FERPA Refresher Presentation

PDF icon FERPA 2022 Presentation

FERPA Refresher Training - Thursday, July 28, 2022

Questions Asked During Presentation

How often is FERPA training required?

FERPA training is required only once during your time at the University of Iowa.  Most faculty and staff members complete FERPA training when they are hired; FERPA training is required for access to MAUI and ICON.  If you have taken FERPA training through Employee Self-Service, you can access the training module at any time through ICON.  At the first of the year, faculty and staff are asked to verify that they understand FERPA through Employee Self-Service.

Who should complete FERPA training?

Anyone working with personally identifiable student educational records or students.  

Eligible student is defined by anyone 18 years of age OR enrolled at the institution.  Is the individual enrolled at the University of Iowa? If yes, they are covered by FERPA.

For more information on how to complete FERPA training, please visit our Faculty and Staff FERPA Training page.

What is the definition of a "School Official"?

Those members of an institution who act in the students' educational interest within the limitations of their "need to know." These may include faculty, administration, clerical and professional employees and other persons who manage student education record information including student employees or agents.  It may also include contractors, volunteers, and others performing institutional functions.

What is considered "Legitimate Educational Interest"?

FERPA permits disclosure of education record information without the student's consent to school officials who have a legitimate educational interest in the information. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill their professional responsibility.

The demonstrated "need to know" by those officials of an institution who act in the students' educational interest, including faculty, administration, clerical and professional employees, and other persons who manage student record information including student employees and agents.

Ask yourself:  "Do you need that information to do your job?  Would your colleagues agree?"

Faculty members are considered school officials as defined by FERPA. Faculty members are given access to class and grade rosters as well as to current advisee information. Beyond this, faculty members must demonstrate a legitimate educational interest in order to receive additional student-record access.  Any person with access to student records, regardless of title or status, should consider educational need to know before accessing a record.  Just because you CAN, doesn't mean you SHOULD.

Is the name of the student's advisor considered Directory Information?

No, a student's advisor is not Directory Information.

For a full list of items that may be shared without student concent at the University of Iowa, please visit the Directory Information on our website.

In a year-long course sequence, can instructors view student's past performance results?

At the University of Iowa, most faculty only have access to their own class rosters.  Faculty who serve as advisors or work with course offerings may be granted student record access and can view all students.  As with any access permitted, just because you can access records, does not mean you should access them.  Regardless, faculty should not view student records to view past performance.  Past performance may be of interest to the faculty member, but it is not a legitimate educational interest needed to perform current job functions.

If prerequisite checking is an issue, faculty should work with their department administrator to either have prerequisites checked through the course library or have administrative staff assign special permission.

As an instructor, can I share a class list or roster with another instructor from a different course?

Instructors are considered school officials, so they may share the information with the other instructor IF that instructor is FERPA trained and has a legitimate educational interest. If you don't know if the other instructor is FERPA trained, please contact UI-FERPA@uiowa.edu

"Course" is not considered directory information at the University of Iowa. Class lists contain personally identifiable information, therefore, they are FERPA protected and should not be shared without student consent or school official legitimate educational interest.

When parents contact about probation, how much can I share with them?

It depends.

If there is an academic records consent form filled out by the student for the parent or third party to discuss either  "All of my University of Iowa education records," or "Academic Standing and Status," then you may share probation status with the requester.  

If no written consent is given by the student, faculty and staff can only share non-restricted directory information with parents or other third parties.  The University of Iowa does not consider probation status directory information, therefore it cannot be shared.

Is student information in a departmental database an education record? Is that information FERPA protected?

Is student information in a departmental database an education record?  

  • Student information housed in a departmental database and shared with the department IS considered an education record.  Education records are defined as records directly related to the student and maintained by the institution or by a party acting for the institution. In this case, the department is acting for the institution.

Is that information FERPA protected?

  • Yes; all student education records are FERPA protected.

When reporting ethnicity, gender, etc., at what point is information considered personally identifiable? (# of majors with demographic less than 10, 5, ..?)

Information or data is deemed 'Personally Identifiable' if it includes:

  1. Student name
  2. Name of the student parent(s) or other family member(s)
  3. Student or family address
  4. Personal identifiers such as social security number, student ID number, and biometric record
  5. Indirect identifiers such as the student date of birth, place of birth, and mother's maiden name
  6. Other information that, alone or in combination, is linked to a specific student that would allow a reasonable person in the school community who does not have personal knowledge of the relevant circumstance to identify the student with reasonable certainty
  7. Information requested by a person who the educational agency or institution reasonably believes knows the identify of the student to whom the education records relates

Items 6 and 7 probably best answer this question.  Information is considered personally identifiable if an individual could identify the student by process of elimination with reasonable certainty.  Generally, demographics are considered personally identifiable if the identified population is less than 6 students.

How do you know what information is appropriate to give to external research organizations?

Some organizations can be considered “school officials” and in most cases have a legitimate educational interest, so we may release this information without student consent.  However, you are not required to give them any or all information.  Best practice is to give only what is absolutely needed. Even then, you have the ability to say no if you believe no legitimate educational need exists. For example, if the organizations are attempting to solicit students, you do not need to release information.

What do I do/say if there is a family crisis and the student needs to be contacted?

In short, an educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. However, it is important to determine if the situation is a true emergency/crisis before releasing information. If you are unsure, you may instead decide to contact the student and instruct them to contact the family member without disclosing any information from the education record.

An educational agency or institution may take into account the totality of the circumstances pertaining to a threat to the health or safety of a student or other individual. If the agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individuals. If, based on the information available at the time of determination, there is a rational basis for the determination, the Department of Education will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making a determination.

Can academic advisors check with a course instructor on how one of their advisees is performing in a specific class? (advisor does not teach/supervise the student)

It depends...

There are several variables that could impact the answer to this question, so it is best to reach out to the FERPA team to inquire before communicating directly with the instructor.

If a parent requests information about their student's records, should we first check the Student Record Consent area of MAUI to find out if the student has granted them access, and proceed from there? Should a new Student Record Consent Form be created?

If a parent requests information about their student's records, administrators should start by looking for a Student Record Request Form in MAUI.  This is located under the student's records, within the Registrar area of MAUI.  Within this form the student has the ability to grant a permission for school officials to provide specified written or oral student record information to third parties.  A authorization code is included in the form to provide the school official a way to verify the identity of the third party.   

A new form is only needed, if the previous form for the third party has expired.

If the faculty is a co-author of a research poster with the student and they present it together in a meeting, can the faculty re-present the same later without the student consent?

If they are co-presenting a research poster with a student, by virtue of the research and work together they have provided consent. If there is any concern, it may be helpful to include a statement in their course syllabus regarding the ability to share that research without the student present at a later date.