FERPA FAQs

FERPA provides that an institution may release general directory information (that is, the items of directory information that have been designated for general, not limited, release) to anyone, but there is no obligation to do so. Since students can restrict their directory information in various ways, you must check a student's UAccess account to confirm that this is no applicable restriction prior to releasing information. If you have any question or doubt about a request for directory information or a student's restriction status, do not release the information and contact the Office of the Registrar for guidance.

Student judicial records containing information about suspected or adjudicated violations of the Student Code of Conduct are protected by FERPA. The Dean of Students Office will release information contained in University judicial records only under the following conditions:

  • Violations related to the possession/consumption of alcohol and/or drugs involving students under the age of 21 (at the time of both the violation and the disclosure) may be disclosed to the students’ parents
  • There are serious health and safety concerns to which the records appear to be relevant
  • Students have signed a FERPA release with the Dean of Students Office

 

Instructors are considered "school officials" and as such are granted access to certain basic information of students currently enrolled in their classes. Instructors may not access the education records of students who are not currently enrolled in their classes without demonstrating a "legitimate educational interest" in such information.

A University student’s records are protected under FERPA, regardless of the student’s age and regardless of whether the parents are paying the student’s tuition. A parent generally will not be granted access to those records unless the student has provided written authorization that specifically identifies which information may be released to the parent. The submission of a parent affidavit permits you to disclose student record information, but you are under no obligation to do so or to speak to parents.

Students are always free to contact the Office of the Registrar (registrar@arizona.edu) to discuss any concerns or make an internal complaint. Additionally, students have a right to file a complaint with the US Department of Education concerning alleged failures by the University of Arizona to comply with the requirements of FERPA.

Student Privacy Policy Office
US Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-8520

The University may disclose to third parties any student information that is designated as directory information, provided the student has not restricted such information from disclosure. Students must request a restriction through UAccess, which will remain in effect unless and until the student changes it. Students who have requested a restriction but then wish to have specific directory information released in a specific circumstance may do so by providing a written authorization to the Office of the Registrar.

Students who wish to restrict the release of their names as directory information should carefully consider the following:

  • Your name will not appear in university publications, including the commencement bulletin.
  • Third parties will be denied all your directory information and will be informed that the University has no information available about your attendance.

When deciding how long to hang on to completed work that was not returned to/picked up by the student, please refer to the University’s retention schedule.

Students have the right to inspect the contents of their education records, including their transcripts, regardless of their financial status with the University. However, the University is not required to release an official transcript to the student or others if the student has a past-due account.

All University of Arizona students, staff, and instructors are assigned a university-managed email account to be used for purposes of official correspondence. Instructors may notify students of their individual grades via email, provided the email is sent from a university email account to a university email account. Notification of grades may also be made through the University’s course management tool, Desire2Learn. In either case, students must provide their NetID and password to access their grades.

Students are permitted to grant parents and others access to their UAccess Student Center account. The guest account can be utilized by student-authorized individuals to view select student information, potentially including class schedules, financial aid disbursements, and final course grades. Guest access also provides the ability for guests to pay student tuition bills.

Leaving personally identifiable graded assignments (homework, quizzes, exams) unattended for students to view is a violation of FERPA, as it allows for unauthorized access. Instead, consider leaving the graded assignments with an assistant who will ask students for proper identification prior to returning the assignments.

It is a violation of FERPA to publicly post grades using the student's name, student identification number, or social security number. Instructors may assign students unique numbers or codes that can be used to post grades, but the order of the posting must not be alphabetic. It is preferable to post grades to the University’s course management tool, Desire2Learn, which provides fast and easy access.

The FERPA rights of a student expire with that student’s death.

All subpoenas are reviewed by the Office of the General Counsel to determine the appropriate course of action. If you receive a subpoena, please contact the Office of General Counsel.

Internally, relevant information may be shared relatively freely with University personnel who can help to assess or address the situation, such as the Dean of Students Office, the Threat Assessment and Management Team, and/or University Police, as well as to University personnel and students who need the information to protect their own health and safety. Externally, the University may share information that it determines to be "necessary to protect the health or safety of the student or other individuals." Factors considered in making this assessment include but are not limited to the severity of the threat to the health or safety of those involved, the need for the information, the time required to deal with the emergency, and the ability of the parties to whom the information is to be given to deal with the emergency. This determination and any such external disclosures are made by the Office of Public Safety, the University Police, the Dean of Students, Campus Health, and others specifically authorized to do so by the University Registrar.

An "education record" for purposes of FERPA includes any record that contains personally identifiable information (broadly conceived) about one or more students and that is maintained by the University or by any person acting for the University – regardless of whether the record is "educational" or "academic" in nature. The term also encompasses any such information or data recorded in any medium, including not only traditional printed paper records, but also electronic files and data, handwritten documents and notes, photographs, audio and video tapes, email messages, microfilm, and microfiche. 

