FERPA and Confidentiality for Faculty & Staff
Family Educational Rights and Privacy Act
What is FERPA?
Maintaining confidentiality of student records is everyone's responsibility whether
you are faculty, staff or student.
Annually, The University of Toledo informs students of the Family Educational Rights and Privacy Act of 1974, as amended. This Act (formerly known as the Buckley Amendment), which the institution intends to comply with fully, has been designated to protect the privacy of educational records. The Family Educational Rights and Privacy Act (FERPA) affords students certain rights with respect to their education records.
FERPA gives colleges and universities the ability to release non-academic information, or "directory information", without the written consent of the student.
Directory Information includes:
- Student name
- Local address and local phone number
- Permanent zip code
- College and major field of study
- Class (freshman, sophomore, etc.)
- University E-mail address
- Dates of attendance
- Student activities
- Degrees, certificates, and awards received
- Full-time or part-time enrollment status
- Student photograph
- Graduate Medical Education placement (MD students only)
At its discretion the university may provide health directory information upon written request from a "public health authority" for the purposes of controlling or preventing the spread of a "disease of major public health concern." A "Public Health Authority" is an agency or authority of the United States government, a State, a territory, or a political subdivision of a State or territory, that is responsible for public health matters as part of its official mandate, as well as a person or entity acting under a grant of authority from, or under a contract with, a public health agency. A "Disease of major public health concern" is one designated by the Ohio Department of Health because of the severity of the disease or potential of epidemic spread.
Health Directory Information includes:
- Student name
- Local address and local phone number
- University email address
- Course enrollment and attendance
- Full-time or part-time enrollment status
- Seating assignment(s)
Students may restrict the release of their Directory Information and Health Directory Information at any point throughout the year by selecting the Update Directory Information/Release Status option in the Student tab on the myUT portal or by visiting the Office of the Registrar. Requests to restrict directory information will be processed immediately.
For additional information on The University of Toledo's policy, please visit the FERPA web page.
Penalties for Violating FERPA Regulations
The Family Policy Compliance Office reviews and investigates complaints of violations
of FERPA. If the Office finds that there has been a failure to comply with FERPA,
it will notify the institution about the corrections that need to be made to bring
the institution into compliance. The Office will establish a reasonable period of
time for the institution to voluntarily accomplish the specified changes.
If the Secretary of Education finds, after this reasonable period of time that an institution has failed to comply with FERPA and determines that compliance cannot be secured by any means, he can, among other options direct that no federal funds under his administrative control (financial aid, education grants, etc.) be made available to that institution.
Parental Access to Student's Educational Record
When a student reaches the age of 18 or begins attending a post secondary institution,
regardless of age, FERPA rights transfer from the parent to the student. Parents may
obtain non-directory information at the discretion of the institution and only after
it has been determined that their child is legally their dependent.. Should a parent
contact you regarding their child, you must not discuss the student with their parent.
You should advise the parent that their child must give you written authorization
that specifically identifies what information may be released to the parent before
you are allowed to do so.
While you cannot discuss the student's particular circumstances, you can listen to the parent's concerns and you are free to describe University policies and procedures, such as the drop/add policy, your attendance policy, billing procedures, the disciplinary process, etc. This information can be helpful to the parent while maintaining the student's privacy under FERPA.
What is an Educational Record?
Just about any information provided by a student to the university for use in the
educational process is considered a student educational record:
- personal information
- enrollment records
- grades
- schedules
Student educational records may be:
- a document in the Registrar's Office
- a computer printout in your office
- a class list on your desktop
- a computer display screen
- notes you have taken during an advisement session
Posting of Grades by Faculty
The public posting of grades either by the student's name, social security number
or student identification number without the student's written permission is a violation
of FERPA. This includes the posting of grades to a class website and applies to any
public posting of grades for students taking distance learning courses.
Instructors and others who post grades should use a system that ensures that FERPA requirements are met. This can be accomplished either by obtaining the student's written permission or by using code words or randomly assigned numbers that only the instructor and individual student should know.
Notification of grades via a postcard violates a student's privacy rights
Notification of grades via e-mail is not recommended. There is minimal guarantee of
confidentiality on e-mail. The institution would be held responsible if an unauthorized
third party gained access, in any manner, to a student's educational record through
any electronic transmission method.
The University of Toledo provides a secure web application for students (myUT portal) to view their academic record.
Letters of Recommendation
Statements made by a person making a recommendation that are made from that person's
personal observation or knowledge do not require a written release from the student.
However, if personally identifiable information obtained from a student's educational
record is included in the letter of recommendation (grades, GPA, etc.), the writer
is required to obtain a signed release from the student which (1) specifies the records
that may be disclosed, (2) states the purpose of the disclosure, and (3) identifies
the party or class of parties to whom the disclosure can be made.
If this letter is kept on file by the person writing the recommendation, it would be part of the student's education record and the student has the right to read it unless he or she has waived that right to access.
Sample letter of recommendation -
I give permission to Prof. Jones to write a letter of recommendation to:
Avi-Owen Corp.
5294 Highlandview Drive
High Point, NC 22155Prof Jones has my permission to include my GPA and grades.
I waive (or do not waive) my right to review a copy of this letter at any time in the future.
Signature/Date
The Media
Nothing in FERPA allows an institution to discuss a student's educational record publicly -
even if a lawsuit has made the information a matter of public record. A school official
may not assume that a student's public discussion of a matter constitutes implied
consent for the school official to disclose anything other than directory information
in reply. Additionally, university employees should follow university policy regarding
the release of information to the media. The official spokesperson for the university
is Marketing and Communication.
Legitimate Educational Interest
What is "legitimate educational interest"? In accordance with FERPA, a school official
has a legitimate educational interest if the official needs to review an education
record in order to fulfill his/her professional responsibility. This includes such
purposes as:
- performing appropriate tasks that are specified in her/his position description or by a contract agreement
- performing a task related to a student's education;
- performing a task related to the discipline of a student;
- providing services for the student or the student's family, such as health care, counseling, job placement, or financial aid.
What is NOT "legitimate educational interest"?
Legitimate educational interest does not convey inherent rights to any and all student
information. The law discriminates between educational interest, and personal or private
interest; determinations are made on a case-by-case basis. Educational interest does
not constitute authority to disclose information to a third party without the student's
written permission.
Special "DON'TS" for Faculty
To avoid violations of FERPA rules, DO NOT:
- at any time use the student's name or any part of the Social Security number or Student Identification Number of a student in a public posting of grades
- ever link the name of a student with his/her student's social security number in any public manner
- leave graded tests in a stack for students to pick up by sorting through the papers of all students
- circulate a printed class list with student name and social security number or grades as an attendance roster
- discuss the progress of any student with anyone other than the student (including parents) without the consent of the student
- provide anyone with lists of students enrolled in your classes for any commercial purpose
- provide anyone with student schedules or assist anyone other than university employees in finding a student on campus
Resource: The AACRAO 2001 FERPA Guide
For more information on FERPA, visit these web pages: