Written by: Barbara Lauren
Published: 12/11/2008

In-Depth Summary of Changes to FERPA Rules

The U.S. Department of Education published its long-awaited final rule on the Family Educational Rights and Privacy Act (FERPA) in the December 9, 2008 issue of the Federal Register. The new regulations will take effect on January 8, 2009. The Department had issued its original Notice of Proposed Rulemaking (NPRM) on March 24, 2008.

The Department has issued the following changes or clarifications.

Definitions – 34 CFR 99.3

Attendance
Old definition: "Attendance in person or by correspondence." New definition: "Attendance in person or by paper correspondence, videoconference, satellite, Internet, or other electronic information and telecommunications technologies for students who are not physically present in the classroom [new material italicized by AACRAO for easier identification]

Also note: In a discussion of "attendance," the Department adds: "We do not agree that the definition of attendance should be limited to receipt of instruction leading to a diploma or certificate, because this would improperly exclude many instructional formats."   Federal Register, Vol. 73, No. 237, at 74807. [Further references will be to page numbers only, of this volume of the Federal Register.]

Biometric record
This is a new definition, appearing under "Personally identifiable information" in section 99.3   The term "biometric record" is defined, for the first time, as a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints; retina and iris patterns; voiceprints; DNA sequence; facial characteristics; and handwriting."
     

Directory information

Section 99.3(1) – Definition of term
The Department states in its discussion of the term: "We have revised the definition of directory information in 99.3 to provide that directory information includes a student ID number if it cannot be used to gain access to education records except when used with one or more other factors to authenticate the user’s identity." At 74808.

Conditions for Disclosing Directory Information.

Note: The Department made use of the comment and discussion sections under Section 99.3(2) to discuss three issues under 99.37 ("What conditions apply to disclosing information?"). These three issues are:

• Opt-out of disclosure of directory information continues after the student was in attendance.

  The Department states in its Discussion of this issue: "[Once] a...student opts out of directory information disclosures, the...institution must continue to honor that election after the student is no longer in attendance," until or unless the student chooses to rescind that decision. At 74809.

• FERPA does not give the student the right to prevent disclosure of their name or other identifier in the classroom
• Miscellaneous provisions regarding Social Security Numbers:
• SSNs may never be disclosed as directory information. At 74845.
• Use of SSN to confirm directory information is prohibited. At 74846.
• However, if a student identifier cannot be used to access records or communicate electronically without one or more additional factors to authenticate the user’s identity, then the institution may treat that number as directory information, regardless of what the number is called. At 74808.
• Under FERPA, an institution may decide to make students’ electronic identifiers and e-mail addresses available within the institution but not release them to the general public as directory information. At 74088.

Education records

Section 99.3(b)(5)

This section clarifies two situations involving "former students." The department reiterates its long-standing distinction between records created or received by an educational institution that are directly related to the individual’s attendance as a student, versus those records which are not directly related to attendance as a student.

In the first situation, the records are not excluded from the definition of "education records" under FERPA; in the second situation, they are excluded. As to the second situation, the Department states: "For example, ‘personally identifiable information’ related solely to a student’s activities as an alumnus of an institution is excluded from the definition of education records under this provision." At 78411.

Section 99.3(b)(6)

This section concerns grades on peer-graded papers before they are collected and recorded by a teacher. The Department implements the holding of a Supreme Court decision on peer-graded papers in Owasso Independent School Dist. No.I-011 v. Falvo, 534 U.S. 426 (2002) (Owasso), which held that peer-grading does not violate FERPA. The Department adds in its discussion: "As suggested by the Supreme Court, FERPA is not intended to interfere with a teacher’s ability to carry out customary practices, such as group grading of team assignments in the classroom...FERPA does not prevent teachers from allowing students to grade a test or homework assignment of another student or from calling out that grade in class, even though the grade may eventually become an education record...." At 74811-82.

Personally identifiable information – Section 99.3

The Department refers readers to the discussion of "Personally Identifiable Information and De-Identified Records and Information," in Section 99.31(b). Please see that section, below, for appropriate discussion.

