THE FUNDAMENTALS OF
FUNDAMENTAL FERPA
Steven J. McDonald
General Counsel
Rhode Island School of Design
FERPA
• The Family Educational Rights and
Privacy Act of 1974
• A.K.A. the Buckley Amendment
FERPA's Big Three
• College students have the right, in
general, to:
– Control the disclosure of their "education
records" to others
– Inspect and review their own "education
records"
– Seek amendment of their "education
records"
So, What's an "Education Record"?
• "'Education records' . . . means those
records that are:
(1) Directly related to a student; and
(2) Maintained by an educational
agency or institution or by a party
acting for the agency or institution"
So, What's an "Education Record"?
• "'Education records' . . . means those
records that are:
(1) Directly related to a student; and
(2) Maintained by an educational
agency or institution or by a party
acting for the agency or institution"
So, What's an "Education Record"?
• "'Educational . . . institution' means any
public or private . . . institution" that
receives funds "under any program
administered by the Secretary [of
Education]"
So, What's an "Education Record"?
• "'Record' means any information
recorded in any way, including, but not
limited to, handwriting, print, computer
media, video or audio tape, film,
microfilm, and microfiche"
• N.B.: Does not include information that
is not "recorded" – that is, personal
knowledge
So, What's an "Education Record"?
• "'Student' . . . means any individual who
is or has been in attendance at an
educational . . . institution"
• "'Attendance' includes, but is not limited
to . . . [a]ttendance in person or by
correspondence"
So, What's an "Education Record"?
• A record is "directly related" to a student if it
contains "personally identifiable information"
about that student
• "'Personally identifiable information' includes,
but is not limited to:" name, address, personal
identifiers (such as SSNs or campus ID
numbers), "a list of personal characteristics
that would make the student's identity easily
traceable", and "other information that would
make the student's identity easily traceable"
So, What's an "Education Record"?
• "Maintain" is . . .
So, What's an "Education Record"?
• "Maintain" is not defined!
• Supreme Court:
– "FERPA implies that education records are
institutional records kept by a single central
custodian, such as a registrar."
– "The ordinary meaning of the word
'maintain' is 'to keep in existence or
continuance; preserve; retain.'"
We Don't Need No "Education"
• "Education records" certainly includes
transcripts, exams, papers, and the like
• But it also includes:
–
–
–
–
–
–
SSNs, ID numbers, and driver license numbers
Attendance and absence records
Discipline records, including complaints
Disability accommodation records
Records that are publicly available elsewhere
Records of information that the student has
publicly revealed
– Pretty much everything!
Except for These:
• "Sole possession" records
– As long as not shared or accessible
• "Law enforcement" records
– But only the law enforcement office's copy
• "Employment" records
– Unless student status is a job requirement
• "Treatment" records
– Only if not shared
• "Alumni" records
– But not if they "relate back"
The Metaphysics of Medical Records
• HIPAA: Protected health information excludes
individually identifiable health information in:
– (i) Education records covered by the Family
Educational Rights and Privacy Act, as amended,
20 U.S.C. 1232g; [and]
– (ii) Records described at 20 U.S.C.
1232g(a)(4)(B)(iv) [that is, treatment records]
• But state medical confidentiality rules still
apply (to medical professionals)
Except for These:
• "Sole possession" records
– As long as not shared or accessible
• "Law enforcement" records
– But only the law enforcement office's copy
• "Employment" records
– Unless student status is a job requirement
• "Treatment" records
– Only if not shared
• "Alumni" records
– But not if they "relate back"
Disclosure
• Before disclosing education records – or
information from education records – an
institution must obtain a signed and dated
written consent from all relevant students,
specifying:
– The records that may be disclosed
– The purpose for which they may be disclosed
– The persons or classes to whom they may be
disclosed
Except for Disclosures:
• To "school officials . . . whom the . . .
institution has determined to have
legitimate educational interests"
– Each institution specifies its own standards
– "School officials" can include students serving
on committees and outside contractors
– "Legitimate educational interests" can include
what is needed to do one's job
– Institution, not individual, makes the
determination
A school official is a person employed by the
University in an administrative, supervisory,
academic or research, or support staff position
(including law enforcement unit personnel and
health staff ); a person or company with whom the
University has contracted (such as an attorney,
auditor or collection agent); a person serving on
the Board of Visitors; or a student serving on an
official committee, such as a disciplinary or
grievance committee, or assisting another school
official in performing his or her tasks. A school
official has a legitimate educational interest if the
official needs to review an education record in
order to fulfill his or her professional responsibility.
Except for Disclosures:
• To "school officials . . . whom the . . .
institution has determined to have
legitimate educational interests"
– Each institution specifies its own standards
– "School officials" can include students serving
on committees and outside contractors
– "Legitimate educational interests" can include
what is needed to do one's job
– Institution, not individual, makes the
determination
Recent Guidance
• "FERPA does not require a
postsecondary . . . institution to make
education records available to anyone
other than an eligible student. Therefore,
nothing in FERPA would prevent the
University from adopting a policy that a
faculty member may not have access to
these records", regardless of the faculty
member's "educational interest".
Except for Disclosures:
• Of "directory information"
– Can include name, address, e-mail address,
telephone number, photograph, date and place of
birth, major, dates of attendance, participation in
officially recognized activities and sports, degrees,
honors and awards received, most recent
educational institution attended, and other
"information that would not generally be
considered harmful or an invasion of privacy if
disclosed"
– Must give current students advance notice of
types and provide opportunity to opt out
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
student name
date admitted
birthdate
mailing address and telephone number
local address and telephone number
university email address
semesters of attendance
major(s)
minor
specialization
school
full- or part-time status
classification (freshman, sophomore, etc)
degree sought
honors and awards
degrees and dates received
participation in officially recognized intercollegiate sports, weight, height,
hometown, parents’ names and previous school(s) attended (for
members of athletic teams)
• Emergency Contact Information
Except for Disclosures:
• Of "directory information"
– Can include name, address, e-mail address,
telephone number, photograph, date and place of
birth, major, dates of attendance, participation in
officially recognized activities and sports, degrees,
honors and awards received, most recent
educational institution attended, and other
"information that would not generally be
considered harmful or an invasion of privacy if
disclosed"
– Must give current students advance notice of
types and provide opportunity to opt out
Students have the right to withhold the release of
information designated as “directory information” by
submitting to the Office of Records and
Registration, not later than 14 days after the
beginning of a term, a request written and signed
that “directory information” not be released. This
request is effective until revoked in writing by the
eligible student to the same office.
Except for Disclosures:
• To "parents . . . of a dependent student"
for federal tax purposes
– Parents of college students have no
general right to see their children's records,
even if the students are minors
– Need to obtain a copy of parents' most
recent tax return to verify dependent status
– Warning: Tell them about this before there's
a problem
Students are not provided report cards as
they are in high school and VCU does not
mail grades to home to the parents. . . .
When a student reaches the age of 18 or
begins attending a postsecondary institution,
regardless of age, FERPA (Family
Educational Rights and Privacy Act) rights
transfer to the student.
What do you mean you cannot disclose any information
to me about my son/daugther's services?
Once your student enrolls in a post–secondary institution,
whether they are 18 or younger, they become the sole
guardian of all records maintained by that institution. Under
the Family Educational Rights and Privacy Act of 1976
(FERPA), the student has the right to access their own
records upon written request. The parent or guardian does
not share that right. This means that parents do not have
legal access to their student's grades, transcripts, or any
information concerning the services they are being provided
through Disability Support Services.
Except for Disclosures:
• In connection with a "health or safety
emergency"
– Disclosure may be made only to
"appropriate parties" and must be limited to
"information [that] is necessary to protect
the health or safety of the student or other
individuals"
Recent Guidance
• An "emergency" exists when "a specific
situation presents imminent danger or threat
to students or other members of the
community, or requires an immediate need for
information in order to avert or diffuse serious
threats to the safety or health of a student or
other individuals."
• "This Office will not substitute its judgment for
what constitutes a true threat or emergency
unless the determination appears manifestly
unreasonable or irrational."
Recent Guidance
• Serious communicable diseases that are
epidemic in nature – yes
• Serious infectious diseases – case-by-case
• Suicidal ideation – case-by-case
• "[A] student's suicidal statements, coupled with
unsafe conduct and threats against another
student, constitute a "health or safety emergency"
under FERPA. However, . . . this exception does
not support a general or blanket exception in
every case in which a student utters a threat."
Except for Disclosures:
• In connection with "financial aid for
which the student has applied or which
the student has received, if the
information is necessary for such
purposes as to:
– Determine eligibility for the aid;
– Determine the amount of the aid;
– Determine the conditions for the aid; or
– Enforce the terms and conditions of the
aid."
Except for Disclosures:
• To "comply with a judicial order or
lawfully issued subpoena"
– Must make a "reasonable effort to notify"
the student beforehand
• Unless it's a grand jury or law enforcement
subpoena and you've been ordered not to
disclose
– No obligation to fight the subpoena on the
student's behalf
Except for Disclosures:
• In a lawsuit, by or against a student, in
which you're an adversary
– No need to notify student in advance
– May disclose only "relevant" records
Except for Disclosures:
• To parents of a student under 21 if the
institution has determined that the
student violated its alcohol or drug rules
– Student must be under 21 at time of
disclosure, not just at time of violation
Except for Disclosures:
• Of the "final results" of a disciplinary
proceeding against an alleged
perpetrator of a crime of violence or
non-forcible sex offense, if the institution
determines that the accused student
violated an institutional rule or policy
– "Final results" = name of the accused
student, violation committed, and sanction
imposed
Except for Disclosures:
• To the victim of an alleged perpetrator of
a crime of violence or non-forcible sex
offense
– Disclosure is still limited to the "final
results" of the disciplinary proceeding
– However, disclosure is permissible
regardless of the finding against the
accused
Except for Disclosures:
• And several more
• N.B.: As far as FERPA is concerned, all of
these are discretionary
– May be other disclosure obligations
• For example, under the Campus Sexual Assault Victims'
Bill of Rights Act, both the accused and the accuser must
be informed of the final results of a disciplinary
proceeding involving an alleged sex offense
• Also N.B.: These exceptions are independent
of each other, not cumulative
What is a "Disclosure"?
• FERPA "clearly does not allow an educational .
. . institution to leave education records
unprotected or subject to access by
unauthorized individuals, whether in paper,
film, electronic, or any other format. We
interpret this prohibition to mean that an
educational . . . institution must use physical,
technological, administrative and other
methods, including training, to protect
education records in ways that are reasonable
and appropriate to the circumstances in which
the information or records are maintained."
What is a "Disclosure"?
• Placing all report cards in a box on a desk
• Sending notice of probation on a postcard
rather than in a sealed envelope
– http://www.ed.gov/policy/gen/guid/fpco/ferpa/l
ibrary/gibsoncmplt.html
• "[A] record management system that
allows unauthorized individuals to have
access to education records"
What is a "Disclosure"?
• "[G]iven that it is virtually impossible to use
physical or technological safeguards to prevent
authorized users from using their access to
education records for unauthorized purposes, it
is important that an educational agency or
institution establish and enforce policies and
procedures, including appropriate training, to
help ensure that school officials do not in fact
misuse education records for their own
purposes."
What is a "Disclosure"?
• "[W]hen an institution is authorized to disclose
information from education records . . ., FERPA does
not specify or restrict the method of disclosure. . . .
FERPA does not mandate any specific method, such as
encryption technology, for achieving these standards
with electronic disclosure of information from education
records. However, reasonable and appropriate steps
consistent with current technological developments
should be used to control access to and safeguard the
integrity of education records in electronic data storage
and transmission, including the use of e-mail, Web
sites, and other Internet protocols."
Implicit Disclosures
• "Just the directory information" for a specified
student or subset of students
– e.g., the names and addresses of all students who
have made sexual harassment complaints
• "Broken locket" requests
– e.g., degree verifications in response to student
SSNs
• "Anonymized" data and information
– e.g., redacted disciplinary reports for all residents
of a given dormitory this year
Recent Guidance
• Schools need not honor student
consents
• Schools cannot require a waiver as a
condition of participation in a course or
program
But Wait, There's More!
