FERPA Guidelines and Regulations MASFAP Fall 2007 Conference

1. FERPA Guidelines and RegulationsMASFAPFall 2007 Conference By: Jason A. Crowe, JD, MS Financial Aid Director at Barnes-Jewish College jcrowe@bjc.org

2. Background • FERPA: The Family Educational Rights and Privacy Act. • Signed into law August 21, 1974. • Became effective November 19, 1974. • Commonly called the “Buckley Amendment.” • 34 CFR Part 99.

3. What is the Law? • 20 U.S.C. § 1232g; 34 CFR Part 99 • Section 99.7 sets forth the notification requirements of the Family Educational Rights and Privacy Act of 1974 • FERPA is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. • Privacy rights transfer from parent to student once the student matriculates into a college or university • Even parents of dependent students find that their right to information is limited

4. What the Law Doesn’t Tell You • FERPA specifically outlines what information you may share without the student’s permission • FERPA does not specifically discuss disclosure of financial aid data to the parent and student who completed the FAFSA

5. Interpreting FERPA • For financial aid purposes we must develop a policy that both makes sense and that is within the spirit of the law • Start with Dept of ED info at www.ed.gov/policy/gen/guid/fpco/ferpa/index.html • Discuss within the office • What questions do parents and students ask? • How do you balance service and privacy? • How do you ensure the person requesting the information is who s/he says s/he is?

6. Write a Policy • Do you share • Parent income/asset data with a student? • Student income/asset/award data with a parent? • Billing information? • Total due only • Charge detail • Aid payments • PLUS eligibility with both custodial and non-custodial parent? • Whatever your policy, have it reviewed by your General Counsel’s Office • Incorporate approved policy into Policy and Procedures Manual

7. Train your Staff • Once you have an approved policy, train your staff to enforce it • Hold group discussions • Develop PowerPoint or documents for reference • Offer to provide intradepartmental training regarding FERPA policy

8. Policy Points • FAFSA data is shared with student and custodial parent(s) freely, including EFC and awards • Signature on FAFSA stands as a mutual “Release of Information” • PLUS eligibility amount may be shared with non-custodial parent

9. Policy continued • Verify the student or parent identity before disclosure • Student number • Parent and student Social Security Numbers • Student date of birth • Local and permanent addresses

10. Allow Student to Disclose • Student can choose to release information to designated parties • Written release • Verified & secure web site (Guest Access) • Guest Access allows student to share online or email information with 3rd parties as he or she chooses • No one can add or change access other than the student

11. Data Security – FERPA and Gramm-Leach-Bliley • GLB is a Federal Trade Commission Regulation • Applies to all institutions that act in a banking capacity • Applies to universities that make loans and/or do loan collections • Schools could be subject to this act because of Perkins, Short Term Institutional loans, and/or “school-as-lender” FFELP

12. GLB’s Effects • Requires institutions meet standards related to safeguarding customer financial information • Two major areas • Privacy of information • Safety of information

13. Privacy of Information Universities that abide by FERPA are meeting the criteria to protect information privacy Safety of Information Natural Disaster Human Error Deliberate Fraud Corruption of Data Theft of Hardware, Software, Reports Unauthorized Access GLB’s Two Requirements

14. How to Comply • Place all student-specific documents in shredding bins • Verify identity of students & parents before sharing data • Refer 3rd party requests for data to the appropriate person (Compliance Officer, Director, etc.) • Report computer problems (viruses,etc.) promptly

15. How to Comply continued • Do not share passwords • Lock or power down computers when leaving your work area • Shield computer screens and data from other students • Do not leave visitors unattended

16. FERPA and the Financial-Aid Office • Rights of parents and eligible students. • Rights transfer to students: • At age 18. • Students are termed as “eligible students.” • Regulations do not apply when: • Student is deceased. • Person applied to school but has not attended. • Definition of parent. • Natural parent. • Guardian. • Individual acting as a parent in the absence of a parent or guardian.

17. FERPA and the Financial-Aid Office • Two parties have access to student’s education record. • The student. • Parents of dependent student. • Defined in IRS Code, Section 152. • School’s release of parents’ financial information to student is not required. • Parental Access to Records • Parents have no inherent rights to inspect eligible student’s records. • Rights can be modified. • Written consent of student. • In compliance with subpoena. • In connection with health or safety issue. • Parent(s) claim student on taxes.

18. FERPA and the Financial-Aid Office • Written releases are not required if: • School official has legitimate educational interest. • Audit/evaluation purposes. • Party is in connection with financial aid to student. • Judicial order or subpoena. • Health and safety emergencies. • Others.

19. What Is Written Consent? • Standards for written consent: • Specify the records to be disclosed. • State the purpose of the disclosure. • Identify to whom the information will be disclosed.

20. Directory Information • Non-personal information that may be disclosed without written consent. • Not considered harmful or invasion of privacy. • Examples of directory information. • Student’s name. • Address and telephone listing. • E-mail address. • Date and place of birth. • Dates of attendance. • Enrollment status. • Degrees, honors and awards received.

21. Release of Directory Information • Annual notification to students required. • Must be made by means likely to inform students. • College catalogue. • College handbook. • School Web site. • Student may request that information not be released. • Request must be in writing.

