FREQUENTLY ASKED QUESTIONS
General Questions
What is FERPA?
The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords students the right to have access to their education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. When a student turns 18 years old or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student ("eligible student"). The FERPA statute is found at 20 U.S.C. § 1232g and the FERPA regulations are found at 34 CFR Part 99.
When do FERPA Rights begin?
A FERPA-related college education record begins for a student when he or she enrolls in a higher education institution. At a post-secondary institution rights belong to the student in attendance, regardless of the student's age.
What records are exempted from FERPA?
Exempted from the definition of education records are those records which are kept in the sole possession of the maker of the records and are not accessible or revealed to any other person except a temporary substitute for the maker of the records. Once the contents or information recorded in sole possession records is disclosed to any party other than a temporary substitute for the maker of the records, those records become education records subject to FERPA. Generally, sole possession records are of the nature to serve as a "memory jogger" for the creator of the record. For example, if a school official has taken notes regarding telephone or face to face conversations, such notes could be sole possession records depending on the nature and content of the notes.
How may a parent or eligible student file a FERPA complaint with the Department of Education?
A parent or eligible student may file a written complaint with the Family Policy Compliance Office regarding an alleged violation under of FERPA. The complaint must be timely (submitted to the office within 180 days of the date that the complainant knew or reasonably knew of the violation) and state clearly and succinctly specific allegations of fact giving reasonable cause to believe that the school has violated FERPA.
Top of Page
From Parents
Who is a parent?
The term "parent" is defined as including natural parent(s), a guardian, or an individual acting as a parent in the absence of a parent or a guardian. Source: 20 U.S.C. § 1232g(d)
In some cases, a stepparent may be considered a "parent" under FERPA if the stepparent is present on a day-to-day basis with the natural parent and child and the other parent is absent from that home. Conversely, a stepparent who is not present on a day-to-day basis in the home of the child does not have rights under FERPA with respect to the child's education records. A grandparent or other caregiver who is acting in the absence of the parent(s) may also be considered a "parent" under FERPA. Source: 34 CFR § 99.3
If a student under 18 is enrolled in both high school and a local college, do parents have the right to inspect and review his or her education records?
If a student is attending a postsecondary institution - at any age - the rights under FERPA have transferred to the student. However, in a situation where a student is enrolled in both a high school and a postsecondary institution, the two schools may exchange information on that student. If the student is under 18, the parents still retain the rights under FERPA at the high school and may inspect and review any records sent by the postsecondary institution to the high school. Additionally, the postsecondary institution may disclose personally identifiable information from the student's education records to the parents, without the consent of the eligible student, if the student is a dependent for tax purposes under the IRS rules.
Are educational agencies and institutions required to notify parents and eligible students of their rights under FERPA?
Yes. Educational agencies and institutions must annually notify parents and eligible students of their rights under FERPA. Specifically, schools must notify parents and eligible students of the right: to inspect and review education records and the procedures to do so; to seek amendment of records the parent or eligible student believes are inaccurate and the procedures to so do; to consent to disclosures of education records, except to the extent that FERPA authorizes disclosure without consent; and to file a complaint with FPCO concerning potential violations. Postsecondary institutions are only required to notify eligible students of their rights under FERPA. Source: 34 CFR § 99.7
In the case of a divorce, do both parents have rights under FERPA?
Generally yes. Unless a school is provided with evidence that there is a court order, State law, or other legally binding document relating to such matters as divorce, separation, or custody that specifically provides to the contrary, FERPA gives custodial and noncustodial parents alike certain rights with respect to their children's education records. A school may ask for legal certification denoting parenthood, such as a birth certificate or court order, from the parent requesting access. Source: 34 CFR § 99.4
Must postsecondary institutions provide a parent with access to an eligible student's education records?
While the rights under FERPA transfer from the parents to the student when the student turns18 or enrolls in a postsecondary institution at any age, FERPA provides ways in which an institution can share education records on the student with his or her parents. Schools may disclose any and all information to parents, without the consent of the eligible student, if the student is a dependent for tax purposes under the IRS rules. FERPA also permits a school to disclose information from an eligible student's education records to parents if a health or safety emergency involves their son or daughter. Another provision in FERPA permits a college or university to let parents of students under the age of 21 know when the student has violated any law or policy concerning the use of possession of alcohol or a controlled substance. School officials may also share information with a parent about an eligible student that is based on that official's personal knowledge or observation and that is not based on information contained in an education record.
How can I gain access to my child's academic and financial information?
Once a student is enrolled in a post-secondary institution, like UC, the rights under FERPA belong to the student and not the parent. You should work with your child and have them give you the information. If you claimed your child on last year's income taxes, UC MAY release information. To receive this information, you must submit a copy of your tax statement showing the student as a dependent and a request stating what information you would like and why. UC must then record in the student's permanent record what they released, to whom, and that it was done under the dependency exception. The student may also submit a FERPA Consent Form indicating what information they are releasing to whom.
