Who Can Release Student Information?
If you have access to student data, you are responsible for its proper handling. No matter what the form or content, you are accountable for handling student records in accordance with the law and University policy. You can view the FERPA Restriction tutorial that demonstrates how to determine whether and which restrictions exist for a student.
FERPA requires that anyone accessing private student records have a "legitimate educational interest" for the information. Examples include:
- Performing a task that is specified in his/her position description or contract
- Performing a task related to a student’s education or to student discipline
- Maintaining safety and security on campus
An institution is not obligated to release directory information to anyone. FERPA only says that an institution MAY release information, but there is no obligation to do so. When in doubt, do not release information, contact the Office of the Registrar for clarification at firstname.lastname@example.org.
The privacy rights of a student expire with that student's death.
Students who perform institutional functions may be deemed "school officials" with a "legitimate educational interest" in accessing designated educational records of other students. The same requirements and responsibilities for a full time school official exist for student workers. Student workers must be trained on FERPA just as if they were faculty or staff.
All subpoenas are first reviewed by the Office of the General Counsel to determine the appropriate course of action. If you receive a subpoena, please contact the Office of General Counsel in Administration 103 or by phone at 520-621-3175.
If non-directory information is needed to resolve a crisis or emergency situation, the University may release that information if the institution determines that the information is "necessary to protect the health or safety of the student or other individuals." Factors considered in making this assessment include, but are not limited to: the severity of the threat to the health or safety of those involved; the need for the information; the time required to deal with the emergency; and the ability of the parties to whom the information is to be given to deal with the emergency.
It is a violation of FERPA to publically post grades either by the student's name, student identification number or social security number. Instructors can assign students unique numbers or codes that can be used to post grades. However, the order of the posting must not be alphabetic.
Leaving personally identifiable, graded papers unattended for students to view is no different from posting grades in the hallway. If these papers contain "personally identifiable" information, then leaving them unattended for anyone to see is a violation of FERPA. Therefore, consider leaving the graded papers (exams, quizzes, and homework) with an assistant or secretary who would ask students for proper identification prior to distributing them.
All University of Arizona students, staff, and instructors are assigned a university managed email account to be utilized for purposes of official correspondence. Instructors may notify students of their individual grades via email, provided the email is sent from a University email account, to a University email account. Notification of grades may also be made via the use of a course management website (D2L, Blackboard, Moodle). In both cases, students must access their grades after providing their UANetID and password, and should have access to their grades only.
Instructors are considered "school officials" and have access to class rosters and basic information for students enrolled in their classes. Instructors may not access other student academic records without demonstrating a "legitimate educational interest" in such information.
Student educational record information is protected under FERPA and parents may not have access to it unless the student has provided written authorization that specifically identifies what information may be released to the parent(s). The presence of a parent affidavit permits you to disclose student record information, but you are under no obligation to do so or to speak to parents.
Written permission of the student is required for a letter of recommendation if any information included in the recommendation is part of the "education record" (grades, GPA and other non-directory information).