Understanding FERPA: Protecting Student Privacy for Academic Success

1. FERPA PRIVACY STUDENT RECORDS RECORD RET RETENTION FERPA PRIVACY CENSUS PERSONAL GHTS FERPA, FERPA, STUDENT CONDUCT FERPA SB1440 GRADUATION ANDPERSISTANCE SUCCE EVALUATIONS GRADES RECORDS RETENTIONSLO REGISTRATION OUTCOMES CSU UC GRADUATIO Victor DeVore, San diego community college district Steve Erwin, College of the canyons STUDENT SUCCESS APPLICATION COLLEGE ASSO

2. Learning Outcomes • Understand what FERPA is and what records are affected by FERPA • Understand students’ rights regarding his/her FERPA protected records • Understand when consent is needed to share student records • Understand record retention schedule and best practices • Understand federal, state and accreditor requirements

3. WHAT IS FERPA?

4. FERPA FERPA stands for the Family Educational Rights and Privacy Act of 1974 FERPA is a Federal Law that is designed to protect the privacy of education records, to establish the right of students to inspect and review their education records, and to provide guidelines for the correction of inaccurate and misleading data through informal and formal hearings. FERPA is enforced by the Family Policy Compliance Office, U.S. Department of Education, Washington DC

5. The Essence of the ACT • College students must be permitted to inspect their own education records. • School officials may not disclose personally identifiable information (PII) about students nor permit inspection of their records without written permission unless such action is covered by certain exceptions permitted by the Act.

6. KEY Terms and Concepts • Education Record • Directory Information • School Official • Legitimate Educational Interest • Prior Consent to Disclosure • Students’ right to access their education records as outlined in the College Catalog and College Website

7. What is an “education record?” • Any record, with certain exceptions, maintained by an institution that is directly related to a student or students. This record can contain a student’s name(s) or information from which an individual student can be personally identified. • FERPA rights attach to students as soon as the student is in attendance at your college.

8. What is “In Attendance” • Defined by local policy. • Local policy can define it to begin as early as when the student submits an application or as late as when the student shows up for class. • This is retroactive, meaning FERPA rights apply to all records, even those that predate the student’s attendance.

9. What is not an education record? • “Sole Possession” notes • Law enforcement unit records • Financial records of the student’s parents • Records maintained exclusively for individuals in their capacity as employees • Medical & Treatment records (HIPAA) • Alumni Records

10. Law Enforcement Records • Records created and maintained by the college’s law enforcement unit (e.g. campus police) for a law enforcement purpose

11. What is “personally identifiable?” Personally Identifiable means data or information which includes: • The name of the student, the student’s parent, or other family members. • The student’s campus or home address; • A personal identifier (such as a social security number or student number) • A list of personal characteristics or other information which would make the student’s identity known with “reasonable certainty”

12. Grades posted outside of professor’s office with student id? • NO

13. What is directory information? • Although not required to be included in the institution’s annual notification, the institution must notify students of what information the institution has designated as directory information. • The Family Policy Compliance Office has recommended that this notification be part of the institution’s annual FERPA notification to students. • Students may opt-out of directory information being published.

14. What is directory information? Some of the following are possible items that a college may designate as directory information: • Name, address, phone number, email address, dates of attendance and enrollment status (full-time, half-time) • Student participation in officially recognized activities and sports including weight, height, and high school of graduation of athletic team members • Degrees and awards received by students, including honors, scholarship awards, athletic wards, Vice President’s and President’s recognition.

15. What can never be directory information? Directory information can never include the following: • Race, gender, ethnicity, sexual orientation • SSN • Grades • GPA • Citizenship • Religion • Student ID Numbers (unless used as a login combined with password/pin; may include ID badges but must require a second authentication feature.)

