FERPA Definitions


FERPA Defined:

FERPA stands for the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) and is a federal law that protects the privacy of students' educational records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Students have specific, protected rights regarding the release of such records, and FERPA requires that institutions strictly adhere to these guidelines.

FERPA guidelines protect students by guarding against the release of their records without their consent. Each semester, The Florida State University publishes information for students and the public regarding their rights and the protection of their educational records under the Family Educational Rights and Privacy Act of 1974, as amended.

Protected Parties under FERPA:

FERPA protects currently or formerly enrolled students, regardless of their age or parental-dependency status. However, FERPA does not protect deceased students or students who have applied to Florida State University but have not attended any classes.

Student Rights under FERPA:

FERPA grants four specific rights to students who are eighteen or older, or who are currently attending a postsecondary institution. Those rights are:

Educational Record:

An Educational Record is any record maintained by an institution that can personally identify a student or group of students. Since FERPA is technology independent, these records can consist of any number of media, including but not limited to hand-written, print, email, files, documents, tapes, disks, film, microfilm, and microfiche. Additionally, virtually any information provided by a student to the university to be used in the educational process is considered a student educational record, and can include:

Moreover, student educational records may appear as:

You may NOT destroy records under investigation. For policies related to the retention of educational records, ask the supervisor of your area or academic department.

Sole Possession Note:

Sole possession notes are personal observation- or recollection-notes made and kept by individuals. Sharing these notes with other people or placing these notes in a public-view area makes them educational records subject to FERPA. As a rule of thumb, if you don't want it to become an educational record, don't write it down.

Legitimate Educational Interest:

In accordance with FERPA, a school official has a legitimate educational interest if the official needs to review an educational record in order to fulfill his/her professional responsibility. A school official, or internal authority, is defined as a person employed by the University in an administrative, supervisory, academic, research, or support staff position. Further, these officials act in the student's educational interest on a legitimate "need-to-know" basis.

If a school official requires information located in a student's educational record to fulfill University-related responsibilities, that official has legitimate educational interest. This includes such purposes as:


Frequently Asked Questions (FAQ)


May a Third Party Access a Student's Educational Records?

When a student reaches the age of 18 or begins attending a postsecondary institution, regardless of age, FERPA rights transfer from the parent to the student. To receive non-directory information, parents or any other interested party must be named by the student as a delegate through the delegated-access process. Should a parent or other third party contact you regarding a student, you must check for this authorization prior to releasing that information. If the parent or other individual has not been named as a delegate, you must not discuss the student with that person and advise the individual that the student must name him or her as a delegate before you are allowed release information.


How Do I Confirm that a Caller Has Delegated Access?

If you have the correct role in Campus Solutions, you can view the student's delegates. For detailed information on viewing a student's delegates, go to: http://www.sc.my.fsu.edu/Staff/How-To/View-a-Student-s-Delegate-s


Directory Information:

At Florida State University, only select information is identified as "Directory Information." Directory Information can be made available to the general public, unless the student notifies the Office of Admissions and Records in writing. Written exception must be received prior to the first class day of the academic year. All other non-directory information is not public information and is protected under FERPA, which supersedes Florida's Sunshine State open records laws.

Anything not on the list below could be a protected educational record, and as such should not be released to a third party without the student's consent. Directory information includes the following 14 items:

  1. Name
  2. Date and place of birth
  3. Local address
  4. Permanent address
  5. Telephone number (if listed)
  6. Classification
  7. Major
  8. Participation in official University activities and sports
  9. Weight and height of athletic team members
  10. Dates of attendance
  11. Degrees, honors and awards received
  12. Most recently attended educational institution
  13. Digitized FSUCard photo
  14. EMPLID


How Do I Correctly Confirm a Student's Identity Over the Phone?

Do not use non-directory information to initially identify a student and subsequently use directory information to confirm that student's identity. For example, if the caller provides a social security number over the phone and you call him/her by his/her name, then you have confirmed that social security number matches that name.

However, you can use directory information to identify a student and non-directory information to confirm the student's identity. For instance, ask a student to give you his/her first and last name and, if it is a common name like John Smith, use the middle initial to help narrow the list of students. The date of birth can also be used to further narrow the possibilities. If you are still uncertain, verify the student's identity by asking him/her information from his/her educational record that only he/she would only know, such as in which semester he/she withdrew from the University.

External authorities who may view educational records include:

What DOES NOT Qualify as a Legitimate Educational Interests?