22. What Is An Educational Record? • Records, files, documents or other materials containing student-related information. • Maintained by an educational agency or institution. • Includes records shared with or accessible to another individual. • May be handwritten, print, electronic, CD-ROM or other media. • FERPA does not mandate time frame for retaining. • Time frame varies based on the type of record. • Federal, state and/or institutional policies specify archiving needs.

23. Exceptions Sole-possession records or private notes. Law enforcement or campus-security records. Personnel records. Unless for student employees. Professional-treatment records. Information obtained on a former student. Alumni records. Maintenance Requirements School must maintain: List of all education records. Location of records. Procedures by which student can review records. Educational-Record Issues

24. Record of Disclosures • FERPA regulations require a record of each disclosure made without written consent. • Record must be kept with student’s education records. • Each disclosure must include: • Names of parties who requested or received the information. • Parties who requested or received information and any legitimate interest.

25. Exceptions to Recording Disclosures • If request was from or disclosure was to: • The student or parent (of an ineligible student). • A school official with legitimate educational interest. • A party seeking directory information. • A party directed by a subpoena with orders that the subpoena not be disclosed. • A representative of the U.S. Attorney General investigating or prosecuting terrorism crimes.

26. Special Circumstances • Three examples of special circumstances. • Subpoenas. • Student Employees’ Use of Education Records. • Parent Access to a Student’s Education Record.

27. The Subpoena • A command from a court requiring a person’s appearance to provide testimony or evidence. • Student notification required. • Send via certified mail with return receipt. • Exceptions. • Subpoena specifies not to notify student. • Submitting records. • Certified copies sent to issuer or agency collecting documents. • May charge fees for copying and mailing. • Consult with legal counsel before responding to subpoena.

28. Student Employees’ Use of Records • Office is responsible for the privacy and confidentiality of student records that student employees use. • Recommended use of code of responsibility. • New-employee-training tool. • Violations and sanctions explained.

29. FERPA Violation Penalties • Complaint procedures. • Written complaints may be filed with Family Policy Compliance Office (FPCO) of the U.S. Department of Education. • If FPCO finds a violation, school is notified to correct its actions. • If school still fails to comply with FERPA, Secretary can direct no further federal funding.

30. FERPA Supreme Court Case • Gonzaga University v. John Doe (June 20, 2002). • By 7-2 vote, Court ruled that students cannot sue schools that release grades and other personal information improperly. • Found that FERPA gives “no specific, individually enforceable rights.” • Leaves enforcement to Department of Education, with right to remove federal funding.

31. Recent Legislative Amendments • FERPA amendments impact privacy of records. • The Jeanne Clery Disclosure of Campus Security and Campus Crime Statistics Act. • The Gramm-Leach-Bliley Act • The Campus Sex Crime Prevention Act. • The USA Patriot Act. • The Student and Exchange Visitor Information System.

32. What Should You Do? • Maintain compliance, customer service and conflict require the financial-aid office to act responsibly. • Develop and share a student-record privacy and confidentiality statement for your office. • Provide staff training and require a signed statement or code of responsibility from all employees. • Attend FERPA conferences/training sessions. • Annually complete the NASFAA Self-Evaluation Guide on FERPA.

33. FERPA Quiz • Question #1 You receive a frantic phone call from an individual who says he is a student’s father and must get in touch with his daughter or son immediately because of an emergency. Can you tell him when and where her or his next class is today?

34. FERPA Quiz Yes, but only if it is a health and safety emergency. In a health and safety emergency, information from a student’s educational record may be released without student consent. If the situation is one in which the student’s safety may be threatened, call the Police and Public Safety. If you question whether the caller is the student’s parent or whether the situation constitutes an emergency in which information should be released, for guidance you should call the Registrar or General Counsels office for further clarification. • Answer #1

35. FERPA Quiz Question #2 A faculty member has been asked to write a letter of recommendation for a student. They would like to review the student’s academic folder before writing the letter. Can you provide the student’s academic folder?

36. FERPA Quiz Answer #2 No. Unless the student provides you with written consent, their need-to-know, as an instructor, is limited to information specifically related to their class.

37. FERPA Quiz • Question #3 An unauthorized person retrieves information from a computer screen that you left unattended. Under FERPA, is your institution responsible?

38. FERPA Quiz Answer #3 Yes. The medium in which the information is held is unimportant. Information on a computer screen should be treated the same as printed reports. No information should be left accessible or unattended.

39. FERPA Quiz Question #4 A local bookstore asks for a list of students with names and local addresses so they can mail them cost-saving coupons. Can you give them a list of the students in your academic unit or in a specific class?

40. FERPA Quiz • Answer #4 No. Remember, nearly (I have not heard of an exception) every educational institution has a policy prohibiting the release of names and addresses for commercial purposes.

41. Web Resources • FERPA http://www.ed.gov/offices/OM/fpco/ferpa/index.html • FERPA exceptionsafter 9/11http://ifap.ed.gov/eannouncements/attachments/0412FERPA.pdf • Gramm-Leach-Bliley • http://www.ftc.gov/privacy/glbact/glboutline.pdf • http://www.ftc.gov/privacy/privacyinitiatives/glbact.html

42. Questions? Comments?Thank You For Attending!