FERPA Tutorial

Welcome to the Family Educational Rights and Privacy Act (FERPA) training site, administered by the Office of the University Registrar. This site is intended to familiarize you with the law regarding student education records. FERPA (also known as the Buckley Amendment) is the federal law passed in 1974 that protects the privacy of student education records. As an institution that receives funding from the U.S. Secretary of Education, Penn State must comply with FERPA regulations.

Education records are maintained by University offices to facilitate the educational development of students. Faculty and staff members may also keep informal records relating to their functional responsibilities with individual students. The University has a policy regarding Confidentiality of Student Records (AD-11) and policies governing the use of the Penn State ID number and Social Security number (AD-53 and AD-97). Other related resources include, but are not limited to:

• Student Affairs Resources for Students
• Academic Policies and Procedures for Students
• The Office of the University Registrar Website
• Penn State University Privacy Office

FERPA governs the release of and access to student education records by:

• Defining students' rights regarding their education records.
• Specifying under what conditions student education records may be shared within the University.
• Specifying under what conditions student education records may be shared outside of the University.

FERPA can be summarized as follows:

• Students must be permitted to inspect their own education records and have the right to request amendment of inaccurate information.
• University officials may not disclose information about students, nor permit inspection of their education records, without students' written permission, unless such action is covered by exceptions permitted by the Act.

Let's begin with some basic definitions.

What is an Education Record?

An education record is information recorded in any form that is directly related to a student and maintained by the University. Education records include:

• Official academic records related to course enrollment, grades, graduation, class lists, student course schedules
• Employment records if that employment is directly related to student status (e.g. work study, graduate assistantships, resident assistants).
• Disciplinary records
• Financial records, including those of a parent or spouse

An education record can exist in any form — handwritten note, computer file, print, tape, film, microfilm. Items such as computer printouts, class lists, test papers and computer screens must be protected.

What is not considered an Education Record?

• "Sole possession" records which are made by faculty and staff for their own use as reference or memory aids and are not shared with others. However, if you share these notes with someone, the notes become part of the education record.
• Personal observations/experiences
• Penn State law enforcement records
• Employment records, unless the employment is connected to student status, such as work study.
• Medical and mental health records used only for the treatment of the student.
• Application records of degree seeking students not officially admitted to the University.
• Alumni records
• Peer graded papers and exams prior to the grade being recorded in the instructor's grade book.

Who are Students?

FERPA defines a student as anyone "in attendance" at an institution. According to Penn State policy, a student is defined as an individual currently or previously enrolled in any academic offering of the University. For newly admitted students, FERPA becomes effective on the first day of classes for those students who have scheduled at least one course. A student who accepted an admission offer but did not schedule at least one course, or a newly admitted student who canceled his/her registration either before or after the semester begins, is not covered by FERPA. FERPA does not cover prospective students or applicants to any academic program of the University.

As we said earlier, FERPA defines students' rights regarding their education record.

Student Rights under FERPA

FERPA gives students four specific rights:

• The right to inspect and review their education records. Penn State must respond in 45 days to this request.
• The right to request the amendment of inaccurate or otherwise inappropriate education records.
• The right to consent to disclosure of his/her records.
• The right to file a complaint concerning alleged failure by Penn State to comply with the requirements of FERPA with the Family Policy Compliance Office in the U.S. Department of Education.

According to Penn State policy, records will not be released to the student, his/her parents, or any third party if the student owes money to the University or if a serious academic and/or disciplinary matter involving the student remains unresolved.

Under their right to inspect and review their education records, what information may students not view?

• Parent's financial records, even though the student may have provided them.
• Letters of recommendation that the student has waived the right to access.
• Portions of records that pertain to other students.

Parent Rights under FERPA

When the student reaches the age of 18 or begins attending a postsecondary institution, regardless of age, FERPA rights transfer from the parent to the student.

Parents may obtain access to their student's education record (grades, GPA, etc.) by obtaining consent from their student. Students may provide consent for their parents to view grades and other portions of their education record through LionPATH. Once delegated access has been granted by the student, the parent may log into LionPATH and select any of the approved functions.

Under FERPA, colleges must not release education records—except under certain circumstances which you'll learn about in a few minutes—without prior written consent from the student.

What is Prior Written Consent?

