Indiana University is committed to the protection and confidentiality of student educational records, adhering closely to the guidelines established by the Family Educational Rights and Privacy Act.
The Family Educational Rights and Privacy Act (FERPA) is a federal law designed to protect the privacy of education records, to establish the right of students to inspect and review their education records, and to provide guidelines for the correction of inaccurate and misleading data through informal and formal hearings.
Training Resources
The FERPA Tutorial for Faculty is designed to give instructors a base-level knowledge of the rules governing release of student information. This tutorial will take approximately 10-15 minutes to complete.
The FERPA Basics training is an in-person presentation that can be scheduled for individual schools or departments upon request.
A FERPA Basics Training class, conducted by the Office of the Registrar, is offered at least once each term. This training includes a presentation and time for addressing questions on specific issues.
Campus Practices
Obtaining consent from students
Once a student begins attending an institution of post-secondary education, all privacy rights move to that student (away from the parents). The general principle is that student education records are considered confidential and may not be released to third parties (including parents) without the written consent of the student.
Such things as progress in a course, deficiencies in a subject area, scores and grades on papers, exams, etc. are all examples of information that make up part of the student's education record. This information is protected under FERPA and the parents may not have access unless the student has provided written authorization that specifically identifies what information may be released to the parent(s). For faculty wishing to communicate with parents (or other third parties) at the student’s request, the following standard consent form, may be helpful. If you would like assistance as you create a release form, please contact the Office of the Registrar.
Posting grades
The public posting of grades either by the student's name, student identification number or Social Security number, without the student's written permission, is a violation of FERPA even if the names are obscured. Consider using Canvas or university tools with built-in security mechanisms.
Returning graded papers and assignments
Distributing graded work in a way that exposes the student's identity or leaving personally identifiable graded papers unattended is no different from posting grades publicly. If the papers contain "personally identifiable" information, then leaving them unattended for anyone to see is a violation of FERPA. Using readily available tools (e.g., Canvas) to distribute grades or graded papers should be given first consideration. Other possible solutions for distributing grade information to students would be to leave graded papers (exams, quizzes, and homework) with an assistant or secretary who would ask students for proper identification prior to distributing them, leave graded work in a sealed envelope with only the student's name on it, or use a code name or number known only to the student and faculty member to identify graded work.
Sending grades to students
Instructors can notify students of their final grades via the U.S. mail if the information is enclosed in an envelope. Notification of grades via a postcard violates a student's privacy. Posting grades on a web site that is open to public access or in a way that exposes individual grades to other class members is not acceptable. The preferred method for communicating about grades is through Canvas, a system designed for FERPA compliance.
Crisis situations/emergencies
If non-directory information is needed to resolve a crisis or emergency situation, an education institution may release that information if the institution determines that the information is "necessary to protect the health or safety of the student or other individuals." In the case of an emergency, contact the appropriate individuals (e.g., IU Police Department, Dean of Students, the Provost, or IU Health Center) and keep a record of with whom you spoke, when you called, what you spoke about and describe the situation that led you to make this call in the first place.
Letters of recommendation
Written permission of the student is required for a letter of recommendation if any information included in the recommendation is part of the "education record" (grades, GPA and other non-directory information) or is an assessment of student performance, such as his/her rank in the class. Statements made from personal observation or knowledge do not require a signed release.
Questions?
Questions and comments regarding FERPA may be directed to the Office of the Registrar at registrar@iu.edu or (812) 855-2654.