FERPACaseStudieswithAnswers
Posting Grades
JohnFacultyistiredoftakingphonecallsfromstudentstofindouttheirgradesaftereveryexamination,so he decidedtoposttheirgradesonthewalloutside hisoffice door. Shouldhe dothis?Ifyes,arethereany limitations to themanner inwhich he poststhem?
Ingeneralthisisnota goodpracticesincestudentsmayviewtheir gradeselectronicallyinnear real-time. However,iftheinstructor decidestopostgrades,theymustbepostedinsucha mannerknown onlytothe individualstudentandtheinstructor.Forexample,acodeestablishedatthebeginningofthetermcould work. Grades should not be postedinthe same order asaclass rosterorinalphabeticalorder.
Student ID Numbersas DirectoryInformation
Yourinstitution isreviewingwhetherornotyourlistofdirectory informationitemsshouldbeupdated.Itwas proposedthatstudentIDnumbers(SIN) shouldbeincludedsothatitcouldbelistedintheonlineStudentDirectory. Are there any FERPAconsiderations?
The 2009regulations establishthat studentIDnumberscannot be considereddirectory informationitemsunless expresslynecessaryaselectronicidentifiers,andonlyinconjunctionwithothersecurityprotocols. Theamendmentsalsoconfirmed thatsocialsecuritynumberscannever bedirectory information norused in confirming di- rectoryinformationwithout asignedconsent.Student IDnumbersshould not be usedtopost grades,inwholeor part. (Note:w901xyzis public,studentU IDnumber isnot.)
Parents who are Employed at the Institution/”Legitimate Educational Interest”
StephanieStudentattendsColeCollegeasanundergraduate.HerfatherisafacultymemberandwantstofindouthowStephanieisdoinginschool.Hecallstheregistrar’soffice tofind out. How should the office respond?
Thefatherdoesnothavealegitimate“needtoknow”Stephanie’srecordeventhoughheisonthefaculty.Youneedtoget a signedconsent from Stephanieor showdependency.
Faculty Access to Admission Records
FredFacultywantstoreviewtheadmissionsfile,includingtranscriptsforstudentscurrently inhisprogram.Is thispermissible?
In general, faculty membersdonothave alegitimate need-to-knowtoaccess admissions files once an
admissions decisionhas beenmade.
Sole Possession Notes
JoeStudent isassignedtoAnnieAdviser.At onepointduringtheyear,heasksif he mayview hiseducation
record,includingeverythingthatAnniehaswrittenabouthim.Heisconcernedaboutwhatpersonalinformation Anniehasincluded.DoesFERPAallowaccesstoallofhisrecord?Ifnot,canhestillseehisrecord?Ayearlater, JoeisnowassignedtoBillAdviser,who “inherited”Joe(andhisrecord)fromAnnie.IfJoeasksto seehisrecord again, would there be anylimitations? Howshould theinstitutionrespond?
Records“withintheexclusivecontrolof themaker” donotneedtobereleased,althoughtheconcept of “sole possession”recordsisthat theyarememory-joggingtypes ofnotes,notameansbywhichto“hide”important studentrecordsinformation. Therestmustbereleasedafter removingreferencestootherstudents. Oncegiven toBillAdviser,the entire recordbecomes aneducation record,accessible toJoe.
ClassWeb-basedDiscussionSites
FredFacultyteachesacoursethathasaWeb-baseddiscussioncomponent.Classmemberscanseeeachother’s
email addressesand name. It isnot open to the publicfor vieworuse. Are there anyFERPAissues?
Sincethediscussionsiteis onlyaccessibletostudents intheclass,thereisnoFERPAissue.Itisadvisableforthe facultymembertoremindclassmembersthatthediscussionthreadsshouldnotbesharedwith othersoutside theclasswithoutpermissionfromtheauthortodoso.Nonon-directoryinformationshouldbedisplayed onthe site.The 2009FERPAregulations specificallystatethatstudentusernamescan bedisplayed toothersin a class, evenif the studentsinquestionhave chosen“norelease” fortheir directory information.
ClassWeb-basedDiscussionSites,Part2
InstructorIvanawantstomakeheronlinecoursemanagement pagespubliclyaccessibletoanyone.Arethere
FERPAimplicationsformaking thisinformationavailable toindividualsbeyondthe course?
