What is FERPA?

Congress enacted FERPA, also referred to as the "Buckley Amendment," in 1974. FERPA conditions federal educational funding on providing students access to, and maintaining the privacy of, education records.

This mandatory online training guide consists of an explanation of FERPA (Family Educational Rights and Privacy Act) policy, a set of questions for you to use to test your comprehension of the policy, and the online form for you to submit when you have completed the training. The training takes approximately 30 minutes and should be completed in one sitting. If you exit the training before you complete it, then you must re-start at the beginning of the training when you return.

Please contact your supervisor if you have any questions regarding this training.

 

Where do I find Cal State East Bay's FERPA Policy?

The University's FERPA Compliance Policy can be found online at http://www20.csueastbay.edu/students/student-services/student-records/ferpa-privacy-policy.html. The summary information in this tutorial cannot be a substitute for reading the Cal State East Bay's Compliance Policy. We also encourage you to review FERPA directly at http://www.ed.gov/policy/gen/reg/ferpa/index.html.

Who is protected under FERPA?

The rights under FERPA apply to eligible students. An eligible student is an individual who is, or has been, in attendance at Cal State East Bay. FERPA does not apply to applicants unless they are admitted and attend Cal State East Bay.

What are a student's rights under FERPA?

There are seven primary rights under FERPA. These are:

  1. The right to inspect and review education records covered by the Act.
  2. The right to challenge (seek amendment of) the contents of these records.
  3. The right to a formal hearing, if necessary, for a fair consideration of such a challenge.
  4. The right to place an explanatory note in the record in the event that a challenge of the contents is unsuccessful.
  5. The right to control, with certain exceptions, the disclosure of the contents of the records.
  6. The right to be informed of the existence and availability of the institutional policy covering FERPA rights.
  7. The right to report violations of FERPA legislation to the University Registrar, the University Information Security Officer and/or the U.S. Department of Education concerning alleged failures of the University to comply with the requirements of FERPA. The name and address of the Office that administers FERPA is: Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue, SW., Washington, DC, 20202-4605.

What is an education record?

FERPA defines an education record subject to the Act to include those records, files, documents, and other materials that:

  1. Contain information that is directly related to a student and
  2. Are maintained by an educational agency or institution or by a party acting for the agency or institution.

What is not an education record?

For purposes of FERPA, the term "education records" does not include the following:

  • "Sole possession" records: Records of instructional, supervisory, or administrative personnel kept in the sole possession of the maker, that are used only as a personal memory aid, and that are not accessible or revealed to any other person except a temporary substitute for the maker of the record;
  • "Law Enforcement" records: Records separately maintained by a law enforcement unit of an educational institution that were created by the law enforcement unit for the purpose of law enforcement;
  • "Employment" records: Records made in the normal course of business concerning an employee of an educational institution who is also a student, provided that the records relate exclusively to the individual in his or her capacity as an employee and are not available for use for any other purpose.
  • "Treatment" records: Records of a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting or assisting in a professional capacity, made, maintained or used only in connection with the provision of treatment to the student, and which are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student's choice.
  • "Alumni" records: Alumni records which contain information about a student after he or she is not longer in attendance at the university and which do not relate to the person as a student.

Can the University disclose students' education records?

In general, an institution cannot disclose "education records" or information from "education records" to anyone other than the relevant student unless it first has obtained a signed and dated written consent from the relevant student (or all relevant students, if the records are "directly related" to more than one student).

How do students provide written consent to the University for the disclosure of their education records?

The student can provide a written release giving specific consent to the disclosure of the student's education records. The release needs to be dated and signed and must describe the records that may be disclosed, the purpose for which they may be disclosed, the persons or classes of persons to whom the records may be disclosed, and time period the release is effective. There are a number of different releases at the University, including a generic release and releases specifically designed for student athletes and for job references.

A faculty member should have a student sign a release before providing a job reference or reference for the student for certain academic purposes, such as scholarships or awards. The faculty member may obtain this release through a personal letter or e-mail from the student, or have the student sign a "Request for Verification" release form.

FERPA permits Cal State East Bay to accept a signed and dated written consent in electronic format as a valid consent to disclose education records. "Signed and dated written consent" includes a record and signature in electronic format that (1) identifies and authenticates a particular person as the source of the electronic consent; and (2) indicates such person's approval of the information contained in the electronic consent.

If a record contains personally identifiable information on other students, redact that information before disclosing the record on behalf of the student who has provided written consent.

The University Registrar is the university official responsible for keeping all official academic education records. Only the Office of Student Records may release an official transcript. All requests for education record information originating from outside the University should be directed to the Office of Student Records.

When can Cal State East Bay disclose education records without written consent?