Common examples include (but are not limited to): 

  • admissions files for students who are accepted and enrolled, including applications, recommendations, high school transcripts, and rater evaluations
  • biographical information about students such as date and place of birth, gender, nationality, race, ethnicity, and identification photographs
  • communications in typed, handwritten, emailed, or other recorded form to, from, or about students
  • course work including papers, exams, grades, and evaluations
  • disciplinary records
  • internship program records
  • personal information shared through course assignments, class discussions, evaluations, and office hour visits
  • student financial and financial aid records
  • student identification number (SID)
  • details about student status such as academic specialization and activities, class schedules, and courses taken

The Family Educational Rights and Privacy Act of 1974, commonly referred to as FERPA or the Buckley amendment, is a federal law designed to protect the privacy of a student’s education record. FERPA applies to all educational agencies or institutions that receive federal funding for any program administered by the Secretary of Education, including the University, and their employees. FERPA also applies to private persons and entities that perform services involving information from student records on the University's behalf; in such cases, the private persons and entities must observe the same FERPA requirements that are applicable to the University and its employees. As is outlined in more detail in our ":annual Notification of FERPA Rights {LINK}, FERPA grants all University students (including minors), the following specific rights: 

  • The right to inspect and review their own education records (as defined by the statute), with certain limited exceptions, within 45 days after the University's receipt of a request
  • The right to seek the amendment of their education records in certain circumstances
  • The right to consent to the disclosure of personally identifiable information contained in their "education records" in many circumstances
  • The right to file a complaint with the U.S. Department of Education about alleged failures to comply with FERPA.  

Students who perform institutional functions (such as engaging in work-study employment or serving on an official University committee) may be given access to designated education records of other students needed to perform those functions. The requirements and responsibilities for these student workers with respect to those records are the same as those that exist for full-time staff; therefore student workers must complete FERPA training.

In a few limited circumstances, and for certain limited purposes, records that otherwise would meet the definition above are not considered to be “education records” under FERPA:

  • Most University of Arizona Police Department records about law enforcement issues 
  • Employment records about non-student staff and faculty members who take courses at the University; however, records pertaining to their student status and activities, as well as employment records about student employees, are subject to FERPA
  • Campus Health records concerning the diagnosis and treatment of student physical and mental health
  • Alumni and Development Office records about former students that do not relate to or contain information about the subject as a student (e.g., information collected by the University pertaining to post-graduation alumni accomplishments)
  • Records that are kept in the sole possession of their maker, that are used only as personal memory aids or reference tools, and that are not shared with or made accessible to others (e.g., personal reminder or summary notes about a meeting with a student). 

  • More information about these exceptions and how they are handled is available from the Office of the Registrar and/or the Office of General Counsel.

Consistent with its obligations, the University notifies students annually of their rights under FERPA. Notification is sent to students via official UA email and is available online.

A student’s FERPA rights begin when the student registers for their first class.

In general, students have a right to access their own education records, as well as to control access to those records by others; in general, the University and its employees are prohibited from releasing or disclosing " personally identifiable information" from a student's education record to anyone other than the relevant student —including even the student's parents, and even if the student is a minor— without that student's prior written consent. However, FERPA allows disclosure without student consent in several circumstances, including but not limited to the following:   

  • To University employees who have a job-related need to know the information contained in the records in order to perform their institutional duties.  (e.g., faculty members sending grades to the Registrar’s Office or faculty or staff concerned about a student’s behavior making a report to the Dean of Students Office, the Threat Assessment and Management Team, and/or University Police)
  • Of “directory information,” as described in more detail below
  • To the parents (or legal guardians) of a "dependent student," as defined in the Internal Revenue Code (under University policy, such disclosures will be made only when the requesting parent or guardian has provided a current, notarized affidavit, along with a copy of the relevant page of the parent's or guardian's most recent income tax return indicating the student's dependent status; otherwise, prior written consent from the student is required). 
  • Of relevant appropriate information to those who need to know and/or can provide assessments and/or assistance in situation involving a significant perceived threat to the health and safety of students and/or others; such information may also be shared relatively freely internally under the “university employee” exception described above, but, in general and whenever reasonably possible, should be shared externally only by University Police, the Dean of Students, Campus Health, or others specifically authorized to do so by the University Registrar  

FERPA permits disclosure in the above circumstances, as well in several additional, less common ones, but does not require any such disclosure; we may and should exercise appropriate discretion and caution. More information about these circumstances and how they are handled is available from the Office of the Registrar and/or the Office of General Counsel.