Penn State Mark

FERPA Frequently Asked Questions (FAQ)

  1. What is FERPA?
  2. Why should I care about FERPA?
  3. What are students' rights under FERPA?
  4. What are "education records"?
  5. Are there any records that are not considered education records?
  6. Are student-related comments and notes covered by FERPA?
  7. What does the law mean when it says that students have the right to control disclosure of their education records?
  8. Does "written consent" have to be collected on paper?
  9. Are there any conditions under which student education records may be disclosed without the student's consent?
  10. Who are "University officials"?
  11. What constitutes "legitimate educational interest"?
  12. Is there any student information that can be released without the student's permission?
  13. What is directory information?
  14. Is the University required to release a student's directory information?
  15. Can a student prevent the release of their directory information?
  16. When do student's FERPA rights begin?
  17. Do University employees have to obtain the student's permission before reviewing a student's education record?
  18. I've found an interesting new online tool that I'd like to use as part of my class. Is it OK to uplad my class list to the vendor's website so that students can log in to the site?
  19. I am interested in conducting research and I need information from student transcripts. What do I need to do?
  20. Do parents have any rights under FERPA?
  21. What changes were made to FERPA in December 2008?
  22. Where can I get more information about FERPA and Penn State's student records privacy policies?

  1. What is FERPA?

    FERPA is the Family Educational Rights and Privacy Act and is a federal law that was enacted in 1974. FERPA protects the privacy of student education records. All educational institutions that receive federal funding must comply with FERPA.

  2. Why should I care about FERPA?

    If you're a student, it's important for you to understand your rights under FERPA. If you're a parent, you'll need to understand how the law changes once your student enters a post-secondary institution. If you're an employee of Penn State with access to student education records, you're obligated to comply with FERPA and to protect those records according to the law.

  3. What are students' rights under FERPA?

    FERPA gives students four basic rights with respect to their education record:
    • The right to control disclosure of their education record
    • The right to review their education record
    • The right to request amendment of inaccurate or misleading portions of their education record
    • The right to file a complaint regarding non-compliance of FERPA with the Family Policy Compliance Office of the U.S. Department of Education

  4. What are "education records"?

    Education records are defined as records, files, documents, and other materials that contain information directly related to a student and are maintained by Penn State or by a person acting for the University. Education records take many forms, including paper and electronic. Education records include:
    • Grades
    • Class lists
    • Student course schedules
    • Disciplinary records
    • Student financial records
    • Payroll records for employees who are employed as a direct result of their status as students (e.g. work study, assistantships, resident assistants)

  5. Are there any records that are not considered education records?

    The following records are excluded from the definition of education records:
    • "Sole possession" records made by faculty and staff for their own use as reference or memory aids and not shared with others
    • Personal observations
    • University law enforcement records
    • Medical and mental health records used only for the treatment of the student
    • Alumni records
    • Peer graded papers and exams prior to the grade being recorded in the instructor's grade book
  6. Are student-related comments and notes covered by FERPA?

    There are many offices at Penn State that record comments and notes regarding students. These may be entered in ISIS on various comment screens or kept in the student file in a department or college. It is important for anyone recording notes regarding an interaction with a student to understand that unless these notes fall into the category of "sole possession" records (see definition in question 5 above), then they are part of the student's education record and subject to FERPA. Since FERPA gives the student the right to review any or all of his/her education record, these notes could be included in that review. Therefore, it is important that notes or comments be factual and objective and that University employees who are recording notes or comments avoid making value judgments or using inappropriate language.
  7. What does the law mean when it says that students have the right to control disclosure of their education records?

    It means that a student's education records may be disclosed only with the student's prior written consent. The prior written consent must:
    • Specify the records to be released
    • State the purpose of the disclosure
    • Identify the party(ies) to whom disclosure may be made
    • Be signed and dated by the student

  8. Does "written consent" have to be collected on paper?

    No. In recent years, the U.S. Department of Education has clarified that an electronic signature may substitute for a written one. In order to qualify as an electronic signature, appropriate authentication must occur. Penn State's access account satisfies the requirements for an electronic signature. Since students must log in to Penn State's e-mail system using their Penn State access accounts, an e-mail note from a student's @psu.edu e-mail address satisfies FERPA's written consent requirement. However because security measures for other e-mail systems are not as strict, an e-mail received from a Gmail, Yahoo mail, or AOL mail account for example would NOT qualify as written consent.

  9. Are there any conditions under which student education records may be disclosed without the student's consent?

    Yes, FERPA does contain some exceptions to the written consent rule. Those exceptions allow disclosure without consent:
    • To University officials (including third parties under contract) with legitimate educational interests
    • To comply with a judicial order or lawfully issued subpoena
    • To appropriate parties in a health or safety emergency in order to protect the student or others
    • To parents in cases of drug or alcohol violation when the student is under the age of 21
    • To the provider or creator of a record to verify the validity of that record (e.g. in cases of suspected fraud)
    • To organizations conducting research studies on behalf of the University, provided there is a written agreement between the University and the research organization
    • To officials at an institution in which the student seeks or intends to enroll or is currently enrolled
  10. Who are "University officials"?

    "University officials" are University employees with general or specific responsibility for promoting the educational objectives of the University or third parties under contract with the University to provide professional, business and similar administrative services related to the University's educational mission. Individuals whose responsibilities place them within this category include instructors; faculty advisers; admissions counselors; academic advisers; counselors; employment placement personnel; deans, department chairpersons, directors, and other administrative officials responsible for some part of the academic enterprise or one of the supporting activities; University Police personnel; health staff; development officers; staff in Alumni Relations; administrative and faculty sponsors of officially recognized clubs, organizations, etc.; members, including students and alumni, of official college (or University) committees; staff personnel employed to assist University officials in discharging professional responsibilities; and persons or entities under contract to the University to provide a specific task or service related to the University's educational mission.

