Understanding and Complying with FERPA

1. Understanding and Complying with FERPA A Comprehensive Guide for Faculty & Staff: The Institute of World Politics Issued by the Office of the Registrar Last updated May 15, 2013

2. What is FERPA? It stands for the Family Educational Rights an The Family Educational Rights Act of 1974, as amended, sets forth requirements regarding the privacy of student records. It is also known as the Buckley Amendment.

3. Family Educational Rights and Privacy Act of 1974 “A federal law designed to protect the privacy of education records, to establish the right of students to inspect and review their education records, and to provide guidelines for the correction of inaccurate and misleading data through informal and formal hearings.” FERPA applies to any educational agency or institution that receives funds under a program administered by the U.S. Department of Education. IWP receives these funds in the form of federal financial aid disbursed to students.

4. Why Comply with FERPA? It’s the Law. Failure to comply could result in the withholding of Federal Funds, including Student Financial Aid. Lawsuits caused by violations cost time and $$$.

5. Family Educational Rights and Privacy Act of 1974 This act is enforced by the Family Policy Compliance Office, U.S. Department of Education, Washington, DC. The Family Policy Compliance Office is the office within the Department of Education that administers FERPA and is responsible for providing technical assistance regarding FERPA to educational institutions.

6. FERPA is applicable to both K-12 and higher education. The Family Compliance Office is responsible for both levels of education. The primary difference between the two level is that at the K-12 level the rights belong to the parents. Once a person attends an institution of higher education, the rights transfer from the parents to the student regardless of the age of the student.

7. Key Terms Student Education Record School Officials Personally Identifiable Directory Information

8. The Essence of the Act College students must be permitted to inspect their own education records. School officials may not disclose personallyidentifiable information about students nor permit inspection of their records without their written permission, unless such action is covered by certain exceptions permitted by the Act.

9. Who is and is not covered under FERPA? Students who are or have been in attendance at a postsecondary institution are covered under FERPA. FERPA protects the education records of any student who ever enrolled (began a course) at IWP. Applicants who are denied admission or who never attend are not covered under FERPA.

10. Check your Understanding Whose record is confidential and protected by FERPA? A current IWP student An alum who got an IWP degree 10 years ago A community member who took a non-credit course at IWP a couple of years ago just for fun A prospective student who applied to a degree program but has never taken classes at IWP Santa Clause

11. Check your Understanding Whose record is confidential and protected by FERPA? A current IWP student An alum who got an IWP degree 10 years ago A community member who took a non-credit course at IWP a couple of years ago just for fun A prospective student who applied to a degree program but has never taken classes at IWP Santa Clause Answers (a), (b), and (c) are correct. FERPA applies to anyone who has ever taken at class at IWP, even if it was a long time ago or audited a class and did not received credit. Answers (d) and (e) are incorrect because the applicant and Santa have never taken a class at IWP.

12. When do FERPA rights begin and end for a student? Rights begin when the student is “in attendance” as defined by the institution. For IWP this means a student is officially registered for at least one class and that class has started. FERPA rights continue after the student leaves the institution and are only terminated upon death of the student.

13. Student (and former student) Rights under FERPA To inspect their education records. To request an amendment to their record and a hearing if the request is for amendment is unsatisfactory.

14. Student (and former student) Rights under FERPA (Cont.) To file a complaint with The U.S. Dept. of Education if they feel their rights are being violated. To expect that their education records are kept confidential except where special provisions are made. To suppress the disclosure of directory information.

15. What are Education Records? All records that directly relate to a student and are maintained by an institution. These records can be in any media form: handwritten, print, type, film, electronic, microfiche, etc.

16. What information might need to be handled in a secure way? Any personally identifiable piece of information,other than strictly directory information. Items such as those listed below fall into this category. Registration forms Transcripts Student information displayed on a computer screen Grades Student schedules Class assignments Class Rosters Any paper with the student’s SSN on it.

17. What are not considered to be Education Records: Personal Notes – kept by a faculty/staff member if kept in the sole possession of the one who made the record (sole possession record). - Personal Notes taken in conjunction with any other person are not sole possession notes. - Sharing personal notes with another person or placing them in an area where they can be viewed by others makes them “educational records”.

18. What are not considered to be Education Records: Law Enforcement Unit Records – maintained solely for law enforcement purposes & revealed only to law enforcement agencies. IWP does not have a campus police unit, so this does not apply to the Institute. Employment Records – of those whose employment is not contingent upon being a student. Records created as a result of being a student (work study, graduate assistant, etc.) are education records. Medical Records - created by a health care professional used only for the medical/health treatment of the student. IWP does not have a student health office, so this does not apply to the Institute. Alumni Records - created after student has left the institution.

19. Check your Understanding Which of the following is an education record? Email about a student sent from and advisor to financial aid A student’s scheduled displayed on a computer monitor A class list showing student names and addresses A student’s grades The Schedule of Courses that is posted on the IWP website each term A student’s phone number, which he has written down and handed to a classmate

20. Check your Understanding Which of the following is an education record? Email about a student sent from and advisor to financial aid A student’s scheduled displayed on a computer monitor A class list showing student names and addresses A student’s grades The Schedule of Courses that is posted on the IWP website each term A student’s phone number, which he has written down and handed to a classmate Answers (a), (b), (c), and (d) are correct. These are records directly related to students and maintained by the Institute. Answer (e) is incorrect because the Schedule of Courses does not contain information about specific students. Answer (f) is incorrect because the record was neither created or maintained by the Institute.

21. Check your Understanding Which of the following is a sole possession record? A sticky note with a student’s name, phone number, and a concern they asked you about, placed by your phone in your private office. A sticky note with a student’s name, phone, number, and a concern they asked you about, placed in an advising file that is accessible to several people An email from an instructor to the faculty chair about a student Notes about comments made by specific students during a class discussion, stored on an instructor’s personal laptop A grade improvement “action plan”, co-created by an instructor and a student

22. Check your Understanding Which of the following is a sole possession record? A sticky note with a student’s name, phone number, and a concern they asked you about, placed by your phone in your private office. A sticky note with a student’s name, phone, number, and a concern they asked you about, placed in an advising file that is accessible to several people An email from an instructor to the faculty chair about a student Notes about comments made by specific students during a class discussion, stored on an instructor’s personal laptop A grade improvement “action plan”, co-created by an instructor and a student Answers (a) and (d) are correct, assuming these records will not be shared with anyone else. Answers (b) and (c) are incorrect because the notes can be read by more than one person. Answer (e) is incorrect because the record was created in cooperation with another person.

23. What information can be released? Directory Information. Information that the student has given written consent to release. Information needed by IWP officials who have a “legitimate educational interest”. Information needed by certain government agencies.

24. What is “directory information”? It is information that can be released without the student’s written consent. Each college/university, to some extent, can determine what information is classified as directory information.

25. Directory Information at IWP includes: Name IWP E-mail Address Enrollment status (full-time, part-time, or less than part-time) Dates of attendance Degrees and certificates received including date awarded

26. More About Directory Information:“May” not “Must” You may release directory information, but FERPA does not require institutions to disclose information from the education record to any party except the student. IWP reserves the right to refuse to release directory information to any person or entity, other than the student, at any time. IWP does NOT release lists of directory information to any person or agency making unsolicited requests. Any school official who has concerns about a release for directory information should decline to provide the information and consult with the Registrar’s Office.

27. Check your Understanding You get a phone call from a woman asking for a student’s address and phone number. When you explain that you cannot give out that information, she says, “Well, give me whatever information you can.” You should: Give her all of the (non-restricted) directory information you have about the student. Ask her what specific information she needs and why. Refer her to the Registrar’s Office. Tell her that we reserve the right to refuse to give information to anyone and hang up.

