Transcript Family Educational Rights and Privacy Act (FERPA) and the

The Basics of
Students' Right to Privacy and
Protecting Their Records
Family Educational Rights and Privacy Act (FERPA)
and the Patriot Act of 2001
What is FERPA?
Family Educational Rights and Privacy Act
The Act provides these rights to students
at the postsecondary level:
1. The right to inspect and review the education
record.
2. The right to seek to have the records
amended.
3. The right to have some control over the
disclosure of information.
Definition of Student
A student is any individual:
• who is or has been in attendance at the
college; and
• regarding whom the college maintains
education records.
What is an Education Record?
Documentation
that a college
creates or processes
concerning a student
What is an Education Record?
(continued)
“Record” means:
Any information maintained in any way.
This includes but is not limited to:
handwriting
computer media
print
film
e-mail
video or audio tape
microfilm
microfiche
What is “Personally Identifiable
Information”?
• Student name
• A personal identifier, such as SSN
• Characteristics or other information that
would make a student’s identity easily
traceable
Directory Information
Information that is not generally considered
harmful or an invasion of privacy
Information that may be disclosed without
prior written consent of the student
Directory Information at ESC
Name
Address
Telephone Number
Dates of Attendance
Most recent previous educational institution attended
Major Area of Concentration (Area of Study and Concentration)
Degrees and Awards Earned
Participation in officially recognized College activities
Birth Date
Record-Keeping Requirement
A College must maintain a record of each
request for access to and each disclosure of
personally identifiable information from the
education records of each student
EXCEPT
When disclosure is made to:
The student
A designated school official
A party with written consent from the student
A party seeking directory information
A party with a law enforcement subpoena or court order which specifies that
the existence or contents of the subpoena or court order not be disclosed.
The US Attorney General in response to an ex parte order (Patriot Act).
Health or Safety Emergency deemed an imminent danger to a student, other
students, or other members of the community or to a situation that
requires the immediate need for information from education records to
avert/diffuse serious threats to the safety or health of a student or other
individuals.
Enforcement and Penalties
• The Family Policy Compliance Office in the U.S.
Department of Education is the enforcement
agency.
• Non-compliance can result in the withdrawal of
U.S. Department of Education Funds.
• Not intended to give students the right to civil
penalties/fines.
SUMMARY
• Students are accorded privacy rights under
the Family Educational Rights and Privacy
Act.
• In most cases, written consent is required
from the student to release information
from the student’s record.
SUMMARY (continued)
• EVERYONE at the institution must
comply with FERPA.
• Failure to follow FERPA can result in the
loss of federal funding.
Protecting and Respecting
the privacy rights of students
is part of all our jobs.
It’s the right thing to do.
What is Your Role?
1. Take reasonable steps to understand “who” is
requesting information
–
–
Are you speaking to the student?
Are you speaking to a third party?
2. Share information as appropriate with the
person requesting information
3. Make sure that student records are maintained
in a secure manner
What is Your Role?(continued)
1. Take reasonable steps to understand
“who” is requesting information
–
Are you speaking to the student?
 Ask the person for a combination of “unique” information that will
assure you that you are speaking to the student, such as:
his/her full name, birth date, student ID, primary mentor, when
you last attended
–
Are you speaking to a third party (not the student)?

If this is to confirm a degree credential, send the inquiry to the
Office of the Registrar.
 Is this over the phone? ESC policy restricts release of Directory
Information over the phone to: Dates of Attendance, Area of
Study and Concentration, Degree and Awards Earned.
What is Your Role ?(continued)
2. Share information as appropriate with the person
requesting information
 If the person is the student, you can share any and all
information.
 If the person is not the student, you are limited to
ESC policies relating to Directory Information.
Remember, we “may” release Directory Information.
We do not “have to.”
What is Your Role ?(continued)
3. Make sure that student records are maintained
in a secure manner.
 Paper records should be maintained in lockable
filing cabinets and rooms.
 Electronic files should be maintained in such a way
to ensure maximum security and access only to
authorized personnel.
 Tech Tip! Always use bcc (not cc) when sending
email to a group of students.
What is Your Role ?(continued)
The student must provide written consent for
anyone/any agency to access their education
record information not covered by exceptions of
the act or documented arrangements (in writing)
previously made by the student currently in
effect. This means that the college cannot release
non-directory education record information to
mothers, fathers, spouses, partners, significant
others, long-lost best friends, etc.
