The Essence
- Federal law designed to protect the privacy of education records. It also provides guidelines for appropriately using and releasing student education records.
- It is intended that students' rights be broadly defined and applied. Therefore, consider the student as the "owner" of his or her education record, and the institution as the "custodian" of that record.
Key Terms/Definitions
EDUCATION RECORDS: Include any record maintained by the institution that is related to the student (in whatever format or medium) with some narrowly defined exceptions:
- Records in the "sole possession of the maker" (e.g., private advising notes).
- Law enforcement records created by a law enforcement agency for that purpose.
- Employment records (unless the employment is based on student status). The employment records of student employees (e.g., work-study, wages, graduate teaching associates) are part of their education records.
- Medical/psychological treatment records (e.g., from a health or counseling center).
- Alumni records (i.e., those created after the student was enrolled).
DIRECTORY INFORMATION: SUNY Fredonia may disclose such personally identifiable information on the student's educational record as has been designated to be directory information unless the student directs otherwise in writing. Directory information is “public” information which may be released without the student's consent to persons making inquiries. Personally identifiable information designated as directory information includes: student’s name; local address and local telephone number; college assigned email address, student’s home address and home telephone number; parent’s name, address, and telephone number; class schedule; date and place of birth; major field of study; class standing; participation in officially recognized sports and activities; weight and height (athletes); electronic images (photographs); dates of attendance at college; degrees and awards received; and the most recent previous educational institution attended.
Directory information cannot include: race, gender, SSN (or part of an SSNN), grades, GPA, country of citizenship, or religion. Except in very specific circumstances, a student ID number (SIN) also cannot be considered directory information.
The students have the right to refuse the designation of all of the categories of personally identifiable information as directory information. If the students exercise this right with respect to all of the categories of directory information, such information will not be released without their consent except as provided by law and college policy. If the students choose to exercise their rights respecting directory information, they should fill out the form Request for Directory & Information Release/Non-Release and send it to the Office of Student Affairs, Eighth Floor, Maytum Hall, State University of New York at Fredonia, Fredonia, New York 14063.
PARENT: With reference to FERPA, the term "parent" refers to either parent if the student is financially dependent (IRS definition).
When do FERPA rights begin?
FERPA rights begin for a student once they turn 18 or enroll in a postsecondary institution – whichever comes first – regardless of age.
Basic Rights of Students
- The right to be notified of their FERPA rights at least once annually.
- The right to inspect and review their education records.
- The right to request an amendment to incorrect or misleading records.
- The right to provide consent before the disclosure of personally identifiable information, except where FERPA permits disclosure without consent.
Annual Notification
Every institution must notify students of their basic FERPA rights at least annually.
Inspection and Review
Students have the right to inspect and review their education records. However, they are not entitled to access:
- Information about other students
- Financial records of their parents/guardians
- Confidential letters of recommendation, if they have waived their right of access them. (Note: Students cannot be required to waive this right.)
FERPA does not dictate which records must be created or how long they must be retained. However, once a student has requested to inspect and review their records, those records cannot be destroyed. It is essential to be familiar with and follow your institution’s records retention policy.
Right to Consent to Disclosure
Students have the right to control to whom his or her education record is released. There are several exceptions to when that permission is not required. In order to release his or her education record, a student must fill the Form FERPA Information Disclosure Consent.
When is Prior Consent Not Required?
FERPA allows—though does not require—institutions to release education records without the student's prior written consent under certain conditions. Some common exceptions include:
- School officials with a legitimate educational interest (“need to know”) — e.g., employees or legal agents accessing records to perform their official, educationally related duties.
- Another institution where the student is enrolled or intends to enroll.
- Authorized representatives of the U.S. Department of Education, state, or local education authorities.
- Financial aid purposes to determine eligibility, amount, conditions, or enforcement.
- State or local officials in compliance with specific state laws.
- Organizations conducting studies to improve instruction or for accreditation purposes.
- Parents of dependent students, as defined by the IRS.
- Compliance with a judicial order or lawfully issued subpoena.
- Health and safety emergencies, when necessary to protect the health or safety of the student or others.
- Directory Information provided the student has not submitted a request to restrict its release.
- Disciplinary information, in specific cases:
- To the alleged victim of a crime of violence, including information from disciplinary proceedings.
- If a student is found in violation of institutional policies regarding a crime of violence, limited information may be released—such as the name, violation, and sanction (this is considered public information).
- To parents of students under 21, if the student has violated laws or institutional policies relating to the use or possession of alcohol or controlled substances (unless state law prohibits disclosure).
Additional Notes:
FERPA rights end at death, unless otherwise specified by state law.
Students have the right to file a complaint with the U.S. Department of Education if they believe their FERPA rights have been violated.
Key Take Aways
- DO NOT post grades or return graded work in ways link students’ names or other personally identifiable information (e.g., leaving graded assignments in a public area).
- DO NOT re-disclose confidential information without authorization. This includes sharing information with colleagues who do not have a legitimate educational interest or who have not been authorized by the student.
- DO NOT disclose records to parents, employers, or other students without the student’s written consent.
- DO NOT include personally identifiable information about Student A in Student B’s record without Student A’s permission.
- DO NOT provide protected information over the phone or via email unless you are certain you are communicating with the student or an authorized SUNY Fredonia official.
DO encourage students to submit written requests when asking for letters of recommendation that include specific references to their academic performance or other education records.
Frequently Ask Questions and Answers
Can I email grades to students?
Yes, but only to the student’s Fredonia email address (STUDENTSNAME @fredonia.edu).
Since we cannot be sure the person sending the email is who he or she claims to be, grades may not be sent to general email accounts. However, faculty may send grades to the official email account the College created for the student.
