What is FERPA?
It is the Family Educational Rights and Privacy Act, a federal statute. It governs student educational records.
What does FERPA restrict?
FERPA limits the disclosure of information from student “education records,” a term that the law defines quite broadly and that is not limited to “academic” records. “Education records” include virtually all records maintained by an educational institution, in any format, that are “directly related” to one or more of its past or present students. A record is “directly related” to a student if it is “personally identifiable” to the student, and a record is “personally identifiable” to a student not only if it expressly identifies the student, but also if the student’s identity could be deduced from the demographic, descriptive, or other information the record contains. Thus, “education records” include not only registrar’s office records, transcripts, papers, exams and the like, but also non-academic student information database systems, class schedules, financial aid records, financial account records, disability accommodation records, disciplinary records, and even “unofficial” files, photographs, e-mail messages, hand-scrawled Post-it notes, and records that are publicly available elsewhere or that the student herself has publicly disclosed.
When may information from education records be disclosed?
In general, information derived from a student’s education records may be disclosed only if: (1) it is “directory information;” (2) the student has consented to the disclosure; or (3) the law provides an exception that permits disclosure without the student’s consent.
What is “directory information”?
FERPA allows institutions to designate certain classes of information as “directory information” that may be released to anyone without a student’s consent. Directory information may (but is not required to) include such items as the student’s name, address (local, permanent, and e-mail), telephone number (local and permanent), dates of attendance at the institution, major, degrees and awards received, participation in officially recognized activities and sports, photograph, as well as other information “that would not generally be considered harmful or an invasion of privacy if disclosed.” A student may choose to block the release of his or her own directory information. This may be done in consultation with the Office of Student Affairs, Dempsey Hall.
May information from student education records be shared with others on campus?
Yes. Under one of FERPA’s many exceptions to the general prohibition against disclosure, campus personnel are free to share information from student education records with other “school officials” who have “legitimate educational interests” in the information.
When may a college or university disclose information from a student’s education records to the student’s parent or legal guardian?
Once a student is in attendance at a postsecondary institution, all rights provided by FERPA rest with the student, even if the student is younger than 18 years old. Education record information may therefore be disclosed to the parent of a college or university student only with the student’s consent or in instances in which one of the many exceptions to FERPA permits disclosure. In regards to student conduct, an institution may (but is not required to) provide information to a parent or legal guardian regarding any violation of law or of an institutional rule or policy governing the use or possession of alcohol or a controlled substance, if the institution has determined that the student committed a disciplinary violation with respect to such use or possession and the student is under the age of 21 at the time of both the violation and the disclosure.
Students may grant access to others in TitanWeb.
May information from a student’s education records be disclosed to protect health or safety?
Yes. FERPA permits the disclosure of information from student education records “to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.”
What about disclosing information from the student discipline process, either to others on campus or to other institutions?
In a separate exception, FERPA further permits institutions to disclose to anyone the final results of a disciplinary proceeding conducted against a student who is an alleged perpetrator of a crime of violence or a nonforcible sex offense, if the institution determines as a result of that disciplinary proceeding that the student committed a violation of the institution’s own rules or policies with respect to such crime or offense. Yet another exception permits institutions to disclose the final results of such a proceeding to the victim regardless of whether the alleged perpetrator was found to be in violation of the institution’s rules or policies. For purposes of these two exceptions, “final results” is limited to the name of the student who is an alleged perpetrator of a crime of violence, the violation found to have been committed, and any sanction imposed against the student by the institution.
Is the disclosure of University Police records records restricted by FERPA?
No. Records that are created by campus law enforcement (whether commissioned police or non-commissioned security) at least in part for a law enforcement purpose are not “education records” and, at least as far as FERPA is concerned, may be shared freely with anyone the institution, in its discretion, deems appropriate. For example, FERPA would not prevent a campus law enforcement unit from disclosing to external law enforcement agencies an incident report concerning the unit’s response to a student’s threatening statements or behavior. However, any copies of that report that are shared with other campus offices would become subject to FERPA, though the original in the law enforcement unit would continue not to be. Moreover, any student education records that other campus offices share with the campus law enforcement unit, as “school officials” with a “legitimate educational interest,” remain subject to FERPA even in the hands of that unit.
This document is taken, in part, from a paper authored by Nancy E. Tribbensee and Steven J. McDonald
Christine R. Williams, FERPA, GLBA & HIPAA: The Alphabet Soup of Privacy, (2007).
Nancy E. Tribbensee, The Family Educational Rights and Privacy Act: A General Overview, (2003).
McDonald, Steven J., ed., The Family Educational Rights and Privacy Act: A Legal Compendium, Second Edition (2002).
Statutes and Regulations:
The Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g. o 34 C.F.R. Part 99.
The Health Insurance Portability and Accountability Act, 42 U.S.C. §§ 1320d-1320d-8.
Student Assistance General Provisions; Campus Safety, 59 Fed. Reg. 22314 (April 29, 1994) (final rule)
Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Parts 160 and 164.