- Registration and Records
- About
- FERPA Tutorial
FERPA Tutorial
This tutorial provides basic Family Educational Rights and Privacy Act (FERPA) training for NIU faculty and staff. The university is legally and ethically obligated to protect the confidentiality of student records. To be granted access to student records, you must complete this tutorial.
What should I expect to gain from this tutorial?
- Knowledge of laws and policies governing acceptable use and release of student records
- An understanding of your responsibilities in complying with these laws and policies
- An understanding of how to protect a student's right to privacy
What is FERPA?
The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents the right to have access to their children's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. When a student turns 18 years old, or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student ("eligible student"). The FERPA statute is found at 20 U.S.C. § 1232g and the FERPA regulations are found at 34 CFR Part 99.
Check Your Understanding
The FERPA rights of a student begin:
Correct!
The correct answer is d, when the student is "in attendance". Northern defines “in attendance” as the first class day in which the student enrolls.
Incorrect
The correct answer is d, when the student is "in attendance". Northern defines “in attendance” as the first class day in which the student enrolls.
What is an Educational Record?
An education record is any record that contains information directly related to a student that is maintained by the institution. This includes, but is not limited to, grade information, disciplinary documentation and billing and financial aid data. Educational records can appear in a variety of forms, including:
- Handwritten documents
- Data stored within computer files
- Printouts that relate to specific student information
- Verbal exchange
This information must be handled with the same standard of care, regardless of its form.
What is not considered an educational record?
Records not considered part of an education record include, but are not limited to, records of the law enforcement unit of an educational institution, records made or maintained by a physician or other recognized professional acting in his or her professional capacity, and records that only contain information about an individual after he or she is no longer a student at the institution.
Directory Information
Briefly defined, FERPA requires colleges and universities to define the information that they will release without a student's prior written consent. Northern Illinois University's definition contains a list of those “directory information” items that may be released:
- Student name
- Address
- Telephone listing
- Email address
- Photographic or electronic picture or image
- Date and place of birth
- Major field of study
- Classification
- Participation in officially recognized activities and sports
- Weight and height of members of athletic teams
- Dates of attendance
- Full or part-time status
- Degrees and awards received
- The most recent previous educational agency or institution attended by the student
One common misconception is that FERPA requires us to release student information. It does not. Accordingly, you should err on the side of not releasing information when you are in doubt. If questions arise regarding the release of student data, consult your immediate supervisor or contact the Office of Registration and Records.
Check Your Knowledge
1. A student's degree can be confirmed to some external (outside of your college) source without first obtaining the permission of the student as long as "degree" is identified by the institution as directory information.
The answer is true, degree can be confirmed as it is considered “directory information” by NIU.
Incorrect
The answer is true, degree can be confirmed as it is considered “directory information” by NIU.
2. You receive a phone call asking to verify (1) that a currently enrolled student: attends your institution, (2) what his address was at the time of attendance, (3) his date of birth, and (4) his gpa. According to FERPA, you can verify all of these except the student's
Incorrect
The correct answer is d (gpa), the other items, (attendance at the institution, address during the time of attendance and date of birth) are all considered directory information
Request to Prevent Disclosure of Directory Information
Any individual who does not want the foregoing information publicly disclosed shall so inform the director of Registration and Records, Williston Hall 220, in writing. Please note that students must be currently enrolled to request nondisclosure of their directory information.
If you request that no directory information be released, any business you wish to conduct at NIU must be done in person with proper identification. Information will not be provided to you over the phone or via email. If you are unable to come in person, you may submit a signed and dated written request containing your SSN and date of birth, listing the specific information you're requesting. We'll reply to you in writing. Please be aware of the following circumstances pertaining to a request to prevent disclosure of directory information:
- A third-party, such as a prospective employer, will need to submit with each request for information your written authorization before NIU can release or verify any information about you.
- To avoid university non-compliance with or delay in response to requests that require immediate information, you should provide written authorization to any agency, company, employer, etc. with which you have contact.
- University publications, such as the Commencement Bulletin and Student Directory will not list your name or other information about you.