28. Check your Understanding You get a phone call from a woman asking for a student’s address and phone number. When you explain that you cannot give out that information, she says, “Well, give me whatever information you can.” You should: Give her all of the (non-restricted) directory information you have about the student. Ask her what specific information she needs and why. Refer her to the Registrar’s Office. Tell her that we reserve the right to refuse to give information to anyone and hang up. Answer (c) is correct. We may release directory information but we are never required to. If a request sets off your “spidey sense”, refer the caller to the Registrar’s Office.

29. Student’s Right to Privacy Students have the right under the law of FERPA to request that their directory information not be released. To do so, students need to submit a request in writing to withhold disclosure of directory information Non-disclosure will remain applicable until the student submits a written request specifying otherwise

30. Who can access Student Information without obtaining written consent? IWP faculty, staff, and other designated officials, who, to carry out their responsibilities, have a legitimate educational interest.

31. A Designated University official is a person employed by the Institute in an administrative, supervisory, academic, research, or support staff position. Also considered IWP officials are persons or companies with whom the Institute has contracted (such as an attorney, auditor, or collection agent), temporary employees, student workers, and graduate assistants employed by the university.

32. Legitimate educational interest is defined as the need to know in order to: • Perform an administrative task outlined in persons official job duties • Perform a supervisory or instructional task directly related to the student’s education • Perform a service or benefit for the student such as health care, job placement, financial aid, etc. • Note: A professor’s desire to know how a student has performed in previous IWP courses (viewing student transcripts) – as a way to gauge if the student is prepared for his/her course is NOT “legitimate educational interest”. This can lead to biased grading, and is a violation of FERPA!

33. Check your Understanding Which of the following constitutes legitimate educational interest? A staff member heard that a student is ill and wants to mail her a card. He looks up her address in the student information system. An instructor emails the Dean with concerns about a student. An instructor with concerns about a student’s writing ability shares those concerns with the student’s advisor. An instructor with concerns about a student’s writing ability asks the student’s advisor how the student is doing in his other classes. The Alumni Office wants contact information so they can invite certain graduates to speak at an alumni event. An instructor conducting research for her doctoral dissertation wants contact information for students who have taken her classes in the past.

34. Check your Understanding Which of the following constitutes legitimate educational interest? A staff member heard that a student is ill and wants to mail her a card. He looks up her address in the student information system. An instructor emails the Dean with concerns about a student. An instructor with concerns about a student’s writing ability shares those concerns with the student’s advisor. An instructor with concerns about a student’s writing ability asks the student’s advisor how the student is doing in his other classes. The Alumni Office wants contact information so they can invite certain graduates to speak at an alumni event. An instructor conducting research for her doctoral dissertation wants contact information for students who have taken her classes in the past. Answers (b), (c), and (e) are correct. Answers (a) and (f) are incorrect because the information is not needed for the employees to do their jobs at IWP. Answer (d) is incorrect because the instructor has legitimate educational interest only in his own class.

35. Who else can access Student Information without obtaining prior written consent? The individual student Whomever the student authorizes by providing the institution with a written release (release must be written, signed and dated and must specify the records to be disclosed and the identity of the recipient) Any party requesting directory information (unless the student has requested non-disclosure) IWP officials of who have a legitimate educational interest

36. Who else can access Student Information without obtaining prior written consent? • Parents if parents claim the student as a dependent for tax purposes. IWP will exercise this option only on the condition that evidence of such dependency is furnished to the Office of the Registrar and all requests for disclosures are referred to that office • Persons in connection with a health or safety emergency

37. Parents’ Rights Parents may obtain directory information. Parents may obtain non-directory information by obtaining a signed consent from their child.

38. Releasing Information : To Colleagues Share student information with other school officials: Only if they have legitimate educational interest in that specific information. By phone only if you are sure who you are talking to. By email only to a colleague’s iwp.edu address CAUTION: Keep in mind that email is vulnerable to accidental misdirection by the sender and can be unsecure. Therefore, sensitive student information like grades should never be emailed.

