Frequently Asked Questions about FERPA

What rights do students have under FERPA?

Upon attending college or turning 18, students have the following rights regarding their education records:

To review their own education records,
To ask for records to be amended. (The right to challenge grades does not apply unless the grade was inaccurately recorded and the record needs correcting.),
To request a hearing if the outcome of the request for amendment is unsatisfactory,
To expect their records will be kept confidential except under specific situations,
To be asked for written consent to release their education records,
To opt out of the release of directory information, and
To file a complaint with the U.S. Department of Education, Family Policy Compliance Office if they feel their FERPA rights have been violated.

Note: Students attending class via Internet or videoconference have the same rights as those attending in person.

It is the college’s responsibility to:

Publicize policies and procedures for safeguarding and disclosing education records,
Comply with students’ requests to review their educational records within 45 days,
Ensure access to education records by providing students with a copy of their records when necessary (i.e., for students or former students who do not live within commuting distance),
Not destroy records if a request for access is pending, and
Keep detailed records of student information disclosure.

A college does not have to permit a student to review education records that contain:

Information on more than one student,
The financial records of his or her parents, and
Confidential recommendation letters.

These items should be temporarily removed from the file so that the student can view his or her educational record.

What rights do parents have under FERPA?

Unless parents claim the student as a dependent for tax purposes, they may obtain directory information including personally identifiable information. In order to obtain non-directory information (e.g. grades, financial records), parents must have a signed consent form from their child if that child is not a dependent. If the student is under 18 and enrolled in both high school and college, the parents retain the rights under FERPA to review any records sent by the college to the high school.

Note: There are also health and safety conditions under which a student’s education records may be disclosed to a parent without the student’s consent. (See Campus Safety.)

What are education records?

An education record meets two criteria: it is maintained by the school and contains information from which a student can be personally identified. These records can take any form; they may be handwritten, printed, typed, preserved on microfiche, entered and stored electronically, etc. They may include notes taken with others present or shared with others. Records of a student’s work-study employment at the college are included as well.

Information that is not considered part of a student’s education record includes: notes taken privately by college faculty or staff and not released to others; law enforcement or campus security records; employment records (unless employment is contingent upon being a student); medical/psychological treatment records; information obtained after the student leaves the college (e.g. alumni records); peer-graded assignments (before the work is collected and the grades are recorded by the instructor.)

Examples of education records that would require the highest level of security include: registration forms, transcripts; grades; student schedules; class assignments, class rosters, forms with social security numbers on them. These types of records are usually released only with the student’s written consent, although there are several exceptions, such as health and safety emergencies.

The college may classify some education records as “directory information.” Directory information may be released without the student’s consent, although students must be informed of their right to opt out (i.e., restrict or withhold directory information from release.)

What is directory information?

Directory information includes the parts of an education record that would not be considered harmful or an invasion of privacy if disclosed. It may include:

Student’s name,
Address,
Telephone number,
Email address,
Photo,
Data and place of birth,
Field of study,
Academic level,
Enrollment status (e.g. full-time or part-time),
Dates of attendance,
Participation in sports and activities,
Degrees, honors and awards received, and
Most recent school attended.

Directory information does not include a student’s social security number. It may include a student ID number only if that number cannot be used without a PIN or password to access educational records.

Colleges may disclose directory information if they have given the student notice of the items they consider directory information and have offered the student the opportunity to opt out of disclosure. They are required to honor former students’ opt-out requests and may not release their directory information. Opting out of directory information disclosure does not prevent faculty in a class in which the student is enrolled from identifying a student by name, disclosing a student’s ID number or email address during class.

FERPA does not specify how a college must notify students of their right to control the release of education records. Colleges often include their annual announcement in:

Student handbooks,
School newspapers,
Course catalogs,
Registration packets.

How may student ID numbers and electronic access codes be used?

Some online services offered by the college (e.g. courses, web-based advisement, registration) require students to register and receive a user number and password. This electronic identifier may be considered directory information and disclosed or used to access education records but only if a password, PIN or some other secret identification method is also assigned. To prevent identify theft and unauthorized access to student information, the password/PIN is used by the student to verify his or her identity and will not be disclosed by the college to outside parties.

Students may opt out of disclosure of their electronic ID, but the college may deny them the opportunity to participate in online courses or web-based services.

The college may create class lists with corresponding student ID numbers and may release them to other agencies or entities, but may not make the lists available to students. Instructors may not use student ID numbers to post grades publicly. Instead, they must create a unique, private code (known only by the instructor and the individual student) for each student.

Under what circumstances may education records be released?

Under most circumstances, prior written consent from the student must be obtained. The consent form must:

List/describe the records to be disclosed,
State the purpose of the disclosure,
Identify the person or group to whom the disclosure is to be made, and
Include the date, signature of the student whose record is to be disclosed, and signature of college records staff.