- NIU assumes no liability as a result of honoring your request that directory information be withheld.
- All requests for "No Release of Directory Information" will be processed within 1-2 weeks following the published deadline for submission of requests as follows:
- Each request will remain in effect on a continuing basis until Registration and Records is informed, in writing, to the contrary by the student or former student.
- This request will NOT prevent the Office of Registration and Records from releasing information to the student's parents if they provide evidence that the student is their dependent.
Check Your Knowledge
A student has a right to inspect information in his or her file in the Registrar's Office and in his or her department..
Correct!
The answer is true, students do have the right to inspect their educational record under FERPA.
Non-Directory Information
Non-directory information is any educational record not classified as directory information. This private information must not be released to anyone, including parents of the student, without written consent from the student. This applies to all student records, whether or not directory information has been suppressed. University staff may access this information only if they have a legitimate need to use it in fulfillment of official duties.
Designated university employees may release non-directory information under certain strictly defined conditions. If someone outside your college or department requests non-directory information, refer the requestor to the Office of Registration and Records. These requests will be evaluated and handled according to the law and university policy.
Responsibilities of NIU Staff Handling Student Records
FERPA pertains to everyone who works at Northern Illinois University, regardless of his or her position. What FERPA says, in effect, is that we may all have access to as much information about students as we need to do our jobs. Clearly, many people who work at the university have no access to student records and have no need for individual student information. However, these staff members may encounter confidential information in the course of doing their job and are therefore required to respect the confidentiality of this data.
Beyond any legal requirements, the university is bound by professional ethics to safeguard the integrity and confidentiality of student information. This includes all university officials, regardless of role or classification. All staff must be in compliance with the FERPA regulations and university policy in order to maintain, report and make available information included in student educational records. Here are some examples:
- Staff may not browse through student records, whether in “hard copy”, form or in computer files, for information about students at random or for information about persons we know.
- Staff must take reasonable precautions to safeguard access to student information. These include shredding documents, not sharing computer ID and passwords, not allowing others to do work under our ID and passwords, and not leaving the student information system up and running and accessible when away from the work station.
- Student information should not be released to others. When in doubt, consult the Office of Registration and Records.
- Student data may be shared among university staff as necessary to carry out the responsibilities of their position; however, take precaution to ensure the security of the student data being shared.
- Staff should refer requests for information from the education record of a student to the proper educational record custodian, e.g., academic, financial, medical and placement.
- Staff should not display student scores or grades publicly in association with names, social security numbers or other personally identifiable information. If scores and grades are posted, use only a coding method agreed upon mutually by the entire class which does not include personally identifiable information. The list should be randomly generated, i.e., displayed in such ways that it not appears in alphabetical order by student name.
- Staff should keep only those individual student records necessary for the fulfillment of his/her specific responsibilities. Private notes of a staff member concerning a student and intended for a staff members own use are not part of the student's educational record.
- Staff should not provide non-directory information to third parties such as prospective employers, associations, honorary organizations, etc. without the student's written consent.
- Staff should keep any personal professional records relating to individual students separate from their educational records. Private records of instructional, supervisory and administrative personnel and ancillary educational personnel are to be kept in the sole possession of the maker and are not to be accessible or revealed to any other person, except a substitute.
- Staff should not provide copies to students of their transcripts from other institutions. If you release copies of transcripts, you are acting as a third party testifying as to the accuracy of the information on the transcripts.
- Staff should understand that only the appropriate educational record custodian may release information about a student's educational record to a third party outside the university.
- All student information requests in the case of an emergency should be directed to Student Affairs at 815-753-6103 during regular office hours or Public Safety (University Police) at 815-753-1212 after hours.
Check Your Knowledge
1. It is permissible for a professor to post student grades on an office door if only a student's social security (i.d.) number is used.
Correct!
The answer is false. Faculty cannot post student social security numbers as they are not considered directory information. If scores and grades are posted, a coding method agreed upon mutually by the entire class which does not include personally identifiable information must be used. The list should be randomly generated, i.e., displayed in such ways that is not appears in alphabetical order by student name.
