Some Commonly Asked QUESTIONS about FERPA

... and answers.

Source: “Answer Book for Higher Education Professionals” Supplement 20 and Higher Education FERPA Bulletin, Vol 9, Issue 1 (December 2006)

For complete text to any of the above or additional questions and issues, please contact the Records Office

(Many of these issues have exceptions but in general situations, these answers apply).
What are some things I should remember in my workplace to protect students’ personal information? 

  • If necessary to include, Social Security numbers must be sent in password-protected attachments only.
  • Shred all papers containing personal information that are no longer needed.
  • Personal information, if kept, must be kept in locked filing cabinets – not just locked rooms.
  • Never leave a computer unattended with personal information on the screen.
  • Set screen savers to default after maximum 15 minutes.

When do FERPA rights begin?

A student’s FERPA rights begin when the student has registered and the first class. NOTE: Students who originally sought admission to one program of study and are denied, but subsequently are admitted and enrolled in a different program of study, have FERPA rights ONLY in their admitted/enrolled program of study.

Since all employees at Union College have to be FERPA trained, do student workers also have to be trained? 

The same requirements and responsibilities for a full time school official exist for student workers. Student workers must be trained on FERPA just as if they were faculty or staff.

Do faculty have access to student records?

The faculty member has to demonstrate “a legitimate educational interest”

in their request to access student records, e.g. advising students. However, faculty do not have access to student academic records unless their normal job duties specifically require access. This is defined at Union College that faculty have access to all information about a student as long as the student is an advisee of the faculty member or is enrolled in one of the faculty members classes taught that specific semester.

Do the parents of college students have rights under FERPA?

No, parents lose their FERPA rights when their child turns 18, OR starts Attending college or any postsecondary institution.

Do the FERPA rights of students ever terminate or expire?

For the most part, no.

Does the spouse of a student have rights with respect to the student’s education records?


Can an institution require students to provide their Social Security number as a condition of enrollment?


What are education records?

Education records under all state laws include demographic/personal information about each name such as name, birth date, address and identification of parents. This also includes class assignments, record of attendance, grades, test scores, course schedules, narrative or anecdotal descriptions of incidents. This refers to all medium (microfilm, handwriting, etc.). The statute defines education records broadly, encompassing in effect whatever documents about students a college opts to maintain which are directly related to a student.

  • Admission records
  • Cumulative academic records
  • Health records
  • Financial aid records
  • Financial records
  • Placement records
  • Disciplinary records

What types of school records are specifically excluded from characterization as education records?

  • sole possession records
  • records maintained by law enforcement units of the college
  • treatment records maintained by a physician, psychiatrist or counseling services of the institution

    Are documents kept in a professor’s personnel file considered education records if they relate to a student?

    Yes, if they have been shared with anyone else, including the student. If they have NOT been shared with anyone they are “sole possession records” and are not subject to a student’s review.

    Does FERPA grant to students a right to review their education records?


    Does a student have the right to review ALL records containing personally identifiable information about him/her maintained by the college?

    No. The college is allowed to exclude two types of records, financial records of the student’s parents and confidential letters of recommendation.

    May a college deny a student who has an unpaid financial obligationto the college access to his/her education records?

    No, a student has the right to review his or her education records. FERPA, however permits colleges to refuse to honor requests to provide copies of records of the student.


    May a student and a professor informally agree that the studentwill not be shown or ask to see a copy of the letter of recommendation?

    A waiver is valid only if it is in writing signed by the student and must contain the following information:

    • Clear identification of the author and the recipient of the letter
    • Identification of the purpose for which the student has requested the recommendation
    • Acknowledgment by the student that the college did not compel him/her to sign the waiver.

    Do faculty always need a written release from the student for a Letters of Recommendation?

    Statements made by a person making a recommendation that are made from that person’s personal observations or knowledge do NOT require a written release from the student. However, if personally identifiable information obtained from astudent’s education record is included in a letter of recommendation (grades, GPA, etc.) the writer is required to obtain a signed release from the student.

    Must a copy of the letter of recommendation be kept?

    If a student gives permission in writing, FERPA does not require a copy be kept. 

    How will faculty know to whom students have given permission to discuss confidential information?

    Students give access in their Self-Service accounts to family members or anyone they select as long as that person is in the UC data base.

    • Go to Self-Service on teh UC web page (bottm left of the page)
    • Click on Academic Reports
    • Click on Profile
    • Click on FERPA Access
    • Type the last name of the student. If several names of students come up with the same last name, click on the one you are looking for.

    May a college require a student to execute a waiver of inspection?


    Does a student who graduated many years ago have the right to review his/her education records?


    May a college insist that an official of the institution be present when a student inspects his education records?


    If a student asks to have copies of education records made for him/her instead of being given an opportunity for review, must the college comply?


    Must a college redact education records that contain the names of OTHER students prior to student review?


    What is a “disclosure” for purposes of FERPA?

    “To permit access to or the release, transfer, or other communication of personally identifiable information contained in the education records to any party, by any means including oral, written, or electronic means” (without student’s consent).

    MUST a college disclose information to a third party?

    No, FERPA does not mandate disclosure. It may be required to disclose education records under other laws, however.

    Is the written consent of the student required in order to place his/her documented research or any academic work in the college library?


    Are all college employees entitled to review education records without student consent?

