Kennesaw State University
FERPA Online Tutorial
This online tutorial provides basic information about FERPA regulations that govern the disclosure of student record information at Kennesaw State University (KSU).
Maintaining confidentiality of student records is everyone's responsibility at KSU. Why? It's federal law. University employees who have access or have requested access to systems that contain student record information will be required to review this tutorial before access is permitted. Employees may be asked periodically to review and acknowledge their understanding of this information to remain current with federal regulations.
What is FERPA?
Family Educational Rights and Privacy Act of 1974 (FERPA), as amended, is a federal law that sets forth requirements regarding the privacy of student records. FERPA governs the disclosure of student records maintained by an educational institution as well as access to those records. FERPA rights begin when a student is accepted to KSU. Institutions that receive funds administered by the Federal Office of Education are bound by FERPA requirements and failure to comply may result in the loss of federal funding.
FERPA grants four specific rights to the student:
- The right to review and inspect their educational records
- The right to have their educational records amended or corrected
- The right to limit disclosure of some portions of their educational records
- The right to file a complaint with the U.S. Department of Education concerning alleged failures by institutions to comply with the Act.
KSU, students are notified of their FERPA right in the Student Handbook, university catalog, and the Registrar's webpage.
What are Education Records?
Under FERPA, education records are defined as any personally identifiable information that is directly related to a student and maintained by an educational agency, institution, or party acting for the agency or institution. Education records can exist in any medium, including, but not limited to, typewritten, hand-written, computer generated, videotape, audiotape, film, microfilm, microfiche, and email.
Education records do not include:
- Sole possession records, i.e., records/notes in sole possession of the maker, used only as a personal memory aid and not revealed or accessible to any other person except a temporary substitute for the maker of the record.
- Medical treatment records that include, but are not limited to, records maintained by physicians, psychiatrists, and psychologists.
- Employment records, unless employment is based on student status, i.e. a graduate teaching assistant or work-study student.
- Law enforcement records created and maintained by a law enforcement unit.
- Post-attendance records, i.e., information about a person that was obtained when the person was no longer a student (alumni records) and not related to the person as a student.
Student education records are considered confidential and should not be released to any person without the written consent of the student, unless the disclosure meets one of the exceptions to signed consent found in FERPA. University officials are granted access to student information only for “legitimate educational interest” -- completion of job responsibilities. They have a responsibility to protect the confidentiality of education records in their possession, regardless of the medium in which the records are stored or presented. A university official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials (such as an attorney, auditor, or collection agent); a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. Unauthorized release of student record data without written consent of the student may trigger legal sanctions.
At KSU, examples of student record information that generally should not be disclosed without prior written consent of the student are:
- Social Security Number/KSU Student ID Number
- KSU Student Email address
- Grades, Credits hours (attempted or earned)
- Grade Point Averages
- Email Addresses
- Enrollment status (part/full time)
- Residency Status
- Tuition and Fee Payment Records
- Financial Aid Records
- Marital status
- Parent’s Name and Address
- Current Class Schedule
- Disciplinary Actions
- Academic Actions
Employees may not disclose information contained in education records without the student’s consent, except under certain limited conditions. For example, the University may disclose what is considered to be “directory” information unless the student has restricted disclosure of such information. Institutions are not required by FERPA to disclose directory information. When in doubt, do not release information.
If a student has restricted the disclosure of directory information, the word “CONFIDENTIAL” will appear in Banner and Owl Express.
Directory information at Kennesaw State University is defined as:
- Name, Address, Telephone Number
- Field of Study (Major)
- Dates of Attendance
- Degrees Awarded
- Participation in Officially Recognized Activities or Sports
- Weight and Height of Athletic Participants
If you are ever in doubt, do not release any information until you contact the Registrar’s Office at 770.423.6415. The Registrar’s Office is the only university office authorized to issue official transcripts and certify students’ enrollment status. All requests for such documentation must be directed to that office.
Parent or Legal Guardian Requesting Information
When a student begins attending a post secondary institution, regardless of age, FERPA rights transfer to the student. Concerns such as progress in a course, deficiencies in a subject area, scores and grades on papers, exams, etc. are all examples of personally identifiable information that constitute part of the student's education record. Post secondary schools (such as KSU) are not required by FERPA to release or provide access to this information to a student’s parent or legal guardian and, in fact, may not do so except under the following conditions.
(1) A student provides written authorization to the Registrar’s Office that specifically identifies what information may be released to the parent(s) or (2) The parent(s) establish that the student is a dependent according to the Internal Revenue Code of 1986, Section 152.
Posting of Grades/Return of Assignments
The public posting of grades by the student's name, Social Security Number or KSU Student ID number is a violation of FERPA. This includes the posting of grades to a class/institutional website and applies to any public posting of grades for students taking distance education courses. Even without the name, using a KSU Student I.D. number or any part of a Social Security Number violates FERPA, as the information may be personally identifiable to the student. Faculty can use code words or randomly assigned numbers that only the instructor and individual student know. Even then, the posting of grades should not be in alphabetical order.
