Training for MGH Institute student employees on FERPA requirements.

1. Training for Student Workers
MGH Institute of Health Professions
Use your down arrow or click your mouse to advance through the presentation

2. What is FERPA?
 The Family Educational Rights and Privacy Act (FERPA) (20




U.S.C. § 1232g; 34 CFR Part 99) is a federal law that
protects the privacy of student education records.
FERPA was passed in 1974 and is one of the oldest federal
privacy laws.
It prohibits schools from releasing student “education
records” without the consent of the eligible student.
FERPA applies to all schools that receive federal funding.
All students enrolled in institutions of higher
education, regardless of age, own their FERPA rights.

3. Defining Educational Records
 Records, files, documents, and other materials that
contain information directly related to a student and
which are maintained by an educational agency or
institution or by a party acting for the agency or
institution.
 This is very broad definition as it encompasses paper
files, electronic files, video recordings, audio
recordings, and other data.
 Educational records are made up of “Directory”
(described in upcoming slides) and “Non-Directory”
information.

4. Student Rights
Student rights begin when a student registers for courses for the
first time. These rights include:
 Inspection and review of educational records.
 Requesting an amendment of educational records.
 Consent to the disclosure of educational records.
 Filing a complaint with the FERPA office in Washington, D.C.
 Obtaining a copy of the school’s FERPA policy.
 The Institute publishes its FERPA policy in the most current
online catalog under the Students Rights to Privacy Information
– FERPA section and students are informed in our Annual Notice
to Students.
 FERPA information can also be found on the Registrar’s section of
our website.

5. How is FERPA enforced?
 FERPA is legally enforced through the Department of
Education’s Family Policy Compliance Office.
 People cannot sue a school for violating FERPA. This was
addressed by the U.S. Supreme Court in Gonzaga
University v. Doe.
 FERPA authorizes the Department of Education to end ALL
federal funding to a school. This penalty is rare. In all of
FERPA’s history, this sanction has never been imposed on
a school.

6. What isn’t covered by FERPA?
 Sole Possession (personal) notes
 Used only to aid your memory.
 Kept for your own use.
 Are not shared with anyone.
 If you share these with anyone, including school officials, they become FERPA
records.
 Observations or personal knowledge;
 Example: overhearing a student making a threatening comment, a student’s
demeanor or mood, etc.
 Law enforcement/public safety records;
 Maintained solely for law enforcement purposes.
 Employment records;
 As long as employment is NOT connected to student status.
 Treatment records;
 Made and maintained by a health care professional as part of
medical/psychological treatment of the student.

7. Directory Information
Information contained in an education record of a student
which would not generally be considered harmful or an
invasion of privacy if disclosed. (1988 Final Regulations)
 Directory information as defined by the Institute:
Name, address, telephone listing, email
Address, Photograph, Date and Place of Birth, Class, Enrollment
Status, Major Field of Study, Participation in official recognized
activities, Dates of attendance, academic honors, Degrees and
awards received, the most recent previous educational agency or
institution attended.

8. Directory Information
 Students may opt to restrict the release of their Directory
information.


FERPA flags will not exclude the student from appearing on
internal reports used by school officials with legitimate
educational interest.
 The only exclusion that applies to school officials is the release
related to internal mailing lists based on ethnicity.
Students may set these flags by going to IONLINE and setting
their privacy options.
 Please note that any requests for directory information on
individual students or groups of students should be sent to the
Registrar’s Office.

9. Disclosure
 The Institute may disclose directory information without consent.
 The Institute must allow eligible students a right to opt out of the
disclosure of directory information.
 The Institute must have written permission from the student to
release any part of their education record that is not considered to
be directory information.
 Exceptions to the previous bullet include, but are not limited to,
 School official with legitimate educational interest (defined in
upcoming slide).
 Subpoena or court order.
 Health or safety emergency.

10. Disclosure (continued)
DISCLOSURE TO PARENTS:
 At institutions of higher education, FERPA rights belong to the
student , and parents are generally not entitled to access the
student’s record without the student’s written consent.
 According to federal law, disclosure to parents is permitted, but not
required, only in the following situations.
 If the student is claimed as a dependent for federal income tax
purposes. Note – this is up to the individual Institution.
 In a health or safety emergency.
 If the student is under 21 years old, and the information involves
disciplinary records about an incident involving the possession of drugs
or alcohol.
It is important to note that the Institute has chosen not to communicate any
non-directory education record information to parents without written
consent from the student.

11. Legitimate Educational Interest
 Non-directory (confidential) education records can be
released without the student’s prior consent to an
Institute official with legitimate educational
interest, which is defined as:
 Performing a task that is specified in his/her position
description or contract.
 Performing a task related to a student’s education or a
student’s discipline.
 Providing a service or benefit to the student.
 Maintaining safety and security on campus.

12. Student Employees
 Student employees may have access to the student
information system (Ellucian), provided that job
responsibilities require it.
 If you supervise a student employee it is your
responsibility to insure that they understand FERPA and
the importance of keeping student records confidential
even if they do not have access to Ellucian.
 The Student Employee FERPA Statement of
Understanding must be signed by the student employee.
(Handled by HR)

13. Protection of Student Data
 Electronic educational record data should only be
accessed through your Institute logon and password and
must be stored on Partners home drives or shared
network drives.
 Non electronic educational record information must be
stored in secured/locked locations.
 Use discretion when sending data via e-mail.