16. School officials • A school official can be a person: • 1. Employed by the college in an administrative, supervisory, academic, research, or support staff position (including law enforcement and health staff personnel), • 2. Elected to the Board of Trustees, • 3. Or a company employed by or under contract to the college to perform a specific task, such as, an agent, an attorney, an auditor, or an outsourced service provider. (e.g. San Diego County Sheriff) • 4. Serving as a student representative on an official committee, such as a disciplinary committee, or assisting another school official in performing his or her tasks. (Teacher’s Assistants)

17. Legitimate Educational interest • The demonstrated need to know by those officials of an institution who act in the student’s educational interest, including faculty, administrators, clerical and professional employees, and other persons who manage student record information. • Although FERPA does not define “legitimate educational interest”, it states that institutions must specify the criteria for determining it.

18. Inspection and review Students have the right to see everything in their “education record” except: • Information about other students; • Financial records of parents; and • Confidential letters of recommendation if they waive their right of access FERPA does not prescribe what records are created or how long they are kept. However you cannot destroy a record if there is a request to inspect and review. It is important to know and understand your district’s records retention policy. (Ref. BP/AP 3310)

19. Inspection and review Students have an absolute right of access to their educational records. If a student (or where applicable, a parent) requests to review a record, you must comply within 15 days. (State law states 15 days, federal law states 45, however since state law is more protective, state law trumps federal law.) Copies of records are not required, however you must provide them if by not doing so you would deny student access (e.g. commute distance is not feasible.)

20. Inspection and review • Title 5, Section 59410 does permit districts, when delineated in board policy, to withhold transcripts, diplomas, grades and other registration privileges if to student, or former student, fails to pay proper financial obligations due to the college. • However, students will always have the ability to inspect their records regardless of financial or other holds

21. Right to amend a record • Student has the right to seek to amend information in their student’s record. • Except – a college is not required by FERPA to afford the student the right to seek to change substantive decisions made by school officials such as grades, disciplinary rulings, disability placements or other evaluations of a student.

22. Right to amend a record • State law permits students to seek to correct information in their student education records which are deemed: • Inaccurate • An unsubstantiated personal conclusion or inference, • A conclusion or inference outside the observer’s area of competence, or • Not based on the personal observations of a named person with the time and place of the observation noted Reference: Ed. Code, Section 76232

23. Process to amend a record

24. Right to consent to disclosure Students have the right to control to whom his or her education record is released. The college must keep all written consents on file for a minimum of three years. There are exceptions….

25. When is prior consent not required? • Institutions may disclose records without consent if certain requirements are met, but it is not required to do so. • Some examples: • “School officials” with a “legitimate educational interest.” Employees and legal agents have access to education records in order to perform their official, educationally-related duties • Disclosure to organizations conducting studies to improve instruction, or to accrediting organizations. • Disclosure to parents of dependent students (IRS definition); Parents must file a certification of dependency e.g. income taxes • Judicial Order or lawfully issued subpoena

26. When is prior consent not required? (cont’d) • Institutions may disclose records without consent if certain requirements are met, but it is not required to do so. • Some examples: • Disclosure of health/safety emergency (must document what the emergency was and to whom the information was released.) • Disclosure of directory information, provided the student has not “opt-out” of direction information.

27. When is prior consent not required? (cont’d) • Solomon Act: • The Act allows military organizations access to information ordinarily restricted under FERPA for the purpose of military recruiting. The Solomon Amendment permits Department of Defense entities to physically access institutional facilities to recruit students, and to obtain students' names, addresses, phone numbers, age, class, and degree program once every term. Institutions are exempt from these requirements if they do not collect this information, or if they do not normally provide this information to prospective employers. The Solomon Amendment only applies to enrolled students over the age 17.

28. When is prior consent not required? (cont’d) • Solomon Act: • Institutions that violate the Solomon Amendment risk loss of funding from several federal agencies, including the Departments of Defense, Education, Health and Human Services, and Labor. If a component of the institution violates the Solomon Amendment, larger system funding may be affected.

29. When is prior consent not required? & Financial Aid • May disclose PII from education records if the disclosure is in connection with financial aid for which the student has applied or has received and the information is NECESSARY to: • determine eligibility for the aid • determine the amount of the aid • determine the conditions for the aid, or • enforce the terms and conditions of the aid. • For these purposes financial aid is payment of funds to a student (or in kind payment) that is conditioned on the student’s attendance at an educational agency or institution.

