Chapter 10: Education Records and Technology

10.1.1 Family Educational Rights and Privacy Act (FERPA) - What FIPPs are included? (5) - Scope - Rights of students (4)

10.1.1 FERPA generally prevents schools from divulging education record information, such as grades and behavior, to parties other than the student without that student's consent. FERPA includes major aspects of Fair Information Practice Principles (FIPPs), such as notice, consent, access and correction, security, and accountability. FERPA applies to all educational institutions that receive federal funding. FERPA protects the rights of students by providing them with the right to: 1. Control the disclosure of their education records to others 2. Review and seek amendment of their own education records 3. Receive annual notice of their rights under FERPA, and 4. File complaints with the U.S. Department of Education

10.1.2.1 What types of records are excepted from FERPA's definition of "education record"? (6)

10.1.2.1 1. Campus police records created and maintained by school campus police for law enforcement purposes 2. Employment records, when the employee is not a student at the university 3. Treatment records or health records, subject to several requirements 4. Applicant records of those who are not enrolled in the university 5. Alumni records created by a school after the individual is no longer a student 6. Grades on peer-graded papers, before they are collected and recorded by a faculty member or other university representative

10.1.2.1 How is "education record" defined by FERPA?

10.1.2.1 An "education record" includes all records that are directly related to the student and maintained by the school or by a party on behalf of the school. This extends beyond grades and other academic records to include financial aid records, disciplinary records, and others related to the student.

10.1.2.2 What types of information are included in the Department of Education's definition of personally identifiable information?

10.1.2.2 1. The student's name 2. The name of the student's parent or other family members 3. The student or student's family's address 4. Personal identifiers such as the Social Security number or student number 5. Other identifiers, such as date of birth 6. Other information that, alone or in combination, can be linked to a student and would allow the student to be identified with reasonable certainty 7. Information requested by a person whom the school reasonably believes knows the identity of the student to which the education record is linked

10.1.2.3 How is "directory information" defined by FERPA?

10.1.2.3 "Directory information" is broadly defined by FERPA to include information that would not generally be considered an invasion of privacy or harmful if disclosed. FERPA does not designate specific information types as directory information for every education institution; instead, it allows individual educational institutions to create their own definitions based on lists of examples provided in the statute and rules laid down by the Department of Education. Examples include name, date of birth, address, email address, telephone number, field of study, and honors received.

10.1.2.3 True/False: Under FERPA, students have the right to opt out from the release of information declared as directory information by an educational institution.

10.1.2.3 (Mostly) true. Before an educational institution can declare information directory information and begin using it as such, the institution must provide students with an opportunity to opt out, or block, the release of their directory information. However, students cannot use this opt-out to prevent the release of information that falls under a FERPA exception.

10.1.2.3 Under regulations promulgated under FERPA, what types of PII are prohibited from being included as directory information? (2)

10.1.2.3 1. SSNs 2. Student ID numbers, if that number, in combination with another type of of directory information would enable an unauthorized user to access the student's records.

10.1.2.3 What is a key distinction of the treatment of "directory information" under FERPA from its treatment under HIPAA?

10.1.2.3 While the general approach under both statutes is opt-in, FERPA's treatment of "directory information" requires the person to opt out if they do not want this category of information to be released.

10.1.3 When determining whether the parent or the student holds the rights related to FERPA, what are the three categories such rules fall under?

10.1.3 1. When the student is enrolled in high school 2. When the student is enrolled in a college or university 3. With regard to the status of the student on their parent's tax return

10.1.3.1 Who holds the rights under FERPA when the student is enrolled in high school?

10.1.3.1 While the student is enrolled in high school, the parent holds the rights under FERPA so long as the student is under the age of 18. When the student turns 18 years old, the rights transfer from the parent to the student. A student may sign a written consent form to grant their parents' permission to view their education records.

10.1.3.2 Who holds the rights under FERPA when the student is enrolled in a college or university?

10.1.3.2 For a student who is attending classes at a college or university while also attending high school, the rules regarding high school attendance apply. Once a student is only attending a postsecondary institution, the student is the holder of the FERPA rights—regardless of age. When the student holds the FERPA rights, the student may sign a written consent form to grant their parents' permission to view their education records.

10.1.3.3 True/False: Even after the rights under FERPA have transferred to the student, a school may disclose to the parents the educational records of the student - without the student's consent - in the circumstance where the student is a dependent for tax purposes.

