FERPA for Faculty
What is FERPA?
FERPA stands for the Family Educational Rights and Privacy Act, which is a federal law passed in 1974 (20 U.S.C. § 1232g). It is also commonly known as the Buckley Amendment. The law protects the privacy of student educational records and provides rights to students for access to and amendment of those records. FERPA applies to any higher education institutions receiving federal funds administered by the Department of Education (DOE).
Who is protected under FERPA?
The rights under FERPA apply primarily to eligible students. A student is an individual who is or has been in attendance at the University. Rights under FERPA at the University are exercised by the student even if under 18 years of age, whereas in the elementary and secondary schools they are exercised by the parent until the student turns 18. Sometimes parents do not understand this distinction.
Applicants are not technically students covered under FERPA, but since they may attend the institution, NDSU treats their applications confidentially. The records of deceased students cease to become educational records under FERPA, but the University typically keeps those records confidential pending the administration of an estate where the personal representative exercises the rights of a student.
What are a student's rights?
There are seven basic rights granted under FERPA. These are the right:
- to be informed about educational records;
- to inspect them;
- to request an amendment to them;
- to challenge the accuracy of the records;
- to prevent unauthorized disclosure of the records;
- to complain to DOE about a violation of FERPA; and
- to waive these rights in writing.
When and how does NDSU provide annual notification of FERPA rights?
The required annual notification is posted at different locations on campus, but the primary notification is in the semester registration schedules (www.ndsu.edu/registrar). There is also a reference in the university catalogs to the annual notice.
Do parents have any rights?
As mentioned previously, when a student is 18 years of age or older, he or she exercises the rights under FERPA. FERPA does allow NDSU to disclose educational records to parents of dependent students just as they would to the student. Dependent means a dependent pursuant to the definition under the IRS Code. Therefore, there must be proof that a parent is including the student as a dependent under the federal tax laws. The Registrar will require a copy of the first page of the 1040 Form and designate this dependency status in the computer network for that semester only.
Faculty need to be careful when a parent calls and asks about an educational record or information about a student in that if there is no waiver or the student is not a dependent, then disclosure to even a parent can be unlawful. In these situations, faculty should obtain assistance first from the Office of Registration and Records and then from legal counsel as needed. There are some exceptions to the above, for example, in emergency situations, as discussed below.
What are education records?
The definition of education records is extremely broad and essentially refers to any record that is directly related to a student (meaning it contains personally identifiable information about the student) and that is kept by the University. Record includes information recorded in any way, including electronically. It also includes pictures taken of student, although these may be directory information as indicated below. When in doubt, assume that the item, if it relates to a student, is an educational record.
Is student email on the HECN system a record?
Yes. As previously mentioned, the definition of education record is extremely broad and includes electronic records. The email address, however, is included as directory information at NDSU (see below). In addition, because of the nature of email, a student may have waived the confidentiality under FERPA, in some situations, by broad dissemination of email. However, NDSU considers student emails to be protected by FERPA.
Are student disciplinary records covered under FERPA?
Yes. There were consistent results in litigation around the country on this issue, particularly with regards to public institutions and open records. In North Dakota, the State Board of Higher Education ("Board") has a specific rule (Policy 1912) providing that disciplinary records are confidential. DOE has clarified this issue by amending the FERPA rules.
FERPA does allow disclosure to parties other than the disciplined student in certain situations. For example, the results of a disciplinary proceeding must be disclosed to the victim of a sex offense or crime of violence, and may be further publicly disclosed if the student was found responsible. Recent changes in the law allow permissive disclosure to the parents of students who are under 21 and convicted or found responsible of drug, violent crime or non-forcible sex offenses. As previously mentioned, disciplinary records could be disclosed to parents of dependent students. These records can also be disclosed to officials at other universities where the student seeks to enroll or is enrolled. Sometimes disciplinary records may contain medical information, for example on mental health or chemical dependency, and separate releases may be necessary to disclose that portion of the file.
What isn't an educational record?