30. Requirements for Compliance • Institutions must provide an annual notification to students of their FERPA rights. • Right to Inspect • Right to amend and challenge • Opt out of directory information • Complaint process with US DoE • Criteria for school officials & legitimate educational interest when disclosing information without prior consent. • Must provide students access to their education records (Keep in mind state = 15 days vs federal = 45 days)

31. SPECIFIC ISSUES

32. Directory Information Example • Your college designates name, address, telephone numbers, email address, and honors and awards received as directory information. A non-profit organization that serves disabled students asks your college for directory information on students who are enrolled in DSPS. • Can the names and contact information of your DSPS students be disclosed to the organization as directory information? • No. You cannot link directory information with an item that cannot be designated as directory information, such as disability status.

33. Student Learning Outcomes • Administrators and faculty with a legitimate educational interest may have access to education records. Please note that the faculty or staff must have a reason to access the information in order to perform their educationally-related duties. • “Good” Example • Math Department Chair asking for GPA records for all students who took MATH-103 and MATH-110 and if they progressed to Pre-Calculus. • “Bad” Example • Business Faculty requesting contact and GPA records for all students who are over the age of 24 and in Intercollegiate sports.

34. Ferpa, minors and concurrent enrollment • Linda, who is 17, is still in high school but is also taking classes at your college. • Have FERPA rights transferred to Linda? • Yes. • Can her parents see the records at your college? • Not unless an exception allows it, e.g., claiming little Linda on their income taxes. • Is there another way the parents might see these records?

35. WHAT ABOUT PARENTS? When a student reaches the age of 18 or begins attending a postsecondary institution regardless of age, FERPA rights transfer to the student.

36. Institutions may disclose education records • of students to their parents by any of the following: • By obtaining the student’s written consent • By having the parents establish the student’s dependency as defined by Internal Revenue Code • By exercising its disclosure option on any students under age 21 regarding a violation of an institutional rule or federal, state, or local law regarding the use of alcohol or controlled substance as long as state law permits. • In a health or safety emergency.

37. Records Retention and Destruction

38. What is records retention • Records retention is the identification, classification, storage, retention, and destruction of records. • Regulations related to records retention: • Title 5, section 59020 to 59041 • Title 5, section 54600 • Student Accounting Manual Section 4 • Education Code, section 76200 • Accreditation Standard II.C.6

39. Title 5, Section 59020 to 59041 • Explains what records and documents district are required by law to prepare or retain. Student records are part of this section. • Districts must classify documents: • Class 1 – Permanent • Class 2 – Optional • Class 3 – Disposable Note: If a Class 1 document is scanned, imaged, or microfiched, then it may be classified as a Class 3 document for disposal. This process must be defined in board policy

40. Title 5, Section 59020 to 59041 • Class 3 Documents • May be destroyed after the third year from the origination of the document • Cannot be destroyed until after the third July 1st date succeeding completion of an audit required by Ed Code section 84040, or of any other required audit.

41. Sample methods to label documents

42. Storage of student records • The institution maintains student records permanently, securely, and confidentially, with provision for secure backup of all files, regardless of the form in which those files are maintained. The institution publishes and follows established policies for release of student records. • Keep files in moisture-free, fire proof area. Best way to safeguard records is to image them but be sure you have a data storage and backup policy in place.

43. Destruction of education records • Districts must establish a schedule for the destruction of education records. • This schedule must be publicized and trained to all staff that have access to protected records. It’s important that you review and update this policy on an annual basis.

44. Destruction of education records

45. Destruction of education records • FERPA does not preclude the destruction of education records unless a request for access is pending. • However, state law requires the following student records to be classified as Class 1 Permanent and retained indefinitely: • records of enrollment and scholarship • certain claims pertaining to an accident or injury of a student (Cal. Code, Regs., tit. 5, § 59023(d).)

46. Questions?