Every university office's first responsibility is to ensure the integrity and confidentiality of student records. We realize that you are aware of this as a staff member, but the University is concerned about this responsibility, so these guidelines make the University’s position clear and serve as an example of best practices with respect to confidentiality.
What is Ferpa?
First of all, it is everyone’s responsibility to become familiar with the federal law that governs the release of student record information. Known by the acronym of FERPA, the title of the law is the Family Educational Rights and Privacy Act. Passed in 1974 and sponsored by then-senator James Buckley, it is commonly referred to as “the Buckley Amendment.” The original intention was to ensure the right of students to have access to their educational records. The primary practical effect of this law from our perspective is that it also requires us to respect the confidentiality of personally identifiable student information by adhering to well-defined guidelines about its release.
What is Directory Information?
In brief, FERPA requires colleges and universities to define the information that they will release without a student’s prior written consent. Northern Illinois University’s definition contains a list of those “directory information” items that we may release: the student's name, address, telephone listing, e-mail address and photographic or electronic picture or image, date and place of birth, major field of study, classification, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance and full- or part-time status, degrees and awards received, and the most recent previous educational agency or institution attended by the student.
One common misconception is that FERPA requires us to release student information. It does not. Accordingly, you should err on the side of not releasing information when you are in doubt. You should always feel free to ask your immediate supervisor for assistance before releasing the requested information. You can always direct questions to the Office of Registration and Records at 815-753-1189.
What Are Your Responsibilities?
FERPA pertains to everyone who works at Northern Illinois University, regardless of his or her position. What FERPA says, in effect, is that we may all have access to as much information about students as we need to do our jobs. Many people who work at the University have no access to student records and do not need individual student information. Some of these same people, however, may come across confidential information in the course of doing their job. The janitorial staff, for example, may come across information about students. They are equally obliged, as we are, to respect its confidentiality.
Beyond any legal requirements, the University is bound by professional ethics to safeguard the integrity and confidentiality of student information. This includes all university officials and persons employed by the university in an administrative, supervisory, academic research, or support staff position, regardless, of their work classification of full-time, part-time or temporary. What follows as some guidelines in c, or temporary. The following regulations and University policies to follow in order to maintain, report and make available for maintaining, reporting, and making records.
- We may have access to all the information we need to do our jobs, but we have no right to any information not needed to do our jobs. Use a “need to know” (rather than a “right to know”) approach when accessing students’ education records. University officials at NIU must have a legitimate university-related educational or administrative interest and a need to review an education record in order to fulfill their professional responsibilities.
- We may not disclose any information about any student to anyone who does not need this information to do his or her job at the University.
- We may not browse through student records, whether in “hard copy” form or in computer files, for information about students at random or for information about persons we know.
- We must take reasonable precautions to safeguard access to student information. These include shredding documents, not sharing computer IDs and passwords, not allowing anyone else to do work under our IDs and passwords, and not leaving the student information system (MyNIU) up and running and accessible when we are away from our computers.
- We should check the student’s record on the student information system or contact the Office of Registration and Records to see if the student has requested nondisclosure before releasing directory information about the student to someone who is not a university official with a need to know.
- We should not release information to others when in doubt. Consult with the Office of Registration and Records.
- We should refer requests for information from the education record of a student to the proper student's education record academic, financial, medical, and placement.
- We should not display student scores or grades publicly in association with names, social security numbers, or other personally identifiable information. If scores or grades are posted, use only a coding method agreed upon mutually by the entire class, which does not include personally identifiable information. The list should be randomly generated, i.e., displayed in such ways that it appears in alphabetical order by student name.
- We should keep only those individual student records necessary for the fulfillment of our teaching or advising responsibilities. Private notes of a professor/staff member concerning a student and intended for a professor’s/staff member’s own use are not part of the student’s educational record.
- We should not provide non-directory information to third parties such as prospective employers (in letters of recommendation), associations, honorary organizations, etc. without the student’s written consent.
- We should keep any personal professional records relating to individual students separate from the educational records. Private records of instructional, supervisory and administrative personnel and ancillary educational personnel are to be kept in the sole possession of the maker and are not to be accessible or revealed to any other person, except a substitute.
- We should not provide copies to students of their transcripts from other institutions. If you release copies of transcripts, you are acting as a third party testifying as to the accuracy of the information on the transcripts.
- We should understand that only the appropriate educational record custodian may release information about a student’s educational record to a third party outside the University.
- We should not share nondirectory information from a student’s education records, such as grades or class schedules, with parents. You may always refer the parents to the Office of Registration and Records.
- We should direct all student information requests in the case of an emergency to Student Affairs at 815-753-6103 during regular office hours or Public Safety (University Police) at 815-753-1212 after hours.
- We should refer all judicial orders, subpoenas or other written requests for access to information or data subject to the Freedom of Information Act immediately to the Office of the University Legal Services.
NOTE: The information presented in this handout is intended to give general information about the Family Educational Rights and Privacy Act and to acquaint faculty and staff with some of the privacy issues surrounding students’ education records. It is not intended as nor is it a substitute for legal advice on any particular issue.
(FerpaGuidelines-Staff and Faculty—Registration and Records/Registrar; revised 07/2015)