10.1.3.3 True.

10.1.4.1 Under FERPA, what conditions must be met before education records may be disclosed? (5)

10.1.4.1 Disclosure of education records is permitted only if one of the following conditions is met: 1. The information is not "personally identifiable" 2. The information is "directory information" whose release the student has not blocked 3. Consent has been provided by the holder of the rights under FERPA 4. The disclosure is made to the holder of the rights under FERPA 5. A statutory exception applies, such as for health or safety purposes

10.1.4.2 What elements are required for student consent to be considered valid under FERPA? (2)

10.1.4.2 1. Valid student consent to disclosure must be signed (by hand or electronically), dated and written. 2. Valid student consent to disclosure must identify the records to be disclosed, the purpose of disclosure, and to whom the disclosure is being made.

10.2.1 The Protection of Pupil Rights Amendment of 1978 (PPRA) amends FERPA to provide certain rights to parents of minors with regard to the collection of sensitive information from students through surveys. What areas of sensitive information are included under the PPRA?

10.2.1 1. Political affiliations 2. Mental and psychological problems potentially embarrassing to the student and their family 3. Sex behavior and attitudes 4. Illegal, antisocial, self-incriminating, and demeaning behavior 5. Critical appraisals of other individuals with whom respondents have close family relationships 6. Legally recognized privileged or analogous relationships, such as those of lawyers, physicians and ministers 7. Religious practices, affiliations or beliefs of the student or student's parent 8. Income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program)

10.1.4.2 What exceptions exist to the FERPA consent requirements to disclose PII from an education record?

10.1.4.2 Exceptions to FERPA consent requirements include disclosure to: 1. School officials who have determined a "legitimate educational interest" in the records. A legitimate educational interest exists if the record is relevant and necessary to the school official's responsibilities, including school employees and board members as well as certain third-party vendors. 2. Educational institutions in which a student seeks or intends to enroll, or is currently enrolled, when the disclosure is for a purpose related to the student's enrollment or transfer. 3. In connection with financial aid that the student has received or for which the student will apply, when the purpose of the disclosure is to determine the student's eligibility for aid or conditions to or amount of financial aid. 4. Organizations doing research studies for, or on behalf of, educational institutions for the purpose of developing predictive tests, administering student aid programs, or improving school instruction. 5. Accrediting organizations to fulfill accrediting duties. 6. The alleged victim of a forcible or nonforcible sex offense. 7. Of information related to sex offenders and others when the information is provided to the school under federal registration and disclosure requirements. 8. A person or entity that is verified as the party that provided or created that record (e.g., a school the student transfers to) 9. Law enforcement or otherwise to comply with a judicial order or subpoena. 10. Appropriate parties in connection with a "health or safety emergency"

10.1.4.2 When a school seeks to disclose the PII from an education record without student consent under one of the exceptions provided for by FERPA, what procedure must they follow regardless of the exception?

10.1.4.2 When a school is authorized to disclose PII from an education record without consent, they must still use "reasonable methods" to verify the identity of the party to whom they disclose the information. Reasonable methods include PINs, passwords, personal security questions, smart cards and tokens, biometric indicators, and other factors known or possessed only by the user.

10.1.5.1 FERPA - Right to Access and Review

10.1.5.1 FERPA provides students with the right to access and review their education records. Once a student has issued a request, the educational institution must provide access to the records within 45 days of that request. The educational institution must also must respond to reasonable requests from students for explanations of the records. As with other disclosures to third parties, the educational institution must use reasonable measures to verify the identity of the student making the record request. When the request pertains to a record containing information about more than one student, the requesting students may access only the parts pertaining to themselves.

10.1.5.1 Exceptions to the Right to Access and Review under FERPA (6)

10.1.5.1 Students do not have the right to inspect: 1. Financial records of their parents 2. Confidential letters of recommendation (if the student has waived the right to inspect those documents) 3. Treatment records 4. Attorney-client privileged information, or 5. Records excluded from the definition of education records (such as law enforcement records). 6. Portions of records containing information about other students, if that student's records are contained within.

10.1.5.2 Under FERPA, if a student's request for corrections to their education record is denied, under what circumstances are they allowed to request a hearing to challenge the decision? (5)

10.1.5.2 1. The student must receive prior and reasonable notice of the time, place and date. 2. It must be held within a reasonable time after the request is made. 3. It must be conducted by a party without a direct interest in the outcome. 4. The student must be afforded a "full and fair" opportunity to present their case, with or without assistance or representation. 5. The decision must be based on the evidence presented at the hearing, delivered, in writing, within a reasonable amount of time after the hearing, and must contain a summary and explanation for the decision. If the hearing affirms the student's request, the education record must be amended, and the student must be notified in writing; if the request is denied, however, the institution must notify the student of their right to place a written statement in the file about the contested record. The statement must then be maintained and disclosed with any release of the contested record.