Prior written consent by the student for release of his or her non-directory education record is NOT required if the record is being disclosed:

Directly to the student,
To college faculty or staff or individuals hired on outside contracts by the college serving a legitimate college function (e.g., performing administrative or instructional tasks in enrollment, financial aid, transfer programs, job placement, or health services; providing information to academic accreditation agencies),
Under a court order or subpoena,
In a situation endangering the health and safety of the student or the public,
To parents regarding alcohol or drug violations of a student under 21 years of age,
In compliance with the requirement that students who are registered sex offenders report their address. Under the campus community notification program of the Wetterling Act, states must require certain sex offenders to register their name and address with the state authority where the offender lives, works, or is enrolled as a student,
In response to the request of a victim of violent crime who asks that the perpetrator’s disciplinary records be released,
When a student is involved in a lawsuit against the college,
To another school in which the student wishes to enroll, and/or
To organizations conducting research, as long as all personally identifiable information (i.e. name, social security number, student number, parents or family members, address, personal characteristics, biometric* data, place and date of birth, mother’s maiden name) is not released to anyone other than the researchers and that information is destroyed when no longer needed for the research project.

*Biometric data may include fingerprints, voiceprints, retinal scans, DNA sequence, handwriting, etc.

May the college release student information for educational research?

A college may disclose student education records, including personally identifiable information, without student consent for research purposes. The research organization must agree in writing to conduct the research in a way that does not permit identification of students or their parents by anyone other than those conducting the research. The college must agree with the purposes of the study and must retain control over the information from the disclosed education records. The college must have a written agreement with the research organization that outlines:

The purpose, scope and duration of the study,
The requirement that information from education records may only be used for the purpose of the study,
The rules regarding re-disclosure and destruction of information,
The information to be disclosed,
The requirement that the research organization destroy or return all records provided, and
The specific date by which the research organization must destroy or return the records.

Note: Although release of personally identifiable information is permitted under this section of FERPA, the recommendation from the agency is that, whenever possible, “agencies and institutions either release de-identified information or remove students’ names and SSNs to reduce the risk of unauthorized disclosure of personally identifiable information.”

Who may obtain a student’s education record?

A student's education record may be released to:

The individual student,
Whomever the student authorizes through a written, signed and dated release specifying the records to be disclosed and the identity of the recipient,
Any party requesting directory information unless the student has opted out of their release,
College faculty or staff who have a legitimate educational, administrative or student services interest,
Schools at which the student intends to enroll,
Parents, if they claim the student as a dependent for tax purposes,
Parents, college personnel, law enforcement or other appropriate parties in connection with a health or safety emergency,
Parents regarding alcohol and drug violations of a student under 21 years of age,
The victim of a crime of violence or a non-forcible sexual assault may request the release of the disciplinary proceedings against the perpetrator,
The U.S. Attorney General, under the USA Patriot Act,
Federal and State agencies of higher education for audit, evaluation, compliance or enforcement purposes, and/or
Research organizations, under written agreement with the college.

What rules govern “redisclosure” of student records?

Recipients of education records may not disclose personally identifiable information to another party (“redisclose”) without the student’s written consent. Exceptions to this rule include: Federal and State officials, recipients under court order to release the records, and crime victims receiving information under the Clery Act.

Officials of federal and state agencies who have received education records for audit, evaluation, compliance or enforcement purposes may forward those records:

To another federal or state official for the same purposes,
To a student’s new school,
To an accrediting agency,
In connection with a health or safety emergency, and/or
In compliance with a court order or subpoena.

A state education agency or other party that rediscloses education records in compliance with a court order or subpoena must meet the student/parental notification requirements before it responds to the records request. The college or education agency must make a reasonable effort to notify the student (or parent of minor student) about the order or subpoena, except in matters covered under the USA Patriot Act or where the court order specifically instructs that the student not be notified.

Under the Clery Act, colleges are required to inform both the accuser and the accused of the outcome of any institutional disciplinary proceeding brought alleging a sex offense or violent crime. The college may not prohibit the victim from re-disclosing this information.

A college or educational agency must keep records of redisclosures it has authorized, including the names of additional parties to whom the information may be disclosed. A State or Federal official that rediscloses education records on behalf of an agency or college, must create a record and make it available within 30 days to the educational agency or college. The educational agency or college is required to obtain a copy of the record and make it available should the student request it. Additionally, the State or Federal official is allowed to organize the record by student’s class, school, district, or other grouping rather than name.

May the college release education records or personal identification information without student consent in public health or safety emergencies?

Yes.
In response to the Virginia Tech tragedy, the Secretary of Education determined that administrators need greater flexibility in responding to threatening circumstances. Therefore, in situations involving an imminent risk to health or safety, colleges may share information to the appropriate parties (including parents) without the student’s prior written consent.

Under the USA Patriot Act, the U.S. Attorney General may apply for an order to collect education records from colleges without the consent or knowledge of students or parents. This is relevant in cases of suspected acts of domestic or international terrorism.

The Campus Sex Crimes Prevention Act contains registration and notice requirements designed specifically for colleges. State collect information about a registered offender’s enrollment or employment at a college, along with any change in that status at the college, and make this information available promptly to the campus police department or other appropriate law enforcement agency. The college is allowed to release sex offender information from the state without the consent of the offender. Furthermore, the college must inform the entire campus community where it can obtain information about registered sex offenders. (See Campus Safety.)