FERPA and Compliance

Introduction

The Family Educational Rights and Privacy Act (FERPA) is a Federal law that provides college students the right to inspect and contest their education records. FERPA requires schools to protect the privacy of student education records. Generally, schools must have written permission from the student in order to release any information from a student's education record, including release to parents in some cases. Even school officials must have a legitimate educational interest before student education records can be accessed without express written consent. Schools may disclose "directory" information but students may request that such information about them is not disclosed. Schools that fail to comply with FERPA can become ineligible for federal student aid.

Video

Technology

FERPA does not specify any technological requirements. However, industry standards for information security provide guidance on the protection of the privacy of student information. Those in possession of or with access to student information are responsible for its protection whether it is in written, electronic, or verbal form. No tool can ensure compliance with FERPA by itself. Privacy is maintained through a combination of tools and processes such as the use of locked cabinets, closed door conversations, encrypted transmission and storage of files, password protection of computers and devices when not in use, limiting computer screen visibility, and secure disposal.

Requests for a risk assessment or guidance on privacy best practices should be referred to the campus information security office - Urbana-Champaign, Chicago, Springfield..

Handling Student Information

Student information of any type should be handled with care, whether subject to FERPA or not. Some student records contain highly sensitive personal information subject to other privacy laws - Health Insurance Portability and Accountability Act and Personal Information Protection Act. Directory information, even acknowledgement that someone is a student, may not be released for students who request suppression of directory information. Suppressed directory information may only be used to complete official University duties directly related to the student’s educational needs. University policy prohibits the release of lists of information, including directory information, except for a legitimate educational purpose. For further information, see the Student Records Policy - Urbana-Champaign, Chicago, Springfield.

Requests for non-directory information from outside of your college or department or other questions about FERPA should be referred to the campus registrar - Urbana-Champaign, Chicago, Springfield.