Disclosure to parents – Sections 99.5, 99.31(a)(8), and 99.30(b)(3)

Section 99.5 addresses the question: "What are the rights of students?" The Department reiterates that FERPA rights transfer to a student when s/he enters a postsecondary institution. In addition, as is also well established, an institution may choose to disclose [not "allow a student to disclose"] education records to a student's parents under Section 99.31(b)(3) and discussion at 74813.

The Department clarifies that it does not have statutory authority to apply 99.31(a)(8) to any other family members. However, the Department points out that the written consent form which a student can choose to sign can "identify the party or class of parties to whom the disclosure may be made." See Section 99.31(b)(3) and discussion at 74813.

Note: The Department does add: "In most cases, when an educational agency or institution discloses education records to parents of an eligible student, we expect the disclosure to be made under the dependent student provision of 99.31(a)(8)."

Outsourcing
Remember to Amend your Annual Notification to Include Contractors, Volunteers, and others performing institutional functions Section 99.31(a)(1)(i)(B)

The regulations in 34 CFR 99.31(a)(1)(i)(B) will now allow institutions to disclose – without consent – education records, or personally identifiable information from education records, to contractors, volunteers, and other non-employees performing institutional services and functions, with one important requirement: that the institution must amend its Annual Notification of FERPA rights to include those parties as "school officials with legitimate educational interests." At 74847.

The Department discusses three considerations in outsourcing.

• Outside Parties Who Quality as School Officials

  The Department’s discussion states: "The statutory basis for expanding the ‘school officials’ exception to outside service providers is that they are ‘acting for’ the agency or institution, nor selling products and services." At 74814.

• Direct control

  The Department suggests, although does not mandate, that "one way in which schools can ensure that parties understand their responsibilities under FERPA with respect to education records is to clearly describe those responsibilities in a written agreement or contract." At 74816.

• Protection of Records by Outside Parties Serving as School Officials

  The purpose of the outsourcing section, 99.31(a)(1), is to provide "that contractors are subject to the same conditions governing the access and use of records that apply to other school officials." At 74817. The Department adds that although schools are free to require that parties to whom services have been outsourced undergo fingerprint and background investigations, there is no statutory requirement in FERPA to include such a requirement in the regulations. At 74816.

Transfer of Education Records

Sections 99.31(a)(2) and 99.34(a)

The Department states: "The regulations are intended to clarify that, after a student has already enrolled in a new school, the student’s former school may disclose any records or information, including health records and information about disciplinary proceedings, that it could have disclosed when the student was seeking or intending to enroll in the new school." [Emphasis added.] At 74818.

Disciplinary Records:

• Commentary on Transfer of Education Records

  The Department states: "FERPA does not contain any particular restrictions on the disclosure of a student’s disciplinary records…." In addition, the Department clarifies that "nothing in FERPA prevents an educational… institution from including in a student’s record and disclosing to teachers and school officials, including those in other schools, appropriate information about disciplinary actions taken against [a] student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community." At 74818-19.

• Ex Parte Court Orders under the USA Patriot Act – Section 99.31(a)(9)

  The Department notes in its discussion that "the USA Patriot Act amendments to FERPA amendments have not been ruled unconstitutional, and its provisions relevant to FERPA do not sunset in 2009. Therefore, we are implementing these provisions in our regulations at this time." At 74819.

• Registered Sex Offenders – 34 CFR 99.31(a)(16)

  The regulations now allow for disclosure without consent of any information provided to an educational institution concerning registered sex offenders, pursuant to the pertinent provisions of the Wetterling Act, 42 U.S.C. 14071 and applicable Federal guidelines. See Fed. Reg. at 74820.

The Department estimates that "two educational authorities in each state and the District of Columbia (one for K-12 and one for postsecondary) and the Department itself, for a total of 103, will maintain the required records of redisclosures." At 74849.

Educational Research
Sections 99.31(a)(6) and 99.31(a)(3)

These sections provide for a series of constraints on an educational institution when it collaborates with another organization which is conducting a study. In summary, all of the Department’s guidance on this matter is intended to ensure that an institution, under the study has "reasonable controls in place to ensure that personally identifiable information from education records is protected." See Fed. Reg. 74827.      

The Department adds: "While we do not have the authority under FERPA to officially certify agreements between…institutions and organizations conducting studies, FPCO [the Family Policy Compliance Office, within the Department] does provide technical assistance…on FERPA." At 74827.

