FERPA Guide for Faculty and Staff

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of student education records.

FERPA applies to all educational institutions that receive funding from the U.S. Department of Education and establishes when student information may be accessed, used, and disclosed.

At the University of San Diego, all faculty, staff, administrators, and student employees who have access to student education records are responsible for understanding and complying with FERPA requirements.

Eligible students have the right to:

• Inspect and review their education records.
• Request the amendment of education records they believe are inaccurate or misleading.
• Consent to the disclosure of personally identifiable information contained in their education records, except where FERPA permits disclosure without the student's consent.
• Restrict the release of directory information.
• File a complaint with the U.S. Department of Education regarding an alleged failure by the University to comply with FERPA.

Education records are records that are directly related to a student and maintained by the University or by a party acting on the University's behalf, regardless of format.

Examples include:

• Student identification information
• Enrollment records
• Class schedules and rosters
• Grades and transcripts
• Degree audit information
• Academic standing
• Advising records
• Financial aid records
• Student account information
• Exams, assignments, and evaluations
• Student disciplinary records (when maintained as education records)

Education records may exist in paper files, electronic systems, email, databases, photographs, audio recordings, video recordings, or other formats.

The following generally are not considered education records:

• Personal notes maintained solely by their creator as a personal memory aid and not shared with others.
• Law enforcement records maintained for law enforcement purposes.
• Employment records relating to individuals employed by the University, unless employment is contingent upon student status.
• Medical or counseling treatment records created, maintained, and used only in connection with treatment of the student and disclosed only to individuals providing treatment.
• Alumni records created or received after the individual is no longer a student and that do not relate to the person’s attendance as a student.

FERPA allows institutions to designate certain information as "directory information," which may be released without the student's written consent unless the student has requested that it be withheld.

At the University of San Diego, directory information includes:

• Student's name
• USD email address
• Major field of study
• Dates of attendance
• Participation in officially recognized activities and sports
• Degrees, honors, and awards received
• Photograph

Before releasing directory information, faculty and staff should verify whether the student has requested that their directory information be withheld. If a confidentiality restriction exists, directory information should not be released unless permitted under FERPA.

FERPA permits the University to disclose education records without the student's consent in certain circumstances, including to:

• The student.
• University officials with a legitimate educational interest.
• School officials at another institution where the student seeks or intends to enroll, or is already enrolled, as permitted by FERPA.
• Parents of a dependent student, as defined by the Internal Revenue Code, when appropriate documentation has been provided.
• Organizations or contractors performing institutional services on behalf of the University.
• Accrediting organizations.
• Federal, state, or local officials as authorized by law.
• Appropriate persons in connection with a health or safety emergency, when knowledge of the information is necessary to protect the health or safety of the student or other persons.
• Parties in compliance with a judicial order or lawfully issued subpoena, provided the University makes a reasonable effort to notify the student in advance of compliance so the student may seek protective action.
• Researchers conducting studies on behalf of the University under FERPA requirements.
• Military recruiters, as required by federal law.

When in doubt, contact the Office of the Registrar before releasing student information.

A legitimate educational interest exists when a University official needs access to a student's education record in order to fulfill their professional responsibilities. This may include performing a task specified in the employee’s job description, performing a task related to the student’s education, performing a task related to student discipline, or providing a service or benefit to the student.

Curiosity is not a legitimate educational interest. Accessing a student's record because you know the student personally, are related to the student, or are simply interested in the information is prohibited.

Class recordings that include only the instructor may generally be shared for instructional purposes.

Recordings that include identifiable student participation should be made available only to students enrolled in the course (or officially cross-listed section) unless the participating students have provided appropriate consent or another FERPA exception applies.

All employees with access to student records are expected to:

• Access student records only when necessary to perform assigned job responsibilities.
• Protect the confidentiality of student information in all formats.
• Verify the identity of individuals requesting access to student information before releasing records.
• Use only your official USD-issued email account when communicating with students or with other University officials regarding student education records. Personal email accounts should never be used to transmit or discuss protected student information.
• Keep paper and electronic records secure.
• Use secure University-approved methods when transmitting sensitive student information.
• Hold conversations involving student records in private settings whenever possible.
• Avoid publicly displaying non-directory information, including grades, student identification numbers, or other personally identifiable information.
• Follow University record retention and information security requirements.
• Report suspected privacy breaches or unauthorized disclosures to the Office of the Registrar immediately.

Before discussing a student's education record, faculty and staff should make reasonable efforts to verify the student's identity.

When meeting with a student in person, request a University-issued or government-issued photo ID when appropriate.

When communicating electronically, faculty and staff should use the student's official USD email address and send messages only from their official USD-issued email account. Likewise, communications with other University officials regarding a student's education record should occur only through official University systems and USD-issued email accounts. Using institutional email helps verify identity, protect student privacy, and support compliance with FERPA and University information security standards.

If you are uncertain whether information may be shared, contact the Office of the Registrar before disclosing any education record information.

• Lock your computer when stepping away from your workspace.
• Avoid leaving printed student information unattended.
• Use only University-approved methods to transmit sensitive student information.
• Do not discuss student information in public or shared spaces where others may overhear.
• Dispose of records containing student information securely.
• If you are unsure whether information may be released, contact the Office of the Registrar before responding.

Generally, no. Once a student begins attending the University of San Diego, FERPA rights belong to the student, regardless of the student's age. Information may only be shared with a parent if the student has provided written consent, the parent demonstrates that the student is a dependent for federal income tax purposes, or another FERPA exception applies.

No. Grades or other personally identifiable information should never be posted in a manner that allows students to be identified. This includes posting grades by student name, student ID number, or any portion of a Social Security number.

Yes, when appropriate safeguards are used. Faculty and staff should use only their official USD-issued email account and communicate with students through their official USD email address. Personal email accounts should never be used to transmit protected student information.

Class rosters are education records and should only be shared with University officials who have a legitimate educational interest. Rosters should never be distributed to individuals who do not have a legitimate educational need to access them.

Yes. If the letter includes information from the student’s education record, such as GPA, grades, academic standing, or class performance, you must obtain the student’s written consent before disclosing that information unless another FERPA exception applies.

Not necessarily. Current enrollment status is not designated as directory information at USD. Before confirming whether an individual is or has been a student, verify that the information may be disclosed under FERPA and that the student has not requested confidentiality. If you are unsure, refer the request to the Office of the Registrar.

Do not respond directly. Immediately forward the request to the Office of the General Counsel and the Office of the Registrar for review and guidance.

Notify your supervisor and contact the Office of the Registrar as soon as possible. Prompt reporting allows the University to assess the situation, take appropriate corrective action, and fulfill any applicable legal or institutional obligations.

This guide is intended as a general reference for University of San Diego faculty and staff and may not address every situation. If you have questions about FERPA or whether student information may be disclosed, please contact the Office of the Registrar before releasing any education record information. Additional guidance is available in the University's official FERPA policy and on the FERPA website.

Email: registrar@sandiego.edu