Yes. Specificcourseregistrations and personally identifiableclass materialsfrom studentsarenotdirectory in- formation.Therefore,theyshouldnotbepublicallyaccessible.Additionally,theremaybestudentsinthe course whohave chosen “norelease”for their directory information;displaying their information effectively
disregardsthisrequest.Theinstructor canofferavoluntary“public”versionofhercoursebutcannotcompelstudents toparticipate.
Podcasting Classes
ProfessorPendergastwantstopubliclypodcasttheentirecontent ofhiscourses.Thisincludesclass discussion. Hedecidesthisshortlybeforethetermbeginsandhasn’tnotifiedregisteredstudentsthatthiswillbe occurring. What are the FERPA implications for thispractice?
Student participationinclass discussions shouldnotbe made public without their expresswritten permission.
DistanceEducationCourseEnrollment
Yourinstitution isincreasinglyenrollingstudents inonline coursework. Astudentin oneofthose classesasked youifhereducationalrecordwascoveredbyFERPAinthesamemannerasstudentstaking classesin thetraditional way.Whatdo you tell her?
The2009regulationsclarifythateducationrecords onstudentsinnon-physicalpresencecircumstancesare subjecttoFERPA.
DataBreach
ProfessorPaulsoncallsyouintheregistrar’soffice totellyouthathislaptop wasstolen.Therewere student
recordfilesonthemachine,includinggrades.ArethereanyFERPAissues?Otherlegalissues?Whatadvicemight yougive the professor?
Itwould bea violation ofFERPA, albeitcompletely unintended, ifthethiefwasabletoaccess the“student
identifiableinformation”beyondanydirectoryinformation.Thiswould constituteinappropriatereleaseofinformationtoa“third party.”
The2009regulationstoFERPAoutlinesomeguidelinesandrecommendationsforsafeguardingand
respondingtodatabreaches.Suggestedresponsesfordatabreaches andotherunauthorizeddisclosuresinclude:
* Reportingtheincidenttolawenforcementauthorities.Dependingonthenatureofthebreach,youmayalso havestateorfederallegalobligations.Forexample, ifthedatafilescontainedSSNs,manystateshavereport- ingandnotificationrequirements.
* Takingstepstoretrieve data andprevent furtherdisclosures.
* Identifyingallaffectedrecordsandstudents.Itmaybeappropriateandevenrequiredforyoutonotifythe students affected.
* Determining how the incident occurred.How can youprevent similarfuture exposures?
*Determiningwhetherinstitutionalpoliciesandprocedures werebreached.Doyouhavepoliciesrelated to breaches,encrypting studentdataonlaptops,the appropriatenessof student dataonlaptops,etc.?
* Conductingarisk assessment.
Non-CreditCourses
JanetAdviserfromyourcontinuingeducationdivisionasksyouwhetheror nottherecordsforstudentsinthe non-creditclassesoffered by CEDare covered under FERPA. Are they?
Iftherecordscontainpersonally identifiableinformationaboutstudentsandaremaintainedinanywaybythe institution, thenthefact thattheyarenon-creditisnotrelevant.Theyareeducationrecordsandarecoveredby FERPA.
HighSchoolDualEnrollmentStudents
Melanieisaseniorinhigh schooland isalsotaking classesatLCC,thelocalcommunity college. Theclassessheis takingat LCC count both for highschool and collegecredit. HowdoesFERPAapply to her educationrecords?
FERPAappliestobothprimary/secondaryandcollege/universityrecords,butindifferentways.For
postsecondaryenrollment,the“ownership”oftheeducationrecordisvestedwiththestudent,regardlessofhis orher age.However,untilastudentbegins collegeworkor turns18,whicheveroccursfirst,the“ownership” ofastudent’seducationrecordis consideredheldbythestudent’sparentsor legalguardians.Thus,thetypical record for a highschoolstudentismanaged by thestudent’sparents. Thatiswhygrades andother education records informationforhigh schoolstudents are routinely releasedtoparents.
However,thatisnottrueforacollegestudent.Unlessthestudenthassignedaconsentformortheparents
haveestablished thestudent’sdependency statuswiththeinstitution, grades arenotroutinely released to
parents.
Inthisscenario,Melanieisbothahighschoolandacollegestudent.Theuniversityshouldtreatherasit
wouldany other collegestudentand her records aretreatedaccordingly aswell.Moststateprovisions for postsecondaryenrollment option(dualenrollmentstudents)containreportingrequirements, includinggrades, backtothehighschoolor secondaryschooldistrict.Sinceitisroutineformosthighschoolstocommunicate grade information toparents, the likely resultisthatLCCreleases grades to Melanie, and toMelanie’s high school. Inturn,the high schoollikely releasesgradeinformationtoMelanie’s parents.
