U.S. Department of Education FERPA
The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. This act is similar to patient privacy rights under HIPAA and must be observed by every member of the university, including preceptors and instructors in supervised practice settings. Violations of FERPA are enforced by fines and/or loss of federal funding for the institution that is in violation.
Generally, schools must have written permission from the student before releasing any information from a student's educational record. "Educational record" refers to any record having to do with a student made in respect to that student's education, including but not limited to transcripts, examinations, grades, papers, clinical evaluations, and correspondence.
FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):
- School officials with legitimate educational interest
- Other schools to which a student is transferring
- Specified officials for audit or evaluation purposes
- Appropriate parties in connection with financial aid to a student
- Organizations conducting certain studies for or on behalf of the school
- Accrediting organizations
- To comply with a judicial order or lawfully issued subpoena
- Appropriate officials in cases of health and safety emergencies
- State and local authorities, within a juvenile justice system, pursuant to specific state law
Schools may disclose, without consent, directory information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must inform students about directory information and allow a reasonable amount of time to request that the school not disclose directory information. Schools must notify students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper article) is left to the discretion of each school. The student ID number, social security number, or similar identifiers must not be released.
Verbal transfer of information is equally protected. There can absolutely not be any discussion of the performance or evaluation of a student in the presence of another student. Discussion of the performance or evaluation of a student with a Program Director or faculty is allowed for purposes of documenting student performance.
FERPA-protected information may be disclosed on an educational or business need-to-know basis. “Legitimate educational interest” includes the business needs of the university. Implicit in the “legitimate educational interest” ability to disclose is a “minimum necessary” rule. In other words, only information that is necessary to perform the legitimate educational or business task at hand may be accessed or disclosed.
Giving information to a non-program person that leads to the location of a student is not allowed. Persons who want to contact students should leave their name and number, which are then forwarded to the student so that the student can make the decision to contact or not contact the caller.
Students have both an ethical and legal expectation of being able to see their own records and to have those records protected from unwanted intrusion.
When in doubt, don't release it, don’t repeat it, and don’t share it.
