FERPA Information - Office of the Registrar

Welcome to the Family Educational Rights and Privacy Act tutorial for JSU Faculty and Staff! This tutorial provides information about the Family Educational Rights and Privacy Act (FERPA) of 1974, how its laws govern the protection of our students' privacy, and how complying with FERPA laws and guidelines affects your job responsibilities at Jacksonville State University.

An educational institution that receives funds under any program administered by the U. S. Secretary of Education must comply with FERPA. Jacksonville State University is, thereby, legally responsible for protecting the confidentiality of JSU students' education records. In response to our role as "custodian" of students' records, all JSU employees should review this tutorial.

What is FERPA?

The Family Educational Rights and Privacy Act sets forth requirements regarding the privacy of student records and affords students certain rights with respect to their education records.

Students have the right to:

inspect and review their education records within 45 days of the date the university receives a request for access.
request the amendment of their education records to ensure that they are accurate, not misleading, or otherwise in violation of the student's privacy.
request that school officials not disclose personally-identifiable information about them, or permit inspection of their records without written permission, unless such action is covered by certain exceptions permitted by the Act.
file a complaint with the U. S. Department of Education concerning alleged failures by Jacksonville State University to comply with the requirements of FERPA.

What Are Education Records?

Records that are directly related to a student that include any information in any medium including, but not limited to, handwriting, print, audio and video tapes, film, e-mail, microfilm, and microfiche. Records that are maintained by an institution or by a party acting for the institution.

Examples of an Education Record are:

Social security number or any part thereof.
Admissions information for students who are accepted and enrolled.
Biographical information including date and place of birth, gender, nationality, race, ethnicity, religion, and identification photographs.
Grades, test scores, evaluations, courses taken, GPA, academic specialization and activities, and official communications regarding a student's academic status.
Coursework including papers and exams, class schedules, as well as written e-mail or recorded communications that are part of the academic process.
Disciplinary records.
Student financial and financial aid records.
Internship or study abroad program records.

Education Records are not:

Sole possession records such as memory aids, reference tools, and personal notes about a student that are not shared with others or made accessible to others including, but not limited to, the student and other university officials.
Jacksonville State University law enforcement records.
Medical treatment records.
Employment records, unless the students' employment is predicated upon their status as student (i.e., Federal work-study student).
Alumni records that do not relate to or contain information about the person as a student.

BEST PRACTICE
Sharing personal notes with another person, or placing them in an area where they can be viewed by others makes them "education records" and subject to FERPA. In short, if you don't want it reviewed, don't write it down; destroy it or store it where you have sole access.

Disclosure of Education Records

Student education records may not be disclosed to anyone unless the student has given written consent, or the disclosure is a legal exception.

One of the exceptions is the release of directory information about a student. Consent from a student is not generally required for the release of directory information, and it may be viewed and released to the public unless the student has placed a privacy restriction on its release through the JSU Registrar's Office.

JSU's Directory Information

The following directory information may be disclosed as long as the student has not requested a privacy restriction to be placed on his or her records:

Student's name
Mailing address
Telephone listing
JSU email address
Enrollment status (full-time, part-time)
Whether currently enrolled or not
Class/level
Major field of study
Participation in officially recognized activities and sports
Weight and height of members of athletic teams
Prior post-secondary institution(s) attended
JSU photograph(s)
Dates of attendance
Thesis/dissertation title
Degrees and awards received

The university reserves the right to deny directory information.

Best Practice
Without the proper access, you may not know if a student has placed a privacy restriction on his or her record, which would prevent the release of directory information. Therefore, when in doubt do not release any information about a student to a third party. Instead, contact the Registrar's Office for assistance.

Disclosure without Prior Consent

In addition to the release of directory information, FERPA also defines other legal exceptions in which an education record may be released to certain parties without written permission from the student. These include the following:

School officials that act in the student's educational interest on a legitimate, need-to-know basis. A school official is a person employed by the university in an administrative, supervisory, academic, research, or support staff position; a person or company with whom the university has contracted; a person serving on the Board of Regents, or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing their tasks.

Best Practice
The school official should ensure that a legitimate educational interest exists before seeking information from a student's education records by determining if the information is needed in order to perform a duty or service related to their professional responsibilities as outlined in their contract or official job description. Simply put, a school official should not be on a "fishing expedition" when they review a student's records.

Other legal exceptions include:

Authorized representatives of the U.S. Department of Education, U.S. Department of Defense, U.S. Attorney General, Immigration and Naturalization Services, Homeland Security, the Comptroller General of the United States, state education authorities, organizations conducting studies for or on behalf of the university, and accrediting organizations.
In connection with the student's application for, and receipt of, financial aid.
In compliance with a judicial order or lawfully-issued subpoena.
Parents of dependent students as defined by the Internal Revenue Code, Section 152.
Appropriate parties in a health or safety emergency.
The alleged victim of any crime of violence handled by disciplinary proceedings conducted by the university.
FERPA rights transfer to a student when the student begins attending JSU regardless of the student's age.
Directory information may be released to parents unless the student has placed a privacy restriction on its release.
Non-directory information may be released to parents in compliance with a lawfully-issued subpoena.

