FERPA TUTORIAL

Georgia Institute of Technology Office of the Registrar

FERPA Highlights

This tutorial is not an exhaustive accounting of FERPA regulations.

What it seeks to do is highlight some of FERPA’s important provisions that are appropriate for the Georgia Tech audience.

What is FERPA?

• The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law, signed in 1974, that protects the privacy of student education records.

• It affords eligible students certain rights with respect to their education records. (An “eligible student” under FERPA is a student who is 18 years of age or older or who attends a postsecondary institution.)

To whom does it apply?

• Applies to all students who attend post-secondary institutions.• GA Tech defines “in attendance” as registered for classes

for the first time.• FERPA continues to apply even if the student does not

continue enrollment beyond the first term of attendance.

• Does not apply to: • Applicants who are denied admission.• Those applicants who were accepted but did not

attend.

What are the rights under FERPA?

The right to inspect and review the student's education records within 45 days after the day Georgia Tech receives a request for access.

• A student should submit to the registrar, dean, head of the academic department, or other appropriate official, a written request that identifies the record(s) the student wishes to inspect.

• The school official will make arrangements for access and notify the student of the time and place where the records may be inspected.

• If the records are not maintained by the school official to whom the request was submitted, that official shall advise the student of the correct official to whom the request should be addressed.

What are the rights under FERPA?

The right to request the amendment of the student’s education records that the student believes is inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA.

• A student who wishes to ask the school to amend a record should write the school official responsible for the record, clearly identify the part of the record the student wants changed, and specify why it should be changed.

• If the school decides not to amend the record as requested, the school will notify the student in writing of the decision and the student’s right to a hearing re garding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.

What are the rights under FERPA?

The right to provide written consent before the university discloses personally identifiable information (PII) from the student's education records, except to the extent that FERPA authorizes disclosure without con sent.

• The school discloses education records without a student’s prior written consent under the FERPA exception for disclosure to school officials with legitimate educational interests.

• A school official is a person employed by Georgia Tech in an administrative, supervisory, academic, research, or support staff position (including law en forcement unit personnel and health staff); a person serving on the board of trustees; or a student serving on an official committee, such as a disciplinary or grievance com mittee.

What are the rights under FERPA?

• A school official also may include a volunteer or contractor outside of Georgia Tech who performs an institutional service of function for which the school would otherwise use its own employees and who is under the direct control of the school with respect to the use and maintenance of PII from education records, such as an attorney, auditor, or collection agent or a student volunteering to assist another school official in performing his or her tasks.

• A school official has a legitimate educational interest if the official needs to review an educa tion record in order to fulfill his or her professional responsibilities for Georgia Tech.

What are the rights under FERPA?

The right to file a complaint with the U.S. Department of Education concerning alleged failures by Georgia Tech to comply with the requirements of FERPA. The name and address of the Office that administers FERPA is:

Family Policy Compliance OfficeU.S. Department of Education400 Maryland Avenue, SWWashington, DC 20202

Disclosure Without Consent

• FERPA permits the disclosure of PII from students’ education records, without consent of the student, if the disclosure meets certain conditions found in §99.31 of the FERPA regulations. Except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the student, §99.32 of FERPA regulations requires the institution to record the disclosure. Eligible students have a right to inspect and review the record of disclosures.

What is an “education record”?

The term means those records that are:(1) Directly related to a student; (2) Maintained by an educational agency or institution or by a party acting for the agency or institution; and(3) Maintained by the institution in any format that is identifiable to the student.

What is included in directory information at Tech?

"Directory Information" is information not generally considered harmful or an invasion of privacy if disclosed. Effective November 1, 2009 the Georgia Institute of Technology considers the following information to be directory information:• Name, address (including GT email address), and telephone

listing• Level (graduate or undergraduate)• Field of study• Enrollment status (full-time, part-time, less than part-time)• Dates of attendance• Degrees with associated honors and designations, and date(s)

awarded• Anticipated date of graduation

Can students request confidentiality?

Yes, the information and procedures are on the Registrar’s Office web site.

How is this recorded in Banner?

If a form is turned in, the “confidential box in Banner will be checked and on all student forms in Banner the word *confidential* will appear in the upper left corner. Students may change their confidential designation at any time.

How is the confidential flag in Banner used?

• The confidential nature of a students information is indicated in Banner when a student submits a request to the Registrar’s Office. It is effective immediately.

• Those who have access to student information need to be aware of this when:• Performing their ordinary duties• Answering questions about student records, as

appropriate• Running reports and storing student data

Are international students covered?

• International students have the same rights as domestic students under FERPA.• inspect their records• request amendments• protect privacy• report violations

• International students consent to release of their information to certain governmental agencies on various forms.

• Department of Homeland Security requirements exist.

What about applicant records?

• Our definition of “in attendance”, when FERPA takes effect, is related to the point at which an incoming student registers for classes.

• As soon as an incoming, admitted student registers for classes, FERPA applies.

• Our FERPA policy includes a statement on applicant records and how we treat them at Tech. We consider them confidential as a matter of internal policy, although they are not protected under FERPA.

How do we handle records of deceased students?

• Under common law regarding privacy rights, the privacy interests of an individual expire with that individual’s death (AACRAO 2001 FERPA Guide, pg. 21). The disposition of records held by an institution is not a FERPA issue, but rather a matter of institutional policy.

• For more guidance in this area, please contact the Registrar’s Office.

Why do we have to comply?

From the Family Policy Compliance Office (FPCO):

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

What does “receives funds” mean?

(c) The Secretary considers funds to be made available to an educational agency or institution if funds under one or more of the programs referenced in paragraph (a) of this section-

• (1) Are provided to the agency or institution by grant, cooperative agreement, contract, subgrant, or subcontract;

• or (2) Are provided to students attending the agency or institution and the funds may be paid to the agency or institution by those students for educational purposes, such as under the Pell Grant Program and the Guaranteed Student Loan Program (Titles IV-A-l and IV-B, respectively, of the Higher Education Act of 1965, as amended).

Source: http://www.ed.gov/policy/gen/reg/ferpa/rights_pg2.html#1

Does FERPA ever change?

December 9, 2008 Final Rules from the US Dept. of EducationChanges related to:

• student attendance• biometric records• use of student ID• conditions for disclosing directory

information• education records• outsourcing, transfer of education

records• USA Patriot Act• registered sex offenders• re-disclosure of records• de-identified records• subpoenas• health and safety exception

Yes, these changes are reported through the Federal Register and organizations such as AACRAO. Legal Affairs and the Registrar’s Office are on alert for these events.

Does it matter how we release the information?

The release of personally identifiable information to any party can occur in oral, written, electronic or any other means.

• This means we have to remain aware of what we are saying in regard to FERPA protected student information.

• It means we have to be aware of what we are putting in writing.

• It means we have to be aware of what we are communicating via email.

• Etc.

Who is responsible for enforcing FERPA?

• Generally speaking, all Institute employees who have access to records are responsible for guarding the confidentiality of those student records.

• Specifically, requests for access to records, requests for amendment of records and complaints regarding any violation of FERPA are to be filed with the Office of the Registrar.

Do we allow parents access to information?

• FERPA rights transfer to a student when s/he enters a postsecondary institution or becomes 18 years of age.

• An institution may choose to allow disclosure to parents, but is not required to do so. This varies from institution to institution.

• We do not have a blanket policy or form, but deal with individual requests on a one-time basis for a very specific need.

How do parents find information on our policy?

The information is on our web site and is covered during FASET presentations.

What if I want to find more information?

The U.S. Department of Education web site is the best source of official and complete information on the law and related information.

As a faculty member or staff member what should I do?

• Do follow the guidelines provided here and refer requests for information that you are not sure about to the Registrar’s Office.

• Do keep only those individual records necessary for the fulfillment of your duties and remember that compliance is everyone’s job.

• Do work with your technical staff and your supervisor to keep those records in a safe and secure manner.

• Do contact the Registrar’s Office if you have any questions about FERPA or about the applicant records policy.

As a faculty member or staff member what should I not do?

• Do not post FERPA protected information in any format in any public location.

• Do not share information from student educational records with others outside the institution.

• Do not be pressured by anyone to release information when it is not allowed. If you feel pressured, contact the Registrar’s Office for assistance.

• Do not store personally identifiable information on a laptop, flash drive, unprotected server, or in other formats that are not secured.

• Do not leave graded exams, homeworks, etc. in a public area for students to review or pick up.

• Do not forget that email is an insecure medium and limit the amount of information that is transmitted back and forth.

• Do not run reports and store them over a period of time more than one year. When requesting or running a report, request only the information that you need to perform your duties.

• Do not forget that confidentiality requests are coded in Banner.

Why is this important to us?

• We care very much about our students.

• It’s the law.• It’s our job.• Breaches have negative impacts on

the Institute’s reputation.• Breaches have negative impacts on

staffing resources – dealing with them is time consuming.