Legitimate educational interest does not convey inherent rights to any and all student information. The law discriminates between educational interest, and personal or private interest; determinations are made on a case-by-case basis. Educational interest does not constitute authority to disclose information to a third party without the student's written permission.

What Do I Do If I Receive a Subpoena or Request from a Lawyer or Officer of the Court?

If you receive a subpoena, or are contacted by an attorney or a court official, contact The Office of the General Counsel at 644-4440 prior to any response, reply, or appearance. The General Counsel's office will review the documents and provide you with support and direction when working through the legal process.

May I Disclose Information from a Student's Education Record to Protect Health or Safety?

Yes. FERPA permits the disclosure of information from student educational records "to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals." For example, if a student sends an e-mail to his resident assistant disclosing that he has just been diagnosed with a highly contagious disease such as measles, the institution could alert the student's roommate, and perhaps others with whom the student has come in close contact, to urge them to seek appropriate testing and medical care. Safety concerns warranting disclosure could include a student's suicidal statements or ideations, unusually erratic and angry behaviors, or similar conduct that others would reasonably see as posing a risk of serious harm to the student and to others.

This exception does not authorize "broadcast" disclosures, but a limited disclosure to a limited number of people, made in good-faith, in light of the facts available at the time. Such disclosure is highly unlikely to be deemed a violation of FERPA, even if the perceived emergency later turns out not to have been one. In general and when reasonably possible, the initial disclosure should be made to professionals trained to evaluate and handle such emergencies, such as campus mental health or law enforcement personnel, who can then determine whether further and broader disclosures are appropriate.

What Do I Do If I'm Contacted by the Media?

Nothing in FERPA allows an institution to discuss a student's educational record publicly - even if a lawsuit has made the information a matter of public record. A school official may not assume that a student's public discussion of a matter constitutes implied consent for the school official to disclose anything other than directory information in reply. Additionally, university employees should follow university policy regarding the release of information to the media.

Does FERPA protect comments stored on Blackboard?

Comments stored on Blackboard by instructors are considered sole possession notes. However, if a teaching assistant is assigned to the course then the comments are considered educational records and are protected under FERPA. Remember, if you do not want others to see it, do not write it down.

What Are the Guidelines for Posting Grades?

The public posting of grades either by the student's name or full social security number without the student's written permission is a FERPA violation. This includes the posting grades to an unsecure class website and applies to any public posting of grades for students taking distance education courses.

Instructors and others who post grades should use a system that ensures that FERPA requirements are met. It is highly recommended that you use Blackboard grade book to post grades. Additional means may include the use of code words or randomly assigned numbers that only the instructor and individual student know.

Emailing final grades is a violation of University policy. There is minimal guarantee of confidentiality with e-mail. The institution would be held responsible if an unauthorized third party gained access, in any manner, to a student's educational record through any electronic transmission method.

What Are the Guidelines for Communicating with Students through E-mail?

If e-mail is the primary vehicle for communicating with online students, remember that:

What Are the Guidelines for Writing Letters of Recommendation?

Statements made by a person making a recommendation that are made from that person's personal observation or knowledge do not require a written release from the student. However, if personally identifiable information obtained from a student's educational record is included in the letter of recommendation (grades, GPA, etc.), the writer - whether a faculty member or department employee - is required to obtain a signed release from the student which (1) specifies the records that may be disclosed, (2) states the purpose of the disclosure, and (3) identifies the party or class of parties to whom the disclosure can be made. If this letter of recommendation is kept on file by the person writing it, it would be part of the student's educational record, and the student has the right to read it unless he or she has waived that right to access.

Sample student release -

I give permission to Prof. Smith to write a letter of recommendation to:

Allstate Insurance

324 Wilkins Drive

Atlanta, GA 33011

Prof Smith has my permission to include my GPA and grades.

I waive (or do not waive) my right to review a copy of this letter at any time in the future.


Can I Take Non-Directory Information out of the Office?

If papers with non-directory information are taken from the office - for example, if you're working from home - they must be returned the next day to be properly stored or destroyed. If electronic files containing non-directory information are saved on a flash drive to be accessed from outside the office, it is imperative that they be encrypted or password-protected, in case the drive is lost or stolen.

How Can I Ensure I Remain in Compliance with FERPA?


What Are the Penalties for Violating FERPA Regulations?

The Federal Family Policy Compliance Office reviews and investigates complaints of violations of FERPA. If the Secretary of Education finds that an institution has failed to comply with FERPA and determines that compliance cannot be secured by any means, he/she can, among other options, direct that no federal funds under his or her administrative control (financial aid, education grants, etc.) be made available to that institution.


Back to Top