FERPA for Faculty and Staff

Here are some best practices to help you protect student education records.

• Avoid using e-mail for sensitive PII (personally identifiable information).
• Use the Protected E-mail Attachments Repository (PEAR) or Box to transmit highly sensitive PII.
• Use password protection on computer files, if possible.
• Keep storage media in a secure, locked location.
• Restrict access to your computer and configure it to automatically lock after a period of inactivity.
• Never leave student data displayed on your computer screen.
• When you have finished a task, exit all files, sign out of all applications, and close all windows
• Consult with your unit or the RIMS website to find out your responsibilities related to the disposal of education records.

In order to disclose PII from education records to a Student over the phone, University staff must verify the student’s identity.  This will prevent an unlawful disclosure.  The UIN alone cannot be used to verify the student’s identity, though may be requested in order to locate a record .

PII from education records will not be given out over the phone  until the student’s identity is authenticated or unless a signed Family Educational Rights and Privacy Act (FERPA) release form from the student allowing release to the specific caller has been processed.

Do not give out any information about a student’s educational record until the student’s identity is authenticated or unless a signed Family Educational Rights and Privacy Act (FERPA) release form from the student allowing release to the specific caller has been processed.

Once a record is located using the UIN, University staff must authenticate the student using questions to which only the student should know the answer. Listed below are suggested questions using Banner forms that are available to many Banner users. You can use one or more of these questions depending on the sensitivity of the Banner data a student requests.

1. Using SPAIDEN

• Date of birth?
• Current mailing address?
• Current permanent address?
• Emergency contact(s)?
• Address at time of application to Illinois?
• Email address used at time of application to Illinois?

2. Using SGASTDN

• Major?
• College?
• Class level?

3. Using SFAREGQ

• Courses registered for this term?
• Name(s) of instructors(s)?

Banner users may wish to vary the Banner forms used to check identity for callers so that the same questions are not asked of each caller.

In practice, FERPA limits how information about a student can be shared.  University officials have a responsibility to protect all education records in their possession.

The following is not a comprehensive list of FERPA requirements, but does outline some requirements for faculty and staff related to student information and records:

• Do not share any information (including grades and academic progress) about a student with other students.
• Do not leave any paperwork or documents that contain student grades or other information in view of others (including other faculty and staff) who do not have a legitimate educational need for that information.
• Do not discuss any student’s information or academic progress while others nearby are able to hear.
• Do not publicly post grades or return papers in a way that connects a grade with an identifiable student. Do not leave papers outside of your office for anyone to pick up or see.
• Do not send group emails or texts to students where any information regarding grades or academic progress is discussed and could be connected to a specific student.
• Do not share information about a student’s schedule with others (including other students).
• Do not release grades or information about a student to anyone (including parents), unless the student has provided express written permission.
• Do not share your UIC passwords with others or provide access to a computer where confidential student information or Education Records can be seen.

Email is an easy way to communicate with students and parents. Prior to sending an email, it’s important to evaluate the risk associated with sending student information and recognizing if it is personally identifiable information (PII).

That said, student records retain their FERPA protections even if requested under FOIA. FOIA does not expand a person’s right to view a student’s private educational record beyond whatever right they may have under FERPA.

Except in certain circumstances, each time a University official discloses education records or information from education records without a student’s consent, that official must:

• Create and/or maintain a record of the request for access and each disclosure of student information that identifies the parties who requested the information and their basis for such request.
• Maintain the record of disclosures in the file for as long as the educational records are maintained.

Exceptions: Records of requests and disclosures do not have to be maintained for requests by

• A parent or eligible student;
• A university officials with a legitimate educational interest; or
• A party seeking directory information.

• Directory information (as defined in the UIC Student Records Policy);
• Information needed by UIC employees who have a legitimate educational interest;
• Information needed by certain government agencies in connection with an audit or evaluation of supported education programs or when otherwise authorized to be disclosed;
• Information needed to protect a Student or other individual in the case of health or safety emergencies;
• Information needed to comply with  judicial orders or subpoenas;
• Information released to parents in cases where students have been found responsible for violating a law or University policy related to drug and/or alcohol abuse.

No.  Under FERPA, a student may not use his or her right to opt out of directory information disclosures to prevent school officials from identifying the student by name or disclosing the student’s electronic identifier or institutional e-mail address in class.

No, a school is required to honor the eligible student’s request to opt out of the disclosure of directory information made while the student was in attendance, unless the student rescinds the opt out request.

Unless the student has given written consent allowing their parent access to their records you cannot discuss specifies of the students situation. You can, however, discuss your grading philosophy in general terms, as presented on the course syllabus.

No, this is not allowed. Distributing students’ exams and papers in this way violates their confidentiality by making confidential records available to the public.

You can discuss information provided to you by the student, such as information from their resume, and information that you have gained in your academic relationship with the student. You cannot discuss any non-directory information (e.g. their grade in a course you taught) without the student’s specific written consent.

FERPA considers campus security officials as employees with a “legitimate educational interest” if they are designated as “university officials” and operating within the scope of their employment. The warrant would not be necessary. Such requests should be forwarded to the Registrar’s Office for processing.

Class enrollment is not considered directory information and therefore requires either written consent of every student in the class, or an official contract between the vendor and UIC containing FERPA specific clauses.

No, not without a subpoena or official court order because they are not affiliated with the university. Any subpoenas or court orders should be brought to the Registrar’s Office for processing.

No, you cannot release the students schedule, unless the student has a release on file. You can offer to send someone to the student’s class to ask them to call home. You may also contact UIC Campus Police or Student Affairs to locate the student if necessary.

Unless the student has placed a confidentiality flag on his/her record, you can provide directory information (including major, degree and awards received). You can also provide personal observations you have of the student. However, without written consent from the student, you cannot relay any other information from the educational record, including grades, GPA, etc.

The only disclosure requirement that is a “must” under FERPA is to the student. All other disclosures, even with a student’s release form is a “may”. The decision to engage in dialog with a parent is up to the discretion of the faculty member or department personnel.

Without the student giving written consent, you may not disclose non-directory information from their educational record. FERPA requires explicit (not implied) consent.

No. Confidentiality does not allow the student to remain anonymous in class. They will be required to participate in all required components of the course.

Since the discussion is only accessible to student in the class, there is no FERPA violation. However, non-directory information should not be displayed on the site. FERPA regulations specifically state that student usernames can be displayed to others in a class even if the student in question has chosen “no release” for their directory information.

It depends. If the comments and notes are recorded in BANNER or kept in a file that is accessible to even one other person they are considered an educational record and subject to FERPA protection. If the comments and notes are kept simply as “memory joggers” and not shared with even one other person they are considered “sole possession” documents and not part of the educational record. Since FERPA grants students the right to review and access their records, the notes that do not meet the “sole possession” criteria should be included in that review. Therefore, it is important that all written comments or notes be factual and objective and devoid of inappropriate value judgments or language.