WHAT IS FERPA?
FERPA stands for Family Educational Rights and Privacy Act (sometimes called the Buckley Amendment). Passed by Congress in 1974, the Act grants four specific rights to the adult student:
- the right to see the information that the institution is keeping on the student
- the right to seek amendment to those records and in certain cases append a statement to the record
- the right to consent to disclosure of his/her records
- the right to file a complaint with the FERPA Office in Washington, D.C.
WHAT IS A STUDENT EDUCATIONAL RECORD?
Just about any information provided by a student to the University for use in the educational process is considered a student educational record. For example :
- personal information
- enrollment records
The type of media in which you find this information doesn’t matter. Student educational records may be:
- a document in the registrar's office
- a computer printout in your office
- a class list on your desktop
- a computer display screen
- notes you have taken during an advisement session
WHAT ARE THE BASIC RULES?
- Student educational records are considered confidential and may not be released without the written consent of the student.
- As a faculty or staff member, you have a responsibility to protect educational records in your possession.
- Some information is considered public (sometimes called "directory information"). This info can be released without the student's written permission. However, the student may consider this info confidential as well. Directory information is: name, address, phone, dates of attendance, degrees received, major program, height and weight of athletes, email address, full- or part-time status and date of birth.
- You have access to student information only for legitimate use in completion of your responsibilities as a university employee. “Need to know” is the basic principle.
- If you are ever in doubt, do not release any information until you contact the Office of the Registrar at 303-871-2284 or email@example.com. The Office of the Registrar is responsible for student record information.
As a DU employee, may I access students’ education records?
University faculty and staff may access students’ education records for the sole and explicit purpose of allowing them to carry out their official University functions. Any other use is prohibited. It is the responsibility of each school official to understand his or her legal responsibilities under FERPA and other privacy regulations at the University of Denver. Failure to adhere to privacy regulations can result in disciplinary action up to and including termination.
School officials with legitimate educational interest may access student information. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility. The University of Denver defines school officials as follows:
University officials with legitimate educational interests include a person employed by the University in an administrative, supervisory, academic, research, or staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her institutional duties.
What rights does FERPA afford students with respect to their education records?
- The right to inspect and review their education records within 45 days of the day DU receives a request for access. Students should submit to the Office of the Registrar written requests that identify the records they wish to inspect. The Office of the Registrar will arrange access (coordinating with appropriate offices) and notify the student of the time and place where records may be inspected.
- The right to request an amendment to the student’s education records that the student believes are inaccurate or misleading. Students may ask to amend a record that they believe is inaccurate or misleading. They should write the Office of the Registrar, clearly identify the part of the record they want changed, and specify why it is inaccurate or misleading. If DU decides not to amend the record as requested by the student, we will notify the student of the decision and advise the student of his or her right to a hearing regarding the request for amendment. Additional information regarding the hearing will be provided to the student when notified of a hearing.
- The right to consent to disclosures of personally identifiable information contained in the student’s education records, except to the extent that FERPA authorizes disclosure without consent (such as to school officials).
- The right to file a complaint with the U.S. Department of Education concerning alleged failures of DU to comply with the requirements of FERPA. The name and address of the office that administers FERPA is:
Family Policy Compliance Office U.S. Department of Education 400 Maryland Ave.,S.W. Washington,DC 20202-4605
Who is protected under FERPA?
Students who are currently or formerly enrolled, regardless of their age or status in regard to parental dependency are protected under FERPA. Students who have applied to but have not attended DU do not come under FERPA guidelines for DU, but records (e.g., transcripts) from previously attended schools are protected by FERPA. FERPA rights terminate at death.
What is not included in an education record?
- Sole possession records or private notes held by school officials that are not accessible or released to other personnel;
- law enforcement or campus security records that are solely for law enforcement purposes and maintained solely by the law enforcement unit;
- records relating to individuals who are employed by the institution (unless contingent upon attendance);
- records relating to treatment provided by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional and disclosed only to individuals providing treatment; and
- records that contain information about an individual obtained only after that person is no longer a student, i.e., alumni records.
What is directory information?
Institutions may disclose information on a student without violating FERPA if it has designated that information as “directory information.” DU designates the following as directory information: the student's name, addresses, telephone numbers, electronic mail addresses, photographic images, date and place of birth, major field of study, full-time or part-time status, class (e.g., graduate, sophomore, junior), participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, anticipated date of graduation, degree(s), honors or awards received, including selection to a dean’s list or honorary organization, the most recent previous educational agency or institution attended by the student.
DU designates directory information solely to perform specific institutional functions. DU does not release any directory information (such as addresses and telephone numbers) to third parties except to conduct these functions. Contact the Office of the Registrar for additional information.
May a student request that directory information not be released?
Any student wishing that directory information not be released must submit a “Request to Withhold Information” form to the Office of the Registrar. Requests must be submitted each fall.
How do I know if a student has requested that directory information not be released? What do I do?
