University Registrar > Privacy Policies > FERPA > FAQ for Faculty

FERPA FAQ for Faculty

January 21, 2008, v. 1.1, Office of the Registrar

What is FERPA and why a publication NOW?

The Family Educational Rights and Privacy Act of 1974, better known as FERPA or the Buckley Amendment, was established to guarantee the rights of student to control access to their educational records. The Family Policy Compliance Office (FPCO) was established to define the steps that need to be taken for an institution to be FERPA compliant.

In 2005 the American Association of Collegiate Registrar’s and Officers of Admission (AACROA) surveyed several thousand faculty members across the United States. Despite a pretty low response rate, the results published in the College and University Journal volume 82 first quarter 2006 showed a large number of faculty did not understand their role in FERPA implementation. This document is Lehigh’s effort to ensure that faculty understands their rights and responsibilities under FERPA. My hope is that every faculty member here is already aware of this issue and learns nothing from this document.

FERPA provides 4 basic rights to a student:

• To view the information (records) that the institution is maintaining about the student,
• To seek amendment of those records and, in certain cases append a statement to those record,
• To consent to disclosure of his/her records,
• To file a complaint with the FERPA office in Washington, D.C.

The recent research concluded that the third item, “consent to disclosure of records,” is the provision of FERPA most violated by faculty and administrators.  Faculty and administrators most commonly violate this right by sharing student information with third parties without the student’s authorization; posting of grades via social security number (considered identification, similar to a name); leaving graded student work in a public place, passing stacks of papers around a room for individuals to sort through (such that others are able to view confidential grades); using listservs to provide students with feedback, and discussing student grades or performance with colleagues possessing “no legitimate need to know”

To begin to understand FERPA we need to understand the applicable definitions and some basic information.

What is Directory information?

It is information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. Directory Information may be disclosed without the permission of the student. Lehigh’s policy defines directory information to include a student's name; home and University address; mailbox number; home and University phone numbers; date and place of birth; name of parent or guardian; name of spouse; major field of college student; class; participation in sports and in officially recognized activities listed by the student; weight and height of members of athletic teams; dates of attendance; degrees and awards received; and the most recently attended educational institution.

When do FERPA rights begin?

They begin for a student when he or she becomes 18 or enrolls in a higher education institution at any age.

When is prior consent not required to distribute educational records?

The University may release a student’s educational record without his or her consent, but is not required to do so. Some of the exceptions to the written release requirement include disclosing educational records:

• To “School officials” with a “legitimate educational interest” / “need to know;” Employees and legal agents may need to have access to educational records in order to perform their official, educationally-related duties;
• To organizations conducting studies to improve instruction, or to accrediting organizations;
• To parents of dependent students (IRS definition); Check to see how your institution expects parents to show that dependent status;
• To comply with a judicial order or lawfully issued subpoena;
• In response to a health/safety emergency; and
• To an individual/entity requesting only directory information

Some Specific Issues for Faculty and Instructional Staff

• POSTING GRADES:  Since grades can never be directory information, it is generally inappropriate to post grades in a public setting.  However, it is acceptable for an instructor to post grades in such a manner that only the instructor and the individual student know the posted grade (e.g. with a personal ID; provided that no portion of the personal ID is a SSN or institutional LIN Student ID Number).  We recommend that the posted list not be in the same order as the class roster or in alphabetical order.
• COURSE WEB SITES:  Many courses are supported by class Web sites and/or discussion groups.  Since only directory information can be made available to the general public and other class members, we recommended that such Web sites have a sufficient security so that only class members and instructors can access appropriate information.
• LETTERS OF RECOMMENDATION: A person who in providing a letter of recommendation makes statements from that person’s personal observation or knowledge do not require a written release from the student who is the subject of the recommendation.
  • However, if the recommendation includes personally identifiable information obtained from a students educational records (grades, GPA, etc.), the writer is required to obtain a signed release from the student that, (1) specifies the records to be disclosed, (2) states the purpose of the disclosure, and (3) identifies the party or class of parties to whom the disclosure can be made.
  • If the recommendation is kept on file by the person writing it, then it becomes part of the students’ educational record and the student has the right to read it (through the inspection process) unless he or she has waived that right of access. If the letter is used for any purpose other than this recommendation, or shared with a colleague the waiver is void.

