FERPA Fundamentals

1. FERPA Fundamentals The Family Educational Rights and Privacy Act (FERPA) sets out the rights and responsibilities associated with student education records. The University’s FERPA Policy outlines students’ rights and the University’s practices concerning the disclosure of education records. • The Basics • DON’T disclose information concerning a student’s education record to anyone outside of the University unless you have confirmed that FERPA permits the disclosure. • DO review the University’s FERPA Policy and related materials, including helpful FAQs. • DO treat all student records as Confidential data under the University’s Data Protection Standards. Source: http://www.bu.edu/compliance/resources/information-security-privacy/ferpa/

2. FERPA – General Guidelines • FERPA generally authorizes the release of information to school officials who have been determined to have a legitimate educational or business interest in receiving the information.  In routine situations, be judicious. • Overall: • Keep students’ personal concerns private, even from their friends and families as well as your friends. • Be friendly, but not friends with your students. • Avoid accidental violations: if third parties are present when you are talking with a student, ask directly if the student is comfortable with the conversation about his or her academic record. Ask before you include a student’s name or picture in a department newsletter. Source: http://www.bu.edu/sph/faculty-staff/teaching-and-advising/student-record-retention-and-disposal/ferpa/

3. FERPA Responsibilities • Unless your position specifically requires it, you may not disclose information about a student to anyone. • To do so is a violation of federal law. • Even a minor disclosure of information, such as telling another student of someone’s class schedule, may be a violation of FERPA and may result in penalties including, but not necessarily limited to, the loss of one's job. • All communication with students must be through your BU email address, not personal accounts. • All Questrom professors are strongly encouraged to sync their calendars with Outlook 365 to be up-to-date on school-wide events and meetings. • For more information: • http://www.bu.edu/compliance/resources/information-security-privacy/ferpa/ • BU FERPA Module (through the School of Public Health): http://sphweb.bumc.bu.edu/otlt/FERPA/index.html. A helpful walkthrough for understanding FERPA, situations one might encounter, and educating TAs. • http://www.bu.edu/reg/academics/ferpa/faqs/

4. FERPA – Student Grades, Coursework, Attendance • Keep accurate records of each student’s grades and attendance. • Keep student papers and grade records in progress in a secure place. • Never post grades by BU ID or SSN. Use grade management software in Blackboard. • Do not “look up” student grades because a friend, relative, or colleague asks you to check on them and you have access because you are a professor or advisor. • Do not allow students to see grades of other students. Return student graded assignments personally. • You may decide to distribute model papers, but: • Obtain the writer’s permission before making them available • Obscure the writer’s personal information before making them available Source: http://www.bu.edu/sph/faculty-staff/teaching-and-advising/student-record-retention-and-disposal/ferpa/

5. FERPA –Email Compliance • Confidential information, including a student’s BUID number, contact information, or grades, should be sent via encrypted email. The best practice is to look up this information on the Faculty/Staff link and upload grades to Blackboard. • Do not keep files on your students unless necessary. Files do not necessarily need to be paper files, they can also be emails or electronic records. • If you are a student’s advisor, you may view his or her transcript electronically on the Faculty Link, so there is no need to keep a paper file. If students who arenot your advisees meet with you, ask them to update their Student Link profiles and include you as a temporary advisor. • Do not post or share lists of student names or email addresses (consider using BCC when emailing your advising group). • Exercise caution when emailing students, limiting those who are copied to people who have a right to access to the student’s information and who are relevant to the situation. Contact the Registrar if you would like a list of faculty and staff who have a right to access student information. • Shred all paper files after graduation. • If you receive a subpoena for student records, contact the SPH Registrar’s Office, 617-638-4963 or 617-638-5072, who will in turn contact the University’s Office of the General Counsel. Source: http://www.bu.edu/sph/faculty-staff/teaching-and-advising/student-record-retention-and-disposal/ferpa/

6. FERPA – Still have questions? • Email Compliance Services or call 617-358-8090 if you aren’t sure where to start or for questions concerning compliance with laws or policies on FERPA. • Information Security can help you keep data secure, reliable, and accessible. Report a data breach to the Information Security Breach Response Team. • OFFICE OF THE UNIVERSITY REGISTRAR. The Registrar can answer questions about education records and FERPA.

7. Sources and Resources • http://www.bu.edu/compliance/resources/information-security-privacy/ferpa/ • http://www.bu.edu/sph/faculty-staff/teaching-and-advising/student-record-retention-and-disposal/ferpa/ • http://sphweb.bumc.bu.edu/otlt/FERPA/index.html • http://www.bu.edu/tech/about/policies/info-security/google-drive-security-guide-for-ferpa/ - storing student records on BU Google drive is ok – personal is NOT. • http://www.bu.edu/reg/academics/ferpa/faqs/ • http://www.bu.edu/cfa/files/pdf/form_bu_ferpa.pdf • http://www.bu.edu/seo/supervisors/supervising/ferpa-sup/ • http://www.bu.edu/reg/academics/ferpa/ • http://www.bu.edu/reg/academics/ferpa/release/ • http://www.bu.edu/reg/academics/ferpa/definitions/