Some specific exceptions include records of a law enforcement unit (Campus Police), certain medical treatment records, and employment records unless employment is a result of student status, such as work study, and records that only contain information about a student after they are no longer a student. While some records, like medical treatment records, may not be an education record as such under FERPA, they are confidential under other provisions of law and professional ethic requirements. A recent federal law, called HIPAA (Health Insurance Portability and Accountability Act) applies to NDSU and mandates policies for the privacy and security of PHI, or protected health information. This impacts a number of areas on campus that have records relating to students, such as the Student Health Center, Counseling Center, and Athletic training.
The law enforcement record exception has sparked a number of lawsuits. Records created by law enforcement but for disciplinary action purposes or that are maintained by another office, such as Student Affairs, are excluded from the law enforcement exception and thus continue to be education records.
How about information on a student who is a registered sex offender?
The Campus Sex Crimes Prevention Act amended FERPA to allow campuses to give out information on registered sex offenders. Sex offenders must identify where they are attending school or plan to attend. In fact, the University must notify the campus on where this information can be found (also applies to employees). Campus Police has this information at NDSU.
What is "directory information"?
FERPA specifies that an institution can specifically define some education record information as directory information not confidential under FERPA. This is information which is generally not considered harmful or an invasion of privacy if disclosed. An example would be a student's name, address, telephone listing, major field of study, and a number of other items, including campus email addresses. What constitutes directory information is one of the most critical and important concepts under FERPA.
Can a student refuse to allow directory information to be released?
Yes. The University must allow a student to opt out or preclude directory information from being disclosed. Some students may be concerned about this information and want to opt out. For example, they may have been pursued by a stalker or an ex-spouse and do not want directory information given out. The new software program under Connect ND will have a menu of opt out options.
The law allows a student to opt out within a certain amount of time after the annual FERPA notice is published. Faculty need to be careful about simply assuming that since an item is directory information it can be freely disclosed. Faculty need to check first with the Office of Registration and Records to see if the student has opted out or access any of the following CICS screens to which faculty have access) to see if "Restricted Directory" is typed across the top right corner of the screen (most will say "Directory Information"): RG62, RG65, RG50. Only a few students elect to opt out each year.
A Request to Prevent Disclosure of Directory Information form may be obtained and submitted to the Office of Registration and Records. Students are advised to consider carefully the consequences of their decision to withhold "Directory Information," as any future requests for such information from non-institutional persons or organizations will be refused unless otherwise allowed by law. In addition, NDSU will not publish the student's name in any directory, publication, commencement program, etc., unless the restriction is lifted in writing by the student. NDSU also assumes no liability for honoring a student's instructions that such information be withheld. A new form must be submitted each academic year and will remain in effect until the end of the summer semester of the academic year for which it was requested.
How does a student give specific consent for release of educational records?
The student can provide a written release giving specific consent to the disclosure of his or her education records. The release needs to be dated and must describe the records, the purpose for the release, and a list to whom the records can be given. The Offices of Registration and Records, Student Financial Services (financial aid), and the Business Office have a joint release form for academic and financial records. There also are specifically designed forms for student athletes, for job references, and for the release of health (including counseling) records. The FERPA release form used for academic and financial records may be found at the Registrar, Student Financial Services, or Business Office web sites under "Forms."
The job reference is one area where faculty typically forget to obtain a release. A faculty member should have a student sign a release before providing a job reference or a reference for the student for certain academic purposes, scholarships, etc. An example of such a release can be found at the General Counsel's website or at the Career Center.
Are electronic signatures in consents valid under FERPA?
They now can be. DOE has just published a proposed regulation change to the Code of Federal Regulations (34 CFR 99.30) recognizing electronic signatures if NDSU follows certain steps to authenticate the signature, attribute it to the consent, ensure the transmission is secure, and document the transactions. This makes practical sense because electronic signatures are now recognized in federal and state law (see e.g., NDCC ch. 9-16 enacting the Uniform Electronic Transactions Act). Electronic signatures are recognized under federal student loan programs as well.
When should I get a written consent from a student?
In addition to the above, the general rule is that when no FERPA exception applies and the faculty member will be disclosing or referring to an educational record, then the faculty member should get written consent.
