FERPA Training for Student Workers - Mass General Brigham University of Health Professions - 2026

FERPA

Training for Student Employees

Your student job may give you access to private student information.

Confidentiality is part of your job.

Learning Objectives Understand why FERPA applies to student employees when they perform university work.

Recognize education records and personally identifiable information (PII).

Understand legitimate educational interest and the limits of job-related access.

Know what you may and may not do with student information.

Handle common situations involving grades, class lists, advising, records, email, and student requests.

Know when to stop and ask a supervisor, Registrar, or FERPA/privacy contact.

FERPA Training for Student Employees | Slide 2

The Most Important Rule Your student job does NOT give you permission to look at any student record you can access.

You may access student information only when it is necessary for your assigned work and consistent with University policy.

Do not use your employee access to look up your own record, a friend's record, a roommate's record, a classmate's record, or anyone else's record out of curiosity.

Do not use information learned at work for personal, academic, social, or employment purposes.

If you are unsure whether access is appropriate: STOP and ASK.

FERPA Training for Student Employees | Slide 3

What Is an Education Record?

Records directly related to a student and maintained by the University or a party acting for the University.

Examples include grades, transcripts, class lists, schedules, advising records, student financial information, disciplinary files, and records in University systems.

Records can be electronic or paper—including email, spreadsheets, screenshots, databases, and printed reports.

Do not assume that information is private only when it is in the Registrar's Office. Your student job may expose you to protected records in many offices.

FERPA Training for Student Employees | Slide 4

Personally Identifiable Information (PII) Names, student ID numbers, email addresses, addresses, and other direct identifiers.

Grades, academic standing, schedules, advising information, disciplinary information, and other student-specific information.

Combinations of facts can identify a student even when a name is not included.

Treat student information as confidential when you have access to it through your job.

FERPA Training for Student Employees | Slide 5

Student Employee = Student + Employee As a student

As an employee

You have FERPA rights concerning your own education records.

Your job may authorize limited access to other students' records.

You should not use your employee access to obtain or change your own records.

Access is limited to your assigned responsibilities.

Use the University's normal student process for questions about your records.

FERPA Training for Student Employees | Slide 6

Your student status does not expand your employee access.

Your employee access creates confidentiality responsibilities.

Legitimate Educational Interest Legitimate educational interest generally means you need the information to fulfill your assigned professional responsibilities.

Example: A student employee assigned to help the Registrar prepare an authorized report may need access to specified student records.

Not legitimate: checking a friend's grades, looking up a classmate's schedule, reading disciplinary information, or browsing records because you are curious.

Access is not a privilege to explore the University's systems.

FERPA Training for Student Employees | Slide 7

Need-to-Know: Access Only What You Need Your supervisor assigns you a task. Access only the records necessary to complete that task.

Do not open unrelated screens, files, student profiles, or reports.

Do not save extra information 'just in case.'

Do not photograph, screenshot, download, print, or copy records unless the job requires it and the method is approved.

Close records and log out when finished.

FERPA Training for Student Employees | Slide 8

Grades & Academic Information Never

Always

Tell a classmate another student's grade.

Use only approved systems.

Look up a friend's grades.

Follow your supervisor's instructions.

Post grades in a group chat or social media.

Verify recipients before sending information.

Use student grades in a personal conversation.

Keep screens, papers, and files secure.

Leave grade reports visible to others.

Ask before sharing information outside your assignment.

FERPA Training for Student Employees | Slide 9

Email, Messaging & Social Media Do not discuss student records in personal text messages, social media, or informal group chats.

Do not forward student information to your personal email.

Verify email recipients before sending protected information.

Do not post screenshots of University systems—even if you think the student cannot be identified.

Do not discuss student records with friends, roommates, classmates, family members, or other student employees who do not have a job-related need to know.

FERPA Training for Student Employees | Slide 10

Working with Other Student Employees Another student employee is not automatically entitled to information you can access.

Share information only when the other person is authorized and needs it for their assigned work.

Do not compare access, show each other records, or 'help' someone by looking up information outside their assigned role.

If a coworker asks you to access something you believe is outside your assignment, check with your supervisor.

FERPA Training for Student Employees | Slide 11

Friends, Roommates & Classmates Your job does not change your personal relationships into authorized access.

Do not look up a friend's schedule, grades, academic standing, financial information, or disciplinary information.

Do not confirm information someone has guessed or heard from another person.

Do not use your job to settle personal disputes or answer questions about another student.

Professional rule: what you learn through your job stays within your job.

FERPA Training for Student Employees | Slide 12

Parents & Family Members If a parent, spouse, sibling, friend, or other person asks you for student information, do not provide it unless your supervisor has confirmed a lawful and approved basis.

Do not confirm whether a student is enrolled in a particular class or program unless your assigned role and University policy specifically permit it.

Do not discuss grades, attendance, disciplinary matters, schedules, or other protected information.

Refer the request to the Registrar or designated University office.

FERPA Training for Student Employees | Slide 13

Scenario 1 — 'Can You Look Up My Grade?'