When using the Banner information system, a pop-up window will appear when accessing information for students who have requested that directory information be suppressed. The pop-up window states: Warning: Information about this person is confidential. An indication that the student information is confidential will appear on Banner web screens and on many Banner reports.
If a student has requested that directory information not be released, no information about that student should be shared with any third party (i.e., the student or anyone who is not a University Official). Academic and student service departments should require that the student appear in person with a picture identification to conduct business. Business should not be conducted over the telephone. If any third party should request any information about the student, the University employee should state “there is no information available for that individual.” Direct inquiries to the Office of the Registrar.
Who may have access to student information?
- The student and any outside party who has the student’s written authorization.
- School officials (defined above) who have “legitimate educational interests.”
- A Teaching Assistant (TA) or a Graduate Assistant (GA) may be granted access to educational records for courses they are assigned to, or for courses which they are assisting with instruction.
- Parents of a dependent student as defined by the Internal Revenue Code may have access to the student’s education records. The parent must attest to dependency status and file a form annually with the Office of the Registrar. Students may revoke parents’ access to their educational records, thus it is important to determine if a release is in effect (see below).
- A person in response to a lawfully issued subpoena or court order, as long as DU first makes a reasonable attempt to notify the student. All subpoenas and court orders for student information should be referred to the Office of the Registrar. Law enforcement officials seeking student information should be referred immediately to the University Counsel (x14646) or the Office of the Registrar (x13897).
- DU may notify parents or guardians when a dependent student under the age of 21 is placed on judicial probation or suspended or dismissed.
How do I know if a student has released educational records to a third party such as a parent?
Students’ information releases are recorded in the Banner system by the Office of the Registrar. iBanner users may view releases on the DU FERPA Information Release Form (SZAFRPA) form. Students, faculty and advisers may see if a release is in place using PioneerWeb Faculty & Adviser self-service. The form shows the valid period for the release; the specific information (e.g., grades) that may be released, and the party to whom the information may be released.
Educational records should never be shared with any third party (including parents) if a release is not in place.
There are two ‘blanket’ releases that are not recorded on SZAFRPA. Varsity athletes sign a standard release provided by the NCAA that authorizes release of information to the NCAA and other parties for athletes. Foreign students sign a release to the U.S. Citizenship and Immigration Services office as part of their I-20 form. Inquiries from NCAA should be referred to the Department of Athletics. Inquiries from U.S. Citizenship and Immigration Services should be referred to the Office of Internationalization.
What can I include in a letter of recommendation for a student?
Faculty and staff are often asked to write letters of recommendation for students. While personal observations do not require a written release, disclosure of any educational record (such as GPA or classroom performance) requires a written release. A customized release form for letters of recommendation is available on the Registrar’s website. Alternatively, DU faculty and staff may ask a student to submit the standard release via PioneerWeb, which specifies information which may be released in the letter of recommendation.
When is the student’s consent not required to disclose information?
When the disclosure is:
- to school officials (defined above) who have a legitimate educational interest;
- to federal, state, and local authorities involving an audit or evaluation of compliance with educational programs;
- in connection with financial aid (this includes veterans’ benefits);
- to accrediting organizations;
- to parents who have filed a Request for Disclosure of Educational Records for a dependent student;
- to comply with a judicial order or subpoena;
- in a health or safety emergency;
- releasing directory information;
- releasing the results of a disciplinary hearing to an alleged victim of a crime of violence.
Other than sharing information with individuals to whom the student has signed a release, these needs should be coordinated through the Office of the Registrar.
Outside contractors may perform work as the University’s agent under specific circumstances. Contact the Office of the Registrar for additional information.
Disclosure to Parents
When a student turns 18 years old or enters a postsecondary institution at any age, all rights afforded to parents under FERPA transfer to the student. In nearly every case, university employees should only disclose information to parents when a release is in place (see page 2). However, FERPA permits some circumstances in which schools may share information with parents without the student's consent. For example:
- Schools may disclose education records to parents if a health or safety emergency involves their son or daughter.
- Schools may inform parents if the student who is under age 21 has violated any law or its policy concerning the use or possession of alcohol or a controlled substance.
- A school official may generally share with a parent information that is based on that official's personal knowledge or observation of the student.
Disclosure to Contractors and Agents
The University may engage contractors or agents to perform work on its behalf. If performing such work includes access to education records, the contractor is designated as a “school official” as defined above. In order to be provided with access to confidential education records, a formal agreement with the contractor must include the following:
- The University of Denver retains full ownership rights in the confidential student information;
- The contractor will use the information solely for the purpose stated in the agreement;
- The contractor will release student information only to University of Denver officials;
- The contractor will institute and maintain reasonable controls to ensure the integrity and security of the information;
- The contractor will indemnify and hold the University harmless from any direct loss, cost, damage or expense suffered by the University as a direct result of the contractor’s failure to comply with its obligations under the agreement;
- The contract will comply with FERPA, the Financial Modernization Act of 1999 and other laws concerning the privacy and confidentiality of information and records;
- The contractor will return or destroy all information provided under the agreement upon termination of the agreement or written request of the University of Denver.
