FERPA protects students’ rights to privacy in their educational records. Educational records encompass information that is (a) directly related to a student and is (b) maintained by an institution or a party acting for the institution (c) in any medium. It’s your job to help protect student privacy by not releasing any information that might identify a student to anyone besides that student or someone who has a legitimate educational interest.
Yes! Students performing work for the University may be designated as school officials and may have a legitimate educational interest qualifying them to access educational records. Therefore, student workers are liable for the same FERPA responsibilities as full-time faculty and staff.
Faculty and staff members are considered “school officials,” so you may access only the educational records in which you have a legitimate educational interest. There is a simple three-step inquiry that you can go through to determine if you have a legitimate educational interest.
FIRST, are you a school official?
Are you employed by the university in an administrative, supervisory, research, or support staff position?
Are you a person employed by contract to the university to perform a special task?
SECOND, do you need access to the record to perform your assigned duties?
Is the information relevant to accomplishing some task or to making a determination about the student?
Is the information necessary to perform your duties?
THIRD, is your need for the record related to your responsibility to facilitate the student's development?
Is the task related to the student's education or discipline?
Is the information needed to provide a service or benefit relating to the student?
No matter what, you should only access the student educational records that are necessary to do your job as an official of the University; any other access is a violation of FERPA. Additionally, even if you may access the information, you may not disclose it unless it is (a) qualifying directory information, (b) the disclosure falls under one of the FERPA exceptions, (c) the student themselves are seeking the information and have presented a photo ID, or (d) the student has provided written permission, signed and dated, that states the information they authorize release of and the person(s) to whom they authorize the University to release that information.
If a student requests a letter of recommendation and the letter includes information that falls within FERPA’s definition of educational records, a written release from the student is necessary prior to issuing it. You should ask the student to fill out a Letter of Recommendation Authorization Release (PDF).
Statements in a recommendation that are based on the faculty member’s personal observations about a student do not require a written release from the student.
When holding class or student appointments over videoconference, you must be certain to use a password-protected invitation or an invitation that accepts only registered participants. You must also ensure that no non-directory information is available in any class or student appointment held via videoconference.
If you record and post a class, you should not post the recording publicly unless only the instructor is visible on the video and only the instructor’s name is shown in the recording. Any recording that contains a student’s personally identifiable information is part of that student’s educational record and is thus protected by FERPA. If you have any questions or concerns about FERPA-related issues before posting a video, please contact the Office of the Registrar.
If you hold office hours via videoconference and discuss any part of a student’s educational record, you must only discuss that information when the student is the only participant in the conference with you. You should also ensure that no other student or other person can enter any videoconference where you are sharing information from a student’s educational record without that student’s explicit written consent.
You may not disclose non-directory, personally identifiable information about students or permit inspection of their records without written permission from the student UNLESS disclosure is permitted by one of the exceptions permitted by FERPA. If you don’t have written permission from the student, you should reach out to the Office of the Registrar or the Office of General Counsel.
Information that is defined as “directory information” may be released even without student consent UNLESS the student has directed the University to withhold that information by placing a Directory Hold. If the student has a Directory Hold in place, a “confidential” flag will appear next to the student’s name on the class roster. If a Directory Hold is in place, no information may be released about that student, including verification of whether the student is enrolled at OU, so we recommend a response such as “I have no information on that person.”
When in doubt, do not release student information – consult your department head, college administrators, the Registrar’s Office, or the Office of General Counsel.
At the postsecondary level, parents and guardians have no inherent rights to access their student’s educational records. As such, you may not release information such as a student’s enrollment in a course, class attendance, or progress/grades without confirming with the Office of the Registrar that an appropriate FERPA release is on file with the University. If a student has provided written consent that is on file with the Office of the Registrar, you may release information to the parents or guardians only after authenticating their identity, such as with photo ID. Even if no specific information can be released about a student, faculty and staff may be able to assist parents by providing general information that does not violate FERPA, such as course requirements, a copy of the course syllabus, or other similar information.
All requests for records of deceased students should be forwarded to the Office of the Registrar for processing. The Office of the Registrar will require a written request along with a copy of the requestor’s ID and a certified death certificate of the former student or alumnus before releasing the record.
Direct the subpoena to the Office of Legal Counsel immediately. Failure to respond to subpoenas in a timely manner could result in sanctions or penalties against the University.
Reach out to the Office of the Registrar or the Office of Legal Counsel immediately. If non-directory information is required to resolve a crisis or emergency, the University may release information that is necessary to protect the health or safety of the student or other individuals, but only to persons whose involvement is necessary to deal with the crisis or emergency. The Office of the Registrar or Office of Legal Counsel will make the determination as to whether the release is necessary and to whom the information should be released.
The moment you realize you have released information protected by FERPA without obtaining proper approval, you should notify your supervisor. Your supervisor will contact the Certification and Compliance Specialist in the Office of the Registrar or the Office of Legal Counsel.
Under federal law, FERPA violations may result in the loss of federal funding for the university. Any breach of confidentiality could lead to disciplinary action, including the possibility of termination of employment, depending on the severity of the breach.
If you are uncertain how to respond to a situation, please ask your department head for assistance. General questions may be directed to the Office of the Registrar or the Office of Legal Counsel.
