Training for Faculty and Staff MGH Institute of Health Professions
What is FERPA? The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of student education records. FERPA was passed in 1974 and is one of the oldest federal privacy laws. It prohibits schools from releasing student “education records” without the consent of the eligible student. FERPA applies to all schools that receive federal funding. All students enrolled in institutions of higher education, regardless of age, own their FERPA rights.
Defining Educational Records Records, files, documents, and other materials that contain information directly related to a student and which are maintained by an educational agency or institution or by a party acting for the agency or institution. This is very broad definition as it encompasses paper files, electronic files, video recordings, audio recordings, and other data. Educational records are made up of “Directory” (described in upcoming slides) and “Non-Directory” information.
Student Rights Student rights begin when a student registers for courses for the first time. These rights include: Inspection and review of educational records. Requesting an amendment of educational records. Consent to the disclosure of educational records. Filing a complaint with the FERPA office in Washington, D.C. Obtaining a copy of the school’s FERPA policy. The Institute publishes its FERPA policy in the most current
online catalog under the Students Rights to Privacy Information – FERPA section and students are informed in our Annual Notice to Students. FERPA information can also be found on the Registrar’s section of our website.
How is FERPA enforced? FERPA is legally enforced through the Department of Education’s Family Policy Compliance Office. People cannot sue a school for violating FERPA. This was addressed by the U.S. Supreme Court in Gonzaga University v. Doe. FERPA authorizes the Department of Education to end ALL federal funding to a school. This penalty is rare. In all of FERPA’s history, this sanction has never been imposed on a school.
What isn’t covered by FERPA? Sole Possession (personal) notes Used only to aid your memory. Kept for your own use. Are not shared with anyone. If you share these with anyone, including school officials, they become FERPA records. Observations or personal knowledge; Example: overhearing a student making a threatening comment, a student’s demeanor or mood, etc. Law enforcement/public safety records; Maintained solely for law enforcement purposes. Employment records; As long as employment is NOT connected to student status. Treatment records; Made and maintained by a health care professional as part of medical/psychological treatment of the student.
Directory Information Information contained in an education record of a student which would not generally be considered harmful or an invasion of privacy if disclosed. (1988 Final Regulations)
Directory information as defined by the Institute: Name, address, telephone listing, email Address, Photograph, Date and Place of Birth, Class, Enrollment Status, Major Field of Study, Participation in official recognized activities, Dates of attendance, academic honors, Degrees and awards received, the most recent previous educational agency or institution attended.
Directory Information Students may opt to restrict the release of their Directory information.
FERPA flags will not exclude the student from appearing on internal reports used by school officials with legitimate educational interest.
The only exclusion that applies to school officials is the release related to internal mailing lists based on ethnicity.
Students may set these flags by going to IONLINE and setting their privacy options.
Please note that any requests for directory information on individual students or groups of students should be sent to the Registrar’s Office.
Disclosure The Institute may disclose directory information without consent. The Institute must allow eligible students a right to opt out of the
disclosure of directory information.
The Institute must have written permission from the student to
release any part of their education record that is not considered to be directory information.
Exceptions to the previous bullet include, but are not limited to, School official with legitimate educational interest (defined in upcoming slide). Subpoena or court order. Health or safety emergency.
Disclosure (continued) DISCLOSURE TO PARENTS: At institutions of higher education, FERPA rights belong to the student , and parents are generally not entitled to access the student’s record without the student’s written consent. According to federal law, disclosure to parents is permitted, but not
required, only in the following situations.
If the student is claimed as a dependent for federal income tax
purposes. Note – this is up to the individual Institution. In a health or safety emergency. If the student is under 21 years old, and the information involves disciplinary records about an incident involving the possession of drugs or alcohol. It is important to note that the Institute has chosen not to communicate any non-directory education record information to parents without written consent from the student.
Legitimate Educational Interest Non-directory (confidential) education records can be released without the student’s prior consent to an Institute official with legitimate educational interest, which is defined as: Performing a task that is specified in his/her position description or contract. Performing a task related to a student’s education or a student’s discipline. Providing a service or benefit to the student. Maintaining safety and security on campus.
Student Employees Student employees may have access to the student information system (Ellucian), provided that job responsibilities require it. If you supervise a student employee it is your responsibility to insure that they understand FERPA and the importance of keeping student records confidential even if they do not have access to Ellucian. The Student Employee FERPA Statement of Understanding must be signed by the student employee. (Handled by HR)
Protection of Student Data Electronic educational record data should only be accessed through your Institute logon and password and must be stored on Partners home drives or shared network drives. Non electronic educational record information must be stored in secured/locked locations. Use discretion when sending data via e-mail.
Never include the SID/SSN in the subject line of an e-mail. Do not send student information to or from non-IHP e-mail addresses.
Review The next set of slides will take you through various scenarios you might encounter. Try to answer each question before reviewing the correct answer in order to test your knowledge.
How do FERPA regulations apply to COVID-19?
Here is a link to the Department of Education’s FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions (FAQ’s).
You receive a call from a recruiting firm asking for the names and addresses of students with a GPA of 3.0 or better. They want to contact the students about exciting job opportunities. Should you give out this information? No. A student’s GPA is not considered directory information and cannot be released in any form without the student’s written consent. Refer the caller to the Registrar’s Office for any clarification.
A person walks into your office with a signed letter giving consent to release the grades of a current student. Do you release the information contained in the letter to him/her? No. You are not able to authenticate the signature on this letter. Please refer this person to the Registrar’s Office.
A person comes into your office and retrieves information about a student from a computer that you left unattended. Under FERPA, are you responsible? Yes. The medium in which the student information is maintained is unimportant. The same answer would apply to a report or file on a student that you left on your desk. It is your responsibility to insure that no student information is left accessible or unattended, including data on your computer.
When do the FERPA rights of a student begin? 1) At the point of application. 2) At the point of admission. 3) When the student makes payment. 4) When the student registers for courses for the first time? Number 4. The FERPA rights of a student begin when the student registers for courses for the first time.
Information would be considered part of an education record based on which of the following? 1) It was directly related to the student and officially maintained by the Institute . 2) Kept only in the Registrar’s Office. Number 1. An educational record is information that is directly related to the student and maintained by the institution. Information does not need to be kept only by the Registrar’s Office in order to be considered an educational record.
Which of the following situations would be a violation of FERPA? 1) Releasing the title of a congressman’s degree to a local newspaper. 2) A faculty member placing graded exams on a table for students to pick up at their convenience. Number 2. Title and graduation information are directory information and can be disclosed. Grades are not. Education records, in ANY FORM, must be kept safe and secure at all times. Placing results to any graded assignments in a publicly accessible area is a violation of FERPA.
Which of the following would NOT be considered educational record information? 1) A student’s library suspension. 2) The grade from a student’s term paper. 3) Date of birth. 4) Student email address. Number 1. A library suspension would be a record kept by the Treadwell Library for library access purposes only and would not be covered by FERPA. All of the other items would be considered pieces of the educational record and therefore would be covered by FERPA.
A special agent with the FBI arrives at your office with a subpoena for educational records? Should you comply with their request? No. You should refer them to the Registrar’s Office who in consultation with the Institute’s counsel, will then handle the processing of the subpoena, including coordinating the collection of any educational records from your department or unit.
Is it permissible for a professor to post student grades on an office door if none of the student’s social security numbers are used? No. Institute faculty and staff are responsible for control of access and protection of student records in their possession. If there is a way for the student to be personally identifiable (via some kind of crosswalk table from student ID or name to any other type of identifier) that still falls under personally identifiable information and would be a violation of FERPA.
A faculty or staff member has the right to inspect the educational records of any student attending the Institute without giving a reason. No. FERPA states that you must have a legitimate educational interest when you access or view a student’s educational record without their consent. This means that you can only access the information on those students when you are required to fulfill any professional responsibility you have to the student or the Institute.
You receive a phone call from an upset parent claiming that there is a family emergency and they need to get in touch with their son/daughter. Can you tell the parents the day, time and location of their son/daughter’s class? No. Course schedules are not considered to be directory information and cannot be disclosed without the student’s consent. Refer the parent to the Registrar’s Office during regular hours of operation, or MGH Police and Security after hours.
The father of a student states that his son received a letter saying that he is “academically deficient” and after reviewing the report the father and son have some questions. Can you answer their questions? No. Academic deficiency and grade information are not directory information and should not be discussed over the phone. You may opt to invite the father and son to meet with you, and at that time ask the student to provide you written consent to discuss his grades with his father. You should do this even if the student will be present during the discussion.
A department chair asks for a list of names and addresses for students enrolled in a specific course. The list will be used to mail out a survey about the quality of the course. Can you provide this to them? Yes. It is permissible to provide this list. The list will be used by a school official (department chair in this case) for a legitimate educational interest.
An academic department is preparing a mailing to students about a critical deadline. Is the department allowed to send this mailing to students who have requested that directory information not be released? Yes. Information for a student who has requested a FERPA restriction on his/her information may be disregarded if the information is being used by a school official with a legitimate educational interest.
A student calls you and asks what grade she received in a course that you taught. Can you tell her what grade she received over the phone? No. You should never discuss educational records over the telephone as it is nearly impossible to know if you are speaking with the actual student. Advise the student to log into their IONLINE account to view their grades.
REMEMBER You must protect the rights of
students. When in doubt…don’t give it out and always refer questions to the Registrar’s Office.
Thank you for completing FERPA training for Faculty and Staff at the MGH Institute of Health Professions