Dear FERPA Professor:
Like many institutions, my employer is using a CRM system (Salesforce) for academic advisors to engage with students and to make notes regarding their advising sessions. The advisors are also using the CRM system for creating and managing “at-risk” cases, and they make comments regarding their outreach efforts and outcomes. The advisors are also using the CRM system to send email messages and SMS messages to engage with students. In addition, academic advisors communicate with students via our regular email server.
Based on my understanding of FERPA and its definition of “education records,” these records would not be considered education records because they are not kept or maintained by a single custodian in a centralized place, such as a registrar in the Registrar’s Office, unless they are printed out of the system and placed in the student’s file.
Can you provide any insight as to industry best practices or consensus regarding these types of records and whether they should be considered “education records” or not?
Please advise.
Sincerely,
Miss Led
__________________________________________________
Dear Miss Led,
Thank you for the question. Education records are defined in FERPA as those records that are "directly related to a student and maintained" by an educational institution or by a party acting for the institution. (See §99.3 "Education Records" in the FERPA regulations). FERPA does not speak to how or where the records are maintained, and it does not require that they be printed out and placed in a student's file. The definition is not encumbered by any other requirements. The term "education records" does not, however, include records that are kept in the sole possession of the maker of the record; are used only as a personal memory aid; and are not accessible or revealed to any other person except a temporary substitute for the maker of the record. Once such records are shared or are accessible by others, they become education records. Absent additional details, it does not appear that the system-maintained records that you are referencing would meet these conditions. If they would not, then they would be education records, and the student would have a right to inspect and review them. You can find the above cited regulations on page 154 of the 2012 AACRAO FERPA Guide.
I hope this is helpful in answering your question.
All the best,
The FERPA Professor