1. FERPA Roundtable Richard Backes, Registrar’s Office

2. Recording date of this workshop is February 1, 2010. Some of the rules and procedures discussed in this workshop are subject to change. Please check university resources before relying exclusively on this recorded presentation.

3. Recording date of this workshop is September 29, 2009. Some of the rules and procedures discussed in this workshop are subject to change. Please check university resources before relying exclusively on this recorded presentation.

4. Introduction Session for those with basic knowledge of FERPA Review basics of FERPA Cover recent regulatory changes effective January 2009 Questions & Answers Resources

5. FERPA Overview Family Educational Rights and Privacy Act  Student right to review records  Student right to some control over the release of their records  Student right to contest what is in their records  Student Right to File a Complaint with Department of Education

6. Definition of an Education Record Any record maintained by WSU that includes personally identifiable information about a student Includes e-mail (if retained), data files, microfilm, microfiche, handwritten notes, photographs, audio files, video files

7. What are not Education Records? Law enforcement records These are separate from education records and maintained by campus police. Personnel records Not based on student status Treatment records Maintained by medical personnel and not shared with anyone else Alumni records Records created after student no longer enrolled Sole possession records Created and maintained as personal file

8. Definition of Directory Information WSU Defines directory as:  Name  Address  Telephone number  E-mail address(es)  Field(s) of study  Dates of attendance  Enrollment status  Weight & height of athletic team members  Participation in officially recognized sports  Degrees & awards received  Grade level  Most recent school attended  Status as graduate assistant and assignment

9. Student Right to Consent Disclosure of education records not requiring student consent:  University officials with a legitimate educational interest  Institutions to which the student seeks or intends to enroll  To federal, state, and local educational authorities  In connection with financial aid  To organizations conducting studies for or on behalf of the institution  To accrediting organizations  To parents of dependent students  To comply with a judicial order or subpoena  In a health or safety emergency  Directory information

10. Student Right to Consent Disclosure of education records not requiring student consent:  To a victim of an alleged perpetrator of a crime of violence or non- forcible sex offense  In connection with a disciplinary proceeding at a post-secondary institution involving a crime of violence or non-forcible sex offense  To a parent regarding a student’s violation of federal, state or local law or institutional policy regarding alcohol or controlled substance if student is under age 21  Disclosure of information concerning sex offenders provided to the institution under the Wetterling Act

11. FERPA: Regulatory Changes and What They Mean

12. Department Recommendations for Safeguarding Education Records Recommendation from Department of Education related to FERPA information From the Preamble of NPRM March 2008 Elsewhere indicates that a data breach is a FERPA violation (disclosure without consent)

13. Department Recommendations for Safeguarding Education Records “The Department recognizes that no system for maintain and transmitting education records, whether in paper or electronic form, can be guaranteed safe from every hacker and thief, technological failure, violation of administrative rules, and other causes of unauthorized access and disclosure. …the Department encourages the holders of personally identifiable information to consider actions that mitigate the risk and are reasonably calculated to protect such information.”

14. WSU Policies on Safeguarding Education Records Executive Policy #8  Confidential Data requirements  Non-public Data requirements  Public Data Use of E-mail, Laptops, USB Drives  E-mail cannot contain confidential information  Encryption should be used for portable devices Server security, data repositories

15. Definition of Attendance Includes by videoconference, satellite, Internet, or other electronic information and telecommunications technologies for students who are not physically in the classroom. Clarifies the definition of attendance to include distance students.

16. Directory Information Institutions cannot designate student’s SSN or other student ID number as directory information. Directory information could include, however, a student’s user ID or other unique identifier used to access or communicate in electronic systems. This user ID must not be able to gain access to education records unless used in conjunction with PIN, password, or similar factor. WSU does not designate SSN, WSUID, or NID as directory information.

17. Definition of Disclosure Excludes from definition of disclosure the release or return of an education record to the identified creator of the record. Possible falsified records can be sent to the issuing institution to confirm the validity of the records.

18. Definition of Education Records Records created after a student is no longer enrolled are excluded from education records if they are not directly related to the individual’s attendance as a student. Peer-graded papers are not education records until collected and recorded by a teacher. Once recorded, they are education records. Graded homework, examinations are education records once recorded.

19. Disclosures to Parents of Eligible Students Institutions may disclose education records to parents without consent, if:  the student is a dependent  In connection with a health or safety emergency  If the student is under 21 and has violated federal, state or local law or institutional policy governing the use or possession of alcohol or a controlled substance  If the disclosure falls within any other exception to the consent requirement, such as directory information.

