FERPA COVID-19 FAQ

FERPA is a Federal law that applies to educational agencies, institutions, and applicable programs funded by the U.S. Department of Education. FERPA provides students with three basic rights:

1. The right to access education records and to seek amendment of those education records
2. The right of privacy or the right to provide consent to disclosure of personally identifying information from student education records unless a specific FERPA exception applies
3. The right to file a complaint under FERPA

Under FERPA, "education records" are defined, with certain exceptions, as those records that:

1. Are directly related to a student
2. Are maintained by an institution or a party acting on its behalf

FERPA prohibits the disclosure of personally identifiable information from education records to third parties. This does not include school officials who have a legitimate educational interest, meaning they need that information to perform their assigned job duties.

Prior written consent must be obtained from the student before any personally identifiable information from education records is disclosed to anyone but that student or other school officials with a legitimate educational interest.

FERPA requires students to provide prior written consent for disclosure of their education record. This written consent must meet all of the following five standards:

1. It is signed and dated by the student;
2. It specifies the records that will or may be disclosed;
3. It states the purpose of the disclosure;
4. It identifies the party or class of parties to whom the disclosure may be made.
5. It must be retained and added to the education record.

Yes, FERPA permits prior written consent in electronic format if it meets both of the following two standards:

1. It identifies and authenticates a particular person as the source of the electronic consent;
2. It indicates that person's approval of the information contained in the electronic consent.

Electronic consent should be submitted through a secure email address (i.e., the student email address provided by the institution) or behind a secure sign-on portal to meet these standards.

Yes. FERPA does not prohibit instructors from taking education records home with them, as long as they have a legitimate educational interest in the records, meaning they need that information to perform their assigned job duties.

School officials, including instructors, who take home education records should use reasonable methods to secure student data from further disclosure. They should prevent unauthorized access to education records through physical, technological, and administrative means of control.

Yes. FERPA’s school official exception permits institutions to disclose student data to service providers that perform an institutional service under the following conditions:

1. The provider is performing a service or function for which the institution would otherwise use its own employees.
2. The provider meets the criteria of a school official in the institution’s annual notification of FERPA rights.
3. The provider is under the direct control of the institution.
4. The education records are used only for authorized purposes and there is no further disclosure of personally identifiable information without separate authorization under FERPA.

While FERPA’s school official exception does not require institutions to enter into an agreement with the provider, it is a best practice. In particular, it is helpful for such an agreement to clarify issues of direct control and data security, as well as to establish the legitimate educational interest.

No. FERPA does not specify permissible apps or software. Under FERPA’s school official exception, institutions may disclose education records to providers of online learning and virtual apps provided they meet the conditions of that exception (see the previous FAQ). Institutions should work with their Legal Counsel and Information Security Office to review a provider’s information security requirements and terms of service.

Instructors may share subject content in the virtual classroom but may not reveal personally identifiable information from education records other than saying a student's name. Names are considered directory information, which is data not normally considered a violation of a person's privacy if publicly available. Although students have the right to request non-disclosure of directory information at their institution, the non-disclosure is not applicable within classroom instruction for the disclosure of the student’s name, identifier, or institutional email address within the courses in which the student is enrolled.

Instructors should not disclose students’ grades, participation/attendance, progress in the course, or other personally identifiable information from education records during virtual instruction.

FERPA does not prohibit a non-student from observing the lesson as long as personally identifiable information from education records is not being disclosed. As virtual learning occurs in a home environment, there may be individuals who pass by and are seen on the video screen who are not actually participating in the lesson. FERPA allows institutions to determine their own policy for visitors in classrooms (physical and virtual) because most instructors do not reveal personally identifiable information from education records other than saying a student's name.

As a best practice, institutions should discourage non-students from observing virtual classrooms in the event that data from education records is disclosed in virtual classrooms. Institutions and instructors may wish to consider one of the following options:

1. Include instructions for students participating in the virtual classroom regarding not sharing or recording any personally identifiable information from education records that may be disclosed in the virtual classroom, or
2. Obtain prior written consent to permit such sharing of personally identifiable information from education records.

Yes. FERPA does not prohibit instructors from making a recording of their lesson available to students enrolled in the class, as long as the recording does not disclose personally identifiable information from education records. If any personally identifiable information from education records is disclosed, prior written consent must be obtained from students before instructors share the recording.

Institutions should review current vendor agreements to determine whether video recordings will be maintained as education records beyond the period of instruction. In general, if the lesson is only recorded to make it available to other students who may have missed that class, then the recording will not be maintained by the provider as an education record, so FERPA would not prohibit the recording.

If a recording of a virtual lesson will be maintained as an education record, it will invoke FERPA and its three major rights: students’ right of access, their right to consent or nondisclosure, and their right to seek amendment of those records. To assess whether FERPA would be invoked by the recording, some questions to consider include:

1. Will the video recording be maintained as an education record, and is it directly related to any student?
2. What, if any, personally identifiable information from education records did the video recordings capture?
3. With whom is the instructor sharing the video recordings?
4. How is the instructor protecting any unauthorized disclosure of video recordings that qualify as education records?

Yes, this is acceptable under one of the following conditions:

1. The instructor does not disclose personally identifiable information from the student's education record within hearing of the family member, or
2. The instructor moves away from the family member to discuss personally identifiable information from the student's education records so that the family member does not overhear, or
3. If the previous options are not possible, the instructor can obtain prior written consent in electronic format from the student for the potential disclosure of personally identifiable information from the student's education record to the family member.

Most often, if instructors are reviewing subject matter instruction, the substance of the subject matter will not involve the disclosure of personally identifiable information from a student's education record and will not invoke FERPA. Discussion of grades, participation/attendance, progress in the course, or other personally identifiable information does invoke FERPA, however.

FERPA requires institutions to allow students to inspect and review their education record within 45 days of receipt of the request. FERPA does not provide any exceptions to the 45-day rule. If students’ circumstances prevent them from exercising their right to review their record in person, the institution must provide a copy or make other arrangements to allow for review. Students who do not live within commuting distance of campus must be provided such accommodations, and in current circumstances of campus closure due to COVID-19, students should also be provided such accommodations.

Institutions should consider what alternative accommodations exist for students to exercise their right to inspect and review their record. Such accommodations may include electronic access, an electronic copy emailed to the student, or a physical copy mailed to the student. Another alternative, given social distancing requirements, is to have the institution work with students to identify mutually agreeable options that work for all parties.

Generally yes, as long as the institution only releases information in non-personally identifiable form. An institution must make a reasonable determination that a student's identity is not personally identifiable and must take into account other reasonably available information.

Institutions should consult with their Legal Counsel and Information Security Office to vet prospective solutions against a number of requirements, only one of which is FERPA, using a risk-based approach.