For Faculty and Staff
FERPA: What Faculty and Staff Members Need to Know
It's the Law
FERPA (Family Educational Rights and Privacy Act), also known as the Buckley Amendment, was passed by Congress in 1974. It grants four specific rights to a post-secondary student:
- To see the records that the institution is keeping on the student.
- To seek amendment to those records and in certain cases append a statement to the record.
- To withhold the disclosure of a student’s educational records except for situations involving legitimate educational interest or as may be required by law.
- To file a complaint with the FERPA Office in Washington.
FERPA applies to all educational agencies or institutions, including Mount Saint Mary’s University, that receive funds under any program administered by the Secretary of Education.
FERPA governs what may be released, but does not require that any information be released.
It's Your Responsibility
You may not disclose personally identifiable information from educational records to persons other than the student in question and University officials who have legitimate educational interest.
A University official has a legitimate educational interest in access to information when that information is appropriate for use in connection with: performing a task that is related to the student’s education; providing a service or benefit relating to the student or student’s family, such as housing, health care, counseling, job placement, or financial aid; performing a task related to the discipline of a student; maintaining the safety and security of the campus; or otherwise performing a task related to the effective functioning of the University.
As a general principle, you may not disclose student information in oral, written, or electronic form to anyone except MSMU staff and faculty who need the information to perform their university functions.
You have a legal responsibility under FERPA to protect the privacy of the student educational records in your possession. You may not access educational records for personal reasons.
Student information stored in an electronic format must be secure and available only to those entitled to access that information.
You may not release lists or files with student information to any third party outside your college or departmental unit.
Student information should not be stored on laptops or home computers unless it is encrypted. Personal digital assistants used to read confidential data should be password protected.
Student information in paper format must be shredded before disposal or placed in a locked disposal bin.
Student Information Types
Student educational records include records directly related to a student and maintained by the institution or by a party acting for the institution. Examples include exams, papers, advising notes, applications, and financial documents.
FERPA requires institutions to allow students to review educational records upon request.
Personal notes maintained by and for a sole individual as a memory aid and not made available to any other faculty or staff members are exempted from this requirement under FERPA. Nevertheless, such “sole possession notes” could be subject to discovery through a court subpoena.
Exclusions to student educational records include certain law enforcement records, certain treatment records, non-matriculant records, employment records, and post-graduation alumni records.
How can a student withhold release of directory information?
A student who so wishes has the right to prevent the release of all directory information including verification of enrollment, or of suppressing selected directory information either to the MSMU community or to the general public. In order to do this, students must fill out a Directory Hold Request with the Registrar’s Office. Student directory information will not be blocked from faculty and staff conducting official university business.
Can student directory or public information always be released?
Student directory information should not be released to third parties. All inquirers should be referred to the Registrar’s Office.
Can student non-directory information ever be released?
All non-directory information is considered confidential and will not be released to outside inquiries without the express written consent of the student.
What should I do if I’m concerned about a student’s health or safety, or the health or safety of those around the student?
You should speak with your department chair, dean, director, or Counseling Services anytime you have a health or safety concern. FERPA allows you to make disclosures of education records to others within the University who have legitimate educational interests in the information, which interests include the performance of services to students, the effective functioning of the University, and the safety and security of the campus. FERPA also permits disclosures of information in a health or safety emergency, if in light of the circumstances and information available at the time, knowledge of the information is necessary to protect the health or safety of a student or other individuals. Your own personal observations of a student’s behavior or condition generally are not considered educational records. Federal and state rules limit what may be disclosed from a student’s health or counseling records, to you or to others, but these rules also contain exceptions for community health and safety emergencies. So, if you have a concern about a student, first and foremost, report it.
What if someone needs to reach the student because of an emergency?
All such inquirers should be directed to the Registrar’s Office or Campus Security.
What are parental rights under FERPA?
When a student reaches the age of 18 or begins attending a postsecondary institution regardless of age, FERPA rights transfer to the student. Parents may obtain directory information at the discretion of the institution. Parents may obtain non-directory information (grades, GPA, etc.) at the discretion of the institution AND after it has been determined that their student is legally their dependent. Parents may also obtain non-directory information by obtaining a signed consent from the student. It is generally the University’s practice not to make disclosures from a student’s educational records involving academic matters to parents without the student’s written consent. A permission to disclose information is available in the Registrar’s Office.