FERPA BASICS: Family Educational Rights and Privacy Act of 1974, as Amended (FERPA)

1. FERPA BASICS: Family Educational Rights and Privacy Act of 1974, as Amended (FERPA) Shannon Williams Associate Registrar

2. Responsibilities of UT Arlington and Its Faculty and Staff • UT Arlington is responsible for insuring that all of its employees comply with Family Educational Rights and Privacy Act of 1974, or FERPA. • Each employee of UT Arlington and all agents acting on the University’s behalf are expected to be familiar with FERPA as it applies to their work, or to seek clarification if needed.

3. Where to Get FERPA Information at UT Arlington • The Office of Admissions, Records and Registration (ARR) serves as the primary contact office for responding to FERPA questions and training needs for the campus. • ARR is also responsible for the annual notification of FERPA policies and procedures to the campus community and maintenance of a FERPA website. • Specific contact details later in program.

4. Why Is FERPA Important to UT Arlington? • It is federal law. • The Department of Education may issue a notice to cease non-compliance. • Universities that do not comply with FERPA may ultimately lose federal funding for programs administered by the Secretary of Education. (Tier I stuff!) • Faculty research grants • Financial aid, scholarships and grants • Graduate fellowships • Education grants

5. What is FERPA? • The Family Educational Rights and Privacy Act of 1974, also known as the Buckley Amendment, is a federal law designed to protect the privacy of student education records. • FERPA requires that schools obtain written permission from students before releasing educational records, and provides standards for appropriately using education records. • In certain well-defined circumstances, some information may be released without the student’s written permission.

6. The Essence of FERPA: Privacy Standards • Privacy Standards: • Students must be permitted to inspect and review their educational records • School officials may not disclose personally identifiable information from a student’s education record without authorization • Institutions are responsible for insuring that all of its school officials comply with FERPA

7. Who Has FERPA Rights at the Postsecondary Level? • FERPA rights belong to the student regardless of age. • A student is a person who has been admitted and is or was enrolled. This applies to all students: enrolled, former, distance education, and students auditing a class.

8. What FERPA Rights are Given to a Student? • Right to inspect and review their education records within 45 days of the request • Right to request to amend their education records • Right to limit disclosure of personally identifiable information • Right to file a complaint with the Department of Education concerning an alleged failure by the institution to comply with FERPA

9. How Long Do Students’ Right Remain in Place? • FERPA does not specify a time limit for maintenance of records, but as long as the record is maintained, FERPA rights continue to apply to the record. • UT Arlington’s records retention policy: http://www.uta.edu/policy/rim

10. What are UTA Employee’s Rights and Responsibilities Related to FERPA? • Education records may be released to school officials with a “legitimate educational interest” without the student’s permission. • However, administrators, faculty, staff or anyone else with this access may not improperly disclose that information

11. Requirement for Rights of Access • Amended FERPA regulation 99.31(a)(1)(ii) requires schools to use “reasonable methods to ensure an official is given access to only those education records in which s/he has a legitimate educational interest. • UT Arlington uses role-based security as the means by which its staff and faculty can access needed data from student records in MyMav.

12. Requirement to Authenticate Identity • Amended FERPA regulation 99.31C, requires schools, before disclosing educational records, use a reasonable method to identify and authenticate the identity of • Students • Parents • School officials • Any other parties

13. What FERPA Rights are Given to a Parent? • A parent has no inherent rights of access to his/her student’s records. • When the student turns 18 or begins attending an institution of higher education, FERPA rights transfer to the student. At UT Arlington, a student is defined as a person who has been admitted and is or was enrolled. • A student may choose to allow his parents access to his records through either a release form available in the Office of Admissions, Records and Registration, or through an individual family arrangement. Release form: http://wweb.uta.edu/ses/recordsandregistration/assets/pdf/student_release_of_info.pdf • Ifs, ands and buts discussed later in program.

14. Annual Notification of Privacy Practices • FERPArequires that the institution provide an annual notification to students of their FERPA rights, and provide students access to their education record. • The Office of Admissions, Records and Registration sends an annual notification to its enrolled students during the first week of classes in the Fall term. • A FERPA website is available to faculty, staff and students at all times. http://wweb.uta.edu/ses/recordsandregistration/content/general_information/ferpa.aspx

15. What are Education Records under FERPA? • Education records are defined as records that are directly related to the student and are maintained by an educational agency or institution, if certain conditions are met. • At UT Arlington, an education record is defined as any information recorded in any way, including but not limited to handwriting, print, tape, film, microfilm, microfiche, and digital image.

