CSI FERPA III: “Return of Privacy” PACRAO 2008 John Snodgrass Chapman University

1. CSI FERPA III:“Return of Privacy” PACRAO 2008John SnodgrassChapman University

2. Collecting the Evidence, , , • Educational Record: covered by FERPA? • Student: does FERPA apply? • Access: signature required? copy required? Immediate? • Must vs May: do I have to? • School Official: provide service for us? • Need to Know: job related? • Dependent: release to parents? Without signature? • Directory Information: Is it listed in the annual notification? Hold in place? How would I know? • Institutional policy & procedures • Other Options:

3. Let’s Try One For Practice

4. Watch Out for the Rotors Hailey Kopptur, mother of incoming new fall admit Candy Seid, has asked for a meeting in August with the advising and student services staff prior to new student orientation to go over certain issues, including Candy’s medical history, allergies, disability information, dietary information, high school records and recommendations – whatever records might be on file. Knowing that the FERPA training is scheduled the day after the meeting, Dean of Students Annie Thingoes isn’t certain what information can be shared. She responds to the mother that according to FERPA guidelines a student release would be required. Is that true? • And what if the meeting was scheduled for the 2nd week of the semester?

5. Response: • The institutional definition of student • If the institutional definition of “student” became applicable after the August date, e.g. the first day of class, then FERPA does not apply and the institution can do whatever it pleases re: providing either the parent or the student access to the educational record. It is recommended however that schools follow FERPA guidelines in such cases. If on the other hand the school definition of “student” came into effect prior to the July date, then FERPA does apply. Likewise, with the second week being after the start of the semester, then FERPA does apply. • The institutional policy re: releasing information to parents of dependent students • Assuming FERPA is in effect, if the institution follows a policy of releasing information to parents of dependent students, then the release could be done to the parent in one of two ways: 1) a student signed release, or 2)proof of dependency either via providing to the school a copy of the most recent tax return in which the student is claimed as a dependent, or a student verification that they are dependent. If on the other hand the institution does not release information to parents of dependent students, then there is only one method of release: signed approval by the student.

6. It’s Your Turn

7. Collecting the Evidence, , , • Educational Record: covered by FERPA? • Student: does FERPA apply? • Access: signature required? copy required? Immediate? • Must vs May: do I have to? • School Official: provide service for us? • Need to Know: job related? • Dependent: release to parents? Without signature? • Directory Information: Is it listed in the annual notification? Hold in place? How would I know? • Institutional policy & procedures • Other Options:

8. 1. A Complete History Ann Grie has applied for an internship with Letzjus/Ghettalawng, an agency specializing in conflict resolution. L&G have been a placement site for IOU interns for several years. Following standard procedure, the agency has requested any pertinent information from the Career Development Office regarding Ann’s candidacy. Unfortunately, Ann has a long history of disciplinary issues and violations of the Student Conduct Code. Along with academic information the CDO informed the company of the student’s behavioral problems. Ann didn’t get the internship. “Foul!!!” said Ann. “I didn’t say you could provide that information”. A complaint was filed with the FERPA Compliance Office. Do we have a problem?

9. Response Key Issue: School Official No, there is not a problem if the agency has been defined as a “school official” and so indicated in the annual notification. If so, then the agency may have access to educational records based upon the need to know criteria. Would disciplinary information be valuable for the agency related to it’s responsibilities to the institution? I should think so.

10. 2. He Was Dismissed? oops Like clockwork, each fall IOU’S top level administrator’s thoughts turn to retention. This year, the idea is to contact parents and ask them how their student’s experience went, and why the student left (hopefully the list excludes students suspended). All surveys are by phone; saves on mailing costs. Hmmm you think, now just what FERPA problems might this create? (It’s after the student is gone, so does that change anything?)

11. Response Key Issues: Alumni Records Alumni records are records received after the student leaves the institution that do not pertain to the student’s enrollment or records created while enrolled. Such records are not educational records (unless they were educational records received from another institution). Unless the BLEACC callers are speaking to parents of dependent students -- and not dependent at the time they attended, but dependent now, (which you most likely don't know) then IOU could not release any of the student's educational record information without the student's signature of release, other than directory information if no holds are in place. So if that were the case and BLEACC doesn't have the releases, then the questions would have to be general in nature and not pertain to the student's educational records. An example would be: Acceptable: "based upon what you know, what is your perception of advising services?" Unacceptable: "based upon your student's being on academic probation, what is your perception of advising services?" And of course parents being parents they will endeavor to take the conversation into educational records.

