FERPA for Faculty & Staff

What Are My Responsibilities Regarding Student Records?

All university employees are considered school officials and are required by law to maintain the confidentiality of student records. Any employee who maintains specific records is considered a record custodian. At the University of Florida, the Office of the University Registrar (O.U.R.) is the official custodian for academic records.

The release of any nondirectory information about a student to any person outside the university community or to any university personnel without a legitimate educational interest violates federal and state law, as well as university regulations. Student employees have the same obligations to maintain confidentiality of student records as any other employee.

Can a Student's Education Record be Disclosed Without the Student's Consent?

In certain instances, the law does not require the university to obtain student consent before disclosing information from an education record. The most common examples of disclosure that do not require your consent include:

Disclosures to school officials with a legitimate educational interest
Disclosures to other institutions where student is enrolled or is seeking to enroll
Disclosures in connection with the receipt of financial aid (validating eligibility)
Disclosures to state/local officials in conjunction with legislative requirements
Disclosures to organizations conducting studies to improve instruction, or to accrediting organizations
Disclosures to parents of dependent students
Disclosures to parents of dependent students who have had drug and alcohol violations twice in one semester or three times during enrollment, regardless of how much time elapses between violations. If a student is hospitalized as a result of drug or alcohol use, the Dean of Students Office may inform his/her parents if doing so is necessary to protect the student's health or safety. This policy is outlined in the Code of Student Conduct. All questions related to this policy should be directed to the Dean of Students Office, 202 Peabody Hall, 352-392-1261
Disclosures in compliance with a judicial order or lawfully issued subpoena. (UF will make a reasonable attempt to notify the student of disclosures to their parents or disclosures in response to a subpoena.)
Disclosures for a health/safety emergency
Disclosures of information from disciplinary proceedings to the alleged victims of violent crimes or sexual offenses
Disclosures of name, sanction and outcome of disciplinary proceedings (public information), when a student has been found in violation of a crime of violence

What Are the Consequences for Violating FERPA?

Under federal law, FERPA violations may result in the loss of federal funding for UF. Under state law, both UF and you personally may be sued. Any breach of confidentiality could lead to disciplinary action, including the possibility of termination of employment.

Must I Formally Acknowledge That I Understand FERPA?

Employees who have access to the University's student record system must complete FERPA training annually. All UF offices should consider developing a procedure for handling confidential academic records and ensuring that all staff are educated in these procedures.

Can Parents Access Their Child's Educational Record?

When a student reaches 18 years of age or enrolls at a postsecondary institution such as UF, the rights afforded to the parents of a student automatically transfer to the student. However, parents may have access to the education record if:

The student provides a signed release to the university, specifying what information should be released, and including the timeframe for the authorization to remain in effect. Additional authentication of the student's signature may be required.
The information requested is directory information and there is no privacy hold on the record.
The information is released in response to a lawful subpoena.
The parents demonstrate that the student is a dependent, as defined by the Internal Revenue Service, by providing the Office of the University Registrar with the following documentation: completed Parent's Consent for Nondirectory Information Release form and a copy of the first and last page of their most recent federal income tax return. Parents' dependency documentation becomes a part of the student's permanent academic record.

The university generally is required to keep a record of each request for access to and disclosure from student records.

What Should I Do if I Receive a Call About a Student With a Privacy Hold?

If a caller requests information about a student who has a privacy hold, an employee cannot provide any information about that student; in fact, one cannot even acknowledge that the individual is a UF student. Any student who has placed a privacy hold on their record must conduct all business in person after presenting photo identification. If the student is unable to appear in person, additional authentication will be required. If there is any question regarding whether or not specific information can or should be provided, always err on the side of caution and consult a supervisor.

Should Faculty Members Release a List of Students Enrolled in My Class Upon a Request?

Faculty should not provide anyone with lists of students enrolled in class(es) for any commercial purpose. Such requests should be forwarded to the Office of University Registrar for review and response.

How are Subpoenas Handled?

Employees should contact the Office of the Vice President and General Counsel for advice on how to proceed (123 Tigert Hall; 352-392-1358).

How Should I Handle a Power of Attorney?

If all legal requirements are met, the individual (often a parent) listed on the power of attorney will be treated in the same manner as would the student. For access to academic records, the O.U.R. requires a notarized power of attorney that specifically authorizes access to academic records or is a general power of attorney that covers any and all documents. If you have any questions about evaluating a Power of Attorney, please contact the Office of the Vice President and General Counsel.

How Should an Employee Handle a Media Request?

If you are contacted by or are working with the news media you should seek the assistance of Strategic Communications and Marketing, Public Affairs Department, 101 Tigert Hall, Steve Orlando 352-846-3903.

How Should an Employee Handle Information Requests for Research Studies and Surveys?

The university often receives requests for student information to include in studies. If you receive such a request, refer the requester to the Office of Institutional Research (355 Tigert Hall; 352-392-0456).

Can Faculty Members Access Student Academic Records?

Faculty must have a legitimate educational interest in order to access a student's academic record.

What are Appropriate Ways to Notify Students of Their Grades?

