Family Educational Rights and Privacy Act (FERPA)

FERPA deals specifically with the education records of students, affording them certain rights with respect to those records. For purposes of definition, what qualifies as education records is specifically defined.

  1. Records directly related to a student 
  2. Maintained by an institution or a party acting for the institution

FERPA gives students who reach the age of 18 or who attend a postsecondary institution the right to inspect and review their own education records. Furthermore, the right to request amendment of records and to have some control over the disclosure of personally identifiable information from these records, shift from the parent to the students at this time.

FERPA applies to the education records of persons who are or have been in attendance in postsecondary institutions, including students in cooperative and correspondence study programs, video conference, satellite, internet, or other electronic forms. FERPA does not apply to records of applicants for admission who are denied acceptance or, if accepted, do not attend an institution.​

Know What Educational Records Are

With certain exceptions, an education record is any student record that meets two specific standards. Education records contain information that is personally identifiable to a student and are maintained by the university. They can be in any medium, including handwritten, print, email, magnetic tape, film, diskette, etc. that are in the possession of any school official, including academic advisors, professors, financial aid staff, etc.

Certain types of records are exceptions and not part of an education record.

  • Law enforcement or campus security records that are solely for law enforcement purposes and maintained solely by the law enforcement unit
  • Records relating to individuals who are employed by the institution,  unless contingent upon attendance
  • Records related to treatment provided by a physician, psychiatrist, psychologist, etc.
  • Alumni records

Directory Information and Disclosures

Under FERPA, directory information is defined as information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed. A school may disclose directory information to third parties without consent if it has given public notice of the types of information which it has designated as directory information, the parent’s or eligible student’s right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as directory information.

Students may ask the university not to publicly disclose their directory information. Be aware, however, that if you’re seeking employment, the Registrar’s Office cannot release your enrollment, degree status nor major to anyone unless you come to the Registrar’s Office with a photo ID. Email Registrar@ucdenver.edu for details.

Examples of Directory and Non-Directory Information

Directory Information Can be Released

  • Student name
  • Hometown, city, state
  • Campus email address*
  • Dates of attendance
  • Previous educational institutions attended
  • School/college or division of enrollment
  • Majors, minors, and field of study
  • Classification level — freshman, sophomore, graduate student, etc.
  • University-recognized honors and awards
  • Degree status — expected graduation date and/or conferral dates/terms
  • Enrollment status
  • Employment related to student status
  • Participation in officially recognized activities/sports
  • Photos and videos taken or maintained by the university

*Campus email addresses are only disclosed to requestors who agree not to use them for solicitation.

Although these items are designated by CU-Denver as directory information, only a limited amount of this information is routinely disclosed by CU-Denver university officials. The university retains the discretion to refuse disclosure of directory information if it believes such disclosure would be an infringement on student privacy rights.

Non-Directory Information Cannot be Released

  • GPA
  • CU student ID number
  • Class schedule
  • Birth date
  • Place of birth
  • Addresses
  • Social Security number

Students

    Education records are kept for seven years from the last semester of enrollment.

    The following people have access to your education record.

    • You (the student) and any outside party who has the student’s written request.
    • School officials (as defined by the University) who has “legitimate educational interests.”
    • Parents of a dependent student as defined by the Internal Revenue Code.
    • A person in response to a lawfully issued subpoena or court order, as long as the University makes a reasonable attempt to notify the student first.
    • Normally, the University will comply with a subpoena after two weeks have elapsed from the day of notifying the student.

    Students can grant third party access to anyone they wish by logging into their UCDAccess student portal.

    Student should submit written requests to the Office of the Registrar and identify the record(s) they wish to inspect. The registrar staff will make arrangements for access and notify the student of the time and place where the records may be inspected. If the requested records are not maintained in the Office of the Registrar, the student will be notified of the correct official to whom the request should be addressed. Notification will be provided within 45 days of the day the university received the request for access.

Parents

    The following people have access to education records:

    • The student and any outside party who has the student’s written request.
    • School officials (as defined by the university) who has “legitimate educational interests.”
    • Parents of a dependent student as defined by the Internal Revenue Code.
    • A person in response to a lawfully issued subpoena or court order, as long as the university makes a reasonable attempt to notify the student first.
    • Normally, the university will comply with a subpoena after two weeks have elapsed from the day of notifying the student.

Faculty

    When a third party, anyone other than the students, requests to see an education record, contact the Office of the Registrar for direction and proper access to procedures.

Administrative

FERPA and Virtual Learning (COVID-19 Scenarios)

    • Yes, FERPA does not prohibit professors/staff from taking PII from students’ education records home with them as long as there is a legitimate educational interest in the education records.
    • School officials, including professors, who take education records home are prohibited from further disclosing the PII from the education records, except as otherwise permitted under FERPA; and, should use reasonable methods to protect the education records, and the PII in those records, from further disclosure.
    • These protections can include access controls that are physical, technological, and administrative controls.

    Yes, under the school official exception to FERPA’s general consent requirement, educational agencies and institutions may disclose students’ education records, or PII in those records, to a provider of such a service or application. CU Denver | Anschutz has contracted with CANVUS, Microsoft Teams, and Zoom as official apps to conduct classes virtually. Please be mindful of the growing concern of zoom-bombing, a form of harassment in which uninvited participants join Zoom events in session, when releasing PII.

    • Assuming that during the virtual lesson, PII from student education records is not disclosed, FERPA would not prohibit a non-student from observing the lesson.
    • The directory information exception permits certain PII from education records which an educational agency or institution has designated as directory information to be disclosed during classroom instruction to students who are enrolled in, and attending, a class.
    • The directory information exception may not be used to opt out of disclosures of a student’s name, identifier, or institutional email address in a class in which the student is enrolled. 34 CFR §99.37(c)(1).

    Yes, assuming the video recording does not disclose PII from student education records during a virtual classroom lesson or appropriate written consent is obtained if PII from the education record, FERPA would not prohibit the teacher from making a recording of the lesson available to students enrolled in the class.

    Yes, as long as the professor:

    1. Does not disclose PII from the student’s education record in hearing of his or her spouse during the conversation; or
    2. Moves away from his or her spouse to discuss PII from the student’s education records so that the spouse does not overhear your discussion; or
    3. Obtains prior consent in writing (electronic) from the parent or eligible student for the potential disclosure of PII from the student’s education records to his or her spouse.

FERPA Resources

The AACRAO 2012 FERPA guide

LeRoy Rooker- Tina Falkner- American Associated of Collegiate Registrars and Admissions Officers – 2012 FERPA and Virtual Learning During COVID-19, March 30, 2020.

U.S Department of Education- Family Educational Right and Privacy Act (FERPA)

Student Privacy 101: FERPA for Parents and Students