12. 3. What a Great Student!!! Thinking it would be great to let the entire library know about the great intern who is working this semester, the director decided to put an article in the weekly newsletter that was distributed throughout the university and on the website. The article was very complimentary, including the following text: “Sue Purr is an outstanding IOU student, coming from Wasilla, Alaska. She is a junior journalism major, an honor student with a 3.76 gpa, captain of the basketball team, dates Joe Sixpack and wants to go into politics or be a soccer mom after she completes her degree. Please stop by and welcome her!!” Surprise!! Sue has filed a complaint with the Compliance Office, stating that she has a directory hold, and did not approve any release of information, and will be a pit bull with lipstick until it is fixed. Do we have a problem?

13. Response Key Issue: Redisclosure Yes, most likely there is a problem. If the agency is defined as a “school official” then it is equally responsible for managing educational records and re-release of those records as is the providing institution. Even if the institution has Directory Information, gpa can’t be part of Directory information; likewise any hold requests would need to be honored. Of course if the student has signed a release, then all is fine.

14. 4. “The Mature One’s Are Always Trouble!” IOU’S faculty have made a request to the registrar to include the date/year of birth on instructor roll sheets; seems they would like to respond “someone your age should know better!” to stupid answers, along with other needs they have expressed. They have promised not to disclose the information to any third parties; and no, birth date is not part of BLEACC’S directory information. What say you?

15. Response Key Issue: Need To Know The issue is not whether instructors do not disclose information such as the date/year of birth, but rather do instructors have a “need to know” to have that information included on the roll sheets?  Section 99.31 of the FERPA regulations say that an institution MAY release educational record information to school officials so long as the information is necessary for the school official (in this case instructors) to perform their responsibilities. So, do faculty need to have students birth date information on their rosters in order for them to perform their course responsibilities?  Assuming that student ID numbers and names are on the roster, BLEACC might have a hard time convincing the FERPA Compliance Office that birth date was necessary on a class roster – and in fact may be perceived by students as discriminatory and unnecessary.  If on the other hand faculty do indeed need this information in order to carry out their course responsibilities, then BLEACC would need to be prepared to articulate that if a challenge should arise.

16. 5. Dad is Hovering, , , Professor Tellie Liketis is sitting in her office in January, one day after grades were released to students via their online access. She receives a phone call from a “Concerned” Dad (a well known local banker and school donor) who questions the grade his son received in “Why Are You Here”, taught by Professor Liketis. Seems the son failed the course. Based upon the less than candid feedback provided by the son, Dad is convinced there must either be a calculation error or the instructor has obviously graded capriciously – and Dad wants to know the answer. Tellie, after reviewing her grade book and the student’s final –all which confirms what she already knows -- proceeds to share those results with the Dad. “OUCH!!” The Dean exclaims when later informed of the conversation (and just having attended one of John’s workshops). “You can’t release that information without the student’s permission!” Had the Dean paid attention in the workshop???

17. Response • The key component of this issue is: • The institutional policy re: releasing information to parents of dependent students • Assuming FERPA is in effect, if the institution follows a policy of releasing information to parents of dependent students, then the release could be done to the parent in one of two ways: a student signed release, or proof of dependency via providing to the school a copy of the most recent tax return, in which the student is claimed as a dependent. If on the other hand the institution does not release information to parents of dependent students, then there is only one method of release: signed approval by the student.

18. 6. Although Poor, Still A Fine Student IOU has an Honors Luncheon (catered for a nominal fee by the President’s wife, who has a small deli in town) during which they describe various scholarship requirements (gap, need based, region, talent, etc) and Honors organizations (service based, etc), and list the names of the recipients/members – and a lengthy list it is. Tye T. “Bud” Jett, one of the need-based scholarship recipients, asked the President how the program had his name listed, since he had a directory hold. “Directory Holds are only for external releases, not internal ceremonies” the President replied as he enjoyed another slice of baked salmon, soon to become a rarity. Does the President have a good understanding of FERPA? Are there any other issues?