Please assign or allow students to choose a unique and confidential identifier (e.g., 4-digit number). This unique identifier cannot be part of the student's name, UFID or social security number.
Grade lists must be posted in random, not alphabetical order.
Web-based course management systems such as Canvas can be used to post grades if the system is secured by username and password. For assistance with Canvas grade posting, contact the Office of Academic Technology (Hub 132; 352-392-4357, elearning.ufl.edu).
The Office of the University Registrar does not send grades by email because there is no guarantee of confidentiality with electronic transmission.
You can send grades via fax or by telephone only if you are certain that the student is the one receiving the information. To verify the student's identity, you should confirm personally identifiable information with the student.
You may also mail students their final grades. Have students provide self-addressed, stamped envelopes. You may not send grade notification using a postcard.

What Standard Security Practices Should Employees Follow?

All employees must utilize reasonable measures to preserve the confidentiality, security and integrity of University of Florida information systems and the information contained therein. All employees should practice appropriate security measures:

Never disclose, share or loan your username(s) and password(s) to anyone (e.g., another employee, faculty member, supervisor, student assistant, etc.). Department staff or supervising faculty should obtain individual log-on information for graduate/teaching assistants. Security access for the student records system is available from the Office of the University Registrar.
Never use generic/group IDs when accessing confidential academic record information.
Ensure that remote access to, retrieval and transmission of confidential academic record information is accomplished through a secure and encrypted connection.
Never leave your computer workstation unattended while signed on without appropriate screen locking (e.g., a password-protected screen saver).
Never leave personal logon information (e.g., username, password, network mapping, etc.) in view of unauthorized persons.
Never program (or "hot-key") automatic access to confidential academic record systems.

Are Electronic Records and Data Protected by FERPA?

FERPA protects the privacy of all educational records, regardless of the medium in which those records are maintained. Therefore, it is important to remember that the same principles of confidentiality apply to paper records and to electronic data.

What are Acceptable Methods for Returning Papers or Exams?

Employees may share graded papers and exams only with the student, with others upon receiving the student's consent or with university officials in performance of official duties. Student papers or exams should not be left outside an office door where students have to look through all the papers to find their own; students should not have access to other students' grades. While you may return papers and/or examinations by mail, the safest practice is to return papers personally to the student.

Can Faculty Members Circulate a Class Attendance Roster?

Yes, a faculty member can circulate an attendance roster, but it should not contain confidential information such as social security number, UFID number and/or grades.

Can a Faculty Member Discuss a Student With Other Faculty?

Faculty should discuss a student's academic record only with that student or with university employees in the performance of official duties.

Can a Faculty Member Post Students' Email Addresses?

Faculty who utilize electronic teaching tools such as Canvas may wish to share students' email addresses or other personally identifiable information with others in the same class. This is permissible as long as students have an opportunity to decline. No information should be posted or disclosed for students with privacy holds.

Is a Faculty Member Required to Obtain a Release Prior to Writing a Letter of Recommendation for a Student?

It depends. In general, a written release is recommended, not required, for letters sent to other educational institutions to which the student is applying and to professional school admission services. The release is required, however, when the recommendation is sent to an employer or to an individual for another purpose.

Faculty may include information from personal observation or knowledge without the student's consent, but it is not acceptable for faculty to access a student's record to view grades/information from other classes and terms. If the recommendation will include nondirectory/personally identifiable information (grades, GPA, etc.) obtained from the student's academic record, you should obtain a signed release from the student. Releases should specify the information that may be disclosed, the identity of the party(ies) to whom the disclosure can be made, the student's signature and the date.

A Parent Calls and Wants to Know if Her Child Has Been Attending Your Class Regularly. Your Response Is:

If you keep attendance records, check with the OUR to determine whether the parent has provided the student's written consent or appropriate IRS documentation indicating the student's dependency status. If so, you may release the information; if not, refer the parent to the administrative area of the OUR.

A Colleague in Your Department Tells You That She Suspects That One of Her Students Has Cheated on an Exam and Asks You About This Student's Performance in Your Class Last Semester. Under FERPA, What is an Appropriate Response?

You should not discuss the progress or performance of a student with anyone, including parents and other faculty, without the student's consent. Inquiries to faculty regarding previous student performance do not constitute a legitimate educational interest. In this case, you can contact Student Conduct and Conflict Resolution (202 Peabody Hall; 352-392-1261) to determine if the student has a prior academic honesty violation.

Do I Have to Notify Students if I am Using Zoom or Taping my Online Class?

Yes, if you are recording a class, you must notify all students with or without privacy holds.

Do the Students With or Without Privacy Holds Have to be Provided an Option to Opt Out of Having Their Picture or Name Appear in the Video?

No. If this is the way the class is being delivered, it is considered a part of the class. We would advise students who don't want their faces to be recorded to turn off their video. Instructors should remind students not to share photos of anyone other than themselves without permission from everyone in the photo.

In my Video of the Class, May I Post it Online? What if There are Privacy Students in my Class?

You may only post it if it behind a secure site, such as Canvas. Only the instructors and students in the class should be able to access the recording.

How do I Submit Grades to my Students Now That my Class is Online? Can I Submit Grades by Email?

No. Grades may not be emailed. If you are using Canvas, you can use it to deliver grades to students.