May an educational agency or institution disclose information over the phone?
While FERPA does not specifically prohibit a school from disclosing personally identifiable information from a student's education records over the telephone, it does require that the school use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the school discloses personally identifiable information from education records. 34 CFR § 99.31(c).
How does a school know when a health or safety emergency exists so that disclosure may be made under this exception to consent?
An educational agency or institution must make this determination on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of a student or others. If the school determines that there is an articulable and significant threat to the health or safety of a student or other individuals and that a third party needs PII from education records to protect the health or safety of the student or other individuals, it may disclose that information to appropriate parties without consent.
May an educational agency or institution disclose directory information without prior consent?
Education records that have been appropriately designated as "directory information" by the educational agency or institution may be disclosed without prior consent. See 34 CFR §§ 99.31(a)(11) and 99.37. FERPA defines directory information as information contained in an education record of a student that would not be considered harmful or an invasion of privacy if disclosed. 34 CFR § 99.3.
FERPA provides that a school may disclose directory information if it has given public notice of the types of information which it has designated as "directory information," the parent or eligible student's right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as "directory information." 34 CFR § 99.37(a). A school is not required to inform former students or the parents of former students regarding directory information or to honor their request that directory information not be disclosed without consent. 34 CFR § 99.37(b). However, if a parent or eligible student, within the specified time period during the student's last opportunity as a student in attendance, requested that directory information not be disclosed, the school must honor that request until otherwise notified.
Top of Page
From Students
Who is an eligible student?
An "eligible student" means a student who has reached the age of 18 or who is attending a postsecondary institution at any age. Once a student becomes an "eligible student," the rights afforded his or her parents under FERPA transfer to that student. Source: 20 U.S.C. § 1232g(d)
What email accounts can I use with FERPA-protected information?
If the email system is provided by the college and is within the college's firewall you may send confidential data in an email. Emails to or from students, or anyone outside the UC domain, should be treated like a postcard and only include directory or non-FERPA data. Send any confidential information to students through UC email.
An eligible student that opted out of directory information has left the school. Now that the student is no longer in attendance, may the school disclose that student’s directory information?
No, a school is required to honor the eligible student's request to opt out of the disclosure of directory information made while the student was in attendance unless the student rescinds the opt-out request.
Does a spouse of an eligible student have rights with respect to that student's education records?
No, spouses of eligible students have no rights under FERPA. Before a college or university discloses information from a student's education records to his or her spouse, the student would have to provide written consent.
Top of Page
From Faculty
Who is a "school official" under FERPA?
A "school official” includes a teacher, school principal, president, chancellor, board member, trustee, registrar, counselor, admissions officer, attorney, accountant, human resources professional, information systems specialist, and support or clerical personnel. A contractor, consultant, volunteer, or other party to whom a school or institution has outsourced institutional services or functions may also be considered a "school official" provided that they are performing an institutional service or function for which the agency would otherwise use employees and is under the direct control of the agency or institution with respect to the use and maintenance of education records. See 34 CFR § 99.31(a)(1)(i)(B).
Does FERPA permit school officials to release information that they personally observed or of which they have personal knowledge?
FERPA applies to the disclosure of education records and of PII from education records that are maintained by the school. Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official's personal knowledge or observation, rather than from the student's education records. For example, if a teacher overhears a student making threatening remarks to other students, FERPA does not protect that information from disclosure. Therefore, a school official may disclose what he or she overheard to appropriate authorities, including disclosing the information to local law enforcement officials, school officials, and parents.
Is it permissible to release GPA to honors organizations without consent?
No. FERPA does not generally permit a school to disclose a student's GPA without the parent's or eligible student's consent.
I want to use online tool or application as part of my course. However, I am worried that it is a violation of FERPA. What should I do?
A teacher should check with their school administration to see what has been defined as directory information. As long as using the application would not require disclosing more than directory information and none of the students have opted out of directory information, it would not be a violation of FERPA.
A student has opted out of directory information and wants to be anonymous on an online course. Are we required to allow the student to take the course anonymously?
No. Under FERPA, a student may not use his or her right to opt out of directory information disclosures to prevent school officials from identifying the student by name or disclosing the student's electronic identifier or institutional e-mail address in class.
What are acceptable methods for returning assignments and exams?
Leaving personally identifiable, graded papers (exams, homework, etc.) unattended for students to view is a form of publicly posting grades. If these papers contain personally identifiable information, then leaving them unattended for anyone to see is a violation of FERPA. If papers cannot be returned personally and individually during class, an alternative would be to leave the graded papers with an assistant who would ask students for proper identification before releasing them.
May I publicly post grades?
