Family Educational Rights and Privacy Act of 1974 (FERPA)
FERPA is a federal law that governs the rights of students and institutional responsibilities with respect to education records. If you have any questions regarding any of the information contained herein, please email the University of Arizona Office of the Registrar.
What is FERPA?
The Family Educational Rights and Privacy Act of 1974, commonly referred to as FERPA or the Buckley Amendment, is a federal law designed to protect the privacy of a student’s education records. FERPA applies to all educational agencies or institutions that receive federal funding for any program administered by the Secretary of Education, including the University, and their employees.
FERPA also applies to private persons and entities that perform services involving information from education records on the University's behalf; in such cases, the private persons and entities must observe the same FERPA requirements that are applicable to the University and its employees. As is outlined in more detail in our "Annual Notification of FERPA Rights," FERPA grants all University students (including minors), the following specific rights:
Understanding the Basics of FERPA
-
With only a few exceptions (described below), the student's education record is considered confidential and neither they nor personally identifiable information from them may be disclosed to others without the written consent of the student.
-
Faculty or staff members have a legal responsibility to protect a student's education record in their possession from unauthorized disclosure, access, or use.
-
Faculty or staff members may access student information only when and to the extent that it is needed for legitimate completion of their responsibilities as a university employee.
-
With only limited exceptions, students have a right to see our records about them, including even casual and informal records such as emails and handwritten notes to the file; with that in mind, all records about students should be created deliberately and thoughtfully.
-
If you have any questions about FERPA, please do not hesitate to contact the Office of the Registrar at registrar@arizona.edu and/or the Office of General Counsel at OGC-Info@email.arizona.edu
Education Record
An "education record" for purposes of FERPA includes any record that contains personally identifiable information (broadly conceived) about one or more students and that is maintained by the University or by any person acting for the University – regardless of whether the record is "educational" or "academic" in nature. The term also encompasses any such information or data recorded in any medium, including not only traditional printed paper records, but also electronic files and data, handwritten documents and notes, photographs, audio and video tapes, email messages, microfilm, and microfiche.
What is an "education record"
Common examples include (but are not limited to):
-
admissions files for students who are accepted and enrolled, including applications, recommendations, high school transcripts, and rater evaluations
-
biographical information about students such as date and place of birth, gender, nationality, race, ethnicity, and identification photographs
-
communications in typed, handwritten, emailed, or other recorded form to, from, or about students
-
course work including papers, exams, grades, and evaluations
-
disciplinary records
-
internship program records
-
personal information shared through course assignments, class discussions, evaluations, and office hour visits
-
student financial and financial aid records
-
student identification number (SID)
-
details about student status such as academic specialization and activities, class schedules, and courses taken
What is NOT an "education record"?
In a few limited circumstances, and for certain limited purposes, records that otherwise would meet the definition above are not considered to be “education records” under FERPA:
-
Most University of Arizona Police Department records about law enforcement issues
-
Employment records about non-student staff and faculty members who take courses at the University; however, records pertaining to their student status and activities, as well as employment records about student employees, are subject to FERPA
-
Campus Health records concerning the diagnosis and treatment of student physical and mental health
-
Alumni and Development Office records about former students that do not relate to or contain information about the subject as a student (e.g., information collected by the University pertaining to post-graduation alumni accomplishments)
-
Records that are kept in the sole possession of their maker, that are used only as personal memory aids or reference tools, and that are not shared with or made accessible to others (e.g., personal reminder or summary notes about a meeting with a student).
More information about these exceptions and how they are handled is available from the Office of the Registrar and/or the Office of General Counsel.
Who has access to education records?
