This handbook is designed for employees of the University of Iowa in administrative, supervisory, academic, research, or support staff positions, including Public Safety and UI Health Care staff.
The Family Educational Rights and Privacy Act (FERPA) also known as the Buckley Amendment, passed by Congress in 1974, grants four specific rights to students:
- The right to inspect and review their educational records
- The right to request the amendment of inaccurate or otherwise inappropriate records
- The right to consent to disclosure of his or her public records
- The right to file a complaint with the Family Compliance Office in the United States’ Department of Education, concerning alleged failure by the University of Iowa to comply with the requirements of FERPA.
Students are granted rights under FERPA if they are currently attending the University of Iowa or have been in attendance, regardless whether in a credit, no-credit, degree or non-degree credit program. FERPA does not apply to applicants of a school or college at the University of Iowa who have been admitted but who have not actually been in attendance.
An education record is any information that is directly related to a student and maintained by a college or university and by agents acting directly for the college or university. Records are treated the same no matter what medium is used to store the information. Some examples of education records include:
- Personal information
- Employment records (where student status is a prerequisite of employment)
- Class schedules
- Printed class lists
- Graded test papers with personally identifiable information related to the individual student
There are five exceptions that are not considered Education Records:
- Personal notes of the University of Iowa faculty and staff (never shared with another individual)
- Employment records (provided employment is not contingent on the individual being enrolled as a student first.)
- Medical and counseling records used solely for treatment
- Records in the Department of Public Safety
- Financial records of a parent or spouse
The University will maintain a record of the requests for and disclosure of personally identifiable information from the educational record of the student.
The record of requests will state the names of the parties who have requested or obtained personally identifiable information, and the legitimate interest of the party in requesting or obtaining that information. This record of requests and disclosures will be maintained by the office that maintains the educational record and may be inspected by the student under the same procedures by which the record itself may be inspected.
Exceptions to this are:
- requests for and disclosure of directory information
- requests and disclosure to persons described in the University of Iowa Policies Affecting Students
- disclosure of information to contractors with a signed MOU (Memorandum of
- Understanding), doing work for the University of Iowa that the University would otherwise do themselves
Internal Administration of Requests.
All external requests for student data under this policy will be coordinated through the Office of the Registrar. Collegiate/departmental staff may comply with informal requests to review and inspect education records, provided the individual is authorized and has an “academic need to know”. Examples of forms will be available via the Registrars’ website for record requests and disclosures. These must be recorded and maintained with the record under the Act.
The Administrator’s Role
University employees or “University Officials” are to act in accordance with FERPA regulations whenever representing the university. A University Official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including Public Safety personnel and UI Health Care staff); a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of Regents; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. Employees may only access and use education records as necessary to conduct official university business. A University official exercises “legitimate educational interest” (interests essential to the general process of higher education, including teaching, research, public service, and directly supportive activities such as academic advising, general counseling, therapeutic counseling, discipline, vocational counseling and job placement, financial assistance and advisement, medical services, academic assistance activities, and co-curricular activities including varsity and intramural sports, social fraternities, specific interest clubs, and student government), if the official needs to review an education record in order to perform his or her professional responsibilities.
You are responsible for protecting the student information in your possession. These are guidelines to follow when acting as a University Official:
Individual directory information may be released without written consent, except when the student has filled a “Request to Withhold Student Information” document
Directory information includes:
- Local Address
- Local Telephone number
- Permanent/Home Address
- Hometown and state
- E-mail address
- University of Iowa Hawk ID
- Programs of study (field(s) of study and degree objective being sought)
- College(s) enrolled in
- Dates of attendance, (including current classification or year)
- Full-time/part-time enrollment status
- Photographs and video recordings of students in public and non-classroom settings
- Registration in a study abroad program
- Degrees, certificates, honors, scholarships, and awards received and date awarded as well as those applied for during the current academic term
- Information about participation in officially recognized activities and sports
- Job title, employing department, work phone number, and work address when employed in a position that requires student status
Students are entitled to restrict the release of directory information, and former students may restrict address and telephone number. To avoid publication of any or all of this information in the University electronic directory, a student must log into MyUI, then under Student Information, Student Life Management section, and select “Restrict or Unrestrict Student Information”. A student may then request that their information be restricted. Alternately, a student could submit a signed written request to the Office of the Registrar, 1 Jessup Hall.
Please note the Office of the Registrar will process requests to restrict the release of directory information. However, note some information already published/released may not be retractable with respect to a student’s change in restriction status. A request to restrict directory information will remain in effect until revoked by the student either by using the application on MyUI or in writing.
University Officials (Dean of Students, Registrar, Provost) may release non-directory information to a third party in the case of an emergency when knowledge of information is necessary to protect the health or safety of students or other persons.
Information must not be released to third parties outside of the University, including parents of students, without the student’s written consent. See the section titled “Parental Rights” for more information.