Cal State East Bay may disclose "education records" without consent only if it first redacts all "personally identifiable information" from the records or one of the 15 exceptions enumerated in FERPA applies. Many of these exceptions are provided in the regulations to allow for the reasonable and practical workings of an educational institution. The exceptions are listed in the University's Student Record Policy. Some of the most common exceptions include:

  • Disclosure to other school officials within the University whom the University has determined to have legitimate educational interests;
  • Disclosure to officials of another school where the student seeks to enroll;
  • Disclosure in connection with financial aid for which the student has applied;
  • Disclosure to accrediting organizations to carry out their accrediting function;
  • Disclosure to parents of a dependent student, as defined by the IRS Code;
  • Disclosure to comply with a judicial order or lawfully issued subpoena;
  • Disclosure in connection with a health or safety emergency;
  • Disclosure to military recruiters.
  • Disclosure of Directory Information.

Can parents access student records without written consent?

When a student over the age of 18 is in attendance at the University, the student possesses his or her rights under FERPA. The student may authorize the University to release information to a parent by completing the Release of Information Form which must be signed by the student and parent, and submitted in person to the Student Information Lobby at Hayward or Concord campuses accompanied with Photo ID.

Written consent to disclose education records is not required to parents of a minor student, if that minor is still claimed by the parents as a dependent for income tax purposes.

Faculty and staff need to be careful when a parent calls and asks for information about a student. If there is no written waiver by the student, disclosure even to a parent can be unlawful. If you are in doubt, faculty and staff should obtain assistance first from the University Registrar or the Office of Student Records.

What is "directory information"?

FERPA permits institutions to specifically define some education record information as directory information not confidential under FERPA. Directory information means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.

Cal State East Bay has defined "directory information" as:

  • Name of student
  • Net ID
  • Telephone numbers
  • E-mail addresses
  • Date and place of birth
  • Department employed
  • Major
  • Degrees awards and honors received
  • Dates of Attendance
  • Class level
  • Enrollment status (i.e., full-time, part-time, undergraduate, graduate)
  • Name of institution last attended
  • Participation in athletics and student activities
  • Height and weight of members of athletic teams
  • Photographs


To take advantage of this exception, the University must give its students notice of the information it has designated as "directory information" and an opportunity to opt out.

Even though directory information is considered public, the University is not required to release any information designated as directory information. There are situations where the campus might decide for policy reasons not to release directory information. For example, the University has opted not to release lists of student e-mail addresses to outsiders even though most, if not all, campuses have designated student e-mail addresses as directory information.


As discussed below, before releasing any directory information, review the student's record in PeopleSoft to determine if the student has placed a FERPA block on their record to prevent the release of any information, including directory information.

Any request for information from an external organization that involves identifiable student data should be directed to the University Registrar.

Can students restrict the disclosure of their directory information?

Yes. The University must allow a student to opt out of the release of directory information. Students must complete a Disclosure of Directory Information Form to request that all directory information be restricted from release. Therefore, faculty and staff need to be careful about assuming that because an item is directory information it can be freely disclosed. If a student restricted the Disclosure of Directory Information, a service indicator icon will appear on every page of their record in PeopleSoft.

Who is a "school official"?

A school official is a person employed by the University in an administrative, supervisory, academic or research role, or support staff person (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials (such as an attorney, auditor or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks.

The University must give annual notice of its criteria for determining who is a "School official."

Any request for information from an external organization that involves identifiable student data

should be directed to the University Registrar.

If at any time you receive a request for student data from an external organization that is not associated with the University or contracted by the University to process or study student data, those requests should be directed to the University Registrar.

You should not release any information on students to individuals or organizations that are not contracted by the University without the signed and written consent of the student or students in question.

What is a "legitimate educational interest"?

"Legitimate educational interests" are defined as those interests, which are essential to the general process of higher education prescribed by the body of policy adopted by the Board of Trustees. Persons who require the records to perform the functions of their job have legitimate educational interests. Legitimate educational interests would include teaching, research, public service, and such directly supportive activities as academic advising, career counseling, discipline, financial assistance and advisement, medical services, and academic assistance activities.

The University must give annual notice of its criteria for determining what is a "legitimate educational interest."

What are the sanctions or liability risks for a FERPA violation?

The responsibility for enforcing FERPA rests with the Family Policy Compliance Office of the Department of Education, which is authorized to investigate and review potential violations and to provide technical assistance regarding compliance issues. If it determines that a complaint is meritorious, the Office will recommend steps necessary to ensure compliance with the act and provide a reasonable time for the institution to come into compliance. If the University does not come into compliance, the Department is authorized to terminate all or any portion of the University's federal funds. While there is generally no private cause of action directly under FERPA, students may seek to hold the University or individuals liable under common law tort theories such as invasion of privacy.

Who can I talk to if I have further questions about FERPA?

The Office of Student Records is the first stop for any student records questions regarding FERPA or the University's policy and implementation of FERPA. University Counsel is also a good resource.

At a minimum, each person on campus who has access to student record information should read the annual notice to students and the Student Record Policy.

Tips on Managing Student Records *

* ADAPTED FROM OF COUNSEL - A BULLETIN ON LEGAL ISSUES AT CATHOLIC UNIVERSITY OF AMERICA - NOVEMBER 1997.

