The Family Educational Rights FERPA The Family Educational Rights and Privacy Act  (20 U.S.C. § 1232g; 34 CFR Part 99) 

Presented by: Lynn Hutt, MBA, CHC Director of UTMC Compliance and Institutional Privacy August 21, 2018

The Family Educational Rights and Privacy Act, known as FERPA, is a Federal law enacted by the United States Congress in 1974. The Act, sets forth requirements regarding the privacy of student records. FERPA governs the release of records maintained by the University and access to these records.

The federal law requires that a written institutional policy complying with the Act be established and adopted procedures be Published. The Confidentiality of Student Records is our official policy. The policy is available for review in the University Policy Manual.

The University of Toledo must… Assure students that this data is used only for intended purposes. Inform students of University record systems and identify what data is on the record. Give students the opportunity to request a correction or an amendment to their record. Make certain employees with access to the student information system protect student’s privacy.

If a student requests records be released to a third party, the University may require written permission from the student before we do so. The information may be considered sensitive for an employment agency, another institution, or individual person.

Students must provide written permission for release of sensitive information to anyone outside of the University. Examples are: Grade Point Average Grades Courses taken Student schedules Social Security Number

FERPA regulations allow students the right to Information release to the general public is known as “Directory Information” and is without the written consent of the student. However…… FERPA regulations allow students the right to restrict this information.

Within FERPA guidelines, institutions decide what information they release as Directory Information. Therefore …. at the University of Toledo Directory Information released without written consent of the student is...

DIRECTORY INFORMATION Student name Local address and local phone number College and major field of study Class (freshman, sophomore, etc.) University E-mail address Dates of attendance Degrees, certificates, and awards received Full-time or part-time enrollment status Student photograph (College of Medicine Only) Graduate Medical Education placement (MD students only)

Students may restrict release of their Directory Information by selecting the link, Update Directory Information Release/Status Release in the Student tab at the myUT portal or by visiting Rocket Solution Central in Rocket Hall.

When information is restricted… If a student decides to restrict Directory information, all information about them is confidential, requests for information will not be released to anyone, without the student’s written permission. Remember…. For our students protection, we will not discuss anything with them by telephone if they restrict their directory information.

What are Educational Records? Records that directly relate to a student Records that are maintained by an educational agency or institution or by a party acting for the agency or institution. Examples are: Student Grade Records Financial Aid Records Student Account Records Admission Application Records Treatment

Educational records are not… Sole possession records such as faculty/advisor personal notes Law enforcement records Employment records Medical records These records have their own rules for respecting privacy. They are not educational records and not subject to FERPA regulations.

Who is allowed to view a student’s record?

School Officials and employees of the University may review student records as long as there is a legitimate educational need to review these records. Faculty and staff members may review student records as long as they have an academic or administrative reason.

Department of Education. It is not legal for school officials, faculty, staff, student worker or any other member of our campus community to access student records for non-educational purposes. Such access is considered a violation of FERPA and if allowed, the University is subject to fines from the Department of Education.

Faculty members must be careful when notifying students what grade they earned for a course or exam. Posting a grade in a public area that lists the student name, social security number (full or partial), or student identification number alongside the earned grade is strictly forbidden under FERPA regulations.

When Posting Grades it must not be done in a personally identifiable manner When posting grades or notifying students: Do not use student name or ID number Do not post in alphabetic order Do not leave graded exams for student to pick-up Leaving graded personally identifiable papers in a hallway or on a desk for students is no different from posting grades on a wall or website Do secure websites, students must only see their own grade Notification of grades via e-mail is not recommended Institutions are held responsible if someone breaks into to the students e-mail account

Protect Sensitive Information Students, faculty and staff expect data in University systems to be secure. Do not send sensitive information through e-mail or instant messenger unless password protected or encrypted Do store sensitive information on a secure university network drive, or password protect and encrypt information on computers Do secure your office, lock doors, lock file cabinets, and desk drawers Do password protect your computer recent violations on web sites Grades were posted with SSN or partial SSN What we need to do Tell students about what happened, send students letters field phone calls from student effected emergency shut down of UT sites EIT working with major search engines to have indexes removed…Google, yahoo If you do post grades do not do so in alpha order. Again…do not use any part of SSN…not even with permission from students

What about parents? Do they have the right to view their child's educational records?

Several years ago the Department of Education amended FERPA so that institutions have the option to allow parents to view their child’s educational records.

