SECTION 3: PROTECTING THE PRIVACY OF EDUCATION RECORDS

In the previous section we discussed directory information. Under FERPA, students also have the right to request that their directory information not be released to a third party by requesting no-disclosure through a Privacy Hold.
Key Points:

• Privacy Holds
• Access to Student Information
• Parents' Rights
• Important Reminders for Faculty and Staff
• Recommendations for Posting Grades
• Letters of Recommendation

With a Privacy Hold, no directory information is given out on that individual. Nothing will be printed in the Joker, Yearbook, or Numerique as long as the student makes a request to the Records and Advisement Office within the second week of the fall semester.
A Privacy Hold means that the student’s entire education record is considered non-directory information. When a student calls the university or a person calls on the student’s behalf, the university cannot even acknowledge that the individual is a student at the university. This makes communication between the university and the student very difficult. Therefore, we recommend that students do not request a Privacy Hold unless it is absolutely necessary.
The university computer system will show if a student has a Privacy Hold.
Key Points:

• A Privacy Hold prevents the university from disclosing the student's local address, local phone number, and university email address without written consent.
• Students can request a Privacy Hold by the second week of the fall semester to prevent the university from releasing any information about a student.
• With a Privacy Hold, the university cannot even acknowledge that the person is a student at the institution.
• A Privacy Hold is not recommended unless it is absolutely necessary.

In addition to having access to directory information, university faculty, staff, and other designated officials have access to non-directory information if they have a legitimate educational interest.
Key Points:

• Student information can be obtained without written consent by university faculty, staff, and other designated officials who have a legitimate educational interest.
• Contact the Director of Records at 423.236.2895 for assistance.

A university official is a person employed by the university in an administrative, supervisory, academic, research, or support staff position (including law enforcement unit personnel and health staff). Also considered university officials are members of the Board, a person or company with whom the university has contracted (such as an attorney, auditor, or collection agent), temporary employees, student workers, and graduate assistants employed by the university.
University officials include:

• Members of the Board
• University administrators
• Faculty and staff under contract or appointment to the University
• Faculty, staff, and students performing a special administrative task such as secretaries, clerks, attorneys, auditors, disciplinary and judicial panel members, etc. for the period of their performance as an employee or contractor
• Temporary employees substituting for an administrative staff or faculty member

Legitimate educational interest is defined as the need to review an education record in order for a university official to carry out his or her responsibilities in order to: perform an administrative task outlined in the official’s duties; perform a supervisory or instructional task directly related to the student’s education; or perform service or benefit for the student such as health care, student job placement, or student financial aid.
Key Points:

• Legitimate educational interest is the need to know in order to:
• Perform an administrative task outlined in the official's duties
• Perform a supervisory or instructional task directly related to the student’s education
• Perform a service or benefit for the student such as health care, student job placement, or student financial aid

Now that you have had the opportunity to learn some of the guidelines governing FERPA, we will take a few minutes to work through a scenario to demonstrate how you would apply this knowledge in your job.
This scenario involves third-party access to student information by a parent who also is a faculty member. Does he have a legitimate educational interest for the information he is requesting?
Sam Student attends the university as an undergraduate student. His father is faculty and desires to know how his son is doing in his classes. He calls his son’s adviser and asks if he could get his grades. How should the adviser respond to the father’s request?
Response A:
Tell the father as much information as possible regarding Sam’s progress in school. After all, he is a faculty member on campus and therefore has a legitimate educational interest.
Response B:
Inform the father/faculty member that you cannot release any non-directory information regarding Sam because it is not based on a legitimate educational interest under FERPA.
Response C:
Tell the father the information he has requested once you have verified his identity and that the caller is the father of the student.

There are many exceptions under FERPA that allow various people and organizations to access student information without written consent. One of these exceptions is the student.
The student always has the right to his or her records and may authorize additional individuals by providing the institution with written release. If you do release non-directory information by using written consent from the student, it is recommended that you keep that written release on file for at least one year.
Authorized representatives of governmental agencies such as the Secretary of Education, U.S. Attorney General, and agents acting on behalf of the institution, such as the National Student Clearinghouse may also have access to student information.
The Clearinghouse is an organization that provides the service of verifying enrollment and degrees on behalf of the university. Providers of student financial aid, accrediting organizations, military recruiters who request information for recruiting purposes only, and authorized representatives of the Department of Veterans Affairs may also be granted access to student information with appropriate approval.
In addition, student information can be released in compliance with a judicial order or subpoena. These requests are always handled through the Director of Records.
Another exception under FERPA is schools in which a student seeks or intends to enroll. If we know a student wants to attend another institution, we can release non-directory information directly to that school without the student’s written consent.
There are other exceptions under FERPA that we did not discuss. If you ever have any questions about what information can or cannot be released, please contact the Director of Records.
Key Points:
Who can access student information:

• The individual student
• Whomever the student authorizes by providing the institution with a written release
• Authorized representatives of the following governmental agencies such as:
• -Secretary of Education
• -U.S. Attorney General
• -State & Local Educational Authorities
• Agents acting on behalf of the institution, such as the National Student Clearinghouse
• Student financial aid providers
• Organizations conducting studies for or on behalf of educational institutions
• Accrediting organizations
• Military recruiters who request “Student Recruiting Information” (Solomon Amendment)
• Department of Veterans Affairs for students receiving educational assistance from the agency
• Compliance with a judicial order or subpoena
• Schools to which a student seeks/intends to enroll
• Internal Revenue Service for purposes of compliance with the Taxpayer Relief Act of 1997

Now that we have discussed some of the exceptions under FERPA, let’s talk about parents’ rights and some additional ways to avoid violations under FERPA. Parents must have a signed consent form from their child in order to obtain non-directory information, but they may obtain directory information.
Parents who claim a student as a dependent under the Internal Revenue Code may have access to non-directory information.
Key Points:

• Parents may obtain non-directory information only if they have a signed consent from their child.
• Parents who claim a student as a dependent under the Internal Revenue Code may access non-directory information by providing evidence of such dependencies to the Director of Records.

There are many ways for you to prevent violations of FERPA. First, if you have access to student information through the university’s computer system, this access does not grant unrestricted use of that information.
Remember that when reviewing student information, the purpose should be based on a need to know for your job. Curiosity is not a valid reason to view student information.
One of the most common violations under FERPA is leaving personally identifiable information in an area that is easily viewed by others. To avoid this type of violation, do not leave confidential information displayed on an unattended computer and make sure that information is not visible to others. Always cover, turn over, or put away papers that contain confidential information if you are going to step away from your desk.
Key Points:

• Access to student information does not authorize unrestricted use of that information.
• Curiosity is not a valid reason to view student information.
• Records should be accessed only in the context of official business.
• Do not leave confidential information displayed on an unattended computer.
• Cover or put away papers that contain confidential information if you are going to step away from your desk.
• Ensure that information displayed on your computer is not visible to others.

Be sure to dispose of confidential records in a secure manner. Any paper that has a student’s Social Security number or student ID on it should be shredded or placed in a secure recycling bin. You should never place confidential information in a recycle bin that is unsecured in a hallway or office.
Key Points:

• Records containing student ID, Social Security numbers, or grades should be shredded.

The following are some helpful hints for faculty to avoid FERPA violations. Although you may not be a faculty member yourself, more than likely you directly or indirectly work with faculty, administrators, and students on campus. Therefore, it is important to have the ability to identify potential FERPA violations.
First, faculty members should never use student’s Social Security numbers to post grades, not even using the last four digits. Further, graded exams, projects, and papers should never be passed so students can see other student’s grades. In addition, a printed class list with the student’s name and Social Security number should never be passed around the class as a sign-in sheet.
Also, be sure that you do not provide anyone with student schedules, lists of students enrolled in your classes, or confidential information such as grades, GPA, and number of credits in a recommendation letter without the written consent of the student.
Key Points:

• To avoid FERPA violations, do not:
• Use the SSN/student ID to post grades
• Leave graded tests in a stack for students to sort through
• Circulate a printed class list with the student name and SSN/student ID
• Provide anyone with student schedules
• Provide anyone with lists of students enrolled in your classes
• Include confidential information such as, grades, GPA, and number of credits in a recommendation letter without the written consent of the student

This scenario refers to the posting of grades on class websites. Your husband is currently taking several courses at the university. He tells you that he is able to check his grade on the class website. You watch as he logs in using his ID and password. To your amazement, you can see his grade as well as the grades of the other students in his class. You realize this is a violation of FERPA laws. What should you do?
In this situation, whom should you notify about this FERPA violation?
Response A:
Notify Records and Advisement about the situation.
Response B:
Confront the instructor directly and inform him or her about FERPA.
Response C:
Do nothing since it is not your responsibility to report FERPA violations and it does not affect you.

Faculty members can post grades by using a PIN or code number that is only known to the instructor and the student. In addition, grades should not be listed in straight alphabetical order by student but in a random order.
Key Points:

• Post grades by a code number known only to the instructor and the student.
• List grades in random order.

Next, we will review the guidelines for writing a letter of recommendation for a student. If the letter of recommendation contains only directory information, no written release is required from the student. However, if the student requests non-directory information such as grades, GPA, number of credit hours, and Social Security number to be included in the letter of recommendation, then you will need to obtain a completed University Letter of Recommendation Authorization Form from the student prior to writing the letter.

Key Points:

• You must have a signed consent from the student if non-directory information is included in a letter of recommendation.
• The signed consent should include the following:

-Who has permission to write the letter
-Where the letter should be sent
-What non-directory information should be included

In conclusion, we have discussed student rights under the Family Educational Rights and Privacy Act of 1974 and university policies and procedures. We have also discussed when FERPA rights begin and end for a student, what is considered to be an education record, directory information, legitimate educational interest, exceptions under FERPA, and tips for preventing violations.

For additional information regarding FERPA, including the official university policy, please visit: www.southern.edu/records. If you have questions about FERPA, you can contact the following offices:

• Director of Records and Advisement or Assistant Director of Records and Advisement
• Vice President of Academic Administration
• University legal counsel

It is important that we comply with FERPA because it is the law and it is essential for us to maintain the trust and respect of our students by protecting their student education records as an institution.