Transcript The following is a presentation prepared for MASFAP’s Fall

FERPA Guidelines
and Regulations
MASFAP
Fall 2007 Conference
By:
Jason A. Crowe, JD, MS
Financial Aid Director at Barnes-Jewish College
[email protected]
Background

FERPA: The Family Educational Rights
and Privacy Act.
– Signed into law August 21, 1974.
– Became effective November 19, 1974.
– Commonly called the “Buckley
Amendment.”
– 34 CFR Part 99.
What is the Law?





20 U.S.C. § 1232g; 34 CFR Part 99
Section 99.7 sets forth the notification requirements of
the Family Educational Rights and Privacy Act of 1974
FERPA is a Federal law that protects the privacy of
student education records. The law applies to all schools
that receive funds under an applicable program of the
U.S. Department of Education.
Privacy rights transfer from parent to student once the
student matriculates into a college or university
Even parents of dependent students find that their right
to information is limited
What the Law Doesn’t Tell You
FERPA specifically outlines what
information you may share without the
student’s permission
 FERPA does not specifically discuss
disclosure of financial aid data to the
parent and student who completed the
FAFSA

Interpreting FERPA

For financial aid purposes we must
develop a policy that both makes sense
and that is within the spirit of the law
– Start with Dept of ED info at
www.ed.gov/policy/gen/guid/fpco/ferpa/index.html
– Discuss within the office
 What questions do parents and students ask?
 How do you balance service and privacy?
 How do you ensure the person requesting the
information is who s/he says s/he is?

Do you share
Write a Policy
– Parent income/asset data with a student?
– Student income/asset/award data with a parent?
– Billing information?
 Total due only
 Charge detail
 Aid payments
– PLUS eligibility with both custodial and non-custodial
parent?
Whatever your policy, have it reviewed by your
General Counsel’s Office
 Incorporate approved policy into Policy and
Procedures Manual

Train your Staff

Once you have an approved policy, train
your staff to enforce it
– Hold group discussions
– Develop PowerPoint or documents for
reference
– Offer to provide intradepartmental training
regarding FERPA policy
Policy Points

FAFSA data is shared with student and
custodial parent(s) freely, including EFC
and awards
– Signature on FAFSA stands as a mutual
“Release of Information”

PLUS eligibility amount may be shared
with non-custodial parent
Policy continued

Verify the student or parent identity before
disclosure
– Student number
– Parent and student Social Security Numbers
– Student date of birth
– Local and permanent addresses
Allow Student to Disclose

Student can choose to release information to
designated parties
– Written release
– Verified & secure web site (Guest Access)
Guest Access allows student to share online or
email information with 3rd parties as he or she
chooses
 No one can add or change access other than the
student

Data Security –
FERPA and Gramm-Leach-Bliley
GLB is a Federal Trade Commission Regulation
 Applies to all institutions that act in a banking
capacity
 Applies to universities that make loans and/or do
loan collections
 Schools could be subject to this act because of
Perkins, Short Term Institutional loans, and/or
“school-as-lender” FFELP

GLB’s Effects
Requires institutions meet standards
related to safeguarding customer financial
information
 Two major areas

– Privacy of information
– Safety of information
GLB’s Two Requirements

Privacy of Information
– Universities that abide
by FERPA are meeting
the criteria to protect
information privacy

Safety of Information
–
–
–
–
–
Natural Disaster
Human Error
Deliberate Fraud
Corruption of Data
Theft of Hardware,
Software, Reports
– Unauthorized Access
How to Comply
Place all student-specific documents in shredding
bins
 Verify identity of students & parents before
sharing data
 Refer 3rd party requests for data to the
appropriate person (Compliance Officer, Director,
etc.)
 Report computer problems (viruses,etc.)
promptly

How to Comply continued
Do not share passwords
 Lock or power down computers when
leaving your work area
 Shield computer screens and data from
other students
 Do not leave visitors unattended

FERPA and the Financial-Aid Office

Rights of parents and eligible students.
– Rights transfer to students:



At age 18.
Students are termed as “eligible students.”
Regulations do not apply when:
– Student is deceased.
– Person applied to school but has not attended.

Definition of parent.
– Natural parent.
– Guardian.
– Individual acting as a parent in the absence of a
parent or guardian.
FERPA and the Financial-Aid Office

Two parties have access to student’s education
record.
– The student.
– Parents of dependent student.



Defined in IRS Code, Section 152.
School’s release of parents’ financial information to student
is not required.
Parental Access to Records
– Parents have no inherent rights to inspect eligible
student’s records.
– Rights can be modified.




Written consent of student.
In compliance with subpoena.
In connection with health or safety issue.
Parent(s) claim student on taxes.
FERPA and the Financial-Aid Office

Written releases are not required if:
– School official has legitimate educational
interest.
– Audit/evaluation purposes.
– Party is in connection with financial aid to
student.
– Judicial order or subpoena.
– Health and safety emergencies.
– Others.
What Is Written Consent?

Standards for written consent:
– Specify the records to be disclosed.
– State the purpose of the disclosure.
– Identify to whom the information will be
disclosed.
Directory Information

Non-personal information that may be
disclosed without written consent.
–

Not considered harmful or invasion of privacy.
Examples of directory information.
–
–
–
–
–
–
–
Student’s name.
Address and telephone listing.
E-mail address.
Date and place of birth.
Dates of attendance.
Enrollment status.
Degrees, honors and awards received.
Release of Directory Information

Annual notification to students required.
– Must be made by means likely to inform
students.




