Training for Student Workers MGH Institute of Health Professions
What is FERPA? The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of student education records. FERPA was passed in 1974 and is one of the oldest federal privacy laws. It prohibits schools from releasing student “education records” without the consent of the eligible student. FERPA applies to all schools that receive federal funding. All students enrolled in institutions of higher education, regardless of age, own their FERPA rights.
Defining Educational Records Records, files, documents, and other materials that contain information directly related to a student and which are maintained by an educational agency or institution or by a party acting for the agency or institution. This is very broad definition as it encompasses paper files, electronic files, video recordings, audio recordings, and other data. Educational records are made up of “Directory” (described in upcoming slides) and “Non-Directory” information.
Student Rights Student rights begin when a student registers for courses for the first time. These rights include: Inspection and review of educational records. Requesting an amendment of educational records. Consent to the disclosure of educational records. Filing a complaint with the FERPA office in Washington, D.C. Obtaining a copy of the school’s FERPA policy. The Institute publishes its FERPA policy in the most current
online catalog under the Students Rights to Privacy Information – FERPA section and students are informed in our Annual Notice to Students. FERPA information can also be found on the Registrar’s section of our website.
How is FERPA enforced? FERPA is legally enforced through the Department of Education’s Family Policy Compliance Office. People cannot sue a school for violating FERPA. This was addressed by the U.S. Supreme Court in Gonzaga University v. Doe. FERPA authorizes the Department of Education to end ALL federal funding to a school. This penalty is rare. In all of FERPA’s history, this sanction has never been imposed on a school.
What isn’t covered by FERPA? Sole Possession (personal) notes Used only to aid your memory. Kept for your own use. Are not shared with anyone. If you share these with anyone, including school officials, they become FERPA records. Observations or personal knowledge; Example: overhearing a student making a threatening comment, a student’s demeanor or mood, etc. Law enforcement/public safety records; Maintained solely for law enforcement purposes. Employment records; As long as employment is NOT connected to student status. Treatment records; Made and maintained by a health care professional as part of medical/psychological treatment of the student.
Directory Information Information contained in an education record of a student which would not generally be considered harmful or an invasion of privacy if disclosed. (1988 Final Regulations)
Directory information as defined by the Institute: Name, address, telephone listing, email Address, Photograph, Date and Place of Birth, Class, Enrollment Status, Major Field of Study, Participation in official recognized activities, Dates of attendance, academic honors, Degrees and awards received, the most recent previous educational agency or institution attended.
Directory Information Students may opt to restrict the release of their Directory information.
FERPA flags will not exclude the student from appearing on internal reports used by school officials with legitimate educational interest.
The only exclusion that applies to school officials is the release related to internal mailing lists based on ethnicity.
Students may set these flags by going to IONLINE and setting their privacy options.
Please note that any requests for directory information on individual students or groups of students should be sent to the Registrar’s Office.
Disclosure The Institute may disclose directory information without consent. The Institute must allow eligible students a right to opt out of the
disclosure of directory information.
The Institute must have written permission from the student to
release any part of their education record that is not considered to be directory information.
Exceptions to the previous bullet include, but are not limited to, School official with legitimate educational interest (defined in upcoming slide). Subpoena or court order. Health or safety emergency.
Disclosure (continued) DISCLOSURE TO PARENTS: At institutions of higher education, FERPA rights belong to the student , and parents are generally not entitled to access the student’s record without the student’s written consent. According to federal law, disclosure to parents is permitted, but not
required, only in the following situations.
If the student is claimed as a dependent for federal income tax
purposes. Note – this is up to the individual Institution. In a health or safety emergency. If the student is under 21 years old, and the information involves disciplinary records about an incident involving the possession of drugs or alcohol. It is important to note that the Institute has chosen not to communicate any non-directory education record information to parents without written consent from the student.
Legitimate Educational Interest Non-directory (confidential) education records can be released without the student’s prior consent to an Institute official with legitimate educational interest, which is defined as: Performing a task that is specified in his/her position description or contract. Performing a task related to a student’s education or a student’s discipline. Providing a service or benefit to the student. Maintaining safety and security on campus.
Student Employees Student employees may have access to the student information system (Ellucian), provided that job responsibilities require it. If you supervise a student employee it is your responsibility to insure that they understand FERPA and the importance of keeping student records confidential even if they do not have access to Ellucian. The Student Employee FERPA Statement of Understanding must be signed by the student employee. (Handled by HR)
Protection of Student Data Electronic educational record data should only be accessed through your Institute logon and password and must be stored on Partners home drives or shared network drives. Non electronic educational record information must be stored in secured/locked locations. Use discretion when sending data via e-mail.
Never include the SID/SSN in the subject line of an e-mail. Do not send student information to or from non-IHP e-mail addresses.
How do FERPA regulations apply to COVID-19?
Here is a link to the Department of Education’s FERPA & Coronavirus Disease 2019 (COVID-19) Frequently Asked Questions (FAQ’s).
Review The next set of slides will take you through various scenarios you might encounter. Try to answer each question before reviewing the correct answer in order to test your knowledge.
Your friend calls you and asks if you can make a copy of her transcript because her insurance company needs it. Can you do your friend this favor?
No. You should refer your friend to IONLINE to make a request for a transcript online. Even if your job responsibility includes making copies of transcripts for this reason, your friend should go through the proper process to request it.
A person walks into your office with a signed letter giving consent to release the grades of a current student. Do you release the information contained in the letter to him/her? No. You should direct the individual to the Registrar’s Office.
A person comes into your office and retrieves information about a student from a computer that you left unattended. Under FERPA, are you responsible? Yes. he medium in which the student information is maintained is unimportant. The same answer would apply to a report or file on a student that you left on your desk. It is your responsibility to insure that no student information is left accessible or unattended, including data on your computer.
When do the FERPA rights of a student begin? 1) At the point of application. 2) At the point of admission. 3) When the student makes payment. 4) When the student registers for courses for the first time? Number 4. The FERPA rights of a student begin when the student is first registered for courses.
Information would be considered part of an education record based on which of the following? 1) It was directly related to the student and officially maintained by the Institute . 2) Kept only in the Registrar’s Office. Number 1. An educational record is information that is directly related to the student and maintained by the institution. Information does not need to be kept only by the Registrar’s Office in order to be considered an educational record.
You are concerned about a friend as he has not been going to classes this semester. You have access to see matriculation information as part of your duties and decide to look to see if he is on academic probation . You find out that he is and you confront your friend with this information. Is this a violation of FERPA? Yes. This is a violation of FERPA. Even if you do not disclose this information to anyone else, simply looking up this information could result in serious consequences such as loss of employment and possible disciplinary action by Student Conduct and Academic Integrity Programs.
Which of the following would NOT be considered educational record information? 1) A student’s library suspension. 2) The grade from a student’s term paper. 3) Date of birth. 4) Student email address. Number 1. A library suspension would be a record kept by the Treadwell Library for library access purposes only and would not be covered by FERPA. All of the other items would be considered pieces of the educational record and therefore would be covered by FERPA.
At the Institute do parents have the same rights as students to access the student’s educational record? What if they are the one who pays for the student’s books and housing meal plan? No. parents do not have the same rights as students to access the student’s educational record. The Institute requires written consent from the student to release information to any party, including the parent.
A special agent with the FBI arrives at your office with a subpoena for educational records? Should you comply with their request? No. you should not. You should refer them to the Registrar’s Office who will handle the processing of the subpoena, including coordinating the collection of any educational records from your department or unit.
Your friend stops by to see you during your break and asks you if you can look up their class schedule. Can you do this? No. Direct your friend to look up their class schedule on IONLINE.
True or False: FERPA says that the Institute must release to anyone, upon request, any information identified as directory information. False. The Institute considers the PURPOSE or USE of the data in determining if releasing such information is necessary. FERPA states that institutions may release directory information not that we have to release directory information. In addition to FERPA that are other policies by which we must abide, including, but not limited to, Institute/Partners privacy policies and practices.
If you are granted access to Ellucian, our student datatbase, that means that you have the right to inspect the educational records of any student attending the Institute without giving a reason. False. FERPA states that you must have a legitimate educational interest when you access or view a student’s educational record without their consent. This means that you can only access the information on those students that is required to fulfill any professional responsibility you have to the student or the Institute.
Your coworker doesn’t have her access to Ellucian yet and asks you if she can use yours. Can you give it to her? No. You should never allow another person to use your access. You are responsible for any action that is taken with your User ID and many actions in Ellucian are tracked. It is also a violation of the security policy you signed when you were given your access and abuse of your access to any system can be permanently revoked for misuse.
There is a box of old transcripts in your department and you are asked to throw them away. Is it okay for you to place them in the recycle bin in the kitchen?
No. Any papers containing personally identifiable information should be shred and not placed in a recycle bin or trash bin.
A student calls you and asks what grade she received in a course. Can you tell her what grade she received over the phone? No. You should never discuss educational records over the telephone. Encourage students to log into their IONLINE account to view their grades.
In Review Check the NAE screen in DATATEL before you answer any questions. If there is a restriction, you may not release the information. Non-directory information may be released to third parties with a signed and dated written consent from the student. The consent must specify: What educational records are to be disclosed; The purpose of the disclosure; Identify the party or class of parties to whom the disclosure may be made.
REMEMBER You must protect the rights of
students. When in doubt…don’t give it out and always refer questions to the Registrar’s Office.
Thank you for completing FERPA training for Student Employees at the MGH Institute of Health Professions