Never include the SID/SSN in the subject line of an e-mail.
Do not send student information to or from non-IHP e-mail
addresses.

14. Review
 The next set of slides will take you through various
scenarios you might encounter. Try to answer each
question before reviewing the correct answer in order to
test your knowledge.

15. Your friend calls you and asks if you can make a copy of
her transcript because her insurance company needs
it. Can you do your friend this favor?
No. You should refer your friend to IONLINE to make a request for a
transcript online. Even if your job responsibility includes making copies of
transcripts for this reason, your friend should go through the proper process
to request it.

16. A person walks into your office with a signed
letter giving consent to release the grades of a
current student. Do you release the information
contained in the letter to him/her?
No. You should direct the individual to the Registrar’s Office.

17. A person comes into your office and retrieves
information about a student from a computer
that you left unattended. Under FERPA, are you
responsible?
Yes. he medium in which the student information is maintained is
unimportant. The same answer would apply to a report or file on a student
that you left on your desk. It is your responsibility to insure that no student
information is left accessible or unattended, including data on your computer.

18. When do the FERPA rights of a student begin?
1) At the point of application.
2) At the point of admission.
3) When the student makes payment.
4) When the student registers for courses for the first
time?
Number 4. The FERPA rights of a student begin when the student is first
registered for courses.

19. Information would be considered part of an
education record based on which of the following?
1) It was directly related to the student and officially
maintained by the Institute .
2) Kept only in the Registrar’s Office.
Number 1. An educational record is information that is directly related to the
student and maintained by the institution. Information does not need to be
kept only by the Registrar’s Office in order to be considered an educational
record.

20. You are concerned about a friend as he has not
been going to classes this semester. You have
access to see matriculation information as part of
your duties and decide to look to see if he is on
academic probation . You find out that he is and
you confront your friend with this information. Is
this a violation of FERPA?
Yes. This is a violation of FERPA. Even if you do not disclose this information
to anyone else, simply looking up this information could result in serious
consequences such as loss of employment and possible disciplinary action by
Student Conduct and Academic Integrity Programs.

21. Which of the following would NOT be
considered educational record information?
1) A student’s library suspension.
2) The grade from a student’s term paper.
3) Date of birth.
4) Student email address.
Number 1. A library suspension would be a record kept by the Treadwell
Library for library access purposes only and would not be covered by FERPA.
All of the other items would be considered pieces of the educational record
and therefore would be covered by FERPA.

22. At the Institute do parents have the same rights
as students to access the student’s educational
record? What if they are the one who pays for
the student’s books and housing meal plan?
No. parents do not have the same rights as students to access the student’s
educational record. The Institute requires written consent from the student to
release information to any party, including the parent.

23. A special agent with the FBI arrives at your office
with a subpoena for educational records? Should
you comply with their request?
No. you should not. You should refer them to the Registrar’s Office who will
handle the processing of the subpoena, including coordinating the collection
of any educational records from your department or unit.

24. Your friend stops by to see you during your break
and asks you if you can look up their class
schedule. Can you do this?
No. Direct your friend to look up their class schedule on IONLINE.

25. True or False: FERPA says that the Institute must
release to anyone, upon request, any information
identified as directory information.
False. The Institute considers the PURPOSE or USE of the data in determining
if releasing such information is necessary. FERPA states that institutions may
release directory information not that we have to release directory
information. In addition to FERPA that are other policies by which we must
abide, including, but not limited to, Institute/Partners privacy policies and
practices.

26. If you are granted access to Ellucian, our student
datatbase, that means that you have the right to
inspect the educational records of any student
attending the Institute without giving a reason.
False. FERPA states that you must have a legitimate educational interest when
you access or view a student’s educational record without their consent. This
means that you can only access the information on those students that is
required to fulfill any professional responsibility you have to the student or
the Institute.

27. Your coworker doesn’t have her access to Ellucian
yet and asks you if she can use yours. Can you
give it to her?
No. You should never allow another person to use your access. You are
responsible for any action that is taken with your User ID and many actions in
Ellucian are tracked. It is also a violation of the security policy you signed
when you were given your access and abuse of your access to any system can
be permanently revoked for misuse.

28. There is a box of old transcripts in your department
and you are asked to throw them away. Is it okay for
you to place them in the recycle bin in the kitchen?
No. Any papers containing personally identifiable information should be shred
and not placed in a recycle bin or trash bin.

29. A student calls you and asks what grade she
received in a course. Can you tell her what grade
she received over the phone?
No. You should never discuss educational records over the telephone.
Encourage students to log into their IONLINE account to view their grades.

30. In Review
 Check the NAE screen in DATATEL before you answer any
questions. If there is a restriction, you may not release
the information.
 Non-directory information may be released to third
parties with a signed and dated written consent from the
student. The consent must specify:
 What educational records are to be disclosed;
 The purpose of the disclosure;
 Identify the party or class of parties to whom the disclosure
may be made.

31. REMEMBER
You must protect the rights of
students.
When in doubt…don’t give it out
and always refer questions to the
Registrar’s Office.

32. Thank you for completing
FERPA training
for Student Employees at the
MGH Institute of Health Professions