Ten Thing IT Staff Need to Know About Education Records Privacy Ten Things IT Staff Need to Know About Education Records Privacy Jeff von Munkwitz-Smith University Registrar University of Connecticut

Ten Thing IT Staff Need to Know About Education Records Privacy Copyright statement Copyright Jeff von Munkwitz-Smith This work is the intellectual property of the author. Permission is granted for this material to be shared for non- commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Ten Thing IT Staff Need to Know About Education Records Privacy What are the regulations? It’s a federal law, the Family Educational Rights and Privacy Act of 1974, as amended. It applies to both K-12 and Postsecondary education. With K-12, the rights belong to the parents; with Postsecondary education, the rights belong to the student, regardless of age or who pays the bills.

Ten Thing IT Staff Need to Know About Education Records Privacy What are a student’s rights? The right to know about the purposes, content, and location of information kept as part of their educational records. The right to gain access to and challenge the content of their educational records. The right to expect that information kept as part of their educational records will be kept confidential, disclosed only with their permission or under provisions of the law.

Ten Thing IT Staff Need to Know About Education Records Privacy What’s an “Education Record”? “Records, files, documents, and other materials that contain information directly related to a student and maintained by the institution or someone acting for the institution according to policy.”

Ten Thing IT Staff Need to Know About Education Records Privacy Some examples Data on the student information system(s), including course management systems. Paper files maintained by the institution messages relating to the student Employment records for student employees Disciplinary records

Ten Thing IT Staff Need to Know About Education Records Privacy What’s not? Employment records of people not employed as a result of their status as a student. “Sole-possession” records Records of police services Application records of people not admitted Alumni records Medical records Parent’s financial information (e.g., tax returns)

Ten Thing IT Staff Need to Know About Education Records Privacy What is “Directory Information”? “Information contained in an education record of a student which would not generally be considered harmful or an invasion of privacy if disclosed.”

Ten Thing IT Staff Need to Know About Education Records Privacy Allowable elements Name Address Telephone number Date and place of birth Major fields of study Dates of attendance Degrees and awards received Photograph Participation in officially recognized activities and sports Height and weight of athletic team members Most recent educational institution attended Student schedule Class roster FT/PT enrollment status

Ten Thing IT Staff Need to Know About Education Records Privacy An institution may choose to include or exclude all or some of the allowable elements in its own definition of “directory information”. It may include similar information, such as e- mail address. It may not include other information, such as student identifier, religion, or ethnic background.

Ten Thing IT Staff Need to Know About Education Records Privacy Why should we care? The penalty for non-compliance can be loss of all federal funding to the institution, including student financial aid. While the law itself does not provide for damages to individuals, courts have increasingly used FERPA as a standard and have awarded damages to students whose education records were inappropriately released.

Ten Thing IT Staff Need to Know About Education Records Privacy Some common questions...

Ten Thing IT Staff Need to Know About Education Records Privacy If a student doesn’t have a“Privacy Bar”, we can release any information. Right? Wrong! If a student has a “privacy bar”, “no release code”, etc., you can’t release any information to the public. If a student doesn’t have one, you may ONLY release Directory Information.

Ten Thing IT Staff Need to Know About Education Records Privacy What about releasing information to parents? Remember: the rights belong to the student, regardless of age or who’s paying the bills! Institutions MAY release non-directory information to parents of dependent students. (Know your institution’s policy.)

Ten Thing IT Staff Need to Know About Education Records Privacy Software vendors understand this. Right? Not always! An example: Class feature in a popular Course Management software product. Another example: a popular ERP product. Don’t assume they know what they’re doing!

Ten Thing IT Staff Need to Know About Education Records Privacy Do we have to release information such as address outside the institution? FERPA does not require release of directory information outside the institution, it allows it. If your institution is public, it pays to know your state’s freedom of information regulations.

Ten Thing IT Staff Need to Know About Education Records Privacy Whose job is it to educate the campus? Good question! A partnership approach works best.

Ten Thing IT Staff Need to Know About Education Records Privacy Where can I go for help? Ask your Registrar Your institution’s attorney AACRAO FERPA Guide The Family Policy Compliance Office web site:

Ten Thing IT Staff Need to Know About Education Records Privacy When in Doubt... Ask!

Ten Thing IT Staff Need to Know About Education Records Privacy Contact information Jeff von Munkwitz-Smith