The following statements summarize FERPA’s position regarding parental access to their child’s educational records When a student reaches the age of 18 or begins attending a postsecondary institution, regardless of age, FERPA rights transfer from the parent to the student. Parents may obtain directory information at the discretion of the institution. Parents may obtain non-directory information (grades, GPA, etc.) at the discretion of the institution and only after it has been determined that their child is legally their dependent. Parents may also obtain non-directory information by obtaining a signed consent from their child.

While you cannot discuss a student’s particular circumstances, you can talk with a parent and describe University policies and procedures, such as... registration add/drop policy billing procedures disciplinary process

Students also have rights regarding their educational record…. (From FERPA regulations) Students have the right to inspect and review their records. The University may take up to 45 days before providing students this access. Students who are denied admission to the university, do not have the right to review their denied applications. Students who are admitted but have not yet enrolled, have no FERPA rights until they actually register for a course. Former students have the same rights under FERPA as presently enrolled students. Deceased students have no FERPA rights.

The University of Toledo has made the decision to extend FERPA rights to all students who have applied for admission

Amendments to FERPA related to Anti-Terrorism Activities October 2001 amendments to the “USA Patriot Act of 2001” affect FERPA regulations.

FERPA generally requires prior written consent from the parent or student before an educational agency or institution may disclose personally identifiable information from educational records to a third party. The law now includes exceptions to this general rule.

The amendments to FERPA permit release of personal information from educational records to the Attorney General of the United States in connection with an investigation or prosecution of terrorism crimes, without the consent or knowledge of the student or parents. Requests for educational records must be accompanied by an Ex Parte order or a lawfully issued subpoena or court order.

Health or Safety Exception In an emergency regarding Health or Safety, FERPA permits nonconsensual disclosure of educational records or personally identifiable, non-directory information in connection with a health or safety emergency if such knowledge is necessary to protect the health or safety of the student or other individuals.

Things to remember… FERPA is everyone’s responsibility Directory Information is the only information released without written consent of the student When a student reaches the age of 18 or begins attending a postsecondary institution, regardless of age, FERPA rights transfer from the parent to the student. Check the confidentiality status of students’ to ensure compliance with privacy restrictions When in doubt contact the Registrar’s Office regarding FERPA issues and student privacy.

419.530.4836 Registrar@utoledo.edu If you have any questions, please contact the Registrars Office 419.530.4836 Registrar@utoledo.edu

FERPA Test True or False? Faculty members have the right to review educational records of any student who is enrolled in their class. FALSE – There must be an educational ‘need to know’ or a legitimate educational interest. Faculty and staff members may inspect student records as long as their intent is academically or administratively related to their class.

2. When a student record is restricted, we may verify the local address on file when contacted by telephone. FALSE – If the student has restricted their information, do not discuss any information over the telephone.

3. An advisors personal notes do not have to be released to a student. TRUE – “Sole possession” concept. Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute.

4. Only in the case of an emergency, may we tell a student’s spouse where the student is on campus, provided they have the student’s ID number, birth date, and current address. FALSE – The student’s schedule is not Directory Information and may only be released with prior written consent.

5. Graded assignments may be placed on a table or in a hallway for students to pick up after class when the student’s ID number is not visible. FALSE - Faculty should never place graded examinations or assignments in a public location where student identifying information such as a name or student ID number links the student with the grade. Also, faculty should not ask another student to “pass out” graded examinations.

6. Grades may be sent to students via University e-mail. FALSE – Notification of grades via e-mail is not recommended. There is no guarantee of confidentiality on the Internet. The institution would be held responsible if an unauthorized third party gained access, in any manner, to a student's education record through any electronic transmission method.

7. School officials awarding academic scholarships need students written permission to review records. FALSE - If it is the responsibility of the school official in question to review student records for the awarding of a possible scholarship, then this school official is said to have a legitimate educational purpose to do so.

8. A dependent students custodial parent may submit a notarized statement preventing the release of their child's educational records to the other parent. FALSE – If one parent claims the student as a dependent for income tax purposes, the institution may disclose information to either parent.

9. If a police officer comes to your office to find a student who he has attempted to catch up with for a week you may provide the officer with the student’s schedule. FALSE - The release of non-directory information is appropriate only if “necessary to protect the health or safety of the student or other individuals”.

10. A parent may receive their child's grades by faxing a copy of his current tax return proving that their child is a dependent. FALSE – Income tax returns should be provided in person along with the parents identification. Suggest that the student order a transcript to be mailed to his parents address or have the student access Self Services from home.