FERPA: What Faculty and Staff Members Need to Know
It's the Law
FERPA (Family Educational Rights and Privacy Act), also known as the Buckley Amendment, was passed by Congress in 1974. It grants four specific rights to a post-secondary student:
- to see the records that the institution is keeping on the student.
- to seek amendment to those records and in certain cases append a statement to the record.
- to withhold the disclosure of a student’s educational records except for situations involving legitimate educational interest or as may be required by law.
- to file a complaint with the FERPA Office in Washington.
FERPA applies to all educational agencies or institutions, including Boston College, that receive funds under any program administered by the Secretary of Education.
FERPA governs what may be released, but does not require that any information be released.
It's Your Responsibility
You may not disclose personally identifiable information from educational records to persons other than the student in question and University officials who have legitimate educational interest. A University official has a legitimate educational interest in access to information when that information is appropriate for use in connection with: performing a task that is related to the student’s education; providing a service or benefit relating to the student or student’s family, such as housing, health care, counseling, job placement, or financial aid; performing a task related to the discipline of a student; maintaining the safety and security of the campus; or otherwise performing a task related to the effective functioning of the University. As a general principle, you may not disclose student information in oral, written, or electronic form to anyone except BC staff and faculty who need the information to perform their university functions.
You have a legal responsibility under FERPA to protect the confidentiality of the student educational records in your possession. You may not access educational records for personal reasons.
Student information stored in an electronic format must be secure and available only to those entitled to access that information.
You may not release lists or files with student information to any third party outside your college or departmental unit.
Confidential data should not be stored on laptops or home computers unless it is encrypted. Personal digital assistants used to read confidential data should be password protected.
Confidential data in paper format must be shredded before disposal or placed in a locked disposal bin.
Student Information Types
Student educational records include records directly related to a student and maintained by the institution or by a party acting for the institution. Examples include exams, papers, advising notes, applications, and financial documents. FERPA requires institutions to allow students to review educational records upon request. Personal notes maintained by and for a sole individual as a memory aid and not made available to any other faculty or staff members are exempted from this requirement under FERPA. Nevertheless, such “sole possession notes” could be subject to discovery through a court subpoena. Exclusions to student educational records include certain law enforcement records, certain treatment records, non-matriculant records, employment records, and post-graduation alumni records.
“Directory information is… information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.” (FERPA Regulations, Code of Federal Regulations, Title 34, Part 99.3)
Information designated by the university as directory information such as email addresses, local and home addresses, telephone numbers, and enrollment status is considered public and can be released without the student’s written permission. However, the student may opt to keep this information confidential. Directory information does not include:
- ethnicity or race
- social security number
- student identification number
- religious affiliation
- grades or GPA
- course enrollment or schedule
How can a student withhold release of directory information?
A student who so wishes has the right to prevent the release of all directory information including verification of enrollment, or of suppressing selected directory information either to the Boston College community or to the general public. In order to do this, students must enter their Agora Portal account by the end of their first week of enrollment to suppress the release of all or selected directory information. Suppression is available by selecting Privacy Preferences. Student directory information will not be blocked from faculty and staff conducting official university business.
Can student directory or public information always be released?
Student directory information should not be released to third parties. All inquirers should be referred to the online directory. Students have set their Privacy Preferences identifying the information that can be released to both internal (via authenticated Agora Portal logon) and external audiences. Directing inquiries to the online directory will ensure that the information released is based on students’ current preferences.
Can student non-directory information ever be released?
All non-directory information is considered confidential and will not be released to outside inquiries without the express written consent of the student.
What should I do if I’m concerned about a student’s health or safety, or the health or safety of those around the student?
You should speak with your department chair, dean, director, or Counseling Services anytime you have a health or safety concern. FERPA allows you to make disclosures of education records to others within the University who have legitimate educational interests in the information, which interests include the performance of services to students, the effective functioning of the University, and the safety and security of the campus.
FERPA also permits disclosures of information in a health or safety emergency, if in light of the circumstances and information available at the time, that knowledge of the information is necessary to protect the health or safety of a student or other individuals. Your own personal observations of a student’s behavior or condition are not educational records and thus are not regulated by FERPA. Federal and state rules limit what may be disclosed from a student’s health or counseling records, to you or to others, but these rules also contain exceptions for community health and safety emergencies. So, if you have a concern about a student, first and foremost, report it.
What if someone needs to reach the student because of an emergency?
All such inquirers should be directed to Campus Police.
What are parental rights under FERPA?
When a student reaches the age of 18 or begins attending a post-secondary institution regardless of age, FERPA rights transfer to the student. Parents may obtain directory information at the discretion of the institution. Parents may obtain non-directory information (grades, GPA, etc.) at the discretion of the institution AND after it has been determined that their student is legally their dependent. Parents may also obtain non-directory information by obtaining a signed consent from the student. It is generally the University’s practice not to make disclosures from a student’s educational records involving academic matters to parents without the student’s written consent.
What must I do if I receive a subpoena concerning student educational records?
A fax of the subpoena should be sent immediately to the Office of the General Counsel. The fax number is 617-552-0961. The Office of the General Counsel will determine whether and how to comply with the subpoena and will determine whether student notification of compliance with the subpoena is required.
For more information?
See the Student Educational Records Policy on the BC Policies and Procedures website or contact Louise Lonabocker, Kathy McGuinness, or Ursula Della Porta in the Office of Student Services.
- disclose information to a student or University official before authenticating the identity of the person.
- link a student’s name with his/her social security number, BC student ID number, or any portion of these numbers in any manner.
- send confidential information such as grades in an email.
- leave graded tests, papers, or other student materials for students to pick up in a stack that requires sorting through the papers of all students.
- include confidential information such as grades or GPA in a recommendation without the written consent of the student.
- discuss the progress of any student with anyone other than the student or the student’s advisor without the consent of the student. Refer inquiries from any other parties including the student’s parents to the student’s academic Dean.
- provide anyone with lists or files of students enrolled in your classes for any commercial purpose.
- provide anyone with student schedules or assist anyone other than university employees in finding a student on campus. Refer such inquiries to Campus Police.
- access the records of any student for personal reasons.
- release your password for ANY reason.