FERPA Handbook for Faculty and Staff

This handbook is designed for employees of the University of Iowa in administrative, supervisory, academic, research, or support staff positions, including Campus Safety and UI Health Care staff.

Family Education Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) also known as the Buckley Amendment, passed by Congress in 1974, grants four specific rights to students:

The right to inspect and review their educational records
The right to request the amendment of inaccurate or otherwise inappropriate records
The right to consent to disclosure of his or her public records
The right to file a complaint with the Family Compliance Office in the United States’ Department of Education, concerning alleged failure by the University of Iowa to comply with the requirements of FERPA.

Students are granted rights under FERPA if they are currently attending the University of Iowa or have been in attendance, regardless whether in a credit, no-credit, degree or non-degree credit program. FERPA does not apply to applicants of a school or college at the University of Iowa who have been admitted but who have not actually been in attendance.

Education Records

An education record is any information that is directly related to a student and maintained by a college or university and by agents acting directly for the college or university. Records are treated the same no matter what medium (handwritten, email, print, digital, etc.) that are in the possession of any school official.

Some examples of education records include:

Personal information
Employment records (where student status is a prerequisite of employment)
Grades
Class schedules
Printed class lists
Graded test papers with personally identifiable information related to the individual student

Exceptions: Education Records Do NOT Include:

Records in the "sole possession of the maker that are not accessible to other personnel”
Law enforcement or campus security records created and maintained by the law enforcement unit and used for law enforcement purposes
Employment records
Medical/psychological treatment records
Alumni records (those created after the student graduated or left the institution)

Record of Requests

The University will maintain a record of the requests for and disclosure of personally identifiable information from the educational record of the student.

The record of requests will state the names of the parties who have requested or obtained personally identifiable information, and the legitimate interest of the party in requesting or obtaining that information. This record of requests and disclosures will be maintained by the office that maintains the educational record and may be inspected by the student under the same procedures by which the record itself may be inspected.

Exceptions to this are:

Requests for and disclosure of directory information
Requests and disclosure to persons described in the University of Iowa Policies Affecting Students
Disclosure of information to contractors with a signed MOU (Memorandum of Understanding), doing work for the University of Iowa that the University would otherwise do themselves

Internal Administration of Requests

All external requests for student data under this policy will be coordinated through the Office of the Registrar. Collegiate/departmental staff may comply with informal requests to review and inspect education records, provided the individual is authorized and has an “academic need to know”. Examples of forms will be available via the Registrars’ website for record requests and disclosures. These must be recorded and maintained with the record under the Act.

The Administrator's Role

University employees or “University Officials” are to act in accordance with FERPA regulations whenever representing the university. A University Official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including Campus Safety personnel and UI Health Care staff); a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent); a person serving on the Iowa Board of Regents; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. Employees may only access and use education records as necessary to conduct official university business. A University official exercises “legitimate educational interest” (interests essential to the general process of higher education, including teaching, research, public service, and directly supportive activities such as academic advising, general counseling, therapeutic counseling, discipline, vocational counseling and job placement, financial assistance and advisement, medical services, academic assistance activities, and co-curricular activities including varsity and intramural sports, social fraternities, specific interest clubs, and student government), if the official needs to review an education record in order to perform his or her professional responsibilities.

You are responsible for protecting the student information in your possession. These are guidelines to follow when acting as a University Official:

Individual directory information may be released without written consent, except when the student has filled a “Request to Withhold Student Information” document

Directory Information

Directory information consists of information that is generally not considered harmful or an invasion of privacy if publicly available. Directory Information is considered public and may be released without the student’s written permission, however cannot be released if the student has restricted access by updating their personal information in MyUI.

Directory Information CANNOT include: race, gender, SSN (or part of the SSN), grades, GPA, country of citizenship, or religion. Except in very specific circumstances, a student ID number also cannot be considered directory information.
Every student must be given the opportunity to “opt out” or have directory information
suppressed from public release.
A “no release” does NOT mean that a school official within the institution who has a demonstrated legitimate educational interest cannot access the information.

Directory Information includes:

Name
Residing Address
Residing Telephone number
Permanent/hometown Address
Hometown and state
UI e-mail address (@uiowa.edu) - Dean of Student Reporting Correct Residential Address and E-mail Address Policy
University of Iowa Hawk ID
Programs of study (including but not limited to: majors, minor, certificates, classification, and degree objective)
College(s) enrolled in
Dates of attendance
Full-time/part-time enrollment status
Photographs and video recordings of students in public or non-classroom settings (photographs from classrooms or class related activities are NOT directory information)
Participation in a study abroad program, not including location
Degrees, certificates, honors, scholarships and awards received, not including monetary amounts, including those applied for during the current academic term;
Participation in officially recognized university activities and sports
Job title, employing department, work phone number, and work address when employed in a position that requires student status
Previously attended educational agencies or institutions

Students can restrict either their directory information (items 2 through 6 above), their academic information (items 7 through 11 above), or both. This is accomplished on MyUI, under Student Records, Student Life Management, Restrict or Unrestrict Student Information.

The Dean of Students office has additional student record policy and directory information.

Please note the Office of the Registrar will process requests to restrict the release of directory information. However, note some information already published/released may not be retractable with respect to a student’s change in restriction status. A request to restrict directory information will remain in effect until revoked by the student either by using the application on MyUI or in writing.