Disclosure of Education Records to Non-Educational State Agencies
The Department explains that there is no specific exception to the written consent requirement under FERPA that permits the disclosure of personally identifiable information from students’ education records to non-educational State agencies. However, disclosures may be made under specific other exceptions in FERPA, such as the health or safety exception, sec. 99.31(a)(10) and 99.36, or in relation to financial aid, sec. 99.31(a)(4), or other exceptions. See 74828.

Disclosure of Education Records to Student’s Former Schools
Sections 99.31(a)(3), 99.31(a)(6), and 99.35(b)

Section 99.31(a)(3) allows for one institution to disclose personally identifiable information from education records, without consent, to a school where the student intends to enroll or seeks to enroll.

Section 99.31(a)(6) is the "studies exception" discussed under Educational Research, above.

Personally Identifiable Information and De-Identified Records and Information
Sections 99.3 and 99.31(b)

Definition of "personally identifiable information"
The Department has removed the "easily traceable" standard (as one source of information which could be included as "personally identifiable information") and has substitute for that standard the following three:

(e)Other indirect identifiers, such as the student’s date of birth, palce of birth, and mother’s maiden name;

(f)Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or

(g)Information requested by a person who the educational agency or institution reasonable believes knows the identity of the student to whom the education record relates.

Paragraph 1 of 99.31(b) refers to de-identified information and thus is not limited to use for education research purposes. At 74836.

Paragraph 2 of that section applies only to parties conducting education research, because it contains coded microdata. At 74386.

Notification of Subpoena – Section 99.33(b)(2)

The Department states, in its discussion of this section: "We have revised the regulation to provide that the burden to notify a...student rests with the recipient of the subpoena or court order."

In addition, the Department has added the provision, under 99.33(3), that if a third party recipient did not provide the notification required under 99.31(a)(9)(ii), the institution is not allowed to grant access to education records to that third party for at least five years.

The "Health or Safety" Exception – (34 CFR 99.36)

The Department has made three important liberalizations to the section of FERPA which governs how institutions can make use of the "health or safety" exception to FERPA.

No longer will the health or safety exception be "strictly construed" [the old section 99.36(c)]. Instead, section (c) now provides the following three types of useful flexibility:

First, in making a determination as to whether to invoke the "health or safety" exception, institutions may take into account the "totality of the circumstances" pertaining to the safety or health of a student or other individuals.

Second, if the institution determines that there is an "articulable and significant threat" to the health or safety of a student "or any other individuals," it may disclose information from education records "to any person whose knowledge of the situation is necessary to protect" the health of safety of the student or other individuals.

Third, "If, based on the information available at the time of the determination, there is a rational basis for the determination, the Department will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making its determination."

Another change occurs in 99.36(a). In connection with an emergency, an institution may disclose personally identifiable information from an education record "to appropriate parties, including parents of an eligible student [emphasis added], if knowledge of the information is necessary to protect the health or safety of the student or other individuals."   The provision for disclosure to the parents, in this context, is new.

In addition, the Department will now require that the institution involved must record, under 34 CFR 99.32(a)(5), the nature of the threat and the parties to whom it disclosed information under the "health or safety" emergency exception.

Identification and Authentication of Identity – Section 99.31(d)

The Department states that a "sliding scale" of protection – for SSNs as opposed to other information – nevertheless "it may not be ‘reasonable’" to use a one-size-fits-all approach to authenticating identity, based on the material proffered to prove identity. AT 74840.

Enforcement – Sections 99.64(a), 99.64(b), 99.66, and 99.67

A complainant need not allege that an alleged violation of FERPA constitutes a "policy or practice." 99.64(a). The FPCO may initiate an investigation on its own. (99.64(b).

Department Recommendations for Safeguarding Education Records

The Department republishes the Department Recommendations for Safeguarding Education records that were published in the preamble to the NPRM (73 FR 15598-15599). See Federal Register, Vol. 73, No. 237, at 74843-74844.

See edocket.access.gpo.gov/2008/pdf/E8-28864.pdf, Federal Register, Part II, Department of Education, 34 CFR Part 99, Family Educational Rights and Privacy; Final Rule. Federal Register, Vol. 73, No. 237, Tuesday, December 9, 2008, 74806-74853