39. Releasing Information : To the Student Share protected information with students: Online behind a secure login (via Web-portal—WebAdvisor) In person (with a photo ID if the student is unknown to you) On paper, mailed to the address on file in our student information system. NOTE: Mailing to another address or faxing to any fax number requires signed permission of the student. Contact the Registrar’s Office for more information. REMEMBER: Security is an issue only for FERPA protected information. You can release general information about assignments or policies in any medium!

40. Releasing Information : To the Student (Other Methods) By phone, only after using “reasonable methods” to authenticate identity - Recognize their voice - Ask three questions that only the student is likely to know CAUTION: The law expressly prohibits asking SSN or DOB to authenticate identity because confirming a correct guess can provide information to identity thieves. Be very careful with this—you can do it, BUT it is not recommended. By email, only to the email address listed in our student information system/Web portal CAUTION: Keep in mind that misdirected emails, shared email accounts, and computer hackers can all comprise the confidentiality of information sent by email, therefore NEVER email grades, GPA, or other sensitive information.

41. Check your Understanding A student wants to discuss his progress in your class. Which of the following are acceptable ways to discuss the information with him? In person after class On the phone at a time arranged during class In response to an unplanned phone call as long as you can authenticate that you are talking to the student To an email address that does not match the one in the student information system Web-portal

42. Check your Understanding A student wants to discuss his progress in your class. Which of the following are acceptable ways to discuss the information with him? In person after class On the phone at a time arranged during class In response to an unplanned phone call as long as you can authenticate that you are talking to the student To an email address that does not match the one in the student information system Web-portal Answers (a), (b), and (c) are correct. Answer (e) is incorrect because you have no way to know if it was really the student who emailed and who will receive the answer.

43. Releasing Information : To a 3rd Party At the request of the student (e.g., to an employer or spouse): release information only with written consent of the student. Contact the Registrar’s Office for more information. At the request of a 3rd party: DO NOT release confidential (FERPA protected/non-directory) student information. Contact the Registrar’s Office for assistance.

44. Check your Understanding A uniformed police officer approaches your desk and indicates that a student is needed for immediate questioning. The officer asks you to look up the student’s schedule and tell him where the student can be located. You should: Tell the officer to get lost. Call the student’s advisor or the student affairs office—they’ll probably know where the student is. Mention that you saw the student going into Bentley Hall an hour ago. Call the Registrar’s Office.

45. Check your Understanding A uniformed police officer approaches your desk and indicates that a student is needed for immediate questioning. The officer asks you to look up the student’s schedule and tell him where the student can be located. You should: Tell the officer to get lost. Call the student’s advisor or the student affairs office—they’ll probably know where the student is. Mention that you saw the student going into Bentley Hall an hour ago. Call the Registrar’s Office. Answer (d) is correct. There are no FERPA emergencies, and FERPA does not include exceptions for law enforcement officers. Our responsibility is to the student. If the Registrar’s Office is unavailable, give him/her the phone number of that office to contact at a later time.

46. TAKE NOTE: Access to student information via computer software does not authorize unrestricted use of that information. Curiosity is not a valid reason to view student information. Records should only be accessed in the context of official business.

47. MORE Important Info: When in doubt – don’t give it out. Refer all requests for student academic information to the Office of the Registrar. Information about a student can be released with a signed consent from the student. Information on a computer should be treated with the same confidentiality as a paper copy. Do not leave confidential information displayed on an unattended computer.

48. More, more important info: Cover or put away papers that contain confidential information if you are going to step away from your desk. Supervisors: You are responsible for the FERPA compliance of those you supervise. This includes student workers, temporary employees, interns, and volunteers. They are also required to view the FERPA presentation and sign a FERPA agreement.

49. Record Disposal Records containing Social Security Numbers or grades should be shredded, not just thrown in the garbage or placed in an unsecured recycling bin.

50. Helpful Hints for Faculty Use the SSN/Student ID to post grades. Leave graded tests in a stack for students to sort through. Circulate a printed class list with the Student Name and SSN/Student ID. To Avoid FERPA Violations – Please Do Not: