FERPA Frequently Asked Questions


Communicating with Students


How do I communicate with online students while staying within FERPA guidelines?

If e-mail is the primary vehicle for communicating with online students, there are a few things that you need to remember:

Back to Top

How do I identify a student over the phone?

Do not use non-directory information to initially identify a student and subsequently use directory information to confirm that student's identity. For example, if the alleged student provides his/her social security number over the phone and you call him/her by his/her name, then you have just confirmed that social security number matches that name. However, you can use directory information to identify a student and non-directory information to confirm the student's identity. For instance, ask a student to give you his/her first and last name and, if it is a common name like John Smith, use the middle initial to help narrow the list of students. The date of birth can also be used to further narrow the possibilities. If you are still uncertain, verify the student's identity by asking him/her information from his/her educational record that only he/she would only know, such as in which semester he/she withdrew from the University.

Back to Top

Security/Retention of Records


Does FERPA protect comments stored on blackboard?

Comments stored on Blackboard by instructors are considered sole possession notes. However, if a teaching assistant is assigned to the course then the comments are considered educational records and are protected under FERPA. Remember, if you do not want others to see it, do not write it down.

Back to Top

What are some guidelines for working at home without infringing on FERPA?

If papers with non-directory information are taken from the office they must be returned to the office the very next day so they can be properly stored or destroyed. If electronic files containing non-directory information are saved on a flash drive to be accessed from outside the office, it is imperative that they be password-protected, in case the drive is lost or stolen.

Back to Top

Sharing Information with Third Parties


How can I write a letter of recommendation without violating FERPA?

If personally identifiable information obtained from a student's educational record is included in the letter of recommendation (e.g. grades, GPA, etc.), the writer is required to obtain a signed release from the student specifying: (1) that the records used may be disclosed, (2) stating the purpose of the disclosure, and (3) identifying the party or class of parties to whom the disclosure can be made. However, statements made by a person based on that individual’s personal observation or knowledge do not require a written release from the student.

Back to Top

Should department employees obtain a letter of consent from students who list the respective employee(s) as a resumé reference?

Yes. Students wishing to list a department employee as a resumé reference should provide the department employee with a letter of consent specifying: (1) which records may be disclosed, (2) what the purpose of the disclosure is, and (3) to whom the disclosure may be made. The department employee should posses the letter of consent prior to serving as a reference. The letter of consent should name all the companies to which the department employee may disclose the student's specified educational records. Alternatively, the letter of consent may state that such information may be released to any potential employers.

Back to Top

May information from a student's education record be disclosed to protect health or safety?

Yes. FERPA permits the disclosure of information from student educational records "to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals." For example, if a student sends an e-mail to his resident assistant disclosing that he has just been diagnosed with a highly contagious disease such as measles, the institution could alert the student's roommate, and perhaps others with whom the student has come in close contact, to urge them to seek appropriate testing and medical care. Safety concerns warranting disclosure could include a student's suicidal statements or ideations, unusually erratic and angry behaviors, or similar conduct that others would reasonably see as posing a risk of serious harm to the student and to others.

This exception does not authorize "broadcast" disclosures, but a limited disclosure to a limited number of people, made in good-faith, in light of the facts available at the time, and is highly unlikely to be deemed a violation of FERPA even if the perceived emergency later turns out not to have been one. In general and when reasonably possible, the initial disclosure should be made to professionals trained to evaluate and handle such emergencies, such as campus mental health or law enforcement personnel, who can then determine whether further and broader disclosures are appropriate.

Back to Top