20. Disclosure of Education Records – School Officials Expands school officials to include contractors, consultants, volunteers, and other outside parties to whom institution has outsourced institutional services or functions. Must have control over outside party regarding education records, including data security. Specific language is required in all contracts that involve release of education records to third parties.

21. Disclosure of Education Records – School Officials Requires institutions to use reasonable methods to ensure that teachers and other school officials obtain access to only those education records in which they have legitimate educational interests. Institutions that choose not to use physical or technological controls to restrict access must ensure that their administrative policy is effective. Requires either limited access (such as by department) or logs of records being accessed.

22. Disclosure of Education Records – School Officials The Registrar’s Office is now limiting access to information using technological controls.  Class lists limited by prefix or teacher assignment  Schedules will be limited by major and/or advising code Access to mainframe screens (OARS) will be limited to those that need access to all records RONet will be expanded to provide access to records currently (or previously) available in OARS

23. Disclosure of Education Records – School Officials High risk records, such as those that contain credit card information, SSNs and other elements used for identity theft, immunization and other health records, certain records on special education students, and official transcript and grades should generally receive greater and more immediate protection than medium or low risk records.

24. Disclosure of Education Records – Organizations Conducting Studies Not necessary for institution to initiate or agree with study Requires institutions to enter into a written agreement with organization specifying:  the purposes of the study  non-disclosure of identity of students  destruction or return of data at conclusion  confidentiality of data during study

25. Disclosure of Education Records – Identification “An educational agency or institution must use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the agency or institution discloses personally identifiable information from education records.”

26. Disclosure of Education Records – Identification WSU provides authenticated access in myWSU Parents and third parties can use myWSU Shared Info to access a student’s information Parent and third parties may have access to a telephone password E-mail is not secure method of sending education records Use of encrypted web systems more secure Cannot use SSN to verify identity of student

27. Disclosure of Education Records – De- Identification of Information Remove data from statistics that might lead to personal identification of students. In particular, the Department of Education has “advised States and schools generally that they may not report publicly on the number of students of a specified race, gender, disability, English language proficiency, migrant status, or other condition …unless there is a sufficient number of students in the defined category so that personally identifiable information is not released.” Small cell sizes must be removed from statistics made public or provided to outside organizations or persons. Examples include Grade Distribution and Majors reports

28. Disclosure of Education Records – Health and Safety Emergencies Removes strict construction of this exception. Adds provision that “an educational agency or institution may take into account the totality of the circumstance pertaining to a threat to the safety or health of a student or other individuals.” “If the institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individuals.”

29. Disclosure of Education Records – Health and Safety Emergencies FERPA not a barrier to providing necessary information to protect students and others. Parents are not excluded from receiving information when there are health and safety concerns. Any exceptions made under this provision are subject to recordation requirements.

30. Disclosure of Education Records – Directory Information Disclosure of Information About Former Students  Institutions must continue to honor any valid request to opt- out of directory information disclosures made while the individual was a student unless the student rescinds the decision. Identification of Students and Communications in Class  Students may not use the right to opt-out of directory information to keep their name, electronic identifier, or institutional e-mail address out of class.  “The right to opt-out of directory information disclosures is not a tool for students to remain anonymous in class.”

31. QUESTION & ANSWER

32. Reference Material WSU Reference Material Questions about FERPA: Richard Backes, (509) 335-1139, backes@wsu.edubackes@wsu.edu Attorney General’s Office, (509) 335-2636 Annual Notification of FERPA Rights: http://www.registrar.wsu.edu/Registrar/Apps/FERPA.ASPX WSU Policy on Release of Education Records: BPPM 90.06 – Release of Student Education Records WAC 504-21 University Policy on Student Education Records

33. Federal Reference Material Family Policy Compliance Office (FPCO): http://www.ed.gov/policy/gen/guid/fpco/index.html Final Regulations for FERPA Published December 2008: http://www.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.pdf Analysis of Final Regulations by the FPCO: http://www.ed.gov/policy/gen/guid/fpco/pdf/ht12-17-08-att.pdf Reference Material

34. WSU employees attending this session via videoconferencing and who wish to have it recorded on their training history must notify HRS within three days of the session date: hrstraining@wsu.edu

35. WSU employees attending this session via videoconferencing and who wish to have it documented on their training history must notify Human Resource Services within three days of the session date: hrstraining@wsu.edu