Penn State must obtain prior written consent from a student before disclosing any non-directory information from their education records. The prior written consent must:

• Specify the records to be released
• State the purpose of the disclosure
• Identify the party(ies) to whom disclosure may be made
• Be signed and dated by the student

In recent years, the U.S. Department of Education has clarified that an electronic signature may substitute for a written one. In order to qualify as an electronic signature, appropriate authentication must occur. Penn State's access account satisfies the requirements for an electronic signature. Since students must log in to Penn State's email system using their Penn State access accounts, an email note from a student's @psu.edu email address satisfies FERPA's written consent requirement. However because security measures for other email systems are not as strict, an email received from a Gmail, Yahoo mail, or AOL mail account for example would NOT qualify as written consent.

FERPA permits disclosure of a student's education record without the student's consent to University officials having a legitimate educational interest in the record.

Who are University Officials?

University officials are University employees with general or specific responsibility for promoting the educational objectives of the University, or third parties under contract with the University to provide professional, business and similar administrative services related to the University's educational mission. These include:

• Instructors
• Faculty advisers
• Admissions counselors
• Academic advisers
• Counselors
• Employment placement personnel
• University Police personnel
• Health staff
• Development officers
• Staff in Alumni Relations
• Deans, department chairpersons, directors and other administrative officials responsible for some part of the academic enterprise or one of the supporting activities.
• Administrative and faculty sponsors of officially recognized clubs, organizations, etc.
• Members, including students and alumni, of official University committees.
• Staff personnel employed to assist University officials in discharging professional responsibilities.
• Persons or entities under contract to the University to provide a specific task or service related to the University's educational mission.

What is Legitimate Educational Interest?

A Penn State employee exercises legitimate educational interest if that person needs to review an education record in order to fulfill his or her professional responsibilities. The concept of legitimate educational interest only applies to University officials. Legitimate educational interests include:

• Teaching
• Research*
• Public service
• Academic advising
• General counseling
• Therapeutic counseling
• Discipline
• Vocational counseling and job placement
• Financial assistance and advising
• Medical services
• Safety
• Raising endowment in support of student scholarships and academic programs
• Academic assistance activities
• Co-curricular activities that are generally supportive of University goals and contribute to the well-being of the participants, including varsity and intramural sports, social fraternities and sororities, specific interest clubs, and student government.

Disclosure of information in a student's education record to a University official does not constitute authorization to share that information with a third party.

Access to information does not authorize unrestricted use.

Records should be used only in the context of official business in conjunction with the educational success of the student.

Curiosity does not qualify as legitimate educational interest.

The fact that someone is a Penn State employee is not the sole qualification for legitimate educational interest.

For more information on appropriate use of student data, review Penn State's guideline ADG06.

---

*Anyone conducting research using information from student education records must receive approval for that research from Penn State's Office of Research Protections. In addition, researchers who are utilizing student education records in their research must agree to:

• Use the information only for purposes of the approved research project. Any new use of the information requires new approval.
• Provide adequate protection for the information to ensure that it is not compromised or subject to unauthorized access.
• Ensure that no one outside the research team has access to the information.
• Destroy the information within a reasonable time after completion of the research.

As we just said, student education records may be released without prior written consent to University officials having a legitimate educational interest in the records. In addition, Penn State may disclose education records or components thereof without written consent of students under the following circumstances:

• In connection with a health or safety emergency if necessary to protect the student or others.
• If disclosure is in connection with financial aid for which the student has applied or received.
• To authorized representatives of:
  • The Comptroller General of the United States
  • The Attorney General of the United States
  • The Secretary of the Department of Education
  • State and local educational authorities
• To state and local officials according to state statute.
• To organizations conducting studies for, or on behalf of, educational agencies or institutions. A written agreement between Penn State and the organization conducting the study must be in place for each study.
• To accrediting organizations.
• In response to a court order and/or lawfully issued subpoena. All court orders/subpoenas must be forwarded to the Office of the University Registrar for processing.
• Under certain circumstances where the requestor is a victim of an alleged crime of violence.
• Under certain circumstances to the parent(s) where the student has been determined to be in violation of a drug or alcohol law or policy and the student is under the age of 21.
• To officials at an institution in which the student seeks or intends to enroll or is currently enrolled. The "currently enrolled" exception permits institutions to supplement, update, or correct any records previously sent as long as the disclosure is for purposes related to the student's enrollment or transfer.
• To the provider or creator of a record (e.g. transcript or letter of recommendation) in order to determine its authenticity.
• To comply with the Patriot Act.