In general, students have a right to access their own education records, as well as to control access to those records by others; in general, the University and its employees are prohibited from releasing or disclosing "personally identifiable information" from a student's education record to anyone other than the relevant student — including even the student's parents, and even if the student is a minor — without that student's prior written consent. However, FERPA allows disclosure without student consent in several circumstances, including but not limited to the following:
-
Allows disclosure to University employees who have a job-related need to know the information contained in the records in order to perform their institutional duties (e.g., faculty members sending grades to the Registrar’s Office or faculty or staff concerned about a student’s behavior making a report to the Dean of Students Office, the Threat Assessment and Management Team, and/or University Police)
-
Allows disclosure of “directory information,” as described in more detail below
-
Allows disclosure to the parents (or legal guardians) of a "dependent student," as defined in the Internal Revenue Code (under University policy, such disclosures will be made only when the requesting parent or guardian has provided a current, notarized affidavit, along with a copy of the relevant page of the parent's or guardian's most recent income tax return indicating the student's dependent status; otherwise, prior written consent from the student is required).
-
Allows disclosure of relevant appropriate information to those who need to know and/or can provide assessments and/or assistance in situations involving a significant perceived threat to the health and safety of students and/or others; such information may also be shared relatively freely internally under the “university employee” exception described above, but, in general and whenever reasonably possible, should be shared externally only by University Police, the Dean of Students, Campus Health, or others specifically authorized to do so by the University Registrar.
FERPA permits disclosure in the above circumstances, as well in several additional, less common ones, but does not require any such disclosure; we may and should exercise appropriate discretion and caution.
More information about these circumstances and how they are handled is available from the Office of the Registrar and/or the Office of General Counsel.
Directory Information
Under certain conditions, FERPA allows educational institutions to disclose basic items of information that are not generally considered to be harmful or private, either generally or limited to specified persons for specified purposes.
The University of Arizona designates the following items as general directory information:
The University of Arizona designates the following items as limited directory information:
- Student employment information (for example, title, pay rate, dates of employment) - Releasable by Human Resources to verify employment for students as well as employees (active and former) to potential employers, landlords, and companies that offer credit instruments (stores, banks, mortgage lenders).
- Date of birth* - Date of birth is released only to official agencies as required for matching student records.
- Photos or videos of students attending or participating in public events – for example, sporting events, concerts, theater performances.
Note: Student photos are part of a student's official record, are not considered directory information, and in the absence of the student's specific consent, must remain confidential at all times. Downloading or copying student photos is prohibited. Photos should be used for identification purposes, only.
*The noted (*) items above can be specifically restricted by the student through UAccess. It is the University employee’s responsibility to make sure there are no directory restrictions prior to releasing any student data as directory information.
Restricting Release of Information
The University may disclose to third-parties any student information that it has designated as directory information without student consent, as long as the student has not restricted such information from disclosure. Students must request such a restriction through UAccess, which will remain in effect unless and until the student releases the restriction. (For more information, see the tutorial.)
Students who have requested a restriction but wish to have specific directory information released in a specific circumstance may do so by providing a written authorization to the Office of the Registrar.
Requesting Directory Information
There are three avenues to request directory information. Submission of a request does not guarantee approval.
| Requestor | Where to Request | Description & Direction of Request |
|---|---|---|
| External Requestor | Public Records | If a request is made by a third party source from outside the University, the requestor must make the request through the Coordinator for Public Records. |
| Internal Requestor | Office of the Registrar | If a request is made on behalf of a University department or a recognized University of Arizona Student Organization, the request can be made by submitting the following form: Request for Directory Information. |
| Solomon Amendment Request for Information | Office of the Registrar | Select the link to obtain a Solomon Amendment Request. |
Filing a Complaint
Students have a right to file a complaint with the U.S. Department of Education concerning alleged failures by the University of Arizona to comply with the requirements of FERPA.
Student Privacy Policy Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-8520
Additional FERPA Resources
University Policies & Procedures
FERPA Privacy Protections for Students related to COVID-19 Response
National Center for Education Statistics — Protecting the Privacy of Student Records: Guidelines for Education Agencies
The Chronicle of Higher Education — The Family Rights and Privacy Act: 7 Myths & the Truth
How to retake your FERPA Training for Staff - Resource Guide
How to retake your FERPA Training for Instructors and Instructional Support Teams - Resource Guide