FERPA Frequently Asked Questions
May a Third Party Access a Student's Educational Records?
When a student reaches the age of 18 or begins attending a postsecondary institution, regardless of age, FERPA rights transfer from the parent to the student. To receive non-directory information, parents or any other interested party must be named by the student as a delegate through the delegated-access process. Should a parent or other third party contact you regarding a student, you must check for this authorization prior to releasing that information. If the parent or other individual has not been named as a delegate, you must not discuss the student with that person and advise the individual that the student must name him or her as a delegate before you are allowed release information.
Directory Information:
At Florida State University, only select information is identified as "Directory Information." Directory Information can be made available to the general public, unless the student notifies the Office of Admissions and Records in writing. Students can submit written exceptions at any time. It should be noted, however, that print publications that have gone to press prior to the Registrar's receipt of the written exception (such as the commencement program) will still list their name. All other non-directory information is not public information and is protected under FERPA, which supersedes Florida's Sunshine State open records laws.
Anything not on the list below could be a protected educational record, and as such should not be released to a third party without the student's consent. Directory information includes the following 13 items:
- Name
- Date and place of birth
- Local address
- Permanent address
- Official FSU e-mail address
- Classification
- Major
- Participation in official University activities and sports
- Weight and height of athletic team members
- Dates of attendance
- Degrees, honors and awards received
- Most recently attended educational institution
- Digitized FSUCard photo
- EMPLID
How Do I Report a Possible FERPA Violation?
Individuals who believe any of their non-directory information was released in violation of FERPA may submit written documentation describing the specific information that was released, and when and where the release occurred. Documentation must be submitted to the Office of the University Registrar along with the complainant's most current contact information.
How Do I Correctly Confirm a Student's Identity Over the Phone?
Do not use non-directory information to initially identify a student and subsequently use directory information to confirm that student's identity. For example, if the caller provides a social security number over the phone and you call him/her by his/her name, then you have confirmed that social security number matches that name.
However, you can use directory information to identify a student and non-directory information to confirm the student's identity. For instance, ask a student to give you his/her first and last name and, if it is a common name like John Smith, use the middle initial to help narrow the list of students. The date of birth can also be used to further narrow the possibilities. If you are still uncertain, verify the student's identity by asking him/her information from his/her educational record that only he/she would only know, such as in which semester he/she withdrew from the University.
External authorities who may view educational records include:
- U.S. Department of Education
- U.S. Department of Defense
- U.S. Attorney General
- Immigration and Naturalization Service
- Comptroller General of the U.S.
- State education authorities
- Organizations conducting studies for or on behalf of the University
- Accrediting organizations
What DOES NOT Qualify as a Legitimate Educational Interests?
Legitimate educational interest does not convey inherent rights to any and all student information. The law discriminates between educational interest, and personal or private interest; determinations are made on a case-by-case basis. Educational interest does not constitute authority to disclose information to a third party without the student's written permission.
What Do I Do If I Receive a Subpoena or Request from a Lawyer or Officer of the Court?
If you receive a subpoena, or are contacted by an attorney or a court official, contact The Office of the General Counsel at (850) 644-4440 prior to any response, reply, or appearance. The General Counsel's office will review the documents and provide you with support and direction when working through the legal process.
May I Disclose Information from a Student's Education Record to Protect Health or Safety?
Yes. FERPA permits the disclosure of information from student educational records "to appropriate parties in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals." For example, if a student sends an email to his resident assistant disclosing that he has just been diagnosed with a highly contagious disease such as measles, the institution could alert the student's roommate, and perhaps others with whom the student has come in close contact, to urge them to seek appropriate testing and medical care. Safety concerns warranting disclosure could include a student's suicidal statements or ideations, unusually erratic and angry behaviors, or similar conduct that others would reasonably see as posing a risk of serious harm to the student and to others.
This exception does not authorize "broadcast" disclosures, but a limited disclosure to a limited number of people, made in good-faith, in light of the facts available at the time. Such disclosure is highly unlikely to be deemed a violation of FERPA, even if the perceived emergency later turns out not to have been one. In general and when reasonably possible, the initial disclosure should be made to professionals trained to evaluate and handle such emergencies, such as campus mental health or law enforcement personnel, who can then determine whether further and broader disclosures are appropriate.
What Do I Do If I'm Contacted by the Media?
Nothing in FERPA allows an institution to discuss a student's educational record publicly - even if a lawsuit has made the information a matter of public record. A school official may not assume that a student's public discussion of a matter constitutes implied consent for the school official to disclose anything other than directory information in reply. Additionally, university employees should follow university policy regarding the release of information to the media.
Does FERPA protect comments stored on Canvas?
Comments stored on Canvas by instructors are considered sole possession notes. However, if a teaching assistant is assigned to the course then the comments are considered educational records and are protected under FERPA. Remember, if you do not want others to see it, do not write it down.
What Are the Guidelines for Posting Grades?
The public posting of grades either by the student's name or full social security number without the student's written permission is a FERPA violation. This includes the posting grades to an unsecure class website and applies to any public posting of grades for students taking distance education courses.
Instructors and others who post grades should use a system that ensures that FERPA requirements are met. It is highly recommended that you use Canvas grade book to post grades. Additional means may include the use of code words or randomly assigned numbers that only the instructor and individual student know.
Emailing final grades is a violation of University policy. There is minimal guarantee of confidentiality with email. The institution would be held responsible if an unauthorized third party gained access, in any manner, to a student's educational record through any electronic transmission method.
What Are the Guidelines for Communicating with Students through email?
If email is the primary vehicle for communicating with online students, remember that:
- E-mailing project and assignment grades is acceptable, but e-mailing final grades is a violation of University policy.
- A student's request for school officials to disclose sensitive information must come from the student's official email account, not from a personal account such as Gmail, Hotmail, or Yahoo.
What Are the Guidelines for Writing Letters of Recommendation?
Statements made by a person making a recommendation that are made from that person's personal observation or knowledge do not require a written release from the student. However, if personally identifiable information obtained from a student's educational record is included in the letter of recommendation (grades, GPA, etc.), the writer - whether a faculty member or department employee - is required to obtain a signed release from the student which (1) specifies the records that may be disclosed, (2) states the purpose of the disclosure, and (3) identifies the party or class of parties to whom the disclosure can be made. If this letter of recommendation is kept on file by the person writing it, it would be part of the student's educational record, and the student has the right to read it unless he or she has waived that right to access.
Sample student release -
I give permission to Prof. Smith to write a letter of recommendation to:
Allstate Insurance
324 Wilkins Drive
Atlanta, GA 33011
Prof Smith has my permission to include my GPA and grades.
I waive (or do not waive) my right to review a copy of this letter at any time in the future.
Signature/Date
Can I Take Non-Directory Information out of the Office?
If papers with non-directory information are taken from the office - for example, if you're working from home - they must be returned the next day to be properly stored or destroyed. If electronic files containing non-directory information are saved on a flash drive to be accessed from outside the office, it is imperative that they be encrypted or password-protected, in case the drive is lost or stolen.
How Can I Ensure I Remain in Compliance with FERPA?
DO NOT:
- at any time use the entire Social Security Number of a student in a public posting of grades
- ever link the name of a student with that student's social security number in any public manner
- leave graded tests in a stack for students to pick up by sorting through the papers of all students
- circulate a printed class list with student name and social security number or grades as an attendance roster
- discuss the progress of any student with anyone other than the student (including parents) without the consent of the student
- provide anyone with lists of students enrolled in your classes for any commercial purpose
What Are the Penalties for Violating FERPA Regulations?
The Federal Family Policy Compliance Office reviews and investigates complaints of violations of FERPA. If the Secretary of Education finds that an institution has failed to comply with FERPA and determines that compliance cannot be secured by any means, he/she can, among other options, direct that no federal funds under his or her administrative control (financial aid, education grants, etc.) be made available to that institution.