Background?
Education records, for institutions that receive federal funding, have privacy protections under U.S. law.
Why?
Grades, disciplinary actions and other school information about a particular student deserve privacy protection.
What?
Family Educational Rights and Privacy Act of 1974 (FERPA)
Protection of Pupil Rights Amendment of 1978 (PPRA)
FERPA is often referred to as the Buckley Amendment, in reference to Senator James Buckley, who supported its enactment.
FERPA
Federal statute provides
students with control over disclosure and access to their education records, also student email
Scope
Applies to all educational institutions that receive federal funding
education Records - maintained by the school,
Education Record Exclusions
the following records are not considered education records under FERPA:
Campus police records created and maintained by school campus police for law enforcement purposes
Employment records, when the employee is not a student at the university
Treatment records or health records, subject to several requirements
Applicant records of those who are not enrolled in the university
Alumni records created by a school after the individual is no longer a student
Grades on peer-graded papers, before they are collected and recorded by a faculty member or other university representative
Students cannot use this opt-out to prevent the release of information that falls under a FERPA exception.
DOE PII Definition
Directory Information
“Directory information” is broadly defined by FERPA to include information that would not generally be considered an invasion of privacy or harmful if disclosed.
FERPA does not designate specific information types as directory information for every educational institution; rather, it rather allows individual educational institutions to create their own definitions based on lists of examples provided in the statute and rules laid down by the Department of Education.
Before an educational institution can declare information directory information and begin using it as such, the institution must provide students with an opportunity to opt out, or block, the release of their directory information.
Disclosure
Schools must use “reasonable methods” to verify the identity of the party to whom they disclose the information
School is authorized to disclose personally identifiable information from an education record without student consent in the following cases
Educational institutions in which a student seeks or intends to enroll, or is currently enrolled,
information related to sex offenders and others when the information is provided to the school under federal registration and disclosure requirements.
To a person or entity that is verified as the party that provided or created that record.
In connection with financial aid that the student has received or for which the student will apply
To appropriate parties in connection with a “health or safety emergency,”
How?
Consent Under FERPA. Valid student consent to disclosure must be signed (by hand or electronically), dated and written.
Identifies
The record(s) to be disclosed
The purpose of disclosure
To whom the disclosure is being made
Student Rights
FERPA provides students with the right to access and review their education records.
Students can request corrections to their education records if they believe the records to be inaccurate, misleading or in violation of their privacy.
If the request is granted, the records must be corrected within a reasonable time (45 days)
FERPA ap vs PPRA
FERPA
applies only to information stored in education records
Directly relates to a student
Maintained by the educational institution or on behalf of the institution
PPRA
All other records (Email, Directories, )
Why does this matter
Institutions could use this information to sell student directory information to commercial entities such as banks or credit card companies, unless a parent or student opts out.
PPRA Rights to Parents for minors
Political affiliations
Mental and psychological problems potentially embarrassing to the student and his/her family
Sex behavior and attitudes
Illegal, antisocial, self-incriminating and demeaning behavior
Critical appraisals of other individuals with whom respondents have close family relationships
Legally recognized privileged or analogous relationships, such as those of lawyers, physicians and ministers
Religious practices, affiliations or beliefs of the student or student’s parent Income
No Child Left Behind Act of 2001
Broadened the PPRA to limit the collection and disclosure of student survey information
The No Child Left Behind Act of 2001 contains a major amendment to PPRA that gives parents more rights with regard to
The surveying of minor students
The collection of information from students for marketing purposes
Certain non-emergency medical examinations.
In addition, an eight category of information (*) was added to the law.**
Public school
Private School - No FERPA, not federally fundunded, FERPA
University - FERPA - student, HIPAA - not student (faculty/staff)
Treatment Records-FERPA exemption?
Institution
Provider/Patient
Privacy Rule
Public Elementary
Nurse/Student
FERPA (it’s public)
Public Secondary
Nurse/Student
FERPA (it’s public)
Post Secondary (non federal)
Read Footnote 10, 11, 42
HIPAA Enactment Concerns
U.S. Department of Health and Human Services (HHS) to address in the Privacy Rule for HIPAA was whether schools would be covered.
the final version of the HIPAA Rule exempted schools where educational records were already subject to the privacy regime of FERPA
Results
the general rule is that health records are subject to FERPA—and not HIPAA
Restrictions - Only where a public elementary or secondary school provides a nurse for student health issues
New technology changes in education.
Online hosting of teaching material for students
Online posting of homework assignments
Online communication between teachers and students
Online delivery of grades to students and parents.
Costs - Many of these technologies are provided free to those in education settings.
Restrictions
These technology company activities are subject to the laws discussed in this chapter
Department of Education issued guidelines to provide assistance in explaining how FERPA applied in the online arena.
Self-regulation
Companies are now a prominent source of privacy rules applied in the educational technology space.
FERPA/PPRA Protections
U.S. law provides the major Fair Information Practice Principles related to education records that schools receiving federal funding must abide by.
Actions Required by Educational Institutions
Must examine their practices to ensure compliance with these relatively detailed rules.