What’s New in FERPA 2009?

Colleges face considerable challenges, especially with regard to maintaining safe campuses, protecting personally identifiable information in students’ education records, and responding to requests for data on student progress. Changes to and clarifications within the Family Educational Rights and Privacy Act (FERPA) are meant to help school officials make decisions about how to manage students’ private data. These amendments and updates are designed to help campus staff:

Implement provisions of the USA Patriot Act. The U.S. Attorney General may apply for an order to collect education records from colleges without the consent or knowledge of students or parents. This is relevant in cases of suspected acts of domestic or international terrorism. The Department recommends that agencies and colleges consult with legal counsel before notifying a parent or student or recording a disclosure of education records made in compliance with a court order under the USA Patriot Act.
Comply with the Campus Sex Crimes Prevention Act’s new exceptions permitting the disclosure of personally identifiable information from education records without consent. The Wetterling Act requires states to release relevant information about persons required to register as sex offenders. FERPA allows colleges to make available to the school community any information provided to it under the Wetterling Act. To protect the public, the college is also permitted to reveal information such as the school or campus at which the student is enrolled.
Implement two U.S. Supreme Court decisions interpreting FERPA. One case determined that peer grading—before the grades are collected and recorded by an instructor— is not part of a student’s education record. Another case determined that the Department of Ed may punish a college for a specific FERPA infraction before conducting an investigation to determining whether a college has an ongoing policy of violating FERPA.
Understand when colleges may release (without student consent) education records to parents. Colleges may do this if the parents claim the student as a dependent on their federal tax return, in the case of a health and safety emergency, or when a student has a disciplinary offense involving drugs or alcohol.
Recognize permissible disclosures of student directory information. Directory information is the part of a student’s education record that may safely be released without student consent. Each college will decide what constitutes directory information, but it may include items such as a student’s name, address, contact information, field of study, etc. It may also include a student ID number if that number cannot be used to gain personally identifiable information without an additional password. Social security numbers may never be included in directory information, nor may it or other non-directory information be used as a reference point to locate the record. Students must be given the opportunity to opt out of disclosure of directory information. If they choose to opt out, that request stays in effect even after they no longer attend the college.
Recognize that colleges may not release information to the media or other parties, without consent, simply because a student is no longer in attendance at the school at the time the record was created or received.
Facilitate disclosures of a student’s education records to contractors, consultants, volunteers and other outside parties to whom the college has outsourced institutional services and functions.
The U.S. Education Department advises that: “schools should always use good judgment in determining the extent to which volunteers, as well as other school officials, need to have access to education records and to ensure that school officials, including volunteers, do not improperly disclose information from students’ education records….FERPA does not prevent schools from outsourcing institutional services and functions; to require schools to record disclosures to these outside parties serving as school officials would be overly burdensome and unworkable.”
Recognize that members of the school’s law enforcement unit qualify as school officials. Officials of a law enforcement unit should maintain education records separately from law enforcement unit records, because unit records (e.g. investigative reports, etc.) are excluded from the definition of education records and are not subject to FERPA privacy requirements. Colleges may disclose information from law enforcement unit records to anyone, including local police and other outside law enforcement authorities, without student consent. Furthermore, FERPA does not contain any particular restrictions on the disclosure of a student’s disciplinary records.
Ensure that teachers and other school officials only gain access to education records in which they have legitimate educational interests. Per the regulations, a college “that makes a disclosure solely on the basis that the individual is a school official violates FERPA if it does not also determine that the school official has a legitimate educational interest.”
Understand the revised definitions of attendance, disclosure, education records, personally identifiable information, and other key terms.
Disclose education records without student consent to another institution to which the student is transferring or to a school in which the student is dually-enrolled.
Disclose students’ personally identifiable information to organizations conducting research only if the college has a written agreement with the organization. The written agreement must include: the purpose, scope and duration of the study; how student records will be used; the stipulation that education records be used only for the research purposes described; description of the information to be released; rules for re-disclosure and destruction of the records; agreement to return or destroy records; date by which records will be returned or destroyed. “Although FERPA permits schools to disclose personally identifiable information to organizations conducting studies for or on its behalf, the U.S. Department of Education recommends that colleges release de-identified information whenever possible. Even when schools opt not to release de-identified information in these circumstances, schools should reduce the risk of unauthorized disclosure by removing direct identifiers, such as names and SSNs, from records that don’t require them, even though these records may still contain some personally identifiable information. This is especially important when a school also discloses sensitive information about students, such as type of disability and special education services received by the student.” The college is held responsible if the research organization fails to comply with FERPA requirements.
Permit federal, state and local education officials to obtain student education records and redisclose those to outside parties on behalf of the college. In response to the increased use of statewide record-sharing databases by the state agencies and commissions charged with auditing and evaluating college performance, a college is required to keep a record of all parties to whom a student’s education record (with its personally identifiable information) is disclosed. State or federal agencies that receive student personally identifiable information and then redisclose it to some other party must maintain records of this action and must, upon request, provide a copy of those records to the college within 30 days. The college must make this information available to a student upon request.
Notice that provisions related to state auditors have been removed as the audit function is covered elsewhere. Typically, colleges disclose education records to state educational authorities for audit, evaluation, or compliance and enforcement purposes.
Understand there are very few exceptions to the rule requiring student written consent to release records to non-educational entities. Exceptions covering state non-educational entities include disclosures made in a health or safety emergency, in connection with financial aid, or in compliance with a state juvenile justice statute.
Understand FERPA investigation and enforcement provisions.
Recognize that in the case of a specific, significant threat to the health or safety of the student or other individual, the college may release education records to anyone whose information could protect the safety of the campus and community. This section of FERPA is a direct response to the lessons learned from the tragedy at Virginia Tech. The college is required to document health and safety emergencies which lead to the release of education records without student consent.