By Michael Bilfinger, AACRAO Associate Director Membership & Awards
As someone with no direct experience in a registrar's office and who recently transitioned into AACRAO's government relations team, one of my personal goals for attending the 109th Annual Meeting was to learn more about FERPA so that I can better advocate for AACRAO members in my new role. As such, I attended the popular session on Monday, "FERPA: The Basics," presented by LeRoy Rooker, Senior AACRAO Fellow.
The Family Educational Rights and Privacy Act, more commonly known as FERPA, is the federal law that pertains to the release, access to, and maintenance of student educational records in primary, secondary, and post-secondary education. But what even is an educational record, you may be asking. An educational record is any information, in any form, directly related to a student and maintained by an educational agency or institution by a party acting for the agency or institution. This includes but is not limited to, a student's transcript and disciplinary records.
Contrary to common belief, FERPA does not actually require institutions to maintain records; however, if (and when) they do, FERPA applies. It should be noted that while institutions are not required to maintain educational records, it is illegal under FERPA to destroy a student's educational records while their request to review and/or amend their records is still pending. This is part of why it is so important for schools not only to have a records retention policy but also a records destruction policy. Doing so can help to protect an institution from FERPA liability and significantly reduce the burden of complying with a student's records review request. That being said, what does it even mean for a student to review and/or amend an educational record?
Under FERPA, students have four legal rights: the right to review their educational record, amend their record, disclose their record, and file a complaint with the Student Privacy Policy Office within the Department of Education alleging that a FERPA violation has occurred. In post-secondary education, these four rights set up the legal framework that makes it such that institutions can't disclose any information in a student's educational record to someone other than the student without first receiving consent from the student. However, there are several exceptions as to when information in an educational record can be disclosed without a student's consent. These exceptions include the following:
School officials with a legitimate educational interest in accessing the educational record. Legitimate educational interest basically comes down to whether or not access to the educational record is essential to the duties of a given position.
Schools in which a student seeks or intends to enroll
Federal, state, and local educational authorities conducting an audit, evaluation, or enforcement of education program
In connection with financial aid
To organizations conducting studies on behalf of educational institutions
Accrediting organizations
Parents of a dependent student. Status as a dependent student is determined by whether or not the student is claimed on their parent's IRS tax return.
To comply with a judicial order or subpoena
In a health or safety emergency
Directory information
To the student
Results of a disciplinary hearing of an alleged victim of a violent crime
Final results of a disciplinary hearing concerning a student who is an alleged perpetrator of a crime of violence and who is found to have committed a violation of the institution's rules or policies
Disclosure to the parent of a student under 21 years of age if the institution finds them to have violated the institution's drug and/or alcohol policy
I want to draw your attention to one particular exception: that of directory information. This is defined as information not generally considered harmful and/or invasive if disclosed, and some examples include name, address, phone number, email, height, and weight. It's critical to note that directory information cannot include social security numbers (SSNs), and SSNs cannot be used to confirm the identity of an individual. There is no requirement for institutions to have directory information, and they get to define this themselves; however, having defined directory information is highly encouraged. Without it, institutions wouldn't be able to announce students' names at convocations, include the height and weight of student-athletes in a marketing promotion, have any public pictures of students, and much more. Students must be given the option to opt out of directory information; doing so would mean that consent must be obtained for a school even to include that student's name in something as simple as the program for a graduation ceremony.
As overwhelming as this all might seem, it is actually just scratching the surface of understanding FERPA and its implications. But fear not! AACRAO has resources on its website as well as publications and courses focused on FERPA that can help. I also highly encourage you to take the FERPA Pre-Test in order to see where you are at with your FERPA knowledge.