10.1.5.2 FERPA - Right to Correction

10.1.5.2 Students can request corrections to their education records if they believe the records to be inaccurate, misleading, or in violation of their privacy. This access is intended to allow students to address incorrect records and is not for other purposes. If the request is granted, the records must be corrected within a reasonable time. If the request is denied, the student has a right to request a hearing subject to several requirements.

10.1.6 True/False: FERPA provides a private right of action to parents and eligible students against education institutions that violate their rights.

10.1.6 False. While violations of FERPA can result in loss of federal funding for the institution, it does not provide a private right of action to parents and eligible students.

10.1.6 What is the complaint procedure under FERPA for alleged violations of rights?

10.1.6 Parents or eligible students who believe their rights have been violated under FERPA can file formal complaints with the Department of Education. The Family Policy Compliance Officer (FPCA) at Department of Education investigates complaints. If concerns are found, the FPCA typically provides technical assistance to the educational institution. Violations of FERPA can result in loss of federal funding for the educational institution.

10.1.7 True/False: FERPA does not preempt state laws regulating educational record confidentiality and/or access.

10.1.7 True. According to the Department of Education, FERPA was intended to establish "a minimum federal standard for record confidentiality and access." FERPA does not preempt state law in this area.

10.2.1 What prompted Congress to pass the Protection of Pupil Rights Amendment of 1978?

10.2.1 As FERPA applies only to education records (information that (1) directly relates to a student and (2) is maintained by the educational institution or on behalf of the institution), some schools could legally sell student directory information to commercial entities such as banks or credit card companies unless a parent or student opts out. Congress passed the Protection of Pupil Rights Amendment to provide certain rights to parents of minors with regard to the collection of sensitive information from students through surveys.

10.2.2 What new requirements did the No Child Left Behind Act of 2001 add to the Protection of Pupil Rights Amendment of 1978 (PPRA)? (4)

10.2.2 The No Child Left Behind Act of 2001 broadened the PPRA to limit the collection and disclosure of student survey information. The amended PPRA now requires all elementary and secondary schools receiving federal funding to: 1. Enact policies regarding the collection, disclosure or use of personal information about students for commercial purposes 2. Allow parents to access and inspect surveys and other commercial instruments before they are administered to students 3. Provide advance notice to parents about the approximate date when these activities are scheduled, and 4. Provide parents the right to opt out of surveys or other sharing of student information for commercial purposes

10.3 What law governs privacy protections for student medical records - HIPAA or FERPA?

10.3 For elementary and secondary schools, student health records are subject to FERPA if the educational institution receives federal funding. Otherwise, health records maintained by private schools that do not receive federal funding are covered by the HIPAA Privacy Rule so long as the school qualifies as a "covered entity" under federal law. At the postsecondary level, healthcare clinics that only treat students are subject to FERPA relating to the student's healthcare records. Both FERPA and the HIPAA Privacy Rule typically apply to college/university healthcare centers that treat students and nonstudents (e.g., faculty and staff). In case of the latter, FERPA applies to the student records and HIPAA Privacy Rule to the nonstudents.

10.4 True/False: Education companies enabling online hosting of teaching materials for students, online posting of homework assignments, and other such technology tools are subject to FERPA and its amendments.

10.4 True.

10.4.1 Google v. Electronic Privacy Information Center (EPIC)

10.4.1 Google developed free Apps for Education—a suite of tools that included Gmail, Google Calendar, Google Docs, and Google Classroom. In 2014, students in California who used Apps for Education sued Google, accusing the company of scanning millions of emails sent to and received by the students. The Electronic Privacy Information Center (EPIC), a nongovernmental organization focused on civil liberties and privacy, asserted that Google's practice violated FERPA and advocated for the Department of Education to investigate the company. Soon after the lawsuit was filed, Google agreed to change its business practices to ensure that the information in the emails could not be used for commercial purposes. During the time period when the lawsuit was pending against Google, the Department of Education issued guidelines to provide assistance in explaining how FERPA applied in the online arena.

10.4.2 2014 Future of Privacy Forum/Software and Information Industry Association K-12 School Service Provider Pledge to Safeguard Student Privacy

10.4.2 Example of industry self-regulation in the education technology space. The Future of Privacy Forum and the Software and Information Industry Association created a student privacy pledge in 2014. The "K-12 School Service Provider Pledge to Safeguard Student Privacy" involves a dozen specific provisions, including a prohibition on selling student personal information and a ban on using information collected in schools for behavioral targeting of advertisements to students. Violation of the pledge would make a company subject to enforcement as a deceptive trade practice under Section 5 of the Federal Trade Commission (FTC) Act.