College catalogue.
College handbook.
School Web site.
Student may request that information not
be released.
– Request must be in writing.
What Is An Educational Record?
Records, files, documents or other materials
containing student-related information.
 Maintained by an educational agency or institution.

– Includes records shared with or accessible to another
individual.
– May be handwritten, print, electronic, CD-ROM or other
media.
– FERPA does not mandate time frame for retaining.
 Time frame varies based on the type of record.
 Federal, state and/or institutional policies specify archiving
needs.
Educational-Record Issues
Exceptions





Sole-possession records or
private notes.
Law enforcement or campussecurity records.
Personnel records.
– Unless for student
employees.
Professional-treatment
records.
Information obtained on a
former student.
–
Alumni records.
Maintenance Requirements

School must maintain:
– List of all education records.
– Location of records.
– Procedures by which student
can review records.
Record of Disclosures



FERPA regulations require a record of
each disclosure made without written
consent.
Record must be kept with student’s
education records.
Each disclosure must include:
– Names of parties who requested or received
the information.
– Parties who requested or received
information and any legitimate interest.
Exceptions to Recording Disclosures

If request was from or disclosure was to:
– The student or parent (of an ineligible
student).
– A school official with legitimate educational
interest.
– A party seeking directory information.
– A party directed by a subpoena with orders
that the subpoena not be disclosed.
– A representative of the U.S. Attorney General
investigating or prosecuting terrorism crimes.
Special Circumstances

Three examples of special circumstances.
– Subpoenas.
– Student Employees’ Use of Education Records.
– Parent Access to a Student’s Education Record.
The Subpoena
A command from a court requiring a person’s
appearance to provide testimony or evidence.
 Student notification required.

– Send via certified mail with return receipt.
– Exceptions.


Subpoena specifies not to notify student.
Submitting records.
– Certified copies sent to issuer or agency collecting
documents.
– May charge fees for copying and mailing.

Consult with legal counsel before responding to
subpoena.
Student Employees’ Use of Records


Office is responsible for the privacy and
confidentiality of student records that
student employees use.
Recommended use of code of
responsibility.
– New-employee-training tool.
– Violations and sanctions explained.
FERPA Violation Penalties

Complaint procedures.
– Written complaints may be filed with Family
Policy Compliance Office (FPCO) of the U.S.
Department of Education.
– If FPCO finds a violation, school is notified to
correct its actions.
– If school still fails to comply with FERPA,
Secretary can direct no further federal
funding.
FERPA Supreme Court Case

Gonzaga University v. John Doe (June 20,
2002).
– By 7-2 vote, Court ruled that students cannot
sue schools that release grades and other
personal information improperly.
– Found that FERPA gives “no specific,
individually enforceable rights.”
– Leaves enforcement to Department of
Education, with right to remove federal
funding.
Recent Legislative Amendments

FERPA amendments impact privacy of
records.
– The Jeanne Clery Disclosure of Campus
Security and Campus Crime Statistics Act.
– The Gramm-Leach-Bliley Act
– The Campus Sex Crime Prevention Act.
– The USA Patriot Act.
– The Student and Exchange Visitor
Information System.
What Should You Do?

Maintain compliance, customer service and
conflict require the financial-aid office to
act responsibly.
– Develop and share a student-record privacy
and confidentiality statement for your office.
– Provide staff training and require a signed
statement or code of responsibility from all
employees.
– Attend FERPA conferences/training sessions.
– Annually complete the NASFAA SelfEvaluation Guide on FERPA.
FERPA Quiz

Question #1

Answer #1
FERPA Quiz
Yes, but only if it is a health and safety emergency.
In a health and safety emergency, information from a
student’s educational record may be released without
student consent.
If the situation is one in which the student’s safety
may be threatened, call the Police and Public Safety.
If you question whether the caller is the student’s
parent or whether the situation constitutes an
emergency in which information should be released,
for guidance you should call the Registrar or General
Counsels office for further clarification.
FERPA Quiz
Question #2
FERPA Quiz
Answer #2
No. Unless the student provides you with
written consent, their need-to-know, as an
instructor, is limited to information
specifically related to their class.
FERPA Quiz

Question #3
An unauthorized person retrieves
information from a computer screen that
you left unattended. Under FERPA, is your
institution responsible?
FERPA Quiz
Answer #3
Yes. The medium in which the information is held is
unimportant. Information on a computer screen should be
treated the same as printed reports. No information should
be left accessible or unattended.
FERPA Quiz
Question #4
A local bookstore asks for a list of
students with names and local
addresses so they can mail them costsaving coupons. Can you give them a
list of the students in your academic
unit or in a specific class?
FERPA Quiz

Answer #4
No. Remember, nearly (I have not heard
of an exception) every educational
institution has a policy prohibiting the
release of names and addresses for
commercial purposes.
Web Resources

FERPA
http://www.ed.gov/offices/OM/fpco/ferpa/index.html

FERPA exceptions after 9/11
http://ifap.ed.gov/eannouncements/attachments/0412FERPA.pdf

Gramm-Leach-Bliley
– http://www.ftc.gov/privacy/glbact/glboutline.pdf
– http://www.ftc.gov/privacy/privacyinitiatives/glbact.html
Questions? Comments?
Thank You For Attending!