FERPA FAQs for Faculty & Staff

For University Staff and Faculty

When do the FERPA rights of a student begin?

According to the law, a person becomes a student for purposes of FERPA when they are "in attendance" at an institution. This includes attendance in person or remotely by videoconference, satellite, Internet, or other electronic and telecommunications technologies. At MACU, we define a student as someone currently or previously enrolled in any academic offering of the University. This does not include prospective students or applicants to any academic program of the University.

FERPA becomes effective on the first day those newly admitted students who have scheduled at least one course. A student who accepted an admission offer but did not schedule at least one course, or a newly admitted student who canceled his/her registration either before or after the semester begins, is not covered by FERPA. 

What are the penalties for violting FERPA?

The Family Policy Compliance Office (FPCO) of the Department of Education reviews and investigates complaints of alleged violations of FERPA. If the (FPCO) Office finds that there has been a failure to comply with FERPA, it will notify the institution about the corrections that need to be made to bring the institution into compliance. The FPCO will then establish a reasonable period of time for the institution to voluntarily accomplish the specified changes. If the Secretary of Education finds that, after this reasonable period of time, an institution has failed to comply with FERPA and determines that compliance cannot be secured by any means, he or she can, among other options, direct that no federal funds (financial aid, education grants, etc.) be made available to that institution.

 What is an education record?

Any record that is maintained by the institution and is personally identifiable to the student. Exceptions to this are medical records, law enforcement records, employment records, alumni records, and sole possession records such as notes in sole possession of the maker, used only as a personal memory aid and not revealed or accessible to any other person.

Who is a “university official?”

A University official is any person employed by the University in an administrative, supervisory, academic, research, or support position; a person elected to the Board of Trustees; a student or a University graduate serving on an official University committee or assisting another University official in performing his or her tasks; or a person employed by or under contract to, or serving as the agent of, the University to perform a specific task.

What data has the Mid-Atlantic Christian University defined as directory information?

Name, permanent and local address and telephone number, school or college, class level, major field, dates of attendance, degree received and date awarded, honors and awards received, participation in recognized activities, previous school(s) attended, and height and weight of members of intercollegiate athletic teams.

Can you share a student's information with their parent?

No. Once a student reaches the age of 18 or attends an institution of postsecondary education, the parents have no rights under FERPA. Only the student can give permission for their parents to have access to their records.

What should you do if your unit receives a subpoena for an academic record?

Forward it to the Office of the Registrar as soon as possible.

Can an instructor post grades or exam results in a public place using a portion of the students' social security number or MACUID?

No. In order for an instructor to post grades or scores, they must either have the written permission of the students or use an identifier that is known only to the instructor and each individual student.

A scholarship committee chair from a fraternity or sorority has asked to receive the grade point averages of their members? Can this information be released to them?

No. The student scholarship chair for a fraternity or sorority is not a "university official" and therefore may not have access to grade point averages of its members. All members of the fraternity must sign written release authorizing the scholarship chair access to their grade point averages.

If a private business requests directory information for students in your unit, must you release this information?

No. An institution is under no obligation to release directory information to anyone. FERPA only says that an institution MAY release directory information. When in doubt, refer the individual to the Registrar's Office.

Do faculty members have a right to inspect education records of any student without giving a reason?

No. Faculty members are considered "school officials", but the faculty member must demonstrate "a legitimate educational interest" in their request to access student records, e.g. advising students, retention study, etc.

You receive a telephone call from a parent claiming there is a family emergency and they need to contact their child immediately. Can you tell the parents the day, time and location of their child's class?

Generally, the answer is “no.” At MACU , a student's class schedule is not listed as directory information; therefore this information may not be released. The answer may be “yes” depending on the circumstances of the emergency. FERPA states that if the release of non-directory information is “necessary to protect the health or safety of the student or other individuals,” then this information may be released.

Are student-related comments and notes covered by FERPA?

There are many offices at the University that record comments and notes regarding students. These may be entered in kept in the student file in a department or a university-wide system. It is important for anyone recording notes regarding an interaction with a student to understand that unless these notes fall into the category of "sole possession"records,then they are part of the student's education record and subject to FERPA. Since FERPA gives the student the right to review any or all of his/her education record, these notes could be included in that review. Therefore, it is important that notes or comments be factual and objective and that University employees who are recording notes or comments avoid making value judgments or using inappropriate language.

I've found an interesting new online tool that I'd like to use as part of my class. Is it OK to upload my class list to the vendor's website so that students can log in to the site?

If a university is providing non-directory information to these vendors (and since class enrollment is not directory information, uploading a class list constitutes a release of non-directory infromation), then FERPA applies. FERPA either requires the consent of every student prior to releasing his/her non-directory information to the vendor, or that a contract is in place with the vendor containing four specific clauses. 

What are some specific examples of FERPA violations?

  • Publicly posting grades by student name or any part of the student ID number without the student’s written permission
  • Leaving graded tests or papers in a stack for students to pick up by sorting through the papers of all students
  • Circulating a printed class roster with names and any part of the student ID, SSN, or grades as an attendance sheet
  • Discussing the student’s progress or records with anyone other than the student (including parents) without the student’s written consent, with the exception of University officials who have a legitimate educational interest in order to fulfill their professional responsibilities
  • Sending a letter of recommendation that includes information from a student’s record, such as grades, GPA, or course attendance, without explicit written permission of the student to release that information
  • Sending a letter of recommendation for a student employee, graduate assistant, or teaching assistant that provides details about that student’s employment (i.e., wages, dates of employment) without written permission of the student
  • Providing lists of students enrolled in class (class roster) to a third party for any commercial purpose
  • Providing student schedules or assisting anyone other than University employees in finding a student on campus
  • Permitting unauthorized use of any information in the files maintained, stored, or processed by the office in which you are employed. This includes copies of permission, registration, or add/drop forms
  • Releasing confidential student information to another student or outside entities
  • Distributing a student’s transcripts. Transcript requests must be submitted to the Registrar’s Office
  • Leaving reports or computer screens with student information in view of others or leaving your computer unattended
  • Allowing another person to access student records because you permit him or her to use your access code
  • Inappropriately disposing of paperwork containing confidential student information (i.e., student ID number, GPA, or grades) by placing it in the trash or recycle bin, rather than shredding the information
  • Disclosing directory information if the student has submitted a written request for non-disclosure of directory information