In 1974, Congress enacted the Family Educational Rights and Privacy Act (also referred to as the Buckley Amendment or FERPA) to guarantee matriculated students at postsecondary institutions certain rights with respect to their educational records.

A FERPA-related college education record begins for a student when he or she enrolls in a higher education institution. At a postsecondary institution, rights belong to the student in attendance, regardless of the student's age.

Basic Rights of Students Under the Act

• To be notified of their FERPA rights at least annually.
• To inspect and review their records.
• To amend an incorrect record.
• To consent to disclosure (with exceptions). 

Inspection and Review

Students have the right to see everything in their "education record," except:

• Information about other students.
• Financial records of parents.
• Confidential letters of recommendation if they waived their right of access.

FERPA does not prescribe what records are created or how long they are to be kept; however, you cannot destroy a record if there is a request to inspect and review. It is important to know and understand the institution's records retention policy.

This federal law also provides guidelines for appropriately using and releasing student education records. It is intended that students' rights be broadly defined and applied. Therefore, consider the student as the "owner" of the information in his or her education record, and the institution as the "custodian" of that record.

What is a Student Educational Record?

Educational records include any record maintained by the institution that contains information that is personally identifiable to a student (in whatever format or medium) with some narrowly defined exceptions:

• Records in the "sole possession of the maker" (e.g., private advising notes).
• Law enforcement records created and maintained by a law enforcement agency for a law enforcement purpose.
• Employment records (unless the employment is based on student status). The employment records of student employees (e.g., work-study, wages, graduate teaching associates) are part of their education records.
• Medical/psychological treatment records (e.g., from a health or counseling center).
• Alumni records (i.e., those created after the student graduated or left the institution).

Education records come in a variety of formats. A student record may be:

• A document in the Registrar's Office.
• A computer printout in your office.
• A class list on your desktop.
• A computer display screen.
• Notes taken during an advisement session.

Proper Custody of Confidential Records Includes

• Not leaving records on desks or tables where others can see them.
• Securing computer screens so that people who come to your work area cannot see student information.
• Not placing copiers, fax machines, or printers in non-secure locations.
• Disposing of papers that contain private information in a secure way (e.g., shredding).
• Not sharing your personal passwords or system passwords.
• Not distributing grades, transcripts, or degree audits for purposes of advisement in plan view or open mailboxes located in public areas.

What is Directory Information?

There is some information about students that is not generally considered harmful or an invasion of privacy if disclosed. FERPA defines this information as directory information and gives institutions discretion over the release of these items.

Each institution establishes what it considers to be directory information. Common examples include: name, address (local, home, and e-mail), telephone (local and home), academic program of study, and date of birth. Directory information cannot include: race, gender, SSN (or part of an SSN), grades, GPA, country of citizenship, or religion.

Every student must be given the opportunity to have directory information suppressed from public release. When a student suppresses their information, everyone within the institution must abide by a student's request that no information be released about the student.

It is important to understand that a "no release" does not mean that a school official within the institution who has demonstrated legitimate educational interest (e.g., a faculty member teaching the student in a class) is precluded from using the information to perform that official's job duties.

School Officials and Legitimate Educational Interest

A school official with a legitimate educational interest may be granted access to confidential student information if the official needs the information to fulfill his/her professional responsibility. This includes:

• Performing appropriate tasks that are specified in his/her position description or by a contract agreement.
• Performing a task related to a student's education.
• Performing a task related to the discipline of a student.
• Providing services for the student or the student's family, such as health care, counseling, job placement, or financial aid.

Legitimate educational interest does not convey inherent rights to any and all student information. The law discriminates between educational interest and personal or private interest; determinations are made on a case-by-case basis. Furthermore, educational interest does not constitute authority to disclose information to a third party without the student's written permission.

School officials have access to student information only for legitimate use in the completion of their responsibilities as university employees. Need to know is the basic principle - not curiosity.

All University of Northern Iowa employees with access to student-related data must understand the need for maintaining the confidentiality of student records under federal law and University policy. School officials have a legal and ethical responsibility to safeguard confidential student information in their possession.

When is Prior Consent Not Required?

The institution may disclose records without consent if certain requirements are met, but it is not required to do so. Some examples of the exceptions to the release requirement include:

• Disclosure to another institution where the student seeks to enroll or is enrolled.
• Disclosure to the Department of Education or state and/or local educational authorities.
• Disclosure in connection with the receipt of financial aid.
• Disclosure to state/local officials in conjunction with legislative requirements.
• "School officials" with a "legitimate educational interest." Employees and legal agents have access to education records in order to perform their official, educationally-related duties.
• Disclosure to organizations conducting studies to improve instruction, or to accrediting organizations.
• Disclosure to parents of dependent students (IRS definition). 
• To comply with a judicial order or lawfully issued subpoena.
• Disclosure for a health/safety emergency (must document what the emergency was to to whom the information was released).
• Disclosure of directory information, provided the student has not requested "no release."

Posting of Grades/Distribution of Graded Materials

The public posting of grades by the student's name, social security number, or any other identifier that allows a student to be known is a violation of FERPA. This includes the posting of grades to a class website. As access to electronic communications increases, it may be tempting to send grades by e-mail. However, there is no guarantee of confidentiality when using e-mail.

Leaving personally identifiable graded papers, exams, or lab books open and unattended for students to pick up is also a violation of FERPA.

Letters of Recommendation

Statements made by a person making a recommendation that are made from the person's personal observation or knowledge do not require written release from the student. However, if personally identifiable information obtained from a student's educational record and included in the letter of recommendation (e.g., grades, GPA, etc.), the writer is required to obtain a signed release from the student which:

• Specifies the records that may be disclosed.
• States the purpose of the disclosure.
• Identifies the party or class of parties to whom the disclosure can be made.

If the person writing the recommendation keeps the letter on file, it is part of the student's education record, and the student has the right to read it unless he or she has waived the right to access.

Final Thoughts

To protect the University and yourself, the release and review of materials from educational records are best handled by designated offices within the University.

Do not share confidential information from a student's educational record, such as grades or grade point averages, with other faculty or staff members of the University unless it is your responsibility to do so. Those outside your line of responsibility who need confidential student information should obtain the information from the official source (e.g., the Office of the Registrar).

Do not share confidential information from student educational records, such as grades, grade point averages, and letters of recommendation, with parents or others outside of the institution without written permission from the student.