Dealing with Requests for Information
• Don’t hesitate to send the request to the
Office of the Registrar.
• Don’t hesitate to say that you don’t know
and will get back to the party within a
reasonable time.
• When in doubt, consult College policies
and procedures.
Subpoenas
• All subpoenas should be accepted and
forwarded to the Office of Administration.
• If the subpoena is about a student, it will be
forwarded to the Office of the Registrar for
the institutional response.
Useful Sites and Contacts
• www.esc.edu/TranscriptRequest
This “address” takes the student straight to the Office of the
Registrar website that contains information about how to request
a transcript.
• Office of the Registrar.
www.esc.edu/Registrar
• ESCNet, Policies and Procedures, for the college
policies concerning the adherence to the Family
Rights and Privacy Act and related student record
security policies.
What Would You Do?
Example #1
“Do I have a financial hold on my account?” asks Neve R.
Paiz to the center staff member over the phone. “Yes you
do” said the student account clerk. FERPA Violation?
Example #1 Answer
On the phone? FERPA says we do not
need a signature to release to the student;
but are we sure that is the student?
Have you taken steps to ascertain that this
is actually the student calling by having the
caller provide a unique combination of
information?
Example #2
Lai Zee’s advisor has been sending emails to her for 3
weeks asking why Lai Zee has missed her appointments.
No reply. Having no luck with email, the advisor locates
the student’s home phone number. The advisor calls the
number and gets sent to voicemail. (“You have reached
123-4567; please leave a message at the tone”). The
advisor then says, “This message is for Lai Zee; please
contact me asap; I am concerned that you will not earn
credit for your studies. Let’s talk about your options”.
Is this a FERPA problem?
Example #2 Answer
Leaving a message on voicemail presents the
potential problem that someone other than the
student may access the message; therefore
only Directory Information could be included.
– Is student progress and academic
achievement information Directory
Information? NO
Example #3
Special Agent 99 comes to a college office and states that
the FBI is investigating a possible interstate book selling
scam, and requests information on all students dismissed
for student conduct reasons and bookstore purchases of
three students. After seeing the badge and revolver the
agent displayed, the college office provided the
information.
Was this a problem?
Example #3 Answer
Was this a problem? Yes.
Student conduct information is considered educational record
information, therefore FERPA does apply.
An FBI agent doing an investigation does not meet any
exception condition in the regulations that does not require a
student signature. Therefore a lawfully issued subpoena or
court order or ex parte order coming the from the Attorney
General is required.
Example #4
The local new car dealer has asked for a list of all new
graduates, including addresses, so that they can send
information about “new graduates purchasing discounts.”
Such information is listed as Directory Information. But
the request is denied. The dealer, also a member of the
College Council and recent attendee at a FERPA training
session, responds by saying that since you have names
and addresses as Directory Information, in accordance
with FERPA you have to give that information to the
dealer.
True? False?
Example #4 Answer
False. Release of Directory Information is
totally discretionary. FERPA has no
requirements as to the release of Directory
Information.
In addition, we have an ESC Policy that
prohibits the release of lists of Empire State
College graduates to organizations or
individuals for commercial purposes.
Example #5
“Did you give me a ‘No Credit’ for Public Policy?” the young
man asked Professor Plum as they were waiting in line at the
coffee shop downstairs from the center. The student’s
girlfriend looked quite defiant as she stood next to him, cell
phone attached to her ear. “Yes I did” responded Professor
Plum.
FERPA Violation?
“And furthermore, as your academic advisor I must inform you
that due to your less than stellar performance this semester you
are on academic warning” the professor added, as he paid for
his Caffe Americano and left the coffee shop.
FERPA Violation?
Example #5Answer
The fact is that students request educational record information
on a regular basis in such environments. Thus the response to
the question about the outcome was not a violation.
However, the providing of unsolicited information, “You are
on academic warning” was a violation, because the student had
not specifically requested the information, and the professor
released this information to other third parties by adding this to
the conversation in a public place without the signed release
from the student. Keep in mind that the professor could have
deferred in delivering the information, and should have said
“come to my office and we can discuss” or “let’s make an
appointment to discuss your progress.”
Further
Questions/Discussion