FERPA for Faculty and Staff
FERPA for Faculty and Staff
The Family Educational Rights and Privacy Act, as amended, (FERPA) also known as the Buckley Amendment, is a federal statute that was originally enacted in 1974, and later supplemented with implementing regulations, to protect the privacy of student educational records. All institutions that receive federal funding must comply with FERPA.
As a faculty or staff member, you have a legal responsibility under FERPA to protect the confidentiality of student education records in your possession. You have access to student information only for legitimate use in the completion of your responsibilities as a university employee. Need to know is the basic principle. You may not release lists or files with student information to any third party outside your college or departmental unit.
Student education records (other than Directory Information or public information) are considered confidential and may not be released without written consent of the student.
If you’re in doubt about a request for student information, contact the Office of the Registrar via email (registration@uic.edu) or phone (312-996-8600).
FERPA for Faculty and Staff
FERPA Overview
What can I do to keep student’s records safe?
What can I do to keep student’s records safe?
Here are some best practices to help you protect student education records.
- Avoid using e-mail for sensitive PII (personally identifiable information).
- Use the Protected E-mail Attachments Repository (PEAR) or Box to transmit highly sensitive PII.
- Use password protection on computer files, if possible.
- Keep storage media in a secure, locked location.
- Restrict access to your computer and configure it to automatically lock after a period of inactivity.
- Never leave student data displayed on your computer screen.
- When you have finished a task, exit all files, sign out of all applications, and close all windows
- Consult with your unit or the RIMS website to find out your responsibilities related to the disposal of education records.
Ways that the University verifies the identity of a student during a phone call
In order to disclose PII from education records to a Student over the phone, University staff must verify the student’s identity. This will prevent an unlawful disclosure. The UIN alone cannot be used to verify the student’s identity, though may be requested in order to locate a record .
PII from education records will not be given out over the phone until the student’s identity is authenticated or unless a signed Family Educational Rights and Privacy Act (FERPA) release form from the student allowing release to the specific caller has been processed.
Do not give out any information about a student’s educational record until the student’s identity is authenticated or unless a signed Family Educational Rights and Privacy Act (FERPA) release form from the student allowing release to the specific caller has been processed.
Once a record is located using the UIN, University staff must authenticate the student using questions to which only the student should know the answer. Listed below are suggested questions using Banner forms that are available to many Banner users. You can use one or more of these questions depending on the sensitivity of the Banner data a student requests.
1. Using SPAIDEN
- Date of birth?
- Current mailing address?
- Current permanent address?
- Emergency contact(s)?
- Address at time of application to Illinois?
- Email address used at time of application to Illinois?
2. Using SGASTDN
- Major?
- College?
- Class level?
3. Using SFAREGQ
- Courses registered for this term?
- Name(s) of instructors(s)?
Banner users may wish to vary the Banner forms used to check identity for callers so that the same questions are not asked of each caller.
As a faculty, staff, and other employee, what should I do to prevent unauthorized disclosure of student records?
In practice, FERPA limits how information about a student can be shared. University officials have a responsibility to protect all education records in their possession.
The following is not a comprehensive list of FERPA requirements, but does outline some requirements for faculty and staff related to student information and records:
- Do not share any information (including grades and academic progress) about a student with other students.
- Do not leave any paperwork or documents that contain student grades or other information in view of others (including other faculty and staff) who do not have a legitimate educational need for that information.
- Do not discuss any student’s information or academic progress while others nearby are able to hear.
- Do not publicly post grades or return papers in a way that connects a grade with an identifiable student. Do not leave papers outside of your office for anyone to pick up or see.
- Do not send group emails or texts to students where any information regarding grades or academic progress is discussed and could be connected to a specific student.
- Do not share information about a student’s schedule with others (including other students).
- Do not release grades or information about a student to anyone (including parents), unless the student has provided express written permission.
- Do not share your UIC passwords with others or provide access to a computer where confidential student information or Education Records can be seen.
Is Email a safe way to share a student's records?
Email is an easy way to communicate with students and parents. Prior to sending an email, it’s important to evaluate the risk associated with sending student information and recognizing if it is personally identifiable information (PII).
Is FERPA the same as FOIA
Some University records are subject to disclosure pursuant to the Illinois Freedom of Information Act. This law gives citizens the right to request information about the affairs of government. The University of Illinois is a government agency and subject to the requirements of FOIA.
That said, student records retain their FERPA protections even if requested under FOIA. FOIA does not expand a person’s right to view a student’s private educational record beyond whatever right they may have under FERPA.
Do I have to document a disclosures of student information?
