FERPA Refresher Presentation

PDF iconFERPA 2021 Presentation

Questions Asked During Presentation

How often is FERPA training required?

FERPA training is required only once during your time at the University of Iowa.  Most faculty and staff members complete FERPA training when they are hired; FERPA training is required for access to MAUI and ICON.  If you have taken FERPA training through Employee Self-Service, you can access the training module at any time through ICON.  At the first of the year, faculty and staff are asked to verify that they understand FERPA through Employee Self-Service.

What is the definition of a "School Official"?

Those members of an institution who act in the students' educational interest within the limitations of their "need to know." These may include faculty, administration, clerical and professional employees and other persons who manage student education record information including student employees or agents.  It may also include contractors, volunteers, and others performing institutional functions.

When parents contact about probation, how much can I share with them?

It depends.

If there is an academic records consent form filled out by the student for the parent or third party to discuss either  "All of my University of Iowa education records," or "Academic Standing and Status," then you may share probation status with the requester.  

If no written consent is given by the student, faculty and staff can only share non-restricted directory information with parents or other third parties.  The University of Iowa does not consider probation status directory information, therefore it cannot be shared.

In a year-long course sequence, can instructors view student's past performance results?

At the University of Iowa, most faculty only have access to their own class rosters.  Faculty who serve as advisors or work with course offerings may be granted student record access and can view all students.  As with any access permitted, just because you can access records, does not mean you should access them.  Regardless, faculty should not view student records to view past performance.  Past performance may be of interest to the faculty member, but it is not a legitimate educational interest needed to perform current job functions.

If prerequisite checking is an issue, faculty should work with their department administrator to either have prerequisites checked through the course library or have administrative staff assign special permission.

As an instructor, can I share a class list or roster with another instructor from a different course?

Instructors are considered school officials, so they may share the information with the other instructor IF that instructor is FERPA trained and has a legitimate educational interest. If you don't know if the other instructor is FERPA trained, please contact reg-access-maui@uiowa.edu

"Course" is not considered directory information at the University of Iowa. Class lists contain personally identifiable information, therefore, they are FERPA protected and should not be shared without student consent or school official legitimate educational interest.

Is student information in a departmental database an education record? Is that information FERPA protected?

Is student information in a departmental database an education record?  

  • Student information housed in a departmental database and shared with the department IS considered an education record.  Education records are defined as records directly related to the student and maintained by the institution or by a party acting for the institution. In this case, the department is acting for the institution.

Is that information FERPA protected?

  • Yes; all student education records are FERPA protected.

When reporting ethnicity, gender, etc., at what point is information considered personally identifiable? (# of majors with demographic less than 10, 5, ..?)

Information or data is deemed 'Personally Identifiable' if it includes:

  1. Student name
  2. Name of the student parent(s) or other family member(s)
  3. Student or family address
  4. Personal identifiers such as social security number, student ID number, and biometric record
  5. Indirect identifiers such as the student date of birth, place of birth, and mother's maiden name
  6. Other information that, alone or in combination, is linked to a specific student that would allow a reasonable person in the school community who does not have personal knowledge of the relevant circumstance to identify the student with reasonable certainty
  7. Information requested by a person who the educational agency or institution reasonably believes knows the identify of the student to whom the education records relates

Items 6 and 7 probably best answer this question.  Information is considered personally identifiable if an individual could identify the student by process of elimination with reasonable certainty.  Generally, demographics are considered personally identifiable if the identified population is less than 6 students.

How do you know what information is appropriate to give to external research organizations?

Some organizations can be considered “school officials” and in most cases have a legitimate educational interest, so we may release this information without student consent.  However, you are not required to give them any or all information.  Best practice is to give only what is absolutely needed. Even then, you have the ability to say no if you believe no legitimate educational need exists. For example, if the organizations are attempting to solicit students, you do not need to release information.

What do I do/say if there is a family crisis and the student needs to be contacted?

In short, an educational agency or institution may disclose personally identifiable information from an education record to appropriate parties, including parents of an eligible student, in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals. However, it is important to determine if the situation is a true emergency/crisis before releasing information. If you are unsure, you may instead decide to contact the student and instruct them to contact the family member without disclosing any information from the education record.

An educational agency or institution may take into account the totality of the circumstances pertaining to a threat to the health or safety of a student or other individual. If the agency or institution determines that there is an articulable and significant threat to the health or safety of a student or other individuals, it may disclose information from education records to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individuals. If, based on the information available at the time of determination, there is a rational basis for the determination, the Department of Education will not substitute its judgment for that of the educational agency or institution in evaluating the circumstances and making a determination.