The public posting of grades by the student's name, student ID, or social security number, without the student's written permission, is a violation of FERPA. If necessary, instructors can assign students unique numbers or codes that can be used to post grades, but the order of the posting must not be alphabetic. Students may access grades on Banner Web soon after they are posted by faculty.
Am I required to verify the identity of the student or others to whom I disclose education records?
Yes. FERPA requires that institutions use "reasonable methods" to verify the identity of students, school officials, parents and others to whom information from education records is disclosed. The use of "widely available" information to verify the identity, such as name, date of birth, social security number or student ID number, is not considered reasonable or sufficient. If the student's social security number or other non-directory information is used alone or combined with another date we must not disclose or confirm directory information.
Identity verification must include at least one element that is either known or possessed only by that person, for example:
- Photo ID
- Random PIN or token
- Password
- Biometric factors (ex: fingerprint scan, voice or facial recognition, etc.)
What are the limits in working with parents?
At the elementary and secondary school level, FERPA gives parents the right to access education records. When a student reaches 18 years of age or is attending an institution of postsecondary education, FERPA rights transfer from parent to student. Therefore, at the postsecondary level, parents have no inherent rights to access their son's or daughter's education records.
Information such as a student's enrollment in a course, class attendance, or progress/grades in a course is personally identifiable information that constitutes part of the student's education record that is protected under FERPA. Parents may not have access unless the student has provided written authorization. If a student has filed a consent form to give parents access to student records, faculty members may release information to parents, provided the identity of the parents has been authenticated. Please contact the Office of the Registrar to obtain information on whether a student has filed a consent form of not.
Parents of a dependent student may challenge the denial of access to educational records by providing to the Registrar's Office evidence that they declare the student as a dependent on their most recent Federal Income Tax form (Form 1040). If such a form has been filed, faculty members may release information to parents, provided the identity of the parents has been authenticated. Please contact the Office of the Registrar to obtain information on Federal Income Tax form (Form 1040).
Even if no specific information can be released about a student, faculty members may be able to assist parents by providing general information that does not violate FERPA. Course requirements, a copy of the course syllabus, and other similar information may be helpful.
How should I handle letters of recommendation?
As a faculty member, you may be asked to write a letter of recommendation on behalf of a student. If the letter includes information that falls within FERPA's definition of educational records, such as grade point average or other non-directory indicators, the student's written consent to disclose this information would be necessary. Unless the student has waived the right of access to the letter, he or she would have the right to read it, because it is part of the student's educational record.
The written release from the student should:
- specify the records that may be disclosed
- state the purpose of the disclosure, and
- identify the party or class of parties to whom disclosure may be made (FERPA § 99.30)
Why can't I post grades by the last four digits of a student's SSN?
The public posting of grades by any of the following methods without the student's written permission is a violation of FERPA:
- Student's name.
- Any part of the student's social security number.
- Student's institutional identification number.
May I include a GPA in a letter of recommendation that the student has asked me to write?
Statements made by a faculty making a recommendation that are made from that faculty's personal observation or knowledge do not require a written release from the student. However, if personally identifiable information obtained from a student's education record is included in the letter of recommendation (for example GPA), then you are required to obtain a signed release from the student. The release will need to specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure can be made. This student release should be requested from the student prior to writing a letter of recommendation. * Faculty are not required to maintain the letters of recommendation, but it is suggested that they do retain the permission letter for 6 months.
What can I include in the recommendation? What Can't I include?
When you write a letter of recommendation, you must have a written request from the student and you can only include what the student authorizes you to include.
What do I have to do to comply with FERPA in returning examinations and term papers?
Leaving personally-identifiable, graded papers unattended for students to pick through is no different from posting grades in a hallway. If these papers contain personally-identifiable information, then leaving them unattended for anyone to see is a violation of FERPA if the instructor has not obtained the written permission of each student to make his or her coursework accessible in this public manner.
BEST PRACTICE:
- Place each student's coursework in a sealed envelope with only the student's name printed on the envelope.
- Identify each student with a code word or randomly assigned number known only to the faculty member and the student. Identify all coursework by this code number.
- Return completed coursework during class.
- Have students collect their coursework from the departmental administrative assistant only after the administrative assistant has affirmed the student's identification via a photo ID. (Check to see if this service is available in your academic division first.)
- Obtain and maintain each student's written permission to distribute coursework in a public manner.
Progress in a course, deficiencies in a subject area, final grades, grades on exams, and other information about academic progress are examples of the confidential information that makes up part of a student's education record. This information is protected under FERPA and parents do not have access to it unless the student has provided consent to the release of this information. You can verify the parent's authorization to access the student's education record through the Office of the Registrar. When a parent calls you and wants this information over the phone, it is recommended this be done in person or with the student present in your office who can verify the identity of the person on the phone.
Can I pass around a class list to take attendance?
Do not record attendance by passing around a class list, which contains the students SSN/Student ID or username.
Top of Page