can include name, address, e-mail address, telephone number, photograph, date and place of birth, major, dates of attendance, participation in officially recognized activities and sports, degrees, honors and awards received, most recent educational institution attended, and other "information that would not generally be considered harmful or an invasion of privacy if disclosed" • Must give current students advance notice of types and provide opportunity to opt out

22. student name • date admitted • birthdate • mailing address and telephone number • local address and telephone number • university email address • semesters of attendance • major(s) • minor • specialization • school • full- or part-time status • classification (freshman, sophomore, etc) • degree sought • honors and awards • degrees and dates received • participation in officially recognized intercollegiate sports, weight, height, hometown, parents’ names and previous school(s) attended (for members of athletic teams) • Emergency Contact Information

23. Except for Disclosures: • Of "directory information" • Can include name, address, e-mail address, telephone number, photograph, date and place of birth, major, dates of attendance, participation in officially recognized activities and sports, degrees, honors and awards received, most recent educational institution attended, and other "information that would not generally be considered harmful or an invasion of privacy if disclosed" • Must give current students advance notice of types and provide opportunity to opt out

24. Students have the right to withhold the release of information designated as “directory information” by submitting to the Office of Records and Registration, not later than 14 days after the beginning of a term, a request written and signed that “directory information” not be released. This request is effective until revoked in writing by the eligible student to the same office.

25. Except for Disclosures: • To "parents . . . of a dependent student" for federal tax purposes • Parents of college students have no general right to see their children's records, even if the students are minors • Need to obtain a copy of parents' most recent tax return to verify dependent status • Warning: Tell them about this before there's a problem

26. Students are not provided report cards as they are in high school and VCU does not mail grades to home to the parents. . . . When a student reaches the age of 18 or begins attending a postsecondary institution, regardless of age, FERPA (Family Educational Rights and Privacy Act) rights transfer to the student.

27. What do you mean you cannot disclose any information to me about my son/daugther's services? Once your student enrolls in a post–secondary institution, whether they are 18 or younger, they become the sole guardian of all records maintained by that institution. Under the Family Educational Rights and Privacy Act of 1976 (FERPA), the student has the right to access their own records upon written request. The parent or guardian does not share that right. This means that parents do not have legal access to their student's grades, transcripts, or any information concerning the services they are being provided through Disability Support Services.

28. Except for Disclosures: • In connection with a "health or safety emergency" • Disclosure may be made only to "appropriate parties" and must be limited to "information [that] is necessary to protect the health or safety of the student or other individuals"

29. Recent Guidance • An "emergency" exists when "a specific situation presents imminent danger or threat to students or other members of the community, or requires an immediate need for information in order to avert or diffuse serious threats to the safety or health of a student or other individuals." • "This Office will not substitute its judgment for what constitutes a true threat or emergency unless the determination appears manifestly unreasonable or irrational."

30. Recent Guidance • Serious communicable diseases that are epidemic in nature – yes • Serious infectious diseases – case-by-case • Suicidal ideation – case-by-case • "[A] student's suicidal statements, coupled with unsafe conduct and threats against another student, constitute a "health or safety emergency" under FERPA. However, . . . this exception does not support a general or blanket exception in every case in which a student utters a threat."

31. Except for Disclosures: • In connection with "financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as to: • Determine eligibility for the aid; • Determine the amount of the aid; • Determine the conditions for the aid; or • Enforce the terms and conditions of the aid."

