We are learning today that being FERPA compliant isn’t as simple as tossing out your old student records. As Tina Nazarian mentions in her article, “The Unintentional Ways Schools Might Be Violating FERPA”, don’t just put them in trash cans—shred them first. If you don’t, your institution might get accused of violating the Family Educational Rights and Privacy Act, or FERPA, which protects student education records in both K-12 and higher education.
FERPA experts state that there are several ways schools may be unaware of their non-compliance; one area often overlooked is with using outside vendors prior to properly vetting them. It is the school’s responsibility to ensure that vendor doesn’t misuse students’ information records. Some “free” online apps may be mining data to sell to third-parties which is in direct violation. To stay compliant, schools should understand exactly what vendors are doing with their data. Schools need to emphasize the information is NOT for the vendor’s own benefit.Another area that is often overlooked, is the holding and releasing of the student records.
An “education record” (K-12) under FERPA is defined as follows: Education Records are those records, files, documents, and other materials which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution. If a school denies access to student records to a guardian of a student under the age of 18, that’s a FERPA violation. However, schools must remember the law’s nuance. If they don’t, they risk illegally denying someone their right to that information, or wrongfully giving a parent access.
Social Media use is another area where schools need to be diligent in sharing information. An inappropriate disclosure to just one person and an inappropriate disclosure to thousands of people on social media are both FERPA violations.
It should be noted, that while FERPA seeks to control access to information, it clearly allows for students to inspect and review their own education records, as defined. Thus, it is for the protection of the rights of the individual student that FERPA was established.
Automating student registration, school choice lottery and electronic cumulative records with the Gateway Suite of products provides school districts with the tools necessary to improve FERPA compliance. SRC’s Gateway Suite provides granular, field-level permissions to documents and data throughout your school district.