Best Practice
If you are presented with a signed release from a student granting their parents access to any part of the student's education records, check with the Registrar's Office before releasing the requested information. Depending on the nature of the request, the Registrar's Office may need to verify the student's signature on the release. Additionally, the parent's identification should be affirmed by a photo ID before releasing the information.

What are the Penalties for Violating FERPA Regulations?

The Family Policy Compliance Office with the Department of Education in Washington, D.C. reviews and investigates complaints of alleged violations of FERPA.
If the Office confirms that a violation has occurred, it will establish a reasonable period of time for the university to make the mandated correction(s) in order to bring the university into compliance.
If the university fails to make the mandated corrections, the Secretary of Education can direct that no federal funds under their administrative control be made available to the institution.
A willful or unauthorized disclosure could constitute just cause for disciplinary action.

FERPA Information for Faculty

The public posting of grades by any of the following methods without the student's written permission is a violation of FERPA:

Student's name
Any part of the student's social security number
Student's institutional identification number. E-mailing grades is not recommended. A student's written permission is required to e-mail grades to any account other than a JSU e-mail account, but this practice is not recommended since there is no guarantee of confidentiality on the Internet, even via the JSU e-mail account.

Suggestion for posting grades publicly while remaining FERPA compliant:

Assign each student a code word or randomly assigned number known only to you and the student. Even a coded list, however, should not be posted alphabetically by student name.

May I include a student's GPA in a letter of recommendation that the student has asked me to write? What may I include in the recommendation? What should I exclude?

A written release from the student is not required if the letter of recommendation contains only statements about the student that are made from the faculty's personal observation or knowledge about the student.

A written release is required from the student if any personally-identifiable (non-directory) information is included in the letter of recommendation (i.e., grades, GPA, or list of completed courses). To include non-directory information, the student must provide a written release to the faculty member that:

a) specifies the record(s) that may be disclosed.
b) states the purpose of the disclosure.
c) identifies the third party to whom the disclosure may be made.

Sample Permission Letter to Write a Letter of Recommendation

I give permission to Professor XXXX to write a letter of recommendation to:

Dr. Tyrone Johnson
Honors Program
East Gate University
Anywhere, AL 99999

Professor XXXX has permission to include my grades and GPA in this letter.

I waive/do not waive my right to review a copy of this letter at any time in the future.

Signature Date

What do I have to do to comply with FERPA in returning examinations and other coursework?

Leaving personally-identifiable, graded papers unattended for students to pick through is no different from posting grades in a hallway. If these papers contain personally-identifiable information, then leaving them unattended for anyone to see is a violation of FERPA if the instructor has not obtained the written permission of each student to make his or her coursework accessible in this public manner.

Best Practice

Place each student's coursework in a sealed envelope with only the student's name printed on the envelope.
Identify each student with a code word or randomly assigned number known only to the faculty member and the student. Identify all coursework by this code number.
Return completed coursework during class.
Have students collect their coursework from the departmental administrative assistant only after the administrative assistant has affirmed the student's identification via a photo ID. (Check to see if this service is available in your academic division first.)
Obtain and maintain each student's written permission to distribute coursework in a public manner.

A father has called me about his daughter's performance in my class. What may I tell him?

Regardless of the age of the student or who is paying the student's bill, it is a violation of FERPA to release non-directory information over the phone to a parent. In addition, it would be a violation of FERPA to release directory information to a parent if the student has requested a privacy restriction to be placed on their education records.

Best Practice

Do not release any information via the telephone without seeking assistance from the Registrar's Office. Remember, the student may have placed a privacy block on their education records.

Faculty who teach hybrid or online courses, or utilize electronic teaching tools such as Canvas may wish to share students' e-mail addresses in a class with others who are in the same class. Is this FERPA compliant?

This is permissible as long as:

the students have had an opportunity to request that their e-mail address not be disclosed.
the faculty member does not share the e-mail address of any student that has requested a confidential block on their records.

When do FERPA rights begin for JSU students?

A person who applied for admission but was not accepted to the university has no rights under FERPA.

FERPA rights begin the first day of class for students who have applied to JSU, have been accepted, and have registered for courses for any term.

Parents call as much as the students because they often complain that they are paying the bill! What can I tell them about their student?

FERPA mandates that no information about a student's education record may be released if the student has placed a privacy block on their record.
If the student has not requested that a privacy block be placed on their record, you may tell the parents any information about the student that is defined by JSU as directory information. Non-directory information may not be released.
General information taken from the JSU Catalog or from the JSU website may also be shared with parents.

What types of information may I release over the telephone, e-mail, or fax machine?

Telephone

Be careful when speaking to anyone on the telephone since you cannot guarantee the identity of the caller. Never discuss non-directory information via the telephone even if the caller identifies themselves as the student. Instead, transfer the caller to the Registrar's Office. Directory information may be disclosed to a third party via the telephone provided the student has not placed a privacy block on their education records. Remember that directory information includes the student’s name, mailing address, telephone listing, JSU email address, enrollment status (fulltime, part-time), whether currently enrolled or not, class/level, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, prior post-secondary institution(s) attended, JSU photograph(s), dates of attendance, thesis/dissertation title, and degrees and awards received.