Health or Safety Exception

The health/safety exception has always existed in FERPA, but received a great deal of attention following various incidents of campus violence. In December 2008, a change was made to the health and safety exception to provide more leeway to institutions in determining when to invoke the exception. Subsection 99.36 of FERPA states:

"An educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals."

Previously the conditions under which the exception was invoked had to be "strictly construed." The regulation now specifies that, when an institution determines that an "articulable and significant threat" exists, the institution may release educational records without consent to those determined to be in a position to assist. The new regulation also requires documentation to include a description of the threat, the records that were released and the individuals to whom the release was made.

To assist faculty and staff in dealing with student-related emergencies, or who may be concerned about a student's behavior, Penn State has developed several policies and guidelines, including:

• SY03 - Emergencies Involving Students
• Referrals to Counseling and Psychological Services

FERPA permits public disclosure of directory information without the student's consent unless the student has requested that directory information be withheld.

What is Directory Information?

Directory information is information contained in a student's education record that would not generally be considered harmful or an invasion of privacy if disclosed. FERPA requires each institution to define its directory items.

At Penn State, the following information is considered directory information:

• Name
• Address (local, permanent, and electronic mail)
• Telephone numbers
• Class level (semester classification or level: first-year, sophomore, junior, etc.)
• Major
• Student activities
• Weight/height (athletic teams)
• Date(s) of attendance
• Enrollment status (full-time, part-time or not enrolled)
• Date of graduation
• Degrees and awards received and where received
• Most recent educational institution attended

A student's directory information may be released to an inquirer, outside the University, unless the student specifically requests that directory information be withheld. However, FERPA does not require that directory information be released—it is at the discretion of the institution. It is Penn State's practice not to provide mailing lists to third parties. For more information on appropriate use of student data, review Penn State's guideline ADG06. Penn State is not subject to Pennsylvania's Right to Know law.

Any information not specifically listed as directory information is considered non-directory information.

When is Directory Information Not Really Directory Information?

It is important to also understand the concept of "implicit disclosure." An implicit disclosure may occur when a list consists only of directory information but the list itself by definition reveals non-directory information. For example, a list of names and email addresses of all students who have a particular grade-point average reveals the students' GPAs. Likewise, a class list containing names and email addresses of the students reveals class enrollments. Since neither grade-point average nor class enrollment are directory items, releasing these lists without prior consent of the students constitutes a FERPA violation.

There are many vendors offering services to streamline and improve instruction. Services such as WebAssign (an online homework and testing tool) and Piazza (a discussion tool) provide benefits to faculty and to students, often at no fee. Usually in order to use these services, the instructor must provide a class list to the vendor. Since class enrollment is not directory information, we must comply with FERPA before releasing this information to the vendor. FERPA either requires us to have the consent of every student to release his/her non-directory information, or to have a contract in place with the vendor containing four specific clauses. If an instructor is considering using any vendor product that requires student information, then the instructor must first check with purchasesoftware@psu.edu to see if an appropriate contract is in place between Penn State and the vendor.

How Does a Student Request that Directory Information be Withheld?

The student must complete a request to withhold directory information form to keep directory information confidential. At Penn State, we call this "requesting confidentiality" and we mark the student's record as "Confidential." Current students with access to LionPATH may complete this form in LionPATH. Prior or current students without access to LionPATH must complete and sign the paper form provided by the Office of the University Registrar. The signed form may be taken in person, or mailed along with a copy of photo identification, to any campus Registrar's office. If an email address is provided, notification will be provided to the student when the directory hold is in effect.

A request to withhold directory information results in the following:

• Student name/address is excluded from future printed telephone directories and other similar printed material, such as commencement programs.
• Requests filed within ten days after the start of registration for fall semester will prevent public information from appearing in printed directories and other annual publications. Requests filed after the first ten days of the fall semester shall be effective only with respect to the inclusion in printed materials prepared after the receipt of the request.
• Student name and address will be removed from the Penn State online Web directory.
• Enrollment and degree awarded inquiries from third parties, including potential employers and insurance companies, will neither receive a confirmation of enrollment nor graduation.
• No Information will be released to any person(s) on the telephone or via email.
• Address changes must be made by the student only, using the LionPATH system, in person at any campus Registrar's office, or by mailing a written request along with a copy of photo identification to any campus Registrar's office.
• It is important to note that a student's request for confidentiality does not permit the student to be anonymous in the classroom (including an online "classroom") nor to impede or be excluded from classroom communication.