When is written consent not necessary?
FERPA provides many specific exceptions when faculty and staff can disclose education records without specific student consent. Many of these exceptions are provided in the regulations to allow for the reasonable and practical workings of an educational institution.
One of the key exceptions is when the disclosure is to other school officials within the University who have "legitimate educational interests." NDSU's annual notice defines legitimate educations interests. Specifically, this includes faculty who have a need to review the educational record in order to fulfill their responsibilities. For example, finding out grade information from all of a student's classes when the faculty member is an advisor. A faculty member may sit on a committee, such as a grade appeals board, and then has a legitimate interest and need to know.
Legitimate education interest does not, however, include simply having a curiosity about the academic record or disciplinary proceedings with regards to a student without some legitimate academic reason. Thus, all records of all student are not open to all faculty at the University.
Other exceptions include disclosure to other school where the student intends to enroll, disclosure to certain federal officials, in connection with financial aid, and disclosures in compliance with lawful subpoenas. As previously mentioned, exceptions also include disclosure to parent of dependent students, directory information and in emergencies. An emergency is defined to include when the information being provided to the other party is necessary to protect the health or safety of the student or other individuals. This provision is strictly construed so that the really must be a bona fide emergency.
In 2008, amendments to the Federal Register expanded the "school official" exception to include contractors, consultants, volunteers, and other outside service providers used by a school districtict or post secondary institution to perform institutional services and functions. This means that outside service providers can have access to educational records, if they fall under the following provisions:
- They are performing an institutional service or function for which the institution would otherwise use employees.
- They are under the direct control of the institution with respect to the use and maintenance of the educational records.
- They are subject to the FERPA rules governing the use and redisclosure of personally identifiable information from education records.
An institution may not disclose educational records to an outside service provider under this exception unless it has specified in its annual FERPA notification that it uses contractors, consultants, volunteers, etc., as school officials to provide certain institutional services and functions.
What about giving information to the INS?
The University has the authority and responsibility to turn over information on it students to the Immigration and Naturalization Services to determine non-immigrant status. Foreign students are required to sign a Form I-20 (obtained from the NDSU Office of International Programs) consenting to such disclosure.
In addition, there is a special exception to FERPA in 8 USC § 1372 allowing the U.S. Attorney General to collect data on foreign students from specified countries identified as terrorism risks. An automated system called SEVIS has been implemented which requires electronic reporting on the status of such students.
What about terrorism and the federal government?
After 9/11, various institutions were contacted by the FBI for information on students. DOE eventually published guidance on the applicability of the emergency exception and subpoenas. The USA Patriot Act of 2001 authorized the U.S. Attorney General to obtain court orders authorizing release of information on students without notice to the student. Handling of subpoenas and determining when information can be turned over to the law enforcement is a complicated area. If faculty were to ever be approached by law enforcement for records, they should contact the Registrar or General Counsel's office immediately.
Should I be careful how I post grades?
Definitely! This is one area where FERPA is often violated. Faculty should not identify the grade to a name, NAID number or Social Security Number. The NAID number and Social Security Numbers are protected under FERPA. Social Security Numbers are also specifically protected under the Federal Privacy Act and state law. Therefore, faculty need to have a system of separate numbers or other alternatives when posting grades.
In addition, do not leave a stack of graded exams with names on them on a table to be picked up. This has happened from time to time. It is poor practice to leave graded exams, even if posted with the alternative numbers, on a table or in a collection where other students can see these other exams as they may be able to identify who wrote the exam. Also, do not disclose to other students a student's grade in class (for example, on a paper or test) without consent, as that is disclosing a "record." In situations where students are required to see and discuss other students' work in class, for example in groups, it is best practice to get consent at the beginning of the class and explain this in the syllabus.
Can I discuss a student with other faculty?
If the other faculty has a legitimate educational interest then the answer is yes. The question assumes that something from a "record" is being disclosed, either directly or indirectly. Discussion that is not based on a "record" is not prohibited under FERPA, for example, giving an opinion about a student generally. The issue, then, is more a matter of professional ethics. Always be aware that conversations about a student might be overheard by others and be circumspect in this area.
