Dear Dr. Rooker,
We would like to ask your advice on a “best practice.” We are aware it is a best practice to not include both the student’s name and student number in the Subject Line of email communications. But is it merely “best
practice,” or is this is a clear violation of FERPA to:
1. Include both the student name and ID number in the subject line of email communications being sent and received within the college’s secure and encrypted network?
2. Include both the student name and ID number in the subject line of email communications that may be sent and received and forwarded outside of the college’s secure and encrypted network?
Thank you,
Joe King
_________________________________________________________________________________________
Dear Joe:
FERPA does not regulate the manner in which an institution communicates, whether electronic or by other means. However, it does require that any such communication not result in the unauthorized disclosure of student education records. Thus,
if the College is communicating over a secure and encrypted network, this would seem to provide reasonable protection for the sharing of education records within the institution.
If, however, the email is forwarded outside the institution, by a school official, this would pose a higher risk of an unauthorized disclosure.
On the other hand, if the student is the one forwarding the email received through the College secure email to an outside email, this would not be a disclosure under FERPA because it is not the institution taking the action. You can find
FERPA's "disclosure" definition on page 153 of the 2012 AACRAO FERPA Guide.
I hope this is helpful in answering your questions.