Do I need to consider FERPA regulations when I return assignments and exams?
Yes! Leaving graded student papers (homework, exams, assignments) unattended for students to go through to find their property is a FERPA violation. If papers cannot be returned personally and individually during class, an alternative would be to leave the graded papers with a university employee who can ask students for proper identification prior to returning them.
Under FERPA guidelines, what student records do I have access to?
Faculty have access to only those education records in which they have legitimate educational interests. The rule of thumb is that a faculty member should only access student education records that are needed to perform his or her job as an official of the university. Any other access to student records is a violation of FERPA.
What student information may I release?
Faculty have the responsibility to protect the student records in their possession (attendance in a class, grades). Faculty MAY NOT disclose personally identifiable information about a student without written permission from the student.
Students at Fredonia give written consent for their educational records to be released by signing this form: Information Disclosure Consent. Note that the individual requesting the information must have the student generated password in order to receive any information about the student’s educational records.
Am I required to verify the identity of the student or others to whom I disclose education records?
Yes. FERPA requires that institutions use reasonable methods to verify the identity of those to whom information from education records is disclosed. The knowledge of “widely available” information to verify identities, such as name, date of birth, social security number, or student ID number, is not considered reasonable or sufficient. Identity verification must include at least one element that is either known or possessed only by that person, for example, a parent’s photo ID or knowledge of the student generated password would be needed to verify the identity of the person that you are sharing protected information with.
What are the limits in working with parents?
At the elementary and secondary school level, FERPA gives parents the right to access education records. When a student reaches 18 years of age OR is attending an institution of post-secondary education at any age, FERPA rights transfer from parent to student. Therefore, once a college student, parents have no rights to access their student’s records. Information such as a student's enrollment in a course, class attendance, or progress/grades in a course is personally identifiable information that constitutes part of the student's education record and is protected under FERPA. Parents may not have access to this information unless the student has provided written authorization. If a student has filed a consent form to give parents access to student records, this form would be on file with Student Affairs. With this form on file, faculty members may release information to parents, provided the identity of the parents has been authenticated or use of the student generated password.
Even if a student has not signed a release to share information protected by FERPA, faculty may be able to assist parents by providing general information that does not violate FERPA. For example, course requirements, a copy of the course syllabus, and other similar information might be helpful.
How should I handle letters of recommendation?
As a faculty member, you may be asked to write a letter of recommendation on behalf of a student. If the letter includes information that falls within FERPA’s definition of education records, such as grade point average or other non-directory indicators, the student’s written consent to disclose this information would be necessary. Unless the student has waived the right of access to the letter, he or she would have the right to read it, because it is part of the student’s educational record.
Education records.
(a)The term means those records that are:
(1) Directly related to a student; and
(2) Maintained by an educational agency or institution or by a party acting for the agency or institution.
(b) The term does not include:
(1) Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except as a temporary substitute for the maker of the record.
(2) Records of the law enforcement unit of an educational agency or institution, subject to the provisions of §99.8.
(3)(i) Records relating to an individual who is employed by an educational agency or institution, that:
(A) Are made and maintained in the normal course of business;
(B) Relate exclusively to the individual in that individual's capacity as an employee; and
(C) Are not available for use for any other purpose.
(ii) Records relating to an individual in attendance at the agency or institution who is employed as a result of his or her status as a student are education records and not excepted under paragraph (b)(3)(i) of this definition.
(4) Records on a student who is 18 years of age or older, or is attending an institution of postsecondary education, that are:
(i) Made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity;
(ii) Made, maintained, or used only in connection with treatment of the student; and
(iii) Disclosed only to individuals providing the treatment. For the purpose of this definition, “treatment” does not include remedial educational activities or activities that are part of the program of instruction at the agency or institution; and
(5) Records created or received by an educational agency or institution after an individual is no longer a student in attendance and that are not directly related to the individual's attendance.
The written release from the student should:
(1) specify the records that may be disclosed;
(2) state the purpose of the disclosure; and
(3) identify the party or class of parties to whom disclosure may be made (FERPA § 99.30).
Statements in a recommendation that are based on the faculty member’s personal observations about a student do not require a written release from the student.
How do I know if a student has restricted access to his/her directory information?
If a student has requested a confidentiality flag for their directory information, this will be stored in YourConnection. YourConnection users will notice the word "Confidential" on any page requiring the student's ID to access information. Faculty and staff accessing student information via YourConnection will see a note of Confidential in class lists and other pages containing student academic data.
What happens during crisis situations and emergencies?
If non-directory information is needed to resolve a crisis or emergency situation, an educational institution may release that information if the institution determines that the information is necessary to protect the health or safety of the student or other individuals. Factors considered in making this assessment are: the severity of the threat to the health or safety of those involved; the need for the information; the time required to deal with the emergency; and the ability of the parties to whom the information is to be given to deal with the emergency. If information is released in this type of situation, a record must be placed in the student’s file describing the articulable and significant threat that formed the basis for the disclosure (the circumstances of the emergency).
If a student and family members have an appointment with faculty or staff to review the student's academic progress, is a signed consent form still necessary?
Yes. By signing the consent form, students give the university authority to share information contained in the student's educational record to their parent or guardian. FERPA does not allow for information to be released on the assumption that if the student is in the room they have given their consent.
Questions or concerns?
If you encounter a situation where you are uncertain about how to respond to a request for protected student information, please ask your department head for assistance. General questions may be directed to the Office of the Registrar.
Key Take Aways
- DO NOT give out directory information about a student who has requested confidentiality.
- DO encourage students to make FERPA release form giving consent for letters of recommendation.