Skip to main content
Compliance

The Family Educational Rights and Privacy Act of 1974 (FERPA)

PURPOSE

The purpose of the Family Educational Rights and Privacy Act of 1974 (FERPA) is to protect parent and student privacy and to limit disclosures of personal information without consent. FERPA addresses two aspects of student records: the student’s right to have personal education records kept private and the student’s right to inspect and review those records.

HISTORY

FERPA was signed into law by President Gerald Ford on August 21, 1974. “Congress enacted FERPA in response to a growing public awareness of and concern about the public dissemination . . . of information commonly considered private in nature, the withholding of ‘secret files’ on students, and recordkeeping practices in general.” FERPA has been amended many times since its enactment. In 2011, the U.S. Department of Education published regulations in response to the growing use of statewide longitudinal data systems (SLDS). These regulations give government departments increased access to personally identifiable information without the consent of the student.

APPLICABILITY TO BYU–Hawaii

FERPA applies to educational institutions with access to Title IV funds if the institution provides services and/or instruction to students. BYU–Hawaii must comply with FERPA because it is a recipient of federal funds under the Pell Grant Program and other federal student loan programs and because it provides educational services and instruction to students. BYU–Hawaii has adopted procedures regarding access to student records which explain in detail student rights relating to their education records.

REQUIREMENTS

All postsecondary students have control over their own education records and must be given the protections and rights outlined in FERPA. A university must allow students to inspect and review their education records, to have an opportunity to amend their records, and to control disclosures of their education records. A university may not disclose information contained in education records without the student’s written consent, except under certain conditions.

A. Education Requirements

Education records are defined as information directly related to the student that is maintained by an educational agency or institution. The following are not classified as education records under FERPA:

  1. records kept solely by the maker (including faculty, staff, administrative, or auxiliary personnel) if the record has not been made available to any other person, except a substitute;
  2. law enforcement records created and maintained by an institution’s law enforcement unit;
  3. an employment-related record that does not result from student status;
  4. treatment records that are maintained by an institution’s health or counseling services and are only available to the individuals providing the diagnosis and treatment;
  5. records created after a student has left the school that are not directly related to the personas a student; and,
  6. peer-graded papers before they are collected or recorded by a teacher.

An institution subject to FERPA is not required to make a) parental financial records or b) confidential letters and statements of recommendation if placed in the student’s record before 1974 or if the student waived their right to access the letter available to students.

B. Recordkeeping

The institution is responsible for maintaining a record of all requests and approvals to view education records, including the identities of the requesters and recipients and the stated legitimate interest for requesting the education records. This record (of requests and access granted) may only be available to school officials, law enforcement officials, and auditors pursuant to their job. However, the institution does not need to track the disclosures to eligible students, disclosures to school officials with a legitimate educational interest, disclosures in response to a subpoena if the court has ordered that the existence or content of the subpoena not be disclosed, disclosures to an ex parte court order of the U.S. Attorney General related to an investigation or prosecution of terrorism, disclosures made with the student’s written consent, or directory information.

C. Student Rights

According to FERPA regulations, an educational institution must allow students to inspect and review their education records maintained by the school. A school must allow for and grant a student’s request to review their education records within a period not to exceed forty-five days of the request. However, an institution is not required to provide copies of records to students unless it is impossible for students to review the records in person—for instance, if the student is currently living far away from campus. The institution may charge a fee for copies made unless the fee prevents exercise of right.

Students have the right to request that an educational institution amend the student’s record. If the school decides not to amend the record, it must inform the individual of their right to a hearing. If the student requests a hearing, it must be held within a reasonable time, conducted by an individual who does not have a direct interest in the outcome, and give the student a full and fair opportunity to present relevant evidence. The educational institution must give the student advance notice of the date, time, and place of the hearing.

After the hearing, if the school still decides not to amend the record, the school must inform the student of their right to place a statement in the record contesting the information’s accuracy. The institution must maintain the student’s statement with the record and disclose the statement in conjunction with record disclosures.

D. Annual Notification

To comply with FERPA, schools must annually notify all students currently in attendance of their rights under FERPA. The notification must include the student’s rights to inspect and review education records, request amendments to the records, consent to disclosures, and file complaints. The notification must also include the procedures for these activities and a definition of who constitutes a school official with legitimate educational interest to view education records. The actual notification method is left to the institution’s discretion but must effectively notify students with disabilities.