  • DO review a copy of the Cal State East Bay FERPA Compliance Policy before responding to a request for education records.
  • DO NOT release directory information on a student without checking the record in PeopleSoft to see whether the information has been flagged for non-release.
  • DO check with the University Registrar before disclosing any student educational record information to third parties outside the institution.
  • DO refer all subpoenas or IRS summons or other legal process requests for education records to the office of the VP of Administration and Finance (SA 4707)
  • DO ensure there is an approved Release of Information form on file sharing educational record information with parents or others outside the institution.
  • DO NOT request information from an education record custodian, or access the student's records by computer, unless you have a legitimate educational interest and are authorized under Cal State East Bay's FERPA Compliance Policy to access the information.
  • DO follow the confidentiality provisions of FERPA by not sharing education records information with your colleagues unless a legitimate educational interest exists.
  • DO NOT put purely personal notes (for example, from a committee meeting recommending students for a particular program) in the student's file, because those notes will become accessible to the student. Such records can be kept confidential only if they are kept in the sole possession of the maker and are not accessible or revealed to any other person. Official committee minutes are likely to be considered accessible. Further, you should not share personal notes with supervisors or coworkers as they may also be considered a part of a students record.
  • DO NOT post students' papers, scores or grades in a public place on which names, Social Security numbers, or other personal identifiers are displayed.
  • DO remember that medical, mental health and law enforcement records should not be put in the student's file with the student's education records. Medical and mental health records supporting an accommodation for a disability should be forwarded to Risk Management (SA 4702) in an envelope marked confidential, and law enforcement records should be kept in the Office of Public Safety.
  • DO NOT release information about a student disciplinary matter without conferring with the University Counsel or Office of Student Judicial Affairs and/or the University Registrar.

THANK YOU FOR COMPLETING THE EDUCATIONAL PORTION OF THIS TUTORIAL.

In the next section you will be asked a series of questions that are designed to help you better understand the application of FERPA at Cal State East Bay. You will not be graded on this exercise but you must complete it to receive your FERPA certification. Failure to answer all the questions on the quiz will prevent you from receiving the certification and cause you to lose access to the University data system or any reports generated through it.

When taking the quiz you are asked at times to think of yourself as the caretaker of the data to which the questions refer. Please try to place yourself in the specific situation asked and answer the question as best you can.


QUIZ

Question #1

A parent calls to ask how his son or daughter is doing in class. The student's directory information has not been suppressed. Can you give the parent information about the student's grades?

       

Question #2

You are the custodian of certain student records and you receive a phone call from someone claiming to be the parent of a student who is currently enrolled at the University. They claim that the student is under the age of 18 and that they, the caller, have the right to view the student's academic record. You look up the student and realize they are under the age of 18 but there is no Release of Information Form. Do you give the caller the information?

       

Question #3

The Records Office receives a formal request in the form of a letter from the parent of a registered student for whom directory information is suppressed. The parent wants to know if the student is registered for the current semester. Should the Records Office release that information?

       

Question #4

You receive a call from the police asking for a student's class schedule for the current term. They are investigating a crime. Can you give them the information?

       

Question #5

The University of California, Berkeley submits a request for a student's final transcript claiming that the student has applied to graduate school at UCB. Should Office of Student Records send an official transcript in response to the official request?

       

Question #6

The Office of Student Records receives a request from an academic department chair who asks for a list of names and addresses for students who are enrolled in a specific course in the department. The addresses will be used to mail a survey about the quality of the course. Results of the survey will be used to improve the course. Is this an appropriate use of student records?

       

Question #7

An academic department is preparing an e-mail message to departmental students about a critical academic deadline. Should the name and e-mail address of a student who has requested that their directory information be suppressed be included in the mailing list?

       

Question #8

A well-respected faculty member asks a college office for a list of student e-mail addresses in order to contact the students about an academic research project she is conducting. Should the college office supply the information?

       

Question #9

The University Registrar is informed that the United States Marine Corps intends to conduct a recruitment activity on campus and the Registrar receives a formal request to supply them with a list of students who are enrolled in the current term and their mailing address so the Marine Corps can inform them they will be on campus and invite the student to meet with them during that appointed time. Do you supply the information to the Marine Corps?

       

Question #10

You receive a subpoena for individual student data and you are unclear as to whom you should give the subpoena. The record involves a student's enrollment and their financial aid.
You should refer the person to one of the following:




Question #11

A faculty member posts grades outside his office. He states this is acceptable because only partially redacted social security numbers are used to indentify the students. Is he violating FERPA?

       

Question #12

A professor has a stack of term papers for students to pick up. Is it acceptable to leave the papers in a location where students can look through the stack to locate their own paper?

       

Question #13

You receive a request from another office within the University to receive names and social security numbers of students in a particular University sponsored program. You retrieve the data from the university's information system and download it to a data file and attach the data file to an e-mail and send it to the requesting party. Was this the correct way to transfer this information?

       

Question #14

An unauthorized person obtains private student information from a computer screen that was left unattended. Is this a violation of FERPA?

       

Question #15

A non-University person comes to a department office with a signed letter giving consent to release the transcript of a student. Should the department provide information from the student's transcript?