How Does a Student Remove A Request to Withhold Directory Information?

A request to withhold directory information is in effect permanently, even if the student is no longer enrolled at Penn State, and can only be removed by the student in writing.

The student must complete and sign the request to remove the action of withholding directory information form. Current students with access to LionPATH may complete this form in LionPATH. Prior or current students without access to LionPATH must complete and sign the paper form provided by the Office of the University Registrar. The signed form may be taken in person, or mailed along with a copy of photo identification, to any campus Registrar's office. If an email address is provided, notification will be provided to the student when the directory hold is released.

• DO refer requests for information from the education record of a student to the proper educational record custodian. When in doubt, contact the Registrar's Office.
• DO keep only those individual student records necessary for the fulfillment of your teaching, advising, or administrative responsibilities. Private notes of a professor or staff member concerning a student and intended for the professor's or staff member's own use are not part of the student's education record.
• DO keep any private records relating to individual students separate from their education records. Private records of instructional, supervisory and administrative personnel and ancillary educational personnel are to be kept in the sole possession of the maker and are not to be accessible or revealed to any other person, except a substitute.
• DO change factual information regarding grades and performance in an education record when the student is able to provide valid documentation that information is inaccurate or misleading. The substantive judgment of a faculty member about a student's work, expressed in grades and/or evaluations, is not within the purview of a student's right to challenge their education records.
• DO use blind copies when emailing groups of students.
• Before responding to any request for directory information, DO first check to see if the student has requested confidentiality (i.e. that directory information be withheld). Review Student Confidentiality for tips on how to determine if a student has requested that directory information be withheld.
• If the student has requested confidentiality, you may not release any information, even directory items, regarding that student. You should simply respond to the requestor that we have no record of the person.

More Guidelines for Faculty and Staff Related to FERPA

• DO NOT display or post student scores or grades publicly in association with names, Social Security numbers, PSU ID, or other personal identifiers. Instructors are encouraged to use CANVAS to securely provide grades to their students.
• DO NOT put papers or lab reports containing student names, Social Security numbers, PSU ID, grades or other personal identifiers in publicly accessible places. Students must not have access to the scores and grades of others in the class.
• DO NOT request information from the educational record custodian without a legitimate educational interest and the appropriate authority to do so.
• DO NOT share student education record information, including grades or grade-point averages, with other faculty or staff members of the University unless their official responsibilities identify their legitimate educational interest in that information for that student.
• DO NOT share, by phone or correspondence, information from student education records, including grades or grade-point averages, with parents or others outside the University, including within letters of recommendation, without written permission from the student.
• DO NOT include in a student's education records or make available to him/her, or to a third party, information from medical, psychiatric, or psychological reports; records from law enforcement officials on or off campus; or notes of a professional or staff person which are intended for that individual alone.
• DO NOT provide student directory information to any third party for commercial use or for solicitation of any product or service. The University does not provide mailing lists to third parties, even if those lists contain only directory information. For more information on appropriate use of student data, review Penn State's guideline ADG06.
• DO NOT include the PSU ID in the subject line of an email message or on any document mailed by surface mail where the PSU ID is visible on the document or in a window envelope.
• DO NOT circulate printed class lists containing non-directory information (e.g. PSU IDs) for purposes of taking attendance. Instead, use a blank "sign in" sheet.
• DO NOT upload a class list or any information about a student to a vendor's website without first checking with purchasesoftware@psu.edu to see if Penn State has a FERPA-compliant contract with the vendor.
• DO NOT conduct research using student information without first receiving approval from the Office of Research Protections/Institutional Review Board and ensuring compliance with FERPA requirements.
• DO NOT make value judgments or use inappropriate language in any comments or notes that are entered into LionPATH or stored in shared student files, since these comments and notes are considered part of the education record and are subject to the student's right to review.

Let's summarize:

FERPA defines students' rights regarding their education records.

Under FERPA, colleges must not release education records—except under certain circumstances—without prior written consent from the student.

FERPA permits disclosure of a student's education record without the student's consent to University officials having a legitimate educational interest in the record.

FERPA permits (but does not require) public disclosure of directory information without the student's consent unless the student has requested that directory information be withheld.