    No, only college officials who have a legitimate educational interest have a right to review without student consent. (This generally is interpreted as ‘in order for an employee to do his or her job).

    What does “dates of attendance” refer to?

    It refers to the academic year, semesters attended, and does not refer to daily records of a student’s attendance at the institution.

    Can a student’s employment information be released?

    No, student employment information is not identified as directory information. Student employment records are ‘education records’ and are subject to FERPA. However, the information can be released with a written release from the student stating what information can be released.

    Can class rosters and a student’s class schedule be included in “directory information”


    Can a student ask to see their admissions file?

    Students have NO FERPA rights until they are ENROLLED and ATTEND the institutions.

    Can a parent deny access to a spouse or former spouse?

    Yes (Sec.99.31(a)(8)

    The parent who claims the student may ask the institution not to disclose his or her financial information or the student’s education record to a spouse or former spouse.

    Is a college responsible for a third party’s failure to keep disclosed personally identifiable information confidential?


    Must a college record requests for disclosure that have not been granted?


    Must a college maintain a log of disclosures that do not require consent?


    Does PEER GRADING violate FERPA?

    No, not if peer grading takes place before the assignments have been collected and recorded by the professor because at that point they are NOT ‘maintained’ by the institution and are not within the definition of ‘education records’.


    Does FERPA require a college to adopt a policy limiting the access of college officials who are authorized to query or update a student information database?


    Are computer files created by students who use college-maintained computer hardware education records?

    Computer files created by college officials and maintained in the course of official business are, to the extent they contain information directly related to students, education records. But FERPA does not clearly answer whether files created by users, either students or college officials, for their own personal use should be considered to be education records triggering FERPA protection.

    Are e-mail messages sent by students with the use of a college-maintained e-mail server education records?

    Yes – if a college maintains student e-mail accounts, the contents are subject to FERPA.

    Notifying students via e-mail

    There is NO guarantee of confidentiality sending confidential information via e-mal. The institution would be held responsible if an unauthorized third party gained access, in any manner, to a student’s education record through any electronic transmission method.

    E-mail Restrictions

    NEVER put confidential information in the subject line, i.e. Early Alert-Jon Smith.

    Releasing non-directory information over the phone.

    FERPA does not preclude an institution from disclosing non-directory information from a student’s education record to that student by telephone. The institution is charged with implementing whatever procedures deemed necessary to verify the individual’s identity. Questions such as place of birth, major program, class level, recent courses taken etc. must be answered correctly before personally identifiable information is provided via telephone. EXCEPTION: Unless the information requested is needed to help resolve an emergency situation.

    Sharing e-mail addresses among students in the same class.

    Faculty who utilize electronic teaching tools such as Moodle or Blackboard may wish to share students’ e-mail addresses in a class with others in the same class. This is permissible as long as

    1. the institution has identified e-mail addresses as directory information,
    2. the students have had an opportunity to request that their e-mail addresses not be disclosed.

    Can a student’s written consent to disclosure be sent to the college via fax?

    Yes, a student can give his written consent to disclosure with a signed fax.

    Does FERPA really require a student’s “written” consent or are electronic alternatives permitted?

    E-mail transmission of student consent and use of PIN number systems are sifficiently reliableconsent a conservative approach is for colleges to retain their paper files of written consents.


    Under FERPA, may an eligible student’s treatment records be shared with parties other than treating professionals?

    An educational institution may choose to disclose a student’s treatment record to any party with a prior written consent, or under any of the disclosures permitted without consent if the disclosure is to a parent of a student at an institution of postsecondary education regarding the student’s violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance if:

    • the institution determines that the student has committed a disciplinary violation with respect to that use or possession;
    • and the student is under the age of 21 at the time of the disclosure to the parent.

    Under what conditions is prior consent not required to disclose information?

    This ONLY applies to disciplinary proceedings in which the final results or decisions were reached on or after October 7, 1998:

    • The student is an alleged perpetrator of a crime of violence or non-forcible sex offense;
    • With respect to the allegation made against him or her, the student has committed a violation of the institution’s rules or policies.

    Are disciplinary action records part of a student’s education records?

    An institution MAY include information about a student’s conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community.

    Can this information be disclosed to teachers or other school officials?

    FERPA has been amended to allow this type of disclosure to teachers and school officials who have a legitimate educational interest in the behavior of the student. Additionally, it was amended to allow disclosure to teachers or school officials in other schools, who have legitimate educational interests in the student.

    DRUG AND ALCOHOL VIOLATIONS Sec.99.31(a)(13) and (14)

    Can the institution disclose violations without the student’s consent?

    Yes. The institution may disclose to parents, without the student’s consent when students under 21 violate drug or alcohol regulations “without regard to whether the student is a dependent."

    What if the student is over 21?

    Colleges can now establish their own policy and procedures about when parents should be contacted.

    Should the student be notified if parents are contacted?

    Colleges are not required to alert students when parents have been notified, but are required to maintain a record of the disclosure to the parents and provide it to the student at their request.

    What applies in health and safety situations?

    The institution may disclose personally identifiable information to appropriate parties in connection with a health and safety situations IF knowledge of the information is necessary to protect the health or safety of the student or other individuals, including disciplinary action taken against the student for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community. (NOTE: disciplinary actions are normally not part of a student’s educational record but are part of law-enforcement records)