16. Typical Examples of Education Records under FERPA • Registration forms • Grades • Class assignments • Any paper with the student’s ID on it • Transcripts • Student schedules • Class rosters • Student information displayed on your computer screen

17. Best Practice for Guarding Student Data • Turn off the screen (or turn away from the screen) while talking to a parent or anyone other than the student to whom you should not disclose information from the student’s record or personally-identifiable information about the student.

18. Education Records Do NOT Include: • Education records are NOT: • Private/personal notes written by individual faculty or staff and kept in the “sole possession” of the one who made the record • Campus police records • Employment records • Alumni records • Medical treatment records • However, when released or shared for accommodations, these records become education records and therefore subject to all FERPA protections • Aggregate statistical records that contain no personally-identifiable information about any student • These records are not subject to the rights of inspection, request for amendment and limitation on disclosure.

19. Education Records Which a Student Does Not Have the Right to Inspect • Medical treatment records, until they are released • Law enforcement records • Employment records • Post-enrollment records • Sole possession records • Peer-graded papers • Confidential letters of recommendation if the student has waived his right of access • Financial records of the student’s parents • Admissions records for a student who does not officially attend the program of admission • Records of a student that contain information on other students • These records are not subject to the rights of inspection, request for amendment and limitation on disclosure.

20. Inspection and Amendment of Education Records • To inspect education records, a student should submit a written request identifying the records to be inspected to the UT Arlington Office of Records and Registration, attn: Associate Registrar. • Details are available at http://wweb.uta.edu/ses/recordsandregistration/content/general_information/ferpa.aspx

21. Personally-Identifiable Information vs. Directory Information in a Student Record • Personally identifiable information is any information that, alone or in combination that is linked to a specific student that would allow a reasonable person, without knowledge of the circumstances, to identify the student. • Directory information contained in an education record is information that would not generally be considered harmful or an invasion of privacy if disclosed. It is not treated as confidential and may be disclosed by the University without student consent unless the student has requested confidentiality.

22. FERPA Directory Information at UT Arlington • Name • Address • Phone Number • E-mail Address • Date of birth • Major field of study • Participation in recognized activities and sports • Height and weight of athletes • Dates of attendance • Degrees and awards received • Most recent previous educational institution attended

23. Withholding Release of FERPA Directory Information • Students may set their FERPA privacy settings in MyMav to indicate that their directory information be withheld or released. • The default setting to release records, so students wishing to withhold directory information must take action. • Navigation in MyMav: • In the student center, click on User Preferences •  Click on FERPA Restrictions • Click on the green button “Edit FERPA/Directory Restrictions” • Choose “Restrict All Fields” or “Release all Restrictions,” then scroll to the bottom of that page and click SAVE • Click the button “Release all Restrictions” (upper right corner), then scroll to the bottom of that page and click SAVE

24. Withholding FERPA Directory Information at UTA: All or Nothing • Currently, when a student chooses to restrict release of any aspect of his/her directory information, none of the student record will be released to any external source.

25. Student Identification • If a student withholds directory information, his/her name must not appear on active websites, deans’ lists, official sites with photos, or the like. • Service Indicator:

26. Impact of Withholding Release • Students who request restrictions to their record will not be included in the following: • Commencement program • Microsoft-hosted Student Email system (address book that allows student-to-student access) • UT Arlington web site “Find People” • UT Arlington printed Campus Directory “Maverick Connection” • Requests from external entities seeking directory information on UTA students whose requests are approved by the custodian of records for UT Arlington • However, restriction will not impact participation in Mav Alert

27. Student Identification and Communication in Classroom • However, a student’s restricting release does not prevent faculty in a classroom from identifying the student by name or from disclosing the EID or email address in the classroom. Student’s rights do not include the right to be anonymous in the classroom or to impede routine classroom communication and interactions. • Previously, FERPA did not address whether opting out from directory information also applied within the classroom in disclosure of the student’s name or electronic identifier. • Amended regulation 99.37 (c): an opt-out or “do not release” privacy setting does not prevent a school from identifying a student by name or from disclosing the EID or email address in the classroom.

28. Caution to Academic Departments Regarding Student Identification and Communication in Classroom • While students cannot elect to be anonymous in the classroom, the Family Policy Compliance Office (FPCO) states it is increasingly important to communicate in course descriptions, syllabi, catalogs, etc., when there’s an expectation of shared information, such as email addresses and papers or documents • Best practices for Blackboard, discussion boards, guest lecturers, etc., are being explored

29. Disclosure Status Remains in Effect Until Changed • Any restriction a student makes in his MyMav record will remain in effect until s/he revokes it. • UT Arlington allows former students to make changes to the disclosure status in effect at the time of their last term of attendance. • FERPA rights cease upon death. However, it is UTA policy that no records of deceased students be released for a period of 25 years after the date of the student’s death, unless specifically authorized by the executor of the deceased’s estate or next of kin.