University Officials may release information without a student’s prior written consent to the following groups:
- University of Iowa faculty and staff with legitimate educational interest
- Representatives of agencies or organizations from which the student has received financial aid, including banks and other lending agencies
- Officials from other educational institutions in which a student intends to enroll
- Individuals or groups specifically exempted from the prior consent requirement
- Federal and state officials, organizations conducting studies on behalf of the University of Iowa and accrediting organizations
Adopt the rule “When in Doubt Don’t Give it Out!” If you are unsure who is entitled to access certain student information, or other records questions please contact the Office of the Registrar via email at email@example.com
The rights under FERPA transfer from the parents to the student, once the student turns 18 years old or enters a postsecondary institution at any age. The right to inspect is limited solely to the student.
The institution may disclose information to parents/legal guardians of a student under the following conditions:
- The student has created a “consent to release academic data” on MyUI or has submitted a signed consent form stating what, when, for how long, and to whom data is to be released.
- There is an emergency situation, and knowledge of information is necessary to protect the health or safety of students or other persons. (Refer these requests to the Dean of Students or the Registrar.)
All requests for student record information for a deceased student must go through the Office of the Registrar.
To avoid violations of FERPA rules, DO NOT:
- at any time use any part of the Social Security Number or Student ID in a public posting of grades or ever link the name of a student with that student's social security number in any public manner
- leave graded tests in a stack for students to pick up by sorting through the papers of all students
- circulate a printed class list with the student, social security number, student ID, or grades as an attendance roster
- discuss the progress of any student with anyone other than the student (including parents) without the consent of the student
"Statements made by a recommender which are made from the recommender's personal observation or knowledge do not require a written release from the student who is the subject of the recommendation. However, if personally identifiable information from the student's educational record is included in a letter of recommendation (grades, GPA, etc.), the writer is required to obtain a signed release from the student(s) which 1) specifies the records that may be disclosed, 2) states the purpose of the disclosure, and 3) identifies the party or class of parties to whom the disclosure can be made." Guidelines for Postsecondary Institutions for Implementation of the Family Educational Rights and Privacy Act of 1974 as Amended, Revised Edition 1998, Richard A. Rainsberger, American Association of Collegiate Registrars and Admissions Officers
University of Iowa Student Consent for Release of Academic Records
An application for students to grant permission for the University to disclose or discuss their student record(s) can be found on MyUI by logging in and then clicking on the Student Records tab. The application is under the heading of Student Life Management. The application is named Academic Record Consent Form. A student can then create a consent form by clicking on “Create A New Release”. All other requests must be provided in writing on a case by case request. You may not release lists of students enrolled in your class(es) to anyone without a legitimate educational need to know. Do not provide anyone with student schedules or assist anyone other than university employees in finding a student on campus.
Technology Use and FERPA
In our current educational environment where the use of technologies is wide spread, it is important that we continue to work in accordance with FERPA regulations to the fullest extent. With new technologies however, additional issues arise about secure transmission of confidential information.
Faxed requests for transcripts, including the student’s signature, or a scanned document attached to an e-mail message authorizing release of a transcript, are acceptable methods of providing the written permission required to release such information.
Faculty and staff utilizing e-mail correspondence with more than one student are responsible for restricting access to a student’s e-mail address if the student has requested non-disclosure of directory information. In 2009 FERPA was modified to state that a student may not be anonymous in a class even if they have restricted their data. The sharing of this information with other members of the class is at the instructor’s discretion, provided it is deemed appropriate for the success of the class. Students participating in such classes should be notified of this. An example of this might be the need to share email addresses in order to facilitate classroom interactions/discussions.
Passwords allowing access to non-directory student information should not be shared and must be protected from unauthorized disclosure.
Electronic student records must be protected from unauthorized access.
Disposal of electronic or paper records should be done in a secure manner.
FERPA does not preclude an institution from disclosing non-directory information from a student’s record to the student over the phone. University of Iowa is however, responsible for implementing the necessary procedures to verify the individual’s identity before any information is released.
Below is a list of sample questions that can be asked in any combination by university officials to verify a student’s identity, prior to releasing any information to a student over the phone:
- identification number
- full name including middle name
- date of birth
- place of birth
- parent name and address
- high school attended
- major or program of study
- student program level
- recent courses taken
- current enrollment adviser’s name
- year of first attendance
You do not need to ask all of these questions to verify the student’s identity. A random selection of questions from a pool of questions makes it more difficult for an imposter.
Non directory information may not be released. If information is needed to help resolve an emergency situation please refer these cases to the Registrar’s Office.
Under the Family Educational Rights and Privacy Act (FERPA) of 2009, students have the right to inspect and review most education records maintained about them by the University of Iowa, and, in many cases, decide if a third party can obtain information from them. Sixteen categories of information, however, are public, or directory, information unless a student specifically requests in writing that some or all of that information be withheld. This may be done by the student via the Student Information System MyUI or by submitting a formal request to the Office of the Registrar. The request will be effective as long as the student is enrolled at The University of Iowa unless the restriction is removed by the student. Former students may restrict address and telephone information.
If you have questions regarding the provisions of the Family Educational Rights and Privacy Act you may contact:
1 Jessup Hall
Iowa City, IA 52242
249 Iowa Memorial Union
The University of Iowa Iowa City, IA, 52242
It is the policy of the University of Iowa to comply fully and fairly with the provisions of FERPA and the regulations adopted at the University.