19. Response Key Issue: Directory Information. Directory Information is not limited to external releases; “Directory Information” is defined as information not generally considered harmful or an invasion of privacy if disclosed. If the attendees did not meet any of the other 99.31 exceptions, then the only option to release without the student’s signature would be “Directory Information.” Institutions must list what their directory information is –typically in the annual notification—and the list may include, but is not limited to such things as name, student addresses, etc. One of the listing options is “degrees & awards received” which may give an initial impression the release described could be done; however the Compliance Office has recently said regarding Directory Information, “, , , while one of the exceptions to the prior written consent requirements in FERPA permits an institution to disclose appropriately designated “directory information,” institutions may not disclose “directory information” that is linked to non-directory information, such as information on a student’s financial aid status. “ Therefore need based scholarships would be problematic. Of course, if students have signed a release allowing the information to be printed in the program, then you are fine. If a student has filed a “Directory Hold” then that student’s name could not be listed without a signed release.

20. 7. So Secure Anyone Can Figure It Out! IOU has a terrific online system on it’s website. This system can be used by anyone who has registered for and attended a class since 1990. In order to use the system, a student must have a UserID and a PIN. The UserID can be the student ID number or it can be the student's Social Security number, either can be the UserID. By default, if a student has never logged into the system, their PIN will be their birthday in a six digit format (ex. If your birthday was today April 3, 2008 your PIN would be 040308). Once they login using their birthday, they are forced to switch their PIN to another six digit number and it cannot be their birthday. They are also forced to setup a security question in case they ever forget their new PIN. Sweet. For security purposes IOU does not have login instructions posted on the website; students must inquire in person or over the phone. Does IOU’s policy and procedures dealing with online access meet FERPA requirements?

21. Response Key Issue: “Known Only The Student” IOU’S policy and procedures do not meet FERPA requirements and would be in violation of FERPA policy. The clearest explanation can be found in the Proposed Rules section dealing with Identification and Authentication of Identity, and how institutions must use reasonable methods to identify and authenticate the identity of students and any other parties to whom it discloses educational records. The last paragraph on page 15585 states as follows: "Likewise, and educational agency or institution must ensure that it does not deliver a password, PIN, smart card, or other factor used to authenticate identity in a manner that would allow access to unauthorized recipients. For example, an agency or institution may not make education records available electronically by using a common form user name (e.g., last name and first name initial) with date of birth or SSN, or a portion of the SSN, as an initial password to be changed upon first use of the system" So your method of initial use, regardless as to how the student is informed, is in violation of FERPA, because the PIN is the birth date and could be commonly known. To be in compliance the initial PIN must be a randomly assigned indicator that is not based upon any known information and that is only available to the user.

22. 8. The 3 AM Phone Call The Dean of Students had just received a phone call from the student health center informing her that a student has been diagnosed as possibly having tuberculosis, followed by the center faxing the symptoms and diagnosis to the dean. The student recently returned from a study abroad stint, and finally was convinced by her apartment roommate to go to health services. What was the dean to do. Multiple issues immediately arise with FERPA implications: could they contact the student’s instructors and share the information? The roommate’s instructors? all other students enrolled in shared courses? parents? parents and spouses of students enrolled in shared courses? What could be released in a general campus-wide alert regarding the student? The dean’s administrative assistant pointed out that the student had a directory hold, which lead to the discussion re: in emergency situations, does the directory hold create an issue? What can they do? (and it must be done immediately!)

23. Response: Section 99.36 deals with What conditions apply to disclosure of information in health and safety emergencies, stating “(a) An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties in connections with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals” Once the dean received the symptom and diagnosis information from the student health center that information became educational records related to XXX. An easy case would be made that the release of XXX name, address, class schedule and possible contagious status to all individuals who may have been in contact would meet the conditions of 99.36; likewise the same could be said for release of YYY name and schedule – even with the directory hold, which does not supersede exceptions listed in 99.31. The Compliance Office has also consistently said that the disclosure of information to parents and other related parties falls within this section.

24. Proposed Regulations: Health or Safety Emergency Removes language requiring “strict construction” Disclosure permitted when institution, taking into account the totality of the circumstances, determines there is an articulable and significant threat to the health and safety of the student or other individuals. Disclosure permissable to any person whose knowledge of information is necessary to protect health and safety of student or others; includes release to student’s parents. Department of Ed will not substitute its judgment for that of the institution in evaluating the circumstances and making its determination.

25. 9. And How Did You Do? “Your graded lab exams are on the table at the back of the room” Professor Faye Ledemall told her Anger Management students. “Pick them up on the way out. They are in alpha order; please try not to mix them up.” As students left they picked up the exams which were neatly stacked and the grades (most of which were not very good as expected) in bold red. Faces grew grim and knuckles white as the students silently shuffled out. The following week the Dean was informed by the DOE Compliance Office that a complaint was filed against Chapman by a student regarding this practice. Why? Is there a problem?

26. Response As with other situations, the issue here is unauthorized release. If a student can see other student’s grades on papers, that is a violation if those grades have been recorded and thus maintained, and the other student has not authorized a release. The appropriate distribution is to have the papers secured in such a way that nothing other than the student’s name would be accessible by other students, e.g. folded and stapled so only the name was showing, in an envelope, or distributed by an assistant providing only to the student their own midterm. The concept is no different than posting a list of names or ID#’s or SSN’s on the wall with grades listed.

27. 10. She Said What? ? ? Student Shohmi Ehvreethng has requested access to all of his education records maintained by the Dean of Students, Advising Center, and Inside Track, the corporation IOU has contracted with for student coaching. Candy D’Libluhnt, Shohmi’s coach, has several comments about their sessions within the electronic notes software, many of which are less than flattering – but true. ‘Do we have to provide the student these records as well? Candy asks? They are confidential for my use only.” Must they release?

28. Response The institution must provide the student access to all education records identifying the student that are maintained, including those maintained by vendors, agencies, etc such as Inside Track. Inside Track records are education records under the control of the institution, therefore must be released in accordance with FERPA requirements. Are the records in question ‘sole possession’ thus not education records? No.

29. Proposed Regulation: School Officials Other School Officials Expand the school official exception to include contractors, consultants, volunteers, and other outside parties to whom an educational institution has outsourced institutional services or functions so long as --In order to be considered a “school official” an agency or institution must be able to show that a non-employee or other outside party is providing an institutional service or function that the agency or institution would otherwise use employees to perform. --The school must also show that the outside party would have “legitimate educational interest” in the information disclosed if the service were performed by employees.

30. 11. It Ain’t Really College Though! In addition to the standard college level coursework, IOU has a center that offers both high school equivalency and GED’s, both at a K-12 level. They are getting requests from the Corrections Department (as well as other folks) for information, and IOU’S legal services says that according to FERPA, if the student is under 18, they must get a parent’s release as well as the student in order to provide information. Is that true?

31. Response Key Issues: Post Secondary Institution No. When a student is in attendance at a post-secondary institution, regardless as to what coursework or level of coursework the student is taking, all rights move from the parent to the student, regardless of age.  That is contained in Section 99.5 (a), which says “When a student becomes an eligible student, the rights accorded to, and consent required of, parents under this part transfer from the parents to the student.”  Furthermore, “Eligible Student” as defined in section 99.3: “means a student who has reached 18 years of age or is attending an institution of postsecondary education”. So regarding release of educational records under FERPA regulations pertaining to post secondary institutions, unless the release without the student’s signature is specifically allowed under section 99.31, the student’s signature of release is required regardless of age. That being said, typically in order to participate in programs students sign waivers to release information as part of the application, so in such cases signed approval for release already exists; furthermore schools are not required to release information to anyone other than the student, even if a student requests such a release. So theoretically a school in such cases could say they won’t release educational record information unless they have both the student and the parent’s signature of release, although again I think a student could file a complaint to the Compliance Office stating that an institution has violated section 99.5. In any event, the institution must have the student’s release on file. That is the only required signature in the regulations.