University Officials (Dean of Students, Registrar, Provost) may release non-directory information to a third party in the case of an emergency when knowledge of information is necessary to protect the health or safety of students or other persons.

Information must not be released to third parties outside of the University, including parents of students, without the student’s written consent. See the section titled “Parental Rights” for more information.

Non Directory Information

Non directory information may not be released. If information is needed to help resolve an emergency situation please refer these cases to the Registrar’s Office.

Under the Family Educational Rights and Privacy Act (FERPA) of 2009, students have the right to inspect and review most education records maintained about them by the University of Iowa, and, in many cases, decide if a third party can obtain information from them. Sixteen categories of information, however, are public, or directory, information unless a student specifically requests in writing that some or all of that information be withheld. This may be done by the student via the Student Information System MyUI or by submitting a formal request to the Office of the Registrar. The request will be effective as long as the student is enrolled at The University of Iowa unless the restriction is removed by the student. Former students may restrict address and telephone information.

University Officials Releasing Information without Student's Prior Written Consent

University Officials may release information without a student’s prior written consent to the following groups:

University of Iowa faculty and staff with legitimate educational interest
Representatives of agencies or organizations from which the student has received financial aid, including banks and other lending agencies
Officials from other educational institutions in which a student intends to enroll
Individuals or groups specifically exempted from the prior consent requirement
Federal and state officials, organizations conducting studies on behalf of the University of Iowa and accrediting organizations

Adopt the rule “When in Doubt Don’t Give it Out!” If you are unsure who is entitled to access certain student information, or other records questions please contact the Office of the Registrar via email at registrar@uiowa.edu

Parental Rights

The rights under FERPA transfer from the parents to the student, once the student turns 18 years old or enters a postsecondary institution at any age. The right to inspect is limited solely to the student.

The institution may disclose information to parents/legal guardians of a student under the following conditions:

The student has created a “consent to release academic data” on MyUI or has submitted a signed consent form stating what, when, for how long, and to whom data is to be released.
There is an emergency situation, and knowledge of information is necessary to protect the health or safety of students or other persons. (Refer these requests to the Dean of Students or the Registrar.)

All requests for student record information for a deceased student must go through the Office of the Registrar.

Faculty Reminders

To avoid violations of FERPA rules, DO NOT:

at any time use any part of the Social Security Number or Student ID in a public posting of grades or ever link the name of a student with that student's social security number in any public manner
leave graded tests in a stack for students to pick up by sorting through the papers of all students
circulate a printed class list with the student, social security number, student ID, or grades as an attendance roster
discuss the progress of any student with anyone other than the student (including parents) without the consent of the student

"Statements made by a recommender which are made from the recommender's personal observation or knowledge do not require a written release from the student who is the subject of the recommendation. However, if personally identifiable information from the student's educational record is included in a letter of recommendation (grades, GPA, etc.), the writer is required to obtain a signed release from the student(s) which 1) specifies the records that may be disclosed, 2) states the purpose of the disclosure, and 3) identifies the party or class of parties to whom the disclosure can be made." Guidelines for Postsecondary Institutions for Implementation of the Family Educational Rights and Privacy Act of 1974 as Amended, Revised Edition 1998, Richard A. Rainsberger, American Association of Collegiate Registrars and Admissions Officers

University of Iowa Student Consent for Release of Academic Records

An application for students to grant permission for the University to disclose or discuss their student record(s) can be found on MyUI by logging in and then clicking on the Student Records tab. The application is under the heading of Student Life Management. The application is named Academic Record Consent Form. A student can then create a consent form by clicking on “Create A New Release”. All other requests must be provided in writing on a case by case request. You may not release lists of students enrolled in your class(es) to anyone without a legitimate educational need to know. Do not provide anyone with student schedules or assist anyone other than university employees in finding a student on campus.

Technology Use and FERPA

In our current educational environment where the use of technologies is wide spread, it is important that we continue to work in accordance with FERPA regulations to the fullest extent. With new technologies however, additional issues arise about secure transmission of confidential information.

Faxed requests for transcripts, including the student’s signature, or a scanned document attached to an e-mail message authorizing release of a transcript, are acceptable methods of providing the written permission required to release such information.

Faculty and staff utilizing e-mail correspondence with more than one student are responsible for restricting access to a student’s e-mail address if the student has requested non-disclosure of directory information. In 2009 FERPA was modified to state that a student may not be anonymous in a class even if they have restricted their data. The sharing of this information with other members of the class is at the instructor’s discretion, provided it is deemed appropriate for the success of the class. Students participating in such classes should be notified of this. An example of this might be the need to share email addresses in order to facilitate classroom interactions/discussions.

Passwords allowing access to non-directory student information should not be shared and must be protected from unauthorized disclosure.

Electronic student records must be protected from unauthorized access.

Disposal of electronic or paper records should be done in a secure manner.

Verification Questions

FERPA does not preclude an institution from disclosing non-directory information from a student’s record to the student over the phone. University of Iowa is however, responsible for implementing the necessary procedures to verify the individual’s identity before any information is released.

Below is a list of sample questions that can be asked in any combination by university officials to verify a student’s identity, prior to releasing any information to a student over the phone:

student/campus
identification number
full name including middle name
date of birth
place of birth
parent name and address
high school attended
major or program of study
student program level
recent courses taken
current enrollment adviser’s name
year of first attendance

You do not need to ask all of these questions to verify the student’s identity. A random selection of questions from a pool of questions makes it more difficult for an imposter.