• In general, must make a record of each
request and each disclosure and
maintain it with the relevant education
record
• In general, may disclose only on
condition that the information not be
redisclosed without student consent
• In general, recipients may use disclosed
information only for specified purpose
Inspect and Review
• Must allow students to "inspect and review" their
own education records within 45 days of request
• Need not provide copies unless "circumstances
effectively prevent the . . . student from exercising
the right to inspect and review"
• Does not include financial aid records of parents
or confidential letters of recommendation to which
the student has waived access
• If record relates to more than one student, must
redact
Recent Guidance
• FERPA does not require the creation or
retention of records, regulate the format of
records (except for inaccuracies), govern the
organization of records, or prohibit the
destruction of records (except for pending
requests), nor does it require notification of
the creation or destruction of records or
attestation of the authenticity of records
• FERPA is not a discovery tool; requests must
be reasonably specific, and schools need not
honor "standing" requests
Seek Amendment
• Student may request amendment of
records containing "information that is
inaccurate, misleading, or in violation of
the student's rights of privacy"
– Not a grade grievance mechanism
• If deny request, must give student an
opportunity for a hearing
• If still deny request, student may include
a statement with the record
Annual Notice
• Must include statement of students'
rights to:
– Inspect and review their own education
records (and procedures for doing so)
– Seek amendment of "inaccurate" or
"misleading" records (and procedures for
doing so)
– Consent to most disclosures
– File a complaint with DOE
Annual Notice
• May (and probably should) include:
– Your definition of "directory information"
and procedure and deadline to opt out
– Your definition of "school officials" and
"legitimate educational interest"
– If applicable, a statement of your practice
of forwarding records to schools to which
students seek to transfer
Questions?
Lost in Cyberspace?
To make himself more accessible,
Professor Kirk frequently communicates
with his students by e-mail and
sometimes sends them comments on
papers and grades. Some of his
students prefer to use Gmail or other
off-campus e-mail accounts.
Goofy Grading?
It's final grade time, and grades are due from
faculty in five hours. Dr. Minnie Mouse, an
instructor in the English Department, asks to
look at some students' academic records.
You ask why, and she replies that all she
wants to look at are the records of students in
her class. Before she assigns grades to her
students, she wants to get a "feel" for what
grades they received in the past.
Have I Got a Deal for You?
Pearson Hyundai calls your office and
asks for a list of all graduating seniors'
addresses so they can inform them
about a new graduate rebate program
they are offering. They will give a
$1,000 rebate to any recent graduate
from VCU. All they need is names and
addresses, both of which are directory
information.
A West Side Story?
You get a call from Officer Krupke, who
tells you she has arrested a person in
Midlothian who claims to be a student at
VCU. She is calling to verify his status.
You check your records and find that
this person is a student. However, there
is a signed statement from the student
that he wants no information on him
released.
Alienation?
A foreign graduate student is placed on
academic probation. His father, who is
paying for his son's education, calls the
son's academic advisor to discuss the
situation and asks for a copy of the
son's transcript and other related
records. He also asks the advisor not to
tell his son that he has called.
Take the Money and Run?
You work in the Financial Aid Office and you
are talking with a member of the Albemarle
County Alumni Club. They are establishing a
new scholarship to be offered to students
from Albemarle County who attend VCU. A
scholarship board from the alumni group will
evaluate the applications. The alumnus has
asked you for the names, addresses and
GPAs of currently enrolled VCU students from
Albemarle County.
Holding Foul?
You receive a call from a prospective
employer of a former VCU student, Gary
Gridiron. He really wants to hire Gary and all
he needs is verification of degree receipt. As
soon as he mentions the student's name, you
know who he is talking about because he is a
former football player here. When you check
Gary's academic record, however, you notice
he has a FERPA hold on his record.
Sue Sue The U.?
Sue Sophomore has been cited by VCU
Police for vandalism on campus, and it is
possible that she will be charged with a crime
in relation to this incident. She has been
referred to Judicial Affairs for action from that
perspective. A prospective law student, she
is concerned about what the Police and
Judicial Affairs files might contain about her,
so she makes a request, under FERPA, to
review them.
The Right Way and . . . ?
An Army officer calls your office and
says he is trying to find an address for
a current member of his squad, who he
knows is also a student at VCU. It is
really important that he get in touch with
her, so he asks for her address.
A Gift for Gab?
Ben Bigbucks, a former student, is referred to
you by his contact in the Development Office.
He was last here in Spring 1992, but did not
receive his degree. He is asking that a
FERPA hold be placed on his record.
While doing a little more checking you find
out a number of things: 1) He is a very
wealthy and prominent individual – the CEO
of a large corporation; 2) A Google search
reveals several places on the web where Ben
claims that he is a graduate of VCU; and 3)
He is a significant contributor to VCU.