Bookmark and Share

FERPA Basics

Family Educational Rights & Privacy Act

In general terms, FERPA prohibits the disclosing of student records (or information from student records) to anyone other than the student to whom the records pertain, unless we have the student's consent. The records that are covered are not limited only to "academic" records. FERPA certainly does protect transcripts, exams, grades, and the like, but it also protects virtually all other records, in any format, that contain personally identifiable information about a student, including the following: the student information database, class schedules, financial account and financial aid records, disciplinary records, "unofficial" records, and even photographs and emails. Moreover, "personally identifiable information" includes not only express identifiers such as names, addresses, and ID numbers, but also other information from which the student's identity could be ascertained, either by itself or in combination with other available information. For example, a record containing such demographic information about a student as gender, age, major, class year, and residence might well make the student personally identifiable even if it does not list the student's name.

Given the breadth of FERPA, it's best to assume that all records concerning students are covered unless a student is sure that they're not. Fortunately, however, there are a number of exceptions to the nondisclosure requirement that enable the University to conduct its academic business and make appropriate disclosures even without the relevant student's consent. The most important such exceptions are the following:

  1. Kutztown University discloses educational records to university officials with legitimate educational interest.  A university official is a person employed by the university in an administrative, supervisory, academic, research or support staff position (including campus police and Health Center staff, a person or company with whom the university has contracted as its agent to provide services, a person serving on the Council of Trustees or a student assisting another university official in the performance of official duties serving on an official university committee). 
  2. The University generally may disclose "directory information" about a student to anyone (though we should use appropriate discretion in doing so).  "Directory information" includes a student's name; local, home, and e-mail addresses; local and home telephone number; major field of study; dates of attendance; anticipated degree and degree date; degrees, honors, and awards received.

Note, students retain the right to request that directory information not be disclosed to the public. Directory information is that part of the record that would not generally be considered harmful or an invasion of privacy if disclosed. Students have the opportunity through MyKU to select aspects of directory information you desire to withhold from disclosure without prior written consent.

Note also that the University cannot disclose directory information in ways that would disclose other, non-directory information. For example, the University cannot provide a list containing only names and addresses in response to a request for the names and addresses of all students who have disciplinary records or who have a specified GPA or higher, because in doing so, the University would implicitly be revealing that those particular students have disciplinary records or the specified GPA, which is protected information. 

  1. The University may disclose any records or information about a student to the student's parents, but only if we first have confirmed that the student is their dependent for tax purposes, either by checking with the student or by obtaining a copy of the parents' most recent tax return. For purposes of this exception, it makes no difference whether the student is a minor. 
  2. When the University have a good-faith belief that there is a health or safety emergency, we may disclose student records and information relevant to that emergency to anyone we reasonably believe can help deal with that emergency. In general, and when reasonably possible, the initial disclosure should be made to professionals trained to evaluate and handle such emergencies, such as Public Safety or the Office of Student Development, who can then determine whether further and broader disclosures are appropriate.

In addition, there are a number of other, more limited exceptions for specific situations.

Keep in mind that all of these exceptions are discretionary, that FERPA does not require the University to disclose student records to anyone other than the relevant student, and that there may be other legal or policy reasons not to disclose information even when FERPA would allow us to do so.