FERPA Information for Staff

The Family Education Rights & Privacy Act, known as FERPA or the Buckley Amendment, is a federal law passed in 1974. It is enforced by the Family Policy Compliance Office in the United States Department of Education. FERPA applies to all educational agencies or institutions, including the University of Delaware, that receive funds under any program administered by the Secretary of Education. The purpose of FERPA is to ensure the accuracy, integrity, and confidentiality of education records maintained by colleges and universities concerning students. FERPA embodies five essential principles:

• A student is entitled to know what education records the institution maintains.
• A student is entitled to inspect most education records containing the student's name or personally identifiable information about the student.
• A student is entitled to correct erroneous education records.
• An institution is obligated to use education records only for their intended purposes and to relinquish education records to third parties only under prescribed circumstances.
• Faculty and staff members who maintain education records are obligated to take reasonable precautions to prevent misuse or unauthorized disclosure of education records.

FERPA protects the education records of any individual who is currently a UD student or who matriculated at UD at any time subsequent to the enactment of the law in 1974. FERPA does not apply to deceased students or persons who applied to UD but never enrolled.

• All UD faculty and staff members are considered university officials under FERPA when they perform specific functions of their position related to the student educational experience. Faculty and staff members routinely handle education records as part of their responsibilities. They are expected to understand their legal obligations under FERPA and to ensure that education records are not used for inappropriate purposes or disclosed in an unauthorized manner. The legal obligations of UD faculty and staff members are set forth in implementing regulations promulgated by the United States Department of Education and available on the Department's web site at https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html.
• FERPA is enforced by the United States Department of Education, which has the authority to audit institutions of higher education for FERPA compliance. FERPA violations may result in the loss of federal funding for the University. Any breach of confidentiality by a faculty or staff member in violation of FERPA could lead to the imposition of disciplinary sanctions under University human resource policies.

• The term "education record" as used in FERPA is very inclusively defined. An education record is any record, file, document, or other material that (i) contains information directly related to a student, and (ii) is maintained by a faculty or staff member. The term encompasses records kept in any format - hard copy, electronic, handwritten, or other. There are only five exceptions recognized in the law. The term "education record" does not include:
  
  • Personal notes that are not shown to anybody else;
  • Police records;
  • Employment records, unless the employment was directly related to the student’s enrollment status;
  • Medical records maintained solely for the purpose of treatment; and
  • Records that contain only information about an individual after he or she is no longer a student, for example, records maintained by the Office of Alumni Relations about the volunteer or gift-giving activities of UD alumni.
• All other records maintained by UD faculty and staff members are presumed to be education records, hence subject to the privacy protections in FERPA, if they identify a student by name or contain other personally identifiable information from which the identity of a student can be derived.

• Under FERPA, current and former students are entitled to inspect and review education records in which they are named or identified. Should you receive a request from a student for access to his or her education records, you should refer the request to the Registrar's Office. Under the FERPA regulations, the institution has 45 days to provide access to requested education records, and is entitled to charge a reasonable fee for copying education records, but is prohibited from charging any fee or cost for search time.
• If a student (including a former student) believes that an education record is inaccurate, the student may seek a correction by writing to the Registrar, clearly identifying the part of the record that is allegedly inaccurate, and specifying why it is inaccurate. If the University decides not to amend the record as requested by the student, the University will notify the student of the decision and advise the student of his or her right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.
• A student (including a former student) has the right under FERPA to file a complaint with the United States Department of Education concerning an alleged failure by the University to comply with the requirements of FERPA.
• FERPA and the implementing regulations impose limitations on students' rights to inspect and review their education records. The University is not required to permit students to inspect and review the following:
  
  • Records that do not contain educational information or do not constitute education records within the meaning of that term in FERPA.
  • Financial records of parents.
  • Education records created or compiled prior to FERPA's 1974 effective date.
  • Confidential recommendations or receipts of honors if the student has waived the right of access to such information.
  • Records containing information on more than one student.

You, as the custodian of an education record, cannot disclose the record to a third party unless either (i) the student who is the subject of the record consents in writing to the disclosure, or (ii) disclosure is warranted without consent under one of FERPA's exceptions to the written-consent requirement.

Written consent:

You are allowed to disclose an education record if the student who is the subject of the record consents in writing. The student's written consent must contain three elements:

• It must specify the records to be released, i.e. grades, notes based on observations, general assessment of performance of student in a class or in a field-based experience;
• It must identify the party or class of parties to whom the records should be released, i.e. prospective employer, non-UD school official, scholarship committee members, etc.; and
• It must indicate the reason for the release, i.e. as part of an application for employment, admission to a graduate program, application for a scholarship/grant, etc.

Disclosure without consent:

FERPA enumerates specific circumstances under which disclosure may be made, but is not required to be made, without consent. The most important are:

• To other University officials and offices with "legitimate educational interests." The University of Delaware determines on a case-by-case basis whether a school official has a legitimate educational interest in the disclosure of personally identifiable information from an education record, based on application of the following considerations:
  • Whether the information to be disclosed is necessary for that official to perform an appropriate task that comes within or is consistent with the official's job duties or the duties spelled out in the official's contract;
  • Whether the information is to be used for official University business and not for purposes extraneous to the official's job duties or the duties spelled out in the official's contract;
  • Whether the information is relevant to a task, determination, proceeding, or other matter relating to the student; and
  • Whether the information is to be used in a manner consistent with the purpose or purposes for which the education record is maintained.

When in doubt, confer with the Registrar's Office before determining whether it is appropriate for you to disclose an education record to another University official under the "legitimate educational interests" exception to the written consent requirement.

• In connection with an application for, or receipt of, financial aid.
• To the parent of a "dependent student" (as the term in quotation marks is defined in the Internal Revenue Code).
• To comply with a judicial order or lawfully issued subpoena. Even if the subpoena is lawfully issued, the University is still not allowed to comply until it has made a "reasonable effort to notify the ... student ... in advance of compliance." If you are served with a subpoena or court order requiring production of an education record, you should promptly notify the General Counsel's Office and send the original copy of the subpoena or order to that office. You should not produce documents unless you are instructed to do so by the General Counsel's Office.
• To cope with a health or safety emergency, if disclosure is necessary to protect the health or safety of the student who is the subject of the education record. When in doubt, confer with the Registrar's Office before determining whether it is appropriate for you to disclose an education record under the "health or safety emergency" exception to the written consent requirement.

What is often misunderstood about FERPA and critically important to the safety of our students and the maintenance of student welfare - is that information based on personal observation is not the same as a protected education record. Personal observations are not subject to FERPA and are not subject to the statutory confidentiality constraints imposed on education records by FERPA. If a faculty or staff member observes behavior or has personal knowledge suggesting that a student is in trouble, particularly when there is reason to believe that the health or safety of the student or others may be in jeopardy, the observer should seek support or advice to diffuse the situation. This may be any action as simple as calling the Office of the Dean of Students for guidance on handling students in crisis or calling the Department of Public Safety to respond to an emergency.

When the information disclosed qualifies as "directory information". Directory information is defined in the FERPA regulations as "information ... which would not generally be considered harmful or an invasion of privacy if disclosed."

Examples of directory information include a student's name, address, telephone number, class (freshman, sophomore, and so forth), college, major field of study, dates of attendance, degrees awarded, and honors or awards conferred.

UD Students may withhold directory information by contacting the Registrar's Office or by changing privacy settings through UDSIS. This causes the following FERPA icon to be placed at the top of their online student record: .

You should confer with the Registrar's Office before determining whether it is appropriate for you to disclose an education record under the "directory information" exception to the written consent requirement.

When the information is requested by the victim of a crime of violence and relates to the results of a disciplinary proceeding against the alleged perpetrator of that crime. A recent amendment to FERPA permits an institution to include, as part of a student's record, information regarding disciplinary action taken against the student for conduct that posed a significant risk to the safety or well-being of the student or others within the school community, and to disclose such information to parents, teachers, and school officials, including those in other schools, who have legitimate educational interests in the behavior of the student.

• When a student reaches the age of 18 or begins attending a post-secondary institution regardless of age, FERPA rights transfer to the student. As a general matter, parents do not have the right to obtain information in education records, including grades, attendance records, or faculty notes about a student's performance in class, unless either the student consents to disclosure or one of the specific FERPA exceptions permits disclosure without the student's consent.
• Students may choose to share specific components of education information with parents/guardians through the Parent/Guardian Secure Services web application. They can change sharing options at any time and are periodically prompted to review their sharing settings.
• UD faculty and staff members may not discuss a student's education record with a parent over the telephone or in person without the written consent of the student. If a parent telephones or visits you to discuss a student, you should decline to do so without written consent from the student.

• Under FERPA, UD faculty and staff members are responsible for protecting education records in your possession and ensuring that those records are not disclosed inappropriately.
• UD faculty and staff members may access and use education records only as necessary to conduct official business that is related to the educational interest of the student.
• UD faculty and staff members should take appropriate measures to protect education records for unauthorized disclosure. Education records stored on personal computers or local networks should be password-protected. Education records maintained in hard-copy form should be secured in locked drawers or other locations from which unauthorized personnel are excluded.
• If somebody who is not a member of the University community - someone claiming to be a student's family member, friend, business associate, or the like - contacts you and says he or she needs to reach the student because of an emergency, the person should be directed to the University of Delaware Police Department.  Do not take it upon yourself to supply information about the student unless you have reason to believe that a health or safety emergency authorizes you to release information without the student's written consent.

Actions Allowed Under FERPA:

• Releasing an education record to the student who is the subject of the record when his or her identity can be positively identified. In general, telephone and non-UD e-mail are not reliable methods to make positive identification. UD e-mail is allowed.
• Posting grades to UD information systems.
• Handing graded work directly to a student in or out of class. (Grades should not be visible to other students when returning student work. A posted grade list is prohibited unless students are identified uniquely using something other than names.)
• Providing information from an education record to school officials with a legitimate education need to know.

Actions Not Allowed Under FERPA:

• Sharing information about students with third parties, parents or others unless the student has provided written consent specifying what information you may share, i.e. letters of recommendation.
• Sharing Directory Information without a written release from a student who has a FERPA restriction.
• E-mailing students any confidential information including grades, unless specifically requested through their UD e-mail account. This information can ONLY be released directly to the student in person, on UDSIS, on UD-supported Learning Management Systems (Canvas), or through UD e-mail. Posting confidential information to other websites, e-mail addresses, blogs, etc. is not allowed.
• Releasing a student's class schedule. If there is an emergency in which an individual needs to locate a student, refer the individual to University of Delaware Police Department.
• Asking students in a class to hand back graded work to other students.
• Leaving graded student work in a public area.
• Sharing or discussing personally identifiable education records with your colleagues or co-workers unless a legitimate education need exists.
• Posting grades in a manner that easily identifies students.
• If in doubt, DO NOT release information about a student. Refer requests and questions to the Office of the Registrar at registrar@udel.edu.

UD Faculty/Staff who work with student records will be prompted to acknowledge their annual review and understanding of the University's FERPA policies and their intention to act in compliance with them.