Incorrect
The answer is false. Faculty cannot post student social security numbers as they are not considered directory information. If scores and grades are posted, a coding method agreed upon mutually by the entire class which does not include personally identifiable information must be used. The list should be randomly generated, i.e., displayed in such ways that is not appears in alphabetical order by student name.
2. Faculty have a right to inspect education records of any student attending your college without giving a reason.
Correct!
The answer is false. University officials at NIU must have a legitimate university related educational or administrative interest and a need to review an education record in order to fulfill their professional responsibility. The access provided for staff to do their jobs does not overlap into information that is not required of their position.
Incorrect
The answer is false. University officials at NIU must have a legitimate university related educational or administrative interest and a need to review an education record in order to fulfill their professional responsibility. The access provided for staff to do their jobs does not overlap into information that is not required of their position.
3. It is permissible to distribute graded examinations by placing them on a table for students to pick up after class.
Incorrect
The answer is false. Staff should not display student scores or grades publicly in association with names, social security numbers, or other personally identifiable information.
Access to Student Records
The access provided for staff to do their jobs does not overlap into information that is not required of the position. Use a “need to know” approach when accessing students' education records. University officials at NIU must have a legitimate university related educational or administrative interest and a need to review an education record in order to fulfill their professional responsibility.
Staff may not disclose any information about any student to anyone who does not need this information to do his or her job and the university.
Staff should check the student's record on the student information system or contact the Office of Registration and Records to see if the student has requested nondisclosure before releasing directory information about the student to someone who is not a university official with a need to know. Non-directory information from a student's education records, such as grades or class schedules, should not be shared with parents. You may always refer parents to the Office of Registration and Records.
Check Your Understanding
1. A student's written permission is required before an institution releases information to a national research organization conducting a study on the advantages and disadvantages of selective admissions.
Incorrect
The answer is false. Prior consent is not required to disclose personally identifiable information to individuals or university officials who have a legitimate university-related educational or administrative interest and need to review an education record in order to fulfill their professional responsibility. With certain restrictions, organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instruction are allowed access to student data.
Correct!
The answer is false. Prior consent is not required to disclose personally identifiable information to individuals or university officials who have a legitimate university-related educational or administrative interest and need to review an education record in order to fulfill their professional responsibility. With certain restrictions, organizations conducting studies for, or on behalf of, educational agencies or institutions for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instruction are allowed access to student data.
2. As defined in FERPA, "legitimate educational interest" refers to:
Incorrect
The correct answer is b, a school official's need to review student education record information to fulfill a responsibility as part of her contract. This is the definition provided by FERPA.
Freedom of Information Act
Some university records are subject to the Illinois Freedom of Information Act (FOIA). This law gives citizens the right to information about the affairs of government.
Do not confuse this with a right to access student educational records. Student records are protected by FERPA, and their privacy is not impacted by FOIA. FOIA does not grant anyone the right to view a student's private educational record.
All judicial orders, subpoenas or other written requests for access to information or data subject to the Freedom on Information Act should be immediately forwarded to the Office of General Counsel.
A Brief Review
- You are responsible for protecting student data in your possession.
- Educational records may not be released without the written consent of the student.
- Individual directory information may be released without written consent, except when the student has requested nondisclosure of directory information, in which case this information may not be released.
- University employees may access and use private educational records only as necessary to conduct official business that is related to the educational interests of the student.
- Always take appropriate measures to ensure that student records are protected.
- If in doubt, do not release information about a student. Refer requests to the Office of Registration and Records at 753-8218.
- If you have questions about FERPA, contact the Office of Registration and Records.
Certification of Completion
By submitting this web form, you verify that the following statements are true:
- I have read the FERPA tutorial and completed the check your understanding questions.
- I understand that I am responsible for protecting student records in my possession.
- I will access private student information only as necessary to perform my officially assigned duties as an employee of the university.
- I will not provide student information to anyone who is not authorized to obtain the information.
- I will abide by all laws and policies governing the privacy and use of student information.