Except in certain circumstances, each time a University official discloses education records or information from education records without a student’s consent, that official must:
- Create and/or maintain a record of the request for access and each disclosure of student information that identifies the parties who requested the information and their basis for such request.
- Maintain the record of disclosures in the file for as long as the educational records are maintained.
Exceptions: Records of requests and disclosures do not have to be maintained for requests by
- A parent or eligible student;
- A university officials with a legitimate educational interest; or
- A party seeking directory information.
What are examples of information that the University may disclose without a student’s consent under FERPA?
- Directory information (as defined in the UIC Student Records Policy);
- Information needed by UIC employees who have a legitimate educational interest;
- Information needed by certain government agencies in connection with an audit or evaluation of supported education programs or when otherwise authorized to be disclosed;
- Information needed to protect a Student or other individual in the case of health or safety emergencies;
- Information needed to comply with judicial orders or subpoenas;
- Information released to parents in cases where students have been found responsible for violating a law or University policy related to drug and/or alcohol abuse.
Faculty/Staff Scenarios
Faculty and Staff Scenarios
General Information
Opted Out
No. Under FERPA, a student may not use his or her right to opt out of directory information disclosures to prevent school officials from identifying the student by name or disclosing the student’s electronic identifier or institutional e-mail address in class.
opted out of directory information
No, a school is required to honor the eligible student’s request to opt out of the disclosure of directory information made while the student was in attendance, unless the student rescinds the opt out request.
A parent calls to talk about why their child received a poor grade in your class. Can you talk with the parent?
Unless the student has given written consent allowing their parent access to their records you cannot discuss specifies of the students situation. You can, however, discuss your grading philosophy in general terms, as presented on the course syllabus.
May I distribute students' graded exams and papers by putting them in a self-serve box so that students can easily pick them up?
No, this is not allowed. Distributing students’ exams and papers in this way violates their confidentiality by making confidential records available to the public.
What information may I write in a letter of recommendation?
You can discuss information provided to you by the student, such as information from their resume, and information that you have gained in your academic relationship with the student. You cannot discuss any non-directory information (e.g. their grade in a course you taught) without the student’s specific written consent.
UIC Police
FERPA considers campus security officials as employees with a “legitimate educational interest” if they are designated as “university officials” and operating within the scope of their employment. The warrant would not be necessary. Such requests should be forwarded to the Registrar’s Office for processing.
You have found a great new online tool that you would like to use as part of your class. Can you upload your class list to the vendor’s website so that the students can log into the site?
Class enrollment is not considered directory information and therefore requires either written consent of every student in the class, or an official contract between the vendor and UIC containing FERPA specific clauses.
Local police
No, not without a subpoena or official court order because they are not affiliated with the university. Any subpoenas or court orders should be brought to the Registrar’s Office for processing.
Call from parent
No, you cannot release the students schedule, unless the student has a release on file. You can offer to send someone to the student’s class to ask them to call home. You may also contact UIC Campus Police or Student Affairs to locate the student if necessary.
Background check
Unless the student has placed a confidentiality flag on his/her record, you can provide directory information (including major, degree and awards received). You can also provide personal observations you have of the student. However, without written consent from the student, you cannot relay any other information from the educational record, including grades, GPA, etc.
Parent and Instructor
The only disclosure requirement that is a “must” under FERPA is to the student. All other disclosures, even with a student’s release form is a “may”. The decision to engage in dialog with a parent is up to the discretion of the faculty member or department personnel.
letter of recommendation
Without the student giving written consent, you may not disclose non-directory information from their educational record. FERPA requires explicit (not implied) consent.
classroom
No. Confidentiality does not allow the student to remain anonymous in class. They will be required to participate in all required components of the course.
classroom
Since the discussion is only accessible to student in the class, there is no FERPA violation. However, non-directory information should not be displayed on the site. FERPA regulations specifically state that student usernames can be displayed to others in a class even if the student in question has chosen “no release” for their directory information.
sole possession notes
It depends. If the comments and notes are recorded in BANNER or kept in a file that is accessible to even one other person they are considered an educational record and subject to FERPA protection. If the comments and notes are kept simply as “memory joggers” and not shared with even one other person they are considered “sole possession” documents and not part of the educational record. Since FERPA grants students the right to review and access their records, the notes that do not meet the “sole possession” criteria should be included in that review. Therefore, it is important that all written comments or notes be factual and objective and devoid of inappropriate value judgments or language.
Quick Links
| Registration Services | Calendars | Financial Matters |
| Student Records | Transcripts | Campus Policies |
| Registration FAQ | FERPA |