Parent Access:

At the post secondary level, parents have no inherent right to inspect their son’s or daughter’s education records. The right to inspect is limited solely to the student. If a faculty member receives a request from a parent for access to non directory and FERPA protected records, that request should be referred to the Associate Dean of Students for Academic Support at ext. 84159 or to the Registrar’s Office at ext. 83191.

Special Note On Troubled Students:

FERPA does not preclude administrators, staff and faculty from sharing crucial information about troubled students. The current legal framework clearly authorizes collaboration among faculty/staff, mental health administrators and campus police officers.  Faculty who fear that one of their students is in distress should contact the Dean of Students office or the Counseling Services Office. The FERPA exception for this situation indicates that protected student information may be disclosed, “if a health or safety emergency exists and the information will help in resolving the emergency”.

Adviser Notes and Comments system:

The University provides a method for permanently storing adviser and faculty comments and advising notes. That system complies with FPCO standards and does not require any faculty action to protect, retain, or provide FERPA access to a student. It is called the Adviser Notes and Comment System and is available through the University Portal and Self Service for Faculty. Instructions for use of the system are available on the Registrar’s web site, or contact the Registrar.

Email Records:

Although there still remains some “gray” areas in electronic records policies there are some fundamentals that will protect advisers and Lehigh.

• Registration records must be retained for one full year after the end of a term. Any email communications pertaining to registration and drop/add advice should be kept for that time.
• Degree program Changes and Authorizations must be kept for five years after the last date of attendance or graduation. If these approvals are communicated via Email (rather than hardcopy forms) and relate to degree program changes, course substitution approvals, performance evaluations or other degree issues, they must be kept for the 5 year time period.

In response to my question about whether email exchanges are part of a student’s education record, the Department of Education had the following comment: 

“referring to email messages between faculty and/or other staff members that are identifiable to a student, then such a message is that student's education record.  In that situation, the student has the same right to inspect and review the email message as any other of the student's education records.

If you're referring to a memory-jogger note that meets the criteria for a "sole possession record" under FERPA, then the student would not have FERPA rights to inspect and review those notes regardless of the format of the record.  Please note that there are specific conditions necessary to qualify as a sole possession record, and in most cases, documents do not meet those requirements.”

What do you do if ... ? (Examples of recommended actions)

A parent calls and wants to know if her son has been attending class regularly. Your response is:

Encourage the parent to ask the student for the information. If you keep attendance records contact the Registrar’s Office to determine if the student has provided written consent or enabled guest login privileges. If the access has not been granted, refer the parent to the Associate Dean of Students or to the Registrar’s Office. You may always just begin the process by automatically referring the parent to these offices right away.

A colleague in your department tells you that she suspects that one of her students has cheated on an exam and asks you about the student’s performance in your class last semester. Under FERPA what is an appropriate response?

You should not discuss the progress or performance of a student with anyone, including parents and other faculty, without the student’s written consent. Inquiries to faculty regarding previous student performance do not constitute a legitimate educational interest. In this case you should refer the colleague to consult with her department chair and then the University discipline process. Any concerns over an issue like this (cheating or general interest), is not “legitimate educational interest.”

Further clarification, if a colleague asks you about a student’s performance in your class and that colleague’s class was pre-requisite for your class, or the input would help you decide to let a student become involved in a research study or independent study, your colleague can discuss the performance. That would be defined as a “legitimate educational reason” for needing the information. Otherwise only their personal general observations may be shared. No specific attendance or grades could be shared.

Can you release a list of students enrolled in your class ?

You should not provide anyone with lists of students enrolled in your class(es) to individuals that do not have a legitimate educational interest.  Refer any requests for information to the Office of Student Records and Registration.

A medical school admissions office wants to confirm that an LU alum earned a 3.95 GPA in your department and graduated with Highest Honors.  Can you confirm both facts?

Honors conferred is designated as directory information and may be released to a third party.  Grade point average could not be released without the student’s written consent.

If a former student has applied for a position in my department, may I view his or her account?

No.  Accessing a Lehigh University student’s record on-line for non-educational purposes, such as potential employment, is not permissible.  Request a transcript from the student as part of an employment process.