E-mail

JSU e-mail has been designated as the official mode of communication. Therefore, use discretion if e-mailing non-directory information. In some instances, a face-to-face meeting with the student may be more appropriate depending on the sensitive nature of the information.

Fax Machine

Use caution when faxing documents containing non-directory information. Only the individual with a legitimate, educational need to know should have access to the fax machine receiving the documents.

May I tell a third party when a student should be on campus if he or she needs to get in touch with the student?

JSU has not designated a student's schedule of classes as directory information. Therefore, no information about a student's schedule may be released to a third party without the student's written consent.

In the case of an emergency, the staff or faculty member should direct the third party to the Registrar's Office for assistance. The Registrar's Office will work with University Police to deliver an urgent message to a student.

May I talk to other JSU campus faculty and staff about a student's education records? What about faculty and/or staff at other universities?

Students' education records may be discussed among JSU campus officials as long as all parties have a legitimate educational interest. In other words, is the information from the student's record needed in order for the school official to perform appropriate tasks that are specified in their position description or contract?

Conversely, faculty and/or staff at other universities are not designated JSU school officials, and do not have a legitimate educational interest in the education records of JSU students. Non-directory information should not be disclosed to faculty and staff from other institutions. FERPA allows an exception for JSU Financial Aid and Registrar's Office staff to disclose information to persons (other than parents) or organizations providing financial aid to students, or determining financial aid decisions for students.

I don't come into direct contact with students' records during my daily job duties. How can I help JSU comply with FERPA regulations?

Every JSU employee can assist the university with protecting the confidentiality of our students' records by doing the following:

Complete FERPA training.
Turn off a computer that a student has unwittingly left logged into his or her Banner account.
Remember to shred confidential information before discarding it.
Alert the Registrar's Office to any information that may be posted publicly in classrooms, buildings, on the grounds, or online that contains personally-identifiable information about students.
Turn in lost ID cards to the Student Life or Registrar's Office.
Destroy any information lying on the grounds, in classrooms, buildings, or offices that contains personally identifiable student information.
Safely store confidential information, and do not leave confidential information displayed on an unattended computer.

FERPA Information for Staff

When do FERPA rights begin for JSU students?

A person who applied for admission but was not accepted to the university has no rights under FERPA.

FERPA rights begin the first day of class for students who have applied to JSU, been accepted, and registered for courses for any term.

Parents call as much as the students because they often complain that they are paying the bill! What can I tell them about their student?

FERPA mandates that no information about a student's education record may be released if the student has placed a privacy block on their record.

If the student has not requested that a privacy block be placed on their records, you may tell the parents any information about the student that is defined by JSU as directory information. Non-directory information may not be released without the student's written consent.

General information taken from the JSU Catalog or from the JSU website may also be shared with parents.

What types of information may I release over the telephone, e-mail, or fax machine?

Telephone

Be careful when speaking to anyone on the telephone since you cannot guarantee the identity of the caller. Never discuss non-directory information via the telephone even if the caller identifies himself/herself as the student. Instead, transfer the caller to the Registrar's Office. Directory information may be disclosed to a third party via the telephone provided that the student has not placed a privacy block on his or her education records. Remember that directory information includes the student's name, address, telephone number, e-mail address, enrollment status (part- or full-time), major, degrees and/or awards received, and participation in campus clubs and organizations.

E-mail

JSU e-mail has been designated as the official mode of communication. In some instances, a face-to-face meeting with the student may be more appropriate depending on the sensitive nature of the information.

Fax Machine

Use caution when faxing documents containing non-directory information. Only the individual with a legitimate, educational need-to-know should have access to the fax machine receiving the documents.

May I tell a third party when a student should be on campus if he or she needs to get in touch with the student?

May I talk to other JSU campus faculty and staff about a student's education records? What about faculty and/or staff at other universities?

Conversely, faculty and/or staff at other universities are not designated JSU school officials and do not have a legitimate educational interest in the education records of JSU students. Non-directory information should not be disclosed to faculty and staff from other institutions. FERPA allows an exception for JSU Financial Aid and Registrar's Office staff to disclose information to persons (other than parents) or organizations providing financial aid to students, or determining financial aid decisions for students.

I don't come into direct contact with students' records during my daily job duties. How can I help JSU comply with FERPA regulations?

Every JSU employee can assist the university with protecting the confidentiality of our students' records. How?

Complete FERPA training.
Turn off a computer that a student has unwittingly left logged into his or her Banner account.
Remember to shred confidential information.
Alert the Registrar's Office to any information that may be posted publicly in classrooms, buildings, on the grounds, or online that contains personally identifiable information about students.
Turn in lost ID cards to the Student Life Office or to the Registrar's Office.
Destroy any information left lying on the grounds, in classrooms, buildings, or offices that contains personally identifiable student information.
Safely store confidential information, and do not leave confidential information displayed on an unattended computer.

View Annual FERPA Notification