FERPA
Training for Faculty & Staff
Protecting student education records in a university environment
Recommended annual training module
Learning Objectives Identify what FERPA protects and what qualifies as an education record. Explain the roles of the student, school official, and legitimate educational interest. Recognize when student information may be disclosed without written consent—and when it may not. Apply FERPA to email, learning-management systems, grade books, class discussions, recommendation requests, and third-party tools. Respond appropriately to parents, employers, law enforcement, students, and other third parties. Know when to stop and refer a question to the Registrar or the University's privacy/FERPA contact.
FERPA Training for Faculty & Staff | Slide 2
FERPA in One Minute FERPA protects
FERPA does not mean
Personally identifiable information (PII) from student education records.
Faculty can never discuss students.
Privacy of records maintained by or for the institution. Students' rights to inspect/review records and seek amendment. Students' right to consent to disclosures, subject to FERPA exceptions.
FERPA Training for Faculty & Staff | Slide 3
Every disclosure requires a signed form. Directory information can always be disclosed. Parents automatically have access to a college student's records. FERPA is the same as HIPAA, GDPR, or state privacy law.
What Is an Education Record? Records directly related to a student and maintained by the institution or a party acting for the institution. Examples: grades, transcripts, advising notes, disciplinary records, attendance records, student emails kept as records, and records in institutional systems. Format does not matter: paper, email, database, LMS, spreadsheet, audio/video, or other digital format can contain protected information. FERPA is concerned with the information and its relationship to the student—not simply where the information is stored.
FERPA Training for Faculty & Staff | Slide 4
Personally Identifiable Information (PII) Direct identifiers: name, student ID, government ID, or other information that directly identifies a student. Indirect identifiers: combinations of information that could reasonably identify a student. Context matters: a student's major, course, unusual circumstance, or small class can make seemingly harmless information identifying. Rule of thumb: If a reasonable person could connect the information to a specific student, treat it as protected unless you have a clear FERPA basis for disclosure.
FERPA Training for Faculty & Staff | Slide 5
The Core Rule: Consent Before Disclosure FERPA generally requires the student's prior written consent before disclosing PII from education records. Consent must identify the records to be disclosed, the purpose of the disclosure, and the person or class of persons to whom the disclosure may be made. FERPA also contains specific exceptions that permit disclosures without consent. Faculty and staff should not invent their own exceptions. Use an established university process when a disclosure is requested.
FERPA Training for Faculty & Staff | Slide 6
School Official + Legitimate Educational Interest School official
Legitimate educational interest
Faculty, instructors, administrators, registrars, advisors, counselors, and other institutional personnel may qualify.
Access must be needed to fulfill professional responsibilities.
Some contractors or service providers may qualify under the school-official exception when FERPA conditions are met.
FERPA Training for Faculty & Staff | Slide 7
Access is not a general right to browse records. Being curious, knowing the student personally, or having a senior title is not enough. Access only the records necessary for the job.
Directory Information: A Common Trap Directory information is information the institution has formally designated and publicly identified under its FERPA policy. It may be disclosed without consent only under the institution's published directory-information policy and subject to applicable opt-out rights. Directory information as defined by the University: Name, address, telephone listing, email Address, Photograph, Date and Place of Birth, Class, Enrollment Status, Major Field of Study, Participation in official recognized activities, Dates of attendance, academic honors, Degrees and awards received, the most recent previous educational agency or institution attended. Do not assume that information is directory information because it 'seems public.' Check the University's current FERPA notice. An opt-out can restrict directory-information disclosures; follow the University's process before releasing information.
FERPA Training for Faculty & Staff | Slide 8
Parents & Families at the University Level At the postsecondary level, FERPA rights generally belong to the student—not the parent. Parents do not automatically have access to grades, attendance, disciplinary records, advising records, or other protected education records. A parent may receive information in certain circumstances permitted by FERPA or with the student's valid consent. Do not confirm or deny protected information to a parent simply because the caller says they are the student's parent. Route parent requests involving records to the Registrar’s Office.
FERPA Training for Faculty & Staff | Slide 9
Grades & Academic Performance Do
Don't
Use approved LMS and university systems.
Post grades using names or student IDs in public spaces.
Discuss a student's performance privately. Verify the recipient before sending records. Use university-approved methods for recommendations and verification.
Leave graded work where other students can see it. Discuss a student's grade in front of classmates. Email a grade to a personal or unverified address. Send a spreadsheet of grades to a broad mailing list.
FERPA Training for Faculty & Staff | Slide 10
Email, LMS & Digital Records Treat institutional email and LMS content containing student records as potentially protected. Check the recipient, attachment, and student before sending. Use BCC or approved group tools when appropriate; avoid exposing student information to other students. Do not download or store student records on personal devices unless university policy expressly permits it. Do not use unapproved AI, cloud storage, messaging, survey, or educational apps to process student PII. Report misdirected emails, lost devices, or suspected unauthorized access immediately through the University's incident process.
FERPA Training for Faculty & Staff | Slide 11
Third-Party Tools & AI: Stop Before You Upload Before entering student information into an external service, confirm that the service is approved by the University. FERPA's school-official exception has conditions for outsourced services, including institutional control and limits on use and redisclosure. Do not paste identifiable student work, grades, accommodations, advising information, or disciplinary information into a public AI tool unless the University has expressly approved that use. Use de-identified or synthetic examples for experimentation whenever possible. Questions? Contact IT/security, procurement/privacy, or the Registrar before using the tool.
FERPA Training for Faculty & Staff | Slide 12
Scenario 1 — The Parent Phone Call A parent calls: 'My daughter is failing your course. Tell me her current grade and whether she has attended class.' What's the best response? A. Give the parent the information because they are the parent. B. Give the information because the student is under 21. C. Explain that you cannot discuss the student's education records without an appropriate FERPA basis and refer the caller to the Registrar’s Office. D. Give only the attendance information.
Correct Answer: C FERPA Training for Faculty & Staff | Slide 13
Scenario 2 — The Grade Spreadsheet You email a spreadsheet containing student names, IDs, grades, and comments to three faculty colleagues because you want feedback on course performance. Is this automatically permitted? A. Yes—faculty can share any student information with other faculty. B. Yes—because the information is inside the University. C. Only if each recipient has a legitimate educational interest and the disclosure is consistent with university policy and FERPA. D. Yes—if the students are in the same program.
Correct Answer: C FERPA Training for Faculty & Staff | Slide 14
Scenario 3 — The AI Tool A faculty member wants to improve feedback by uploading a student's identifiable paper and grade to a free public AI service. Best practice? A. Upload it because the student gave the paper to the University. B. Upload it if the service says it is secure. C. Confirm that the tool is institutionally approved and that the proposed use complies with FERPA, contracts, security, and university policy; otherwise, do not upload identifiable student information. D. Remove the student's first name and upload it.
Correct Answer: C FERPA Training for Faculty & Staff | Slide 15
Scenario 4 — The Class Discussion During class, a faculty member says: 'Alex earned the highest grade on the exam, while Jordan failed.' What's the concern? A. None—students are already in the same class. B. The faculty member has disclosed identifiable academic information to other students. C. It is allowed because the grades were discussed verbally. D. It is allowed if the faculty member believes the disclosure will motivate students.
Correct Answer: B FERPA Training for Faculty & Staff | Slide 16
What Faculty & Staff Should Do 1. MINIMIZE — Access and share only what you need for the task. 2. VERIFY — Confirm the student's identity and the recipient before disclosure. 3. USE APPROVED SYSTEMS — Keep student records in university-approved systems. 4. KEEP IT PRIVATE — Discuss student records only with people who have a legitimate educational interest or another valid FERPA basis. 5. STOP & ASK — If you're unsure, do not disclose. Contact the Registrar’s Office. 6. REPORT — Immediately report suspected unauthorized disclosure, loss, or access through university procedures.
FERPA Training for Faculty & Staff | Slide 17
Quick Knowledge Check — True or False 1. 'FERPA means faculty can never discuss a student with another faculty member.' 2. 'A parent automatically has access to a college student's grades.' 3. 'Directory information is whatever the faculty member considers public.' 4. 'A verbal disclosure can be a FERPA disclosure.' 5. 'Removing a student's name always makes a record anonymous.' 6. 'When unsure, the best practice is to pause and contact the University's FERPA/privacy resource.’
FERPA Training for Faculty & Staff | Slide 18
Quick Knowledge Check — True or False Answers 1.
False — Faculty may discuss a student with another faculty member when there is a legitimate educational interest, and the disclosure is permitted under FERPA and University policy.
2.
False — A parent does not automatically have access to a college student's grades. Consent or another valid FERPA basis is generally required.
3.
False — Directory information is defined by the University, consistent with FERPA requirements and its published policy. Faculty cannot decide individually what is public.
4.
True — FERPA applies to disclosures made verbally, electronically, in writing, or by other means.
5.
False — Removing a name does not necessarily make information anonymous. Other details may still make a student identifiable.
6.
True — When uncertain, the best practice is to pause and consult the University's FERPA/privacy resource before disclosing or sharing student information.
FERPA Training for Faculty & Staff | Slide 18
FERPA Decision Guide Do I have student education-record information? → If yes, continue cautiously. Am I accessing it for my legitimate educational responsibilities? → If no, stop. Am I disclosing it to someone else? → Identify the recipient and purpose. Do I have student consent or a clearly applicable FERPA exception? → If no, do not disclose. Is the recipient verified and authorized under university policy? → If uncertain, stop. Is the method secure and approved? → If no, use an approved method. Still unsure? → Contact the Registrar / FERPA or privacy officer before disclosing.
FERPA Training for Faculty & Staff | Slide 19
Resources & University Contacts Registrar / Student Records Office/ FERPA / Privacy Officer: Registrar@mghihp.edu Annual FERPA Notice: Annual Notice Student Records Request: Student Records Request Procedure Directory Information / Opt-Out Procedure: Privacy Declaration Form U.S. Department of Education — Student Privacy Policy Office: www.studentprivacy.ed.gov
FERPA Training for Faculty & Staff | Slide 20
Protect student privacy.
When in doubt, don't disclose—pause and ask. Thank you.