  11. What constitutes "legitimate educational interest"?

    FERPA permits university employees to have access to student education records in which they have "legitimate educational interest." Such access does not require prior written consent of the student.

    But what constitutes "legitimate educational interest"? A definition can be found in Penn State's University Policy on Confidentiality of Student Records, AD-11. Essentially, legitimate educational interest is necessary for employees to carry out their responsibilities in support of Penn State's educational mission. You can also think of legitimate educational interest as a "need to know" that is essential to carrying out your job responsibilities related to education.

    It is important to understand several points related to "legitimate educational interest:"

    • Curiosity is not a legitimate educational interest. Just because you have access to ISIS and are able to view the record of your neighbor's son, does not mean that you have a legitimate educational interest in his grades and cumulative GPA.
    • Simply the fact that you are a university employee does not constitute legitimate educational interest. Your need to know must be related to your job responsibilities in support of the university's educational mission. In other words, records should be used only in the context of official business in conjunction with the educational success of the student.
    • Your legitimate educational interest is limited. While you may have a need to access education records for students in your college, you do not necessarily have a similar need to view records of students outside your college. In other words, access to information does not authorize unrestricted use.

  12. Is there any student information that can be released without the student's permission?

    FERPA permits each institution to define a class of information as "directory information." FERPA permits public disclosure of directory information without the student's consent.

  13. What is directory information?

    Directory information is information contained in a student's education record that would not generally be considered harmful or an invasion of privacy if disclosed. You may view a list of Penn State's directory items on the Registrar's website.

  14. Is the University required to release a student's directory information?

    No. The only required disclosure of education records is to the student. All other disclosures, including those with student consent and disclosures of directory information, are at the discretion of the institution.
  15. Can a student prevent the release of their directory information?

    FERPA requires each institution to allow students to block disclosure of their directory information. At Penn State, we refer to this action as "confidentiality." The following are consequences of a student placing confidentiality on their record:
    • Student name/address is excluded from the Penn State online directory and printed telephone directories.
    • Student name will not appear in the commencement program.
    • Verification of enrollment, graduation, or degrees awarded will not be provided to third parties, including potential employers and insurance companies.
    • No information will be released to any person on the telephone or via e-mail.

    Requests for confidentiality are permanent until removed in writing by the student.

  16. When do student's FERPA rights begin?

    According to the law, a person becomes a student for purposes of FERPA when they are "in attendance" at an institution. This includes attendance in person or remotely by videoconference, satellite, Internet, or other electronic and telecommunications technologies. At Penn State, we define a student as someone currently or previously enrolled in any academic offering of the University. This does not include prospective students or applicants to any academic program of the University.

    According to Penn State policy, FERPA becomes effective on the first day of classes for those newly admitted students who have scheduled at least one course. A student who accepted an admission offer but did not schedule at least one course, or a newly admitted student who canceled his/her registration either before or after the semester begins, is not covered by FERPA.

  17. Do University employees have to obtain the student's permission before reviewing a student's education record?

    "University officials" are permitted access to student education records without student consent as long as those officials have a "legitimate educational interest" in that student's record. The student's permission is not required.

  18. I've found an interesting new online tool that I'd like to use as part of my class. Is it OK to upload my class list to the vendor's website so that students can log in to the site?

    There are many vendors offering services to streamline and improve instruction. Services such as WebAssign (an online homework and testing tool) and Piazza (a discussion tool) provide benefits to faculty and to students, often at no fee. Sounds like a win-win. But, if a university is providing non-directory information to these vendors (and since class enrollment is not directory information, uploading a class list constitutes a release of non-directory infromation), then FERPA applies. FERPA either requires the consent of every student prior to releasing his/her non-directory information to the vendor, or that a contract is in place with the vendor containing four specific clauses. If an instructor is considering using any vendor product that requires student information, then the instructor must first check with purchasesoftware@psu.edu to see if an appropriate contract is in place between Penn State and the vendor.
  19. I am interested in conducting research and I need information from student transcripts. What do I need to do?

    Anyone conducting research using information from student education records must receive approval for that research from Penn State's Office of Research Protections. In addition, researchers who are utilizing student education records in their research must agree to:
    • Use the information only for purposes of the approved research project. Any new use of the information requires new approval.
    • Provide adequate protection for the information to ensure that it is not compromised or subject to unauthorized access.
    • Ensure that no one outside the research team has access to the information.
    • Destroy the information within a reasonable time after completion of the research.

  20. Do parents have any rights under FERPA?

    In primary and secondary educational institutions (i.e. K-12), all FERPA rights belong to the parent. However, when the student reaches the age of 18 or begins to attend a post-secondary institution regardless of age, all FERPA rights transfer to the student. For Penn State students, the FERPA rights belong to the students, not the parents.

  21. What changes were made to FERPA in December 2008?

    The December 2008 update to the law did not change any of the four basic student rights under FERPA. The changes clarified portions of the law and incorporated interpretations that had been made over the years by the Family Policy Compliance Office and as a result of various court cases. You may review a summary of the changes on the Registrar's website.

  22. Where can I get more information about FERPA and Penn State's student records privacy policies?

    Confidentiality/FERPA
    Faculty and FERPA
    FERPA online Tutorial
    Family Policy Compliance Office of the U.S. Department of Education
    Penn State policy AD-11