30. Social Security Numbers and FERPA • Amended FERPA regulations specifically prohibit designation of social security numbers as directory information or for authentication purposes. • This includes any part of the SSN. • Don’t even use the last 4!

31. New Business Process Related to Commencement Program • Beginning Fall 2009, if a student restricts all directory information, his/her name will not be included in the commencement program. • For students graduating in Spring 2011 and thereafter, we have turned on functionality that will allow the student to release his/her name only for the Commencement Program but otherwise maintain the “do not release” privacy setting.

32. Screenshot: Inclusion in the Commencement Program with DO NOT RELEASE Privacy Setting

33. Disclosure of Personally Identifiable Information Without Student Consent • The University of Texas at Arlington will disclose information from a student’s education record without the written consent of the student to: • The student • Anyone, in response to requests for directory information when the student has not indicated not to release his personally-identifiable information

34. Disclosure of Personally Identifiable Information Without Student Consent to University Personnel • To appropriate University administrators, faculty members, staff members and outside service providers, such as contractors and consultants, who require access to education records in order to perform their legitimate educational duties.  • This includes student workers who at any time may access student records as a part of their duties.  • UT Arlington restricts and tracks access to education records to enforce the “legitimate education interests” requirement in this exception.

35. Disclosure of Personally Identifiable Information Without Student Consent to Parents • A parent may access the student’s record if the student is claimed as a dependent for federal income tax purpose • However, medical and treatment records, which are governed by FERPA, are also subject to more stringent state regulations that prohibit parents from access to those treatment records if the student is 18 or older. • This exception is under review at UT Arlington; please verify with the Office of Admissions, Records and Registration before advising a parent of it) • Parents may be notified by the institution in the event of a health or safety emergency and the institution believes the student presents a serious danger to himself or others. • Parents may be notified by the institution if their student (under 21) is found to have violated the alcohol or drug policy of the institution

36. Disclosures of Personally Identifiable Information Without Student Consent • In connection with a student's application for, establishing eligibility or conditions for, or receipt of financial aid.  UT Arlington contracts with the National Student Clearinghouse to provide enrollment and degree data to lenders and guarantors.  • To officials of other schools in which the student seeks or intends to enroll, upon request • Agents acting on behalf of the institution (contractors, etc.) • Example: Credentials, Inc.: third-party partner for transcript production

37. Disclosures of Personally Identifiable Information Without Student Consent • Anyone requesting the final results of a disciplinary hearing against an alleged perpetrator who has been found in violation of the campus code relating to a crime of violence or non-forcible sex offense • Anyone, when the disclosure concerns information provided by sex offenders required to register under state or federal law • An alleged victim of a crime of violence when the disclosure is the result of a disciplinary hearing regarding the alleged perpetrator of that crime with respect to that crime

38. Disclosures of Personally Identifiable Information Without Student Consent • Appropriate parties, such as law enforcement or the student’s parents, if a health or safety emergency exists, and the institution believes the student presents a serious danger to himself or others. • Golden Rule in making this decision: Will this information assist in resolving the emergency? • Authorized representatives of the Comptroller General, Secretary of Education, US Attorney General or state and local educational authorities if the disclosure is in connection with an audit or evaluation of federal or state supported education programs

39. Reverse Articulation • As a benefit to its graduates, UT Arlington provides complimentary transcripts to Dallas County Community College District and Tarrant County College District • Student must have earned 16 or more for-credit hours at that institution • Permission to send the transcript back to the community college is part of the Application for Graduation. • The community college notifies these students that they should apply for conferral of their associate degree. • Permission has until now been on UTA’s graduation application. Beginning with students applying for Fall 2011 and beyond, permission will also be on Apply Texas application.

40. Reverse Articulation Tarrant County College Outcomes to Date

41. Next Steps • Combined release form in place by Orientation for Records and Bursar Office forms in time for Summer Orientation • Additional FERPA information as part of compliance modules • Continued implementation of revised amendments where applicable • Challenges of technology --- Blackboard a good example

42. Contacts for FERPA Policies and Procedures • Office of Admissions, Records and Registration, UTA Box 19088, Arlington, TX  76019 • Shannon Williams, Associate Registrar; direct 817/272-6105; swilliams@uta.edu • http://wweb.uta.edu/ses/recordsandregistration/content/general_information/ferpa.aspx • Federal Enforcement Agency Family Policy Compliance Office, US Department of Education, Washington, DC