Students should be directed to Owl Express to view final course grades. Final course grades posted via Owl Express will appear immediately on the student’s Advising Guide.
Assignments and papers that contain "personally identifiable" information should not be distributed to the student in a way that would allow other students to view the information. Graded papers should not be left unattended in an office or classroom for students to sort through or returned to students via another student. Both of these examples are a violation of FERPA. A possible solution would be to leave the exams, quizzes, etc. with an assistant or secretary who requests proper identification prior to distributing the information to the student.
Note: An inadvertent and unauthorized release of grades to someone other than the student is a violation of FERPA.
As an employee, you may be asked to write a letter of recommendation for students seeking admission to programs or in support of a job application. Statements made by a person making a recommendation that are made from that person’s personal observation or knowledge do not require a written release from the student who is the subject of the recommendation. However, if personal identifiable information obtained from a student’s educational record is included in a letter of recommendation (courses taken, grades, GPA and other non-directory information) the writer is required to obtain a signed release from the student, unless the letter is released to the student for distribution. The signed release must specify the records to be disclosed, the purpose of the disclosure and the party to whom the disclosure can be made. If the letter of recommendation is kept on file by the person writing the recommendation, then it becomes part of the student’s education record and the student has the right to read it unless he/she has specifically waived that right of access.
Reminders - "Do's and Don'ts"
- DO keep only those individual student records necessary for the fulfillment of your job responsibilities. Private notes of a faculty/staff member concerning a student and intended for a faculty/staff member’s own use are not part of the student’s education record. However, emails from one school official to another at KSU concerning a student are educational records if they are maintained by either official.
- DO forward all judicial orders, subpoenas or other written requests for data access to the Registrar’s Office.
- DO direct all student information requests in the case of an emergency to Public Safety at 770.423.6666.
- DO refer requests for information from the education record of a student to the appropriate record custodian. Only the record custodian may release information about a student’s education record to a third party outside the university. Below is a list of records/custodians at the university
||Financial Aid Office
|Financial (Fee Payment Records
||Student Conduct / Academic Integrity
- DO help prevent the unauthorized use of KSU student email addresses. KSU has not designated student email addresses as “directory” information. When
using any email utility to send email messages to students always use the “BC” (Blind Copy) option.
- DO encrypt any computer files stored or any device that contain any personally identifiable information that is directly related to a student.
- DO properly discard any reports/computer files containing student personal
- DO NOT display student scores or grades publicly in association with names, Social Security Numbers, KSU ID Numbers, or other personal identifiers
- DO NOT use a part of or the entire Social Security Number or KSU Student ID number of a student in any public manner
- DO NOT share information from the student education records (including grades, grade point averages, class lists) with individuals outside the university
- DO NOT provide anyone with student schedules or assist anyone other than university employees in finding a student on campus
- DO NOT share your user id and password to Owl Express or Banner INB with anyone.
- DO NOT store student’s personal identifiable information on your desktop computer or in portable electronic devices. If storage of personal identifiable information is required, proper security measures (file encryption and disposal) must be taken to protect access by third parties.
Disclosure: To permit access to, release, transfer or allow any other type of communication of personally identifiable information contained in education records to any party by any means; including oral, written or electronic communication.
Education Records: All records which contain information directly related to a student; and are maintained by an educational agency or institution or by a party acting for the agency or institution.
Educational Agency: An entity that administers a school or schools to which it is directly linked.
Educational Institution: A school or other entity that provides educational services and is attended by students.
A student who has attained the age of 18 or has attended an institution of higher education
Legitimate Educational Interest: University officials are granted access to student information only for “legitimate educational interest” -- completion of job responsibilities. Access for any other reason requires a student’s written consent.
Record: Information maintained in any way—including, but not limited to: Audio Tape, Computer Media, Film, Handwriting, Microfilm, Microfiche, Print, Video Tape
Sole Possession Record: Records which are created and maintained by the person generating education records (not in conjunction with the student). These are essentially personal notes or "memory joggers."
School Official: Defined from institution to institution in its annual notification, a school official may be:
- an employee of a college (administrative, supervisory, academic, research, or support staff position)
- a person elected to the board of trustees
- a company or person employed/contracted by a college to perform a special task (i.e., attorney, auditor, or collection agency)
- a person or student serving on an official committee (i.e., disciplinary/grievance, scholarship) or assisting an official in his/her tasks (i.e., work study students)
Need to Review?
Click on any of the links below to review the material covered in this tutorial.
Who to Contact with Questions/Concerns/Feedback?
- U.S. Department of Education Website
- American Association of Collegiate Registrarís and Admissions Officers
- The AACRAO 2010 FERPA Guide (LeRoy Rooker)
Last Updated: 4/4/2011