E. Directory Information

Directory information is information contained in a student’s education record that is generally not considered harmful or an invasion of privacy if disclosed to a third party. Educational institutions subject to FERPA must give public notice about categories included in the directory information and give students a reasonable amount of time to request that directory information be kept private. If these notices have been given, directory information may be disclosed to third parties without written consent, unless a student requests otherwise.

Directory information that the school may designate and provide includes, but is not limited to:

  1. name,
  2. address,
  3. telephone number,
  4. email address,
  5. photograph,
  6. date and place of birth,
  7. major,
  8. grade level,
  9. enrollment status,
  10. dates of attendance,
  11. participation in officially recognized activities and sports,
  12. height and weight (if a student athlete),
  13. degrees,
  14. honors and awards, and
  15. most recent educational institution attended.

The Department of Education has taken the position that disclosure of a student’s race, gender, or sensitive demographic identifiers would constitute an invasion of privacy and therefore should not be designated as directory information. Educational institutions may not release “personally identifiable information . . . other than directory information.” Institutions also may not release directory information if doing so also discloses non-directory information. Schools may disclose alumni directory information without notifying alumni of their rights; however if the alum, as a student, requested that their directory information not be disclosed, the school must retain this policy after graduation.

A student may not request directory information (such as the student’s name, identifier, or email address) be kept private from the student’s enrolled classes. For example, a student may not remain anonymous in class and may not “impede routine class communications and interactions.” Furthermore, even if a student requests that directory information be kept private, the university can still require the student to wear and publicly display a student ID card containing directory information.

F. Permissible Disclosures

According to FERPA, an educational institution is not permitted to release a student’s education records without the student’s written permission unless the release fits into a specific exception (outlined below). The student’s written consent must name the records being disclosed, the reason for the disclosure, and the people who will receive the information. To be effective, the consent must also be signed and dated.

FERPA allows schools to disclose records, without consent, to the following parties or under the following conditions:

  1. school officials with legitimate educational interests;
  2. officials from transfer schools in which the student seeks or intends to enroll;
  3. authorized representatives of the Comptroller General, the Attorney General, the Department of Education, or state and local educational authorities for purposes of an audit or evaluation or compliance or enforcement activity;
  4. for financial aid purposes;
  5. state and local officials concerning juvenile justice systems or pursuant to a state statute;
  6. organizations conducting educational studies (with certain restrictions);
  7. accrediting organizations;
  8. parents of dependent children (as defined in the tax code at 26 U.S.C. § 152);
  9. under a judicial order orlawfully issued subpoena (notification to the student may be required before a disclosure is made);
  10. in the context of a lawsuit brought by the educational institution against the student (limited to relevant information);
  11. in connection with a health or safety emergency;
  12. the information consists only of directory information (for which the school has provided notice and the student has not opted out of the disclosure);
  13. the student;
  14. victims of a violent crime or non-forcible sex offense and information consists only of final results of institutional disciplinary proceeding;
  15. final results of a school disciplinary proceeding in the case of a violent crime or non-forcible sex offense if a student is found to have violated school rules or policies (limited to student name, violation committed, and sanction imposed);
  16. to parents of students under age 21 relating to a violation of the school’s drug and alcohol rules; or,
  17. the disclosure is concerning registered sex offenders.

The institution may include, in a student’s education record, information about disciplinary actions taken against a student because of behavior that was a risk to public safety. The institution may also disclose disciplinary information to school officials or teachers with legitimate educational interests in that student’s behavior.

In investigations or prosecutions of terrorism, an institution must comply with court orders to release relevant education records without the student’s consent. The school is not liable for good faith disclosures to the government.

G. Statewide Longitudinal Data Systems

Many states have begun to use statewide longitudinal data systems (SLDS) to track student and educational program outcomes and success. FERPA does “not establish the authority for any type of data collection at any level, whether Federal, State, or local,” and “does not authorize the establishment of SLDS.”

Institutions are generally not required to share student records with authorized representatives from any government agencies, and, under FERPA, should exercise judgment when disclosing student records to these agencies to prevent unwanted re-disclosures by the agency. In the event of a re- disclosure the institution may request a copy of the record from the federal, state, or local educational authority. This copy must be provided to the institution within thirty days.

PENALTIES

If a university fails to comply with FERPA regulations the government may withhold further payments, issue a complaint, or terminate eligibility to receive funding.

COMPLIANCE CALENDAR

Each educational agency or institution shall annually notify current students of their rights under FERPA.