32. 12. “I’m Still His Mama!!” Long after students have left IOU, it seems parents still land on the tarmac. While the student was enrolled the parent had access due to dependency; yet long after the student withdraws or graduates, mom & dad still want access. Is that ok? When IOU says no, the conversation gets heated, and the rotors spin fast. Must they continue to provide access? (regardless of the parent’s donor status, of course)

33. Response Key Issue: 99.31 parent of dependent students; exceptions and obligation to release The important point to remember is that even though IOU may have a policy allowing parents of dependent students access, or even if the student's signature of release is on file, FERPA specifically says that we are not required to release to anyone listed in section 99.31 other than the student; we may if we choose to. So if IOU’S policy says that after a student leaves the institution a signature of release from the student is required, that is perfectly ok. Additionally such a policy is probably appropriate, because the student's attitude could change drastically, and the parents may well have not claimed the student and are just pushing for info.

34. 13. “And Would You Bring Me A Cup of Coffee When You’re Done?” Several of IOU’s faculty are technically challenged (or pompous) and thus have their unit aides enter course grades on the electronic grading system rather than doing it themselves. Of course the unit aides have had no FERPA training; and since they do not have their own password/PIN access, the faculty give them their password to enter the grades. Are there any issues here?

35. Response: Key Issues: School official, need to know, access security. Departmental/instructor aides certainly provide a service to the institution that is necessary, thus such aides definitely would and should come under the definition of “school official”, and be identified in IOU’S annual notification.  They most likely perform a variety of necessary functions that would call for access to student educational records based upon their need to know.  If part of their responsibilities is to enter grades, then most definitely they must be considered a school official.  In saying this, then the aides are no less responsible for carrying out FERPA regulations than the faculty or you for that matter, and they definitely need to have FERPA training.   The larger concern is that by the faculty giving aides their password there becomes a much higher risk factor re: need to know and inappropriate access, because those aides automatically have access to a great deal more information than just the ability to enter grades.  Many institutions consider this a definite no no; faculty nor anyone else for that matter should be sharing user names and passwords.

36. 14. Time To Start Payin’ Those Student Loans IOU has an institutional mandate to verify graduate’s employment status should they not go on to school. They have developed a slick Verification Form students fill out authorizing the college to obtain the information, including employer name, start date, and salary. The Career Planning Office questions what FERPA issues may be involved with the maintenance & release of this Authorization form as well as the employer information should any requests arise. Are there any?

37. Response Key Issue– Alumni records In so far as what information about the student you include within your request for information from the employer, that information would be covered by FERPA regulations, since it deals with student records you have on file which were gathered while the individual was a student. If the student signs a release stating the institution can include within the request education record information necessary for the employer to identify the student, that’s fine. If there is not a signed release, then the only information the institution could include about the student would be directory information that you have designated. Whatever information the employer sends would be considered alumni records and not education records and not within FERPA regulations IF the information dealt with employment/records which occurred AFTER the student left the institution.

38. 15. Not If They’re Are On Strike IOU’S Payroll clerk is in a quandary. The employee union has organized student-employee groups. The union leadership has stated that as exclusive representative they are entitled to non-directory employment related records. The clerk always previously released the information; but having attended the PACRAO FERPA workshop and getting LeRoy Rooker’s autograph, she now has doubts. Is this a FERPA issue? Should she pay her union dues in case there is a confrontation?

39. Response Key Issues: Too Many To List. FERPA says that employment records are not considered educational records – thus FERPA does not apply – if the employment IS NOT conditional upon the employee being a student. However, if the employment is conditional upon the employee being a student, e.g. work study, then the employment records are educational records, and FERPA does apply. So with that being said, if the student-employees in question can only get their jobs because they are a student, then FERPA applies, and their signature of release would be required in order to provide non-directory information to the union.  That is said under the assumption that the union could not meet the “school official” definition – an entity providing a necessary service to the institution. “Exclusive representative” does not trump FERPA regulations. Another reasonable assumption would be that when the students join this union, they most likely sign some document as a condition of membership. If so, that would be the place for the boilerplate language stating that the student will allow the institution to provide necessary educational records, whatever those are, and signs his/her approval.  If that exists, then no other signature would be necessary.