Why are student-athlete GPA's publicized?
Students sign a special consent form with the Athletic Department agreeing to such publication. There are a number of reasons for this including public relations and community interest as well as academic awards. In many situations a student may specifically want their grade or specific achievements publicized, such as on dean's lists. The University's notice of directory information does include selection to a dean's list and grade point average of those selected.
How is military recruiting on campus affected by FERPA?
Many universities or colleges within universities, particularly law schools, have restricted access by military officials to information on students even when such information may have been given to other employers. This has been based on the position that the military discriminates against homosexuals. The Federal Government enacted a special law, called the Solomon Amendment, which provides a process for restricting Department of Defense funding to institutions, generally through the grant process, if military recruiters are not given equal access to the campus or directory information with some exceptions. For example, if a university did not provide director information to any employers, it would not have to provide it to the military. At NDSU. military recruiters are treated the sane as other potential employers.
Does FERPA apply to information and documents relating to the disability of a student?
Yes. This information or records which relate to a student and relate to their attendance at the institution and, there, must be handled with the same confidentiality as other education records. In some situations, these records may have a dual status as both and educational record and a medical record. However, the records are treated with confidentiality under FERPA, in any event.
How does FERPA relate to the Open Records Law and Open Meetings Law?
As a public institution, NDSU is subject to the State Open Records and Open Meetings Law, and therefore, absent an exception, records in the possession of NDSU faculty are subject to the Open Records Law. FERPA is an exception to the Open Records Law as it is a federal law providing for confidentiality.
There have been a number of cases around the country exploring the relationship between the State Open Records Law and FERPA. Some of these cases have tried to limit the definition of education record to only those records dealing with academics. North Dakota has not had specific litigation regarding this issue but Attorney General's opinions and Board rules clearly provide that student records are exempt from the Open Records Law. It is also possible that certain meetings at the University, which might otherwise be open, could be closed in part when discussing confidential student educational records. However, if the meeting is otherwise open, only so much of the meeting can be disclosed that discusses the confidential records unless there is other legal authority to further close the meeting.
Examples of meetings which would be closed to discuss confidential student records would be grade appeals board and disciplinary proceedings.
What are the sanctions or liability risks for a FERPA violation?
FERPA provides for a complaint procedure to the United States Department of Education with an ultimate sanction of withholding of federal funding. It is extremely rare for cases to get to the point where the Federal Government would threaten to withhold funding.
There has been some litigation in some courts where plaintiffs have been allowed to sue under civil rights statutes for FERPA violations. However, in 2002,k the United States Supreme Court, in Gonzaga University v. Doe, determined there was not a private cause of action in federal court for a violation of FERPA. However it is a criminal offense in North Dakota to knowingly disclose confidential information unless allowed by law, and private civil actions in state court based on various theories are always a risk.
Should a faculty member be named in a lawsuit for a violation, the North Dakota Attorney General's Office provides legal representation for acts committed within the scope of the faculty member's employment. Generally, acts surrounding disclosure of education records would be within the scope of a faculty member's employment even if the disclosure was wrongful, unless such disclosure would e considered intentional, reckless or grossly negligent. As a result, employees need to take the privacy obligations under FERPA very seriously.
Who can I talk to if I have further questions about FERPA?
Good resources on campus are the Registrar, Associate Director for Student Rights and Responsibilities, General Counsel, or a Department Chair or Dean. There are a number of good sources on the Web, including the home page of the Family Policy Compliance Office of the Department of Education. Also see the website for the General Counsel's Office at CUA for more information on FERPA.
The Registrar has good resources on FERPA, including the 2001 FERPA Guide published by the American Association of Collegiate Registrars and Admission Officers (AACRAO). Various organization publish manuals or summaries of FERPA such as the Center for Policy in Higher Education. These are just some of the many resources that a faculty member can consult. Each faculty member, at a minimum, should read the annual notice published in the semester course schedule as a starting point.