32. Except for Disclosures: • To "comply with a judicial order or lawfully issued subpoena" • Must make a "reasonable effort to notify" the student beforehand • Unless it's a grand jury or law enforcement subpoena and you've been ordered not to disclose • No obligation to fight the subpoena on the student's behalf

33. Except for Disclosures: • In a lawsuit, by or against a student, in which you're an adversary • No need to notify student in advance • May disclose only "relevant" records

34. Except for Disclosures: • To parents of a student under 21 if the institution has determined that the student violated its alcohol or drug rules • Student must be under 21 at time of disclosure, not just at time of violation

35. Except for Disclosures: • Of the "final results" of a disciplinary proceeding against an alleged perpetrator of a crime of violence or non-forcible sex offense, if the institution determines that the accused student violated an institutional rule or policy • "Final results" = name of the accused student, violation committed, and sanction imposed

36. Except for Disclosures: • To the victim of an alleged perpetrator of a crime of violence or non-forcible sex offense • Disclosure is still limited to the "final results" of the disciplinary proceeding • However, disclosure is permissible regardless of the finding against the accused

37. Except for Disclosures: • And several more • N.B.: As far as FERPA is concerned, all of these are discretionary • May be other disclosure obligations • For example, under the Campus Sexual Assault Victims' Bill of Rights Act, both the accused and the accuser must be informed of the final results of a disciplinary proceeding involving an alleged sex offense • Also N.B.: These exceptions are independent of each other, not cumulative

38. What is a "Disclosure"? • FERPA "clearly does not allow an educational . . . institution to leave education records unprotected or subject to access by unauthorized individuals, whether in paper, film, electronic, or any other format. We interpret this prohibition to mean that an educational . . . institution must use physical, technological, administrative and other methods, including training, to protect education records in ways that are reasonable and appropriate to the circumstances in which the information or records are maintained."

39. What is a "Disclosure"? • Placing all report cards in a box on a desk • Sending notice of probation on a postcard rather than in a sealed envelope • http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/gibsoncmplt.html • "[A] record management system that allows unauthorized individuals to have access to education records"

40. What is a "Disclosure"? • "[G]iven that it is virtually impossible to use physical or technological safeguards to prevent authorized users from using their access to education records for unauthorized purposes, it is important that an educational agency or institution establish and enforce policies and procedures, including appropriate training, to help ensure that school officials do not in fact misuse education records for their own purposes."

44. What is a "Disclosure"? • "[W]hen an institution is authorized to disclose information from education records . . ., FERPA does not specify or restrict the method of disclosure. . . . FERPA does not mandate any specific method, such as encryption technology, for achieving these standards with electronic disclosure of information from education records. However, reasonable and appropriate steps consistent with current technological developments should be used to control access to and safeguard the integrity of education records in electronic data storage and transmission, including the use of e-mail, Web sites, and other Internet protocols."

45. Implicit Disclosures • "Just the directory information" for a specified student or subset of students • e.g., the names and addresses of all students who have made sexual harassment complaints • "Broken locket" requests • e.g., degree verifications in response to student SSNs • "Anonymized" data and information • e.g., redacted disciplinary reports for all residents of a given dormitory this year

46. Recent Guidance • Schools need not honor student consents • Schools cannot require a waiver as a condition of participation in a course or program

47. But Wait, There's More! • In general, must make a record of each request and each disclosure and maintain it with the relevant education record • In general, may disclose only on condition that the information not be redisclosed without student consent • In general, recipients may use disclosed information only for specified purpose

48. Inspect and Review • Must allow students to "inspect and review" their own education records within 45 days of request • Need not provide copies unless "circumstances effectively prevent the . . . student from exercising the right to inspect and review" • Does not include financial aid records of parents or confidential letters of recommendation to which the student has waived access • If record relates to more than one student, must redact

49. Recent Guidance • FERPA does not require the creation or retention of records, regulate the format of records (except for inaccuracies), govern the organization of records, or prohibit the destruction of records (except for pending requests), nor does it require notification of the creation or destruction of records or attestation of the authenticity of records • FERPA is not a discovery tool; requests must be reasonably specific, and schools need not honor "standing" requests

50. Seek Amendment • Student may request amendment of records containing "information that is inaccurate, misleading, or in violation of the student's rights of privacy" • Not a grade grievance mechanism • If deny request, must give student an opportunity for a hearing • If still deny request, student may include a statement with the record