A friend says: 'You're working in the Registrar's Office. Can you quickly look up my grade? I just want to know if it posted.'

What should you do?

A. Look it up because the friend gave you permission.

B. Look it up but do not tell anyone else.

C. Do not access the record through your employee privileges; direct the student to the normal student-facing process.

D. Look it up if your supervisor is not nearby.

Correct answer: C. Why: Employee access to student records is limited to a legitimate educational or job-related need. A friend’s request or personal permission does not authorize you to use your employee access to view their record. The appropriate response is to direct the student to the normal student-facing process for checking their grade.

FERPA Training for Student Employees | Slide 14

Scenario 2 — 'Just Tell Me Who Is in the Class' A classmate asks: 'You're helping the department. Can you tell me who is registered for the class? I want to find my friends.'

What should you do?

A. Provide the class list because the person is a current student.

B. Show only the names of people you know.

C. Do not disclose the class list unless the request is part of an authorized job responsibility.

D. Take a screenshot and send it privately.

Correct answer: C. Why: A student’s enrollment and class-registration information may be protected under FERPA. Simply being a current student does not give someone the right to access another student’s records. Access should be limited to individuals with an authorized role and legitimate educational interest.

FERPA Training for Student Employees | Slide 15

Scenario 3 — Screenshot You see a funny or surprising student record on your work computer. You take a screenshot to show your roommate.

What's wrong?

A. Nothing if the screenshot is deleted afterward.

B. Nothing if the student's name is not visible.

C. The screenshot may contain protected student information, and accessing/copying/disclosing it for a personal purpose is inappropriate.

D. It is acceptable if your roommate is also a student.

Correct answer: C. Why: Employee access to student records is limited to legitimate University responsibilities. Viewing, copying, screenshotting, or sharing student information for personal reasons is not permitted, even if the information is later deleted or the recipient is another student.

FERPA Training for Student Employees | Slide 16

Scenario 4 — 'My Supervisor Asked Me' Your supervisor asks you to retrieve a student report. You notice the report contains more information than you expected.

What should you do?

A. Read everything because your supervisor asked.

B. Download a copy for your own records.

C. Access and handle only what is necessary for the assigned task and ask your supervisor if you are unsure about the scope.

D. Send the report to your personal email so you can finish later.

Correct answer: C. Why: Access to student education records should be limited to information necessary to perform your authorized job responsibilities. A supervisor’s request does not automatically mean you should review or retain information unrelated to the assigned task. When in doubt, confirm the appropriate scope of access before proceeding.

FERPA Training for Student Employees | Slide 17

If You Make a Mistake Do not hide it.

Do not delete evidence or attempt to investigate the incident yourself unless instructed.

Immediately tell your supervisor or the University's designated privacy/IT/security contact.

Explain what happened, what information was involved, who may have received it, and when it occurred.

Follow the University's incident-response instructions.

FERPA Training for Student Employees | Slide 18

Your FERPA Checklist Before I access a record: Is this required for my assigned job?

Before I share information: Is the recipient authorized and does the recipient need it for their job?

Before I download/print/copy: Is this necessary and approved?

Before I use a personal device or app: Is that explicitly allowed by University policy?

Before I answer a parent/friend/classmate: Should this go to the Registrar or my supervisor?

When uncertain: STOP. PROTECT. ASK.

FERPA Training for Student Employees | Slide 19

Quick Knowledge Check 1. A student employee can look up any record because they are a University employee. TRUE / FALSE 2. A friend asking for their own grade makes it okay to use employee system access to retrieve it. TRUE / FALSE 3. A student employee may share information with another student employee only when the sharing is authorized and job-related. TRUE / FALSE 4. A screenshot of a student record can create a privacy problem. TRUE / FALSE 5. When unsure, the best response is to stop and ask a supervisor or FERPA contact. TRUE / FALSE

FERPA Training for Student Employees | Slide 20

Quick Knowledge Check - Answers 1.

False — Being a University employee does not give a student employee unrestricted access to student records.

2.

False — A friend’s request does not make it appropriate to use employee system access to retrieve their record. The student should use the normal student-facing process.

3.

True — Information may be shared with another student employee only when the sharing is authorized and necessary for a legitimate job-related responsibility.

4.

True — A screenshot can contain protected student information and create a FERPA/privacy issue, even if it is later deleted.

5.

True — When unsure, stop and ask a supervisor or the University's FERPA/privacy contact before accessing or disclosing the information.

FERPA Training for Student Employees | Slide 20

Resources & University Contacts Registrar / Student Records Office/ FERPA / Privacy Officer: Registrar@mghihp.edu Annual FERPA Notice: Annual Notice Student Records Request: Student Records Request Procedure Directory Information / Opt-Out Procedure: Privacy Declaration Form U.S. Department of Education — Student Privacy Policy Office: www.studentprivacy.ed.gov

FERPA Training for Student Employees | Slide 21

Your access is a responsibility.

Use student information only for your job.

When in doubt: STOP and ASK.