FERPA 2012

1. FERPA 2012 Informational session on the core regulations, definitions, and concerns in daily university life.

2. To be clear: FERPA is constantly being interpreted. This presentation provides information in accordance with the recent amendments to FERPA and the case law as it stands. If you have a question about FERPA, ask it because the law may be different now.

3. Main purposes College students must be allowed to inspect and have access to their own “education records” School officials may not disclose “personally identifiable information” about students nor permit inspection of their records without 1) written permission from the students, or 2) under an exception covered by the act. Intro to FERPA

4. What it’s not • FERPA is not a public records request; different process under ORC 149.43. • FERPA is not a Freedom of Information Act Request; the University is not subject to that law. • FERPA does not replace the grade appeals process under university policy.

5. Release (cont). • Right to “Inspect and Review” • No right to copies • Right to request an Amendment • School must decide within a reasonable amount of time whether to grant request. • Student has a right to a hearing. • Student has a right to insert a statement into the record. • Must provide access within 45 days • Can be redacted to protect the identity of other students

6. University policy 5-08 Operational policy 5-08.101 Defines “school officials” and “legitimate educational interest” and more Describes record request process Outlines procedure for challenging the content of an educational record Process for review and destruction of records Also, the Registrar has several reference materials available on its website and at: http://www.kent.edu/registrar/info/records_policy.cfm FERPA as KSU

7. The Interpreter • “The Provost will be the custodian and major executive officer of the university responsible for the implementation of this policy.” • Questions of Interpretation are under the VP for EMSA as assisted by the Registrar. • Registrar required to maintain the records inventory of all student records and approve all forms utilized for FERPA.

8. “Education records” – information and documents (1) directly related to the student and (2) maintained by the university “Personally identifiable information” – SSN or student number, financial information (continually being interpreted) “School official” – University employee (including students in certain situations), third-party vendor performing work of the University, consultants “Legitimate Educational Interest” – requires that a “school official” is performing a duty in the course and scope of their University employment. Key Terms

9. Key Terms • Eligible Student: a student who has reached 18 years of age OR is attending an institution of postsecondary education. • “Attendance” – includes videoconference, satellite, Internet, or ‘other technologies.’ • Personally identifiable information can also include: • “Information that, alone or in combination, is linked or linkable to a specific student and their educational record or records.” • Student ID numbers (Applies to Banner, See Federal Regulations, FPCO decisions) • Genetic information • One-time testing numbers acceptable

10. Alumni records vs. Student records Peer grading: not collected, not protected Third-party subpoena: If the University contracts with a firm to perform a service normally performed by the University, and that firm receives a subpoena, it has to comply and provide notice to any student/parent affected by the subpoena. Deceased students: “FERPA would not bar an educational agency or institution from exercising its own discretion with respect to disclosure of records relating to deceased students.” (FPCO Letter, 11/20/1991) Sole-possession records. What is a record?

11. What is a record? • Does not apply to “observations” • Disciplinary records are education records • Institution law enforcement records are not. • Student Employment Records: if the position requires that the person must be a student, then it is protected under FERPA as employment incident to their studies. • Helpful Link: • The Catholic University of America’s site on FERPA compliance has opinions spanning several issues: • http://counsel.cua.edu/ferpa/questions/index.cfm • If you have questions, ask.

12. According to FERPA, students have the right to protect their directory information from disclosure by notifying the university. At Kent State, the student notifies the Office of the Registrar. The Registrar “marks” the students record to prevent disclosure of the information. In Banner, if a student’s directory information is prohibited from disclosure, a “pop up” indicating such will be displayed on the first INB form that a person accesses of the student’s information. (It can also be viewed in the INB form SPAIDEN.) 4. Opt out lasts for the life of the student. Directory Opt-Out

13. In response to “targeted requests,” if the University reasonably believes that a public records request is targeted toward a specific student and the release of that information will lead to the identity of that student and the discovery of educational records, the University may refuse to release the information. Disclosure of PII

14. Disclosure • FERPA is about disclosure. • Two types: • With consent of the student • Without consent of the student • Even if consent is provided, you are not compelled to release to another party but student.