These terms must be included in the contract or may be incorporated by signing an Agent/Contractor Agreement available from the Office of the Registrar. The Office of the Registrar must review any contract or agreement involving the release of education records as defined above.
Balancing Student Privacy and School Safety
University officials are regularly asked to balance the interests of safety and privacy for individual students. While FERPA generally requires institutions to ask for written consent before disclosing information, it also allows colleges and universities to take key steps to maintain campus safety.
Health or Safety Emergency
In an emergency, FERPA permits school officials to disclose without student consent education records, including personally identifiable information from those records, to protect the health or safety of students or other individuals. At such times, records and information may be released to appropriate parties such as law enforcement officials, public health officials, and trained medical personnel. [34 CFR § 99.31(a)(10) and § 99.36]. This exception to FERPA's general consent rule is limited to the period of the emergency and generally does not allow for a blanket release of personally identifiable information from a student's education records. DU officials may disclose information from education records to parents if a health or safety emergency involves their son or daughter.
FERPA and Student Health Information
DU may share student medical treatment records with parents under the circumstances described above. While these records may otherwise be governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the HIPAA Privacy Rule excludes student medical treatment records and other records protected by FERPA.
While student disciplinary records are protected as education records under FERPA, there are certain circumstances in which disciplinary records may be disclosed without the student's consent. DU Community Standard officials may disclose to an alleged victim of any crime of violence or non-forcible sex offense the final results of a disciplinary proceeding conducted by the institution against the alleged perpetrator of that crime, regardless of whether the institution concluded a violation was committed. An institution may disclose to anyone – not just the victim – the final results of a disciplinary proceeding, if it determines that the student is an alleged perpetrator of a crime of violence or non-forcible sex offense, and with respect to the allegation made against him or her, the student has committed a violation of the institution's rules or policies [34 CFR §§ 99.31(a)(13) and (14)].
FERPA and Student and Exchange Visitor Information System (SEVIS)
FERPA permits institutions to comply with information requests from the Department of Homeland Security (DHS) and its Immigration and Customs Enforcement Bureau (ICE) in order to comply with the requirements of SEVIS. SEVIS compliance is administered by the Office of Internationalization.
Electronic Information Resources
DU employs a number of electronic information systems which contain confidential student information. These include Banner, Blackboard and other learning management systems, the DU portfolio and others. The same principles of confidentiality that apply to paper records also apply to electronic data.
May I use social media such as Facebook or blogs in my classroom?
FERPA does not forbid instructors from using social media in the classroom, but common sense guidelines should be used to ensure the protection of students. Information posted to such media are public and may be viewed by others. You must inform students of this fact and should consider it if requiring students to use them. Students should not be required to release any personal information on a public site. Instructor comments or grades on student material should never be made public.
How may I use information from the DU data reporting views, the DU Operational Data Store or Enterprise Data Warehouse?
These data tools are made available for specific communication tasks and internal reporting. Specific policies exist for use of data from these tools. Contact the Office of the Registrar or University Technology Services for additional information.
Requirements for Electronic Data Protection
- Protected student information may be stored only in approved storage locations.
- Protected student information stored on office computers, home computers and laptops must be encrypted. The University Technology Services website lists an approved, easy-to-use encryption tool.
- Before computers and rewritable storage media (e.g., hard disks, other magnetic media, and flash memory devices such as key chain storage devices) are transferred between University departments or to different employees within a University department, all files that the recipients are not explicitly authorized to access must be deleted and free space must be erased.
- When computers and rewritable storage media are discarded or sold outside the University, rewritable storage media must be erased by overwriting with meaningless data.
- Media such as CDs and DVDs that are not rewritable must be physically destroyed before they are discarded.
The complete policy for secure computing may be seen at www.du.edu/uts/policies Questions can be directed to University Technology Services at 303.871.2100
How do I get additional information about FERPA?
The Office of the Registrar administers FERPA for the University of Denver. All inquiries regarding FERPA should be referred to:
The Office of the Registrar
University of Denver
2197 S. University Blvd., Room G45
Denver, CO 80208
Academic Departments Document Retention
|Advising Plans||Notes from faculty after advisement sessions with students||5 years|
|Appeal for Grade Change||Student requested through their department a review and consideration of a different final grade||1 year|
|Applications for Admission||Applicants who do not enroll, whether they are accepted or rejected,
Applicants who enroll
|Blackboard Accounts||Instructor virtual grade book||2 years|
|Correspondence||To and from faculty member regarding student issues||5 years|
|Course Syllabi||Instructor outline of the course requirements. May include information about tests, projects, reading assignments, as well as required textbooks||5 years|
|Disciplinary Actions on Students||Information received||5 years|
|Examinations, Tests, Quizzes||Examinations, tests, quizzes, and term papers used to demonstrate student’s knowledge of materials learned in a particular course||1 year|
A comprehensive document retention schedule is located at: http://www.du.edu/bfa/records/retentionschedule/retention_sched.html