What is FERPA?

FERPA (Family Educational Rights and Privacy Act), also known as the Buckley Amendment, was passed by Congress in 1974.

• FERPA is designed to protect the privacy of students’ educational records and personally identifiable information.
• FERPA applies to all educational agencies or institutions, including the University of Iowa, that receive funds under any program administered by the Secretary of Education. 

It's Your Responsibility

As a faculty or staff member at the University of Iowa, you have a legal responsibility under FERPA to protect the confidentiality of student educational records in your possession. Student educational records (other than directory information) are considered confidential and may not be released without written consent of the student. Your job places you in a position of trust and you are an integral part of ensuring that student information is handled properly.

Education Records

An education record is any record that is directly related to a student and maintained by the university. 

Education records include any records in whatever medium (handwritten, email, print, digital, etc.) that are in the possession of any school official. 

Exceptions: Education Records Do NOT Include:

• Records in the "sole possession of the maker that are not accessible to other personnel.”
• Law enforcement or campus security records created and maintained by the law enforcement unit and used for law enforcement purposes.
• Employment records.
• Medical/psychological treatment records.
• Alumni records (those created after the student graduated or left the institution).

Directory Information

Directory information consists of information that is generally not considered harmful or an invasion of privacy if publicly available. Directory information is considered public and may be released without the student’s written permission; however cannot be released if the student has restricted access by updating their personal information in MyUI.

• Directory Information cannot include: race, gender, SSN (or part of the SSN), grades, GPA, country of citizenship, or religion. Except in very specific circumstances, a student ID number also cannot be considered directory information.
• Every student must be given the opportunity to “opt out” or have directory information suppressed from public release.
• A “no release” does NOT mean that a school official within the institution who has a demonstrated legitimate educational interest cannot access the information.

Guests in the Class

If a student has a legitimate educational need or fulfilling a make-up section/exam, they may be permitted to attend with permission from the instructor. This should be in the syllabus, so students are aware it is a possibility.

In instances where there are guest speakers, students should be notified of these occurrences or possibilities through the syllabus and require advanced notice so the student can opt out without penalty.

In cases of seminars or colloquiums, enrolled and non-enrolled students may share a physical space. 

• Ideally, other students may attend if student information is not shared and it is difficult to determine who is enrolled in the course
• If students can be associated with the course through required course activities (such speaking commitments, performances, auditions, defense for thesis, etc.) it must be noted in the course description and the syllabi. This ensures students are aware of the expectations of the course and have the option to opt out.
• ICON/Canvas access should not be given as enrollment can be identified based on tools available in the system that may identify enrollment.

Including Student Names in Faculty Materials

Faculty may wish to reference student names in CVs, websites, or promotion and tenure (P&T) materials. To comply with FERPA, please follow these key points:

General Use

• Student names may be shared only if they are classified as directory information and the student has not requested a FERPA restriction.
• Restrictions can change at any time for current students, so always verify before sharing externally.

Promotion & Tenure

• Internal reviewers (UI faculty/staff) may view student names if they have a legitimate educational interest.
• External reviewers require written student consent unless the name is directory information and no restriction is in place.

Former Students

• FERPA restrictions in place at the time of last attendance must be honored. Later requests are optional to enforce, based on institutional policy.

Best Practice

When in doubt, get written consent before including student names in any public or externally shared materials.

Sample Consent Language:

“I give permission for [Faculty Name] to include my name in materials related to their professional activities, including CVs, websites, and promotion and tenure documents, which may be shared with individuals outside the University of Iowa.”