15. Registrar’s Office provides an official “release form” for students to fill out, allowing a third party to view the student’s educational records. The form is available on the Registrar’s site at (or search for it at kent.edu): http://www.registrars.kent.edu/home/forms/FERPA%20Parent%20Rights.pdf With Consent

16. When educational records can be released without consent to parents: The student is a dependent for Federal income tax purposes (Must verify with tax records); In connection with a health or safety emergency; If the student is under the age of 21 and has violated a Federal, State or local law or institutional rule or policy governing the use or possession of alcohol or a controlled substance; If the disclosure falls within any other exception to the consent requirement (such as in compliance with a court order or lawfully issued subpoena). Without Consent

17. Parents • The “dependent” exception. • The parent’s tax return should to honored as being able to “view” their student’s academic data.   A signed copy of the return presented on the spot is okay, but must be for the most recent tax year and only for the person(s) named on the form: • Father and mother of the student must be named on the “joint” tax form or provide copies of each if filed separately. • One cannot establish dependency and then grant the other access under their name.  This would be true for legal separations and cases where either one of the biological parents has remarried.   But, if remarried and both names appear on the “joint” filing, we are obligated to honor both. • If divorced, only the parent who has claimed our student on their taxes for that year gets access.

18. Clarifies disclosure (without consent) to “school officials” The University must use “reasonable methods” to ensure that faculty and other officials obtain access to only those educational records in which they have a legitimate educational interest. The controls should consist of a combination of physical, technical, administrative measures to limit access - i.e. the University’s use of the role-based security feature in Banner. No right to “re-disclosure”. Without Consent

19. Allows for disclosure (without consent) to other educational institutions; Was strictly prohibited without consent; Must be for purposes related to the student’s enrollment or transfer; University may also provide updates, correct, or explain information it has disclosed; Includes all records – education, health, discipline. Without Consent

20. More flexibility to “Health and Safety Emergencies” Uses “totality of circumstances” perspective If the University determines that there is an “articulable and significant threat to the health or safety of a student or to individuals”, it may disclose information from educational records to any person whose knowledge of the information is necessary to protect the health and safety of the student or other individual. Without Consent

21. Without Consent • In connection with financial aid for which the student has applied or which the student has received, if the info is necessary to: • Determine eligibility for the aid • Determine the amount of the aid • Determine the conditions for the aid; or • Enforce the terms and conditions of the aid. • “Financial aid” – payments of funds provided to an individual (or payment in kind of tangible or intangible property) that is conditioned on the individual’s attendance at an education agency or institution.

22. Without Consent • Can release to: • Organizations conducting studies on behalf of schools • Accrediting organizations • To comply with a judicial order or subpoena to release records • The court if the university is initiating the lawsuit • Other state educational agency or authority • To another school where the student seeks to or intends to enroll, as long as it is related to the student’s enrollment or transfer.

23. As specifically stated in the language, the University may be responsible for their outside service providers’ failures to comply with applicable FERPA requirements. The outside contractor who obtains access to educational records without consent must be under the direct control of the University and subject to the same conditions governing the use and redisclosure of records that apply to other school officials under the regulations. Outside contractors

24. Identifying those accessing records: The University must use “reasonable methods” to identify and authenticate the identity of parents, students, school officials, and any other parties when requests are made. “Reasonable” = if the measures reduce the risk of unauthorized disclosures using customary good business practices. Access control

25. Additional disclosures • Can we disclose information over the phone? • This is not advisable. • There is no uniform policy in place that provides for a secure way to determine identity over the phone. • Without a uniform policy, there is additional exposure. • What if the parent stops by my office? • Still need consent. • What about an executed Power of Attorney? • Permissions • Situations • Validity (Call our office)

26. The State ex rel. ESPN v. Ohio State University, 132 Ohio St.3d 212 (6/19/2012) Involved the Trades for Tats scandal Determined FERPA was a valid reason to not disclose under the ORC 149.43. HOWEVER, where redactions can be made, they must be made, and the record must be released. “Educational Record” not defined by subject. Recent Case

27. Guidance • Office of the University Registrar: http://www.kent.edu/registrar/info/records_policy.cfm • General FAQs: http://www.kent.edu/registrar/info/genfaq.cfm • Family Policy Compliance Office: http://www2.ed.gov/policy/gen/guid/fpco/index.html

28. Registrar • Glenn Davis, University Registrar • gdavis3@kent.edu • 330-672-3131 • Mailing Address: • 122 Michael Schwartz Building • Kent, OH 44242