Talking withParents
YoureceiveacallfromDaveandKathySmith,theparentsofoneofyourformerstudents.Theirson, Kevin,was dismissedoverayearago.Daveand Kathy live in Floridaand havebeenpaying Kevin toattendyour collegefor everytermduringthelastthreeyears,includingroomandboardandout-of-statetuition.They calledtosee how thingswere goingsince theydon’thear much fromKevinaboutschool. Howdo youhandle thisconversation?
FERPApermitsdisclosure ofinformationfrom educationrecordstoparents ofstudentsinafewdifferent
circumstances:
* Ahealthor safety emergencysituation.
* Whenthestudenthasbeenfoundinviolationofconductrelatedtoacontrolledsubstanceoralcoholandis underthe ageof 21.
* When the student is dependent basedonthe IRSdefinitionof “dependency.”
* When youhavewritten permissionfromthe student.
Here,prior consent is requiredto releaseanythingbutdirectoryinformation. However,so longasKevinhasnot optedoutof directoryinformationthroughtheRegistrar’sOffice,theschoolofficialcouldinformthe parentthat Kevin isnota studentattheinstitution. You cannottelltheparentshewasdismissed. Also, considerpracticaltips for talkingwith theparents.Findout what theyalreadyknowandthenbuildfrom it.If appropriate,discussuseof thedependencyexceptionforprovidingaccessto Kevin’srecord.
AccessbyDivorcedParents
Frank’s parentsaredivorced.By agreement,hismotherclaimshim as dependent,buthis fatheris requiredto payhiswaythroughcollege.FrankandhismotherhavebothrefusedtotellFrank’sfatheranythingabouthis academic progress at StateCollege. Frank’s fatherturns totheinstitution forhelp.Can theinstitution givehim the information?
Theregulationsallowrelease ofinformationtoeither parentifthestudentisclaimedasadependent oneither parent’staxes.Theinstitutionshould obtainacopy ofthetaxreturnvalidatingdependencypriortodisclosing theinformation.Thefathermayneedtoresorttocourtactiontogainaccesstotheeducationrecords information.
PrivateCauseof ActionunderFERPA
RalphStudentfeelsthat hiscollegerecordshavebeenreleased inappropriately.CanRalphuseFERPAtobringa suitagainstthe college?Whyorwhynot?What otheroptionsmighthehaveaswell?How shouldtheinstitution respond?
ThereisnoprivatecauseofactionunderFERPA.ThisissuewasconfirmedbytheU.S. SupremeCourtin Gonzaga Universityand RobertS Leaguev. JohnDoe, a 2002decision. Thestudentmightwanttopursueaction underaCommonLaw remedy, such aslibelor slander.
ScholarshipEligibilityReviews
Youaretalkingwitha memberofanalumnigroup. Theyareestablishinganewscholarship tobeofferedtostu- dentsfromtheirlocalareawhoareattendingyourinstitution.Theevaluationoftheapplicationswillbedoneby a scholarship board fromthealumnigroup. Thealumnushasasked youfor thenames, addressesandGPAsforall the currently-enrolledstudentsfromthat area.Whatshould yougive them?
Sincethealumniarenotemployeesoftheinstitution,theycouldnotgenerally beprovidedpersonally
identifiableinformationfrom studentrecords.Therefore,youshould onlyreleasedirectoryinformationtothem.However,ifstudentsapplyingfor financialaidhavegiven writtenpermissiontoreleaseinformation tothirdpartiesin reviewing alltheirfinancialaidopportunities, youcould releasetheirinformation.
Implied ConsentandFERPA
TedStudentisaveryoutspoken andwell-known student-athleteatBarrett University.Inarecentnews
conferencehediscussedagreatdealofinformationabouthisacademicanddisciplinaryrecord.Anosyreportercalls youinthe registrar’soffice toconfirmtheinformationand to get some moredetails. Whatshould youtell him?
Youcanonlygive outdirectoryinformation (assuming Ted doesnothavea “norelease”). Eventhoughthestu- dentmadetheinformationpublic,youstillneedastudentreleaseinorder toreleaseor,inthiscase,confirmit. Thereisnoimplied consentwithFERPA.Aneffectivestrategywouldbetoprovidethereporter withaconsent formandsuggestgettingthestudent’ssignatureonit.Thisplacestheburdenonthestudenttodecidewhether ornot toreleasetheinformationto the reporter.