The information and content on this page is referenced from the AACRAO (American Associate of Collegiate Registrars and Admissions Officers) 2012 FERPA Guide.  

What is FERPA?

In 1974, Congress enacted the Family Educational Rights and Privacy Act (FERPA) to guarantee students access to their educational records and to prohibit dissemination of educational records without the student's consent.

Also known as the Buckley Amendment, FERPA is a Federal law that protects the privacy of student education/academic records.

The FERPA statute is found at 20 U.S.C. § 1232g and the FERPA regulations are found at 34 CFR Part 99.  The law applies to all schools receiving federal funds from the US Department of Education.

Who is covered under FERPA?

Students who have reached the age of 18 or begin to attend a post-secondary institution, whichever comes first, are covered under FERPA. When a student begins to officially attend an institution is determined by the individual institution. At UI, “student” is defined as all current or former students who have attended UI and “attendance” means enrollment in courses.

What are education records?

Education records are all records that directly relate to a student and are maintained by an institution. These records may be in any format: electronic, handwritten, printed, typed, film, microfiche, etc. FERPA does not extend to information gained by personal observation or, in some circumstances, information learned from others. Examples of education records include grades, enrollment records, class schedules, printed class lists, test papers, and employment records for student jobs.

What information is NOT considered a part of the education record?

Notes kept by faculty/staff that are not accessible to any other person (sole possession notes), alumni records that contain information gathered after the student is no longer in attendance, employment records unless employment is contingent upon student status (such as work-study or GA / TA assignments), Campus Safety records that are maintained solely for law enforcement purposes and are revealed only to law enforcement agencies, and student medical records created by a healthcare professional and disclosed only to other healthcare professionals for the medical/health treatment of the student. Once a law enforcement or medical record has been disclosed to an institution, however, it becomes part of the educational record.

What is considered "Legitimate Educational Interest"?

FERPA permits disclosure of education record information without the student's consent to school officials who have a legitimate educational interest in the information. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill their professional responsibility.

The demonstrated "need to know" by those officials of an institution who act in the students' educational interest, including faculty, administration, clerical and professional employees, and other persons who manage student record information including student employees and agents.

Ask yourself:  "Do you need that information to do your job?  Would your colleagues agree?"

Faculty members are considered school officials as defined by FERPA. Faculty members are given access to class and grade rosters as well as to current advisee information. Beyond this, faculty members must demonstrate a legitimate educational interest in order to receive additional student-record access.  Any person with access to student records, regardless of title or status, should consider educational need to know before accessing a record.  Just because you CAN, doesn't mean you SHOULD.

What is directory information?

Information that may be released to the public without the student’s written consent, unless the student restricts disclosure. Each institution determines what information is classified as directory information. Details on what is considered directory information and information on how to restrict directory information at UI can be found on the directory information page. 

What student information needs to be handled securely?

All educational records directly related to a student and maintained by the institution should be handled securely.  Registration forms, grades and transcripts, student information displayed on a computer screen, student schedules, class assignments, class rosters, and any electronic or paper document with the student's ID or grades on it are all education records and should be handled with FERPA in mind. 

What rights are granted to students under FERPA?

Students have the right to inspect and review their own educational records, petition for the amendment of any incorrect information in their records, and have some control over the disclosure of information contained in their records.

What information may be released without a student’s consent?

Directory information, information for which the student has given written release, information needed by a school official with a legitimate educational interest, final disciplinary results of a crime of violence committed by a student, parental notification of an alcohol/drug violation committed by a student under 21 years of age, disclosures to victims of crimes of violence or non-forcible sex offenses, disclosures to other schools which the student seeks or intends to enroll or where the student is already enrolled as long as the disclosure is for purposes related to the student's enrollment or transfer, and emergency situations where there is an imminent risk to health and safety.

What are faculty responsibilities regarding FERPA?

Faculty are responsible for controlling access and protecting the student records they access or possess. Faculty should: be conscious and aware of others who may be able to overhear their conversations or see their computer screen; never provide anyone with student information, including schedules; keep confidential papers in filing cabinets and shred rather than trash; post during term and final grades only in MAUI and in ICON – there should be no need to post them elsewhere; never leave graded assignments together in a public place for students to pick up; be sensitive to student privacy; decline requests from parents—please refer them to the Office of the Registrar; never volunteer confidential information in letters of recommendation without first getting specific written consent from the student. When in doubt, reach out and contact the Office of Registrar.

What are parental rights under FERPA?

A parent can obtain access to a student’s personally identifiable information when: the student has authorized (via written consent) their parent to accompany them to a meeting with a college official(s); the student has submitted an Academic Record Consent Form through MyUI; the student provides express written consent for third party release of education records; a health or emergency situation exists that threatens the safety of the student or others; a student under the age of 21 is in violation of any laws governing the use of alcohol; the student is deceased, upon which FERPA rights cease.

Do FERPA rights cease?

Students’ rights do not cease after enrollment ends or the student graduates. Former students have the same rights as currently attending students.  Under common law regarding privacy rights, the privacy interests of an individual expire with death.  Alumni records are not covered by FERPA.

Can an instructor publicly post grades in class or via a class-accessible website or message board for students taking distance learning classes?

No. This would be a violation of student privacy rights.

Can faculty members access student records?

Faculty members are considered school officials as defined by FERPA. Faculty members are given access to class and grade rosters as well as to current advisee information. Beyond this, faculty members must demonstrate a legitimate educational interest in order to receive additional student-record access.  Any person with access to student records, regardless of title or status, should consider educational need to know before accessing a record.  Just because you CAN, doesn't mean you SHOULD.

Is the University of Iowa obligated to release directory information?

FERPA states that an institution may release directory information. We are not, however, required to do so. If you encounter a situation in which you are uncomfortable providing information, do not do so. If the requesting party is insistent, contact the Office of the Registrar.

How should faculty and staff handle recommendation and reference letters?

Do not include any non-directory information in a recommendation or reference letter unless you are specifically authorized to do so by the requesting student. The student must request the release of this information in writing.

Are student workers bound by FERPA guidelines?

Yes. Student employees of the university are under the same obligation to uphold FERPA rights and regulations as faculty and staff. This obligation is not limited to paid student workers; it also includes students who have access to non-directory information as part of their duties, such as teaching assistants, lab assistants, etc.  Student employees with access to student records must complete FERPA training.