FERPA Guide for Faculty and Staff

This guide is intended as a general reference for University of San Diego faculty and staff and does not replace FERPA, University policy, or other applicable laws and regulations. For specific questions or situations, consult the University's official FERPA policy and contact the Office of the Registrar before disclosing student information.

Family Educational Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a federal law that protects the privacy of student education records.

FERPA applies to all educational institutions that receive funding from the U.S. Department of Education and establishes when student information may be accessed, used, and disclosed.

At the University of San Diego, all faculty, staff, administrators, and student employees who have access to student education records are responsible for understanding and complying with FERPA requirements.

Student Rights Under FERPA

Eligible students have the right to:

• Inspect and review their education records.
• Request the amendment of education records they believe are inaccurate or misleading.
• Consent to the disclosure of personally identifiable information contained in their education records, except where FERPA permits disclosure without the student's consent.
• Restrict the release of directory information.
• File a complaint with the U.S. Department of Education regarding an alleged failure by the University to comply with FERPA.

What Are Education Records?

Education records are records that are directly related to a student and maintained by the University or by a party acting on the University's behalf, regardless of format.

Examples include:

• Student identification information
• Enrollment records
• Class schedules and rosters
• Grades and transcripts
• Degree audit information
• Academic standing
• Advising records
• Financial aid records
• Student account information
• Exams, assignments, and evaluations
• Student disciplinary records (when maintained as education records)

Education records may exist in paper files, electronic systems, email, databases, photographs, audio recordings, video recordings, or other formats.

Records Not Covered by FERPA

The following generally are not considered education records:

• Personal notes maintained solely by their creator as a personal memory aid and not shared with others.
• Law enforcement records maintained for law enforcement purposes.
• Employment records relating to individuals employed by the University, unless employment is contingent upon student status.
• Medical or counseling treatment records created, maintained, and used only in connection with treatment of the student and disclosed only to individuals providing treatment.
• Alumni records created or received after the individual is no longer a student and that do not relate to the person’s attendance as a student.

Directory Information

FERPA allows institutions to designate certain information as "directory information," which may be released without the student's written consent unless the student has requested that it be withheld.

At the University of San Diego, directory information includes:

• Student's name
• USD email address
• Major field of study
• Dates of attendance
• Participation in officially recognized activities and sports
• Degrees, honors, and awards received
• Photograph

Before releasing directory information, faculty and staff should verify whether the student has requested that their directory information be withheld. If a confidentiality restriction exists, directory information should not be released unless permitted under FERPA.

Who May Access Education Records?

FERPA permits the University to disclose education records without the student's consent in certain circumstances, including to:

• The student.
• University officials with a legitimate educational interest.
• School officials at another institution where the student seeks or intends to enroll, or is already enrolled, as permitted by FERPA.
• Parents of a dependent student, as defined by the Internal Revenue Code, when appropriate documentation has been provided.
• Organizations or contractors performing institutional services on behalf of the University.
• Accrediting organizations.
• Federal, state, or local officials as authorized by law.
• Appropriate persons in connection with a health or safety emergency, when knowledge of the information is necessary to protect the health or safety of the student or other persons.
• Parties in compliance with a judicial order or lawfully issued subpoena, provided the University makes a reasonable effort to notify the student in advance of compliance so the student may seek protective action.
• Researchers conducting studies on behalf of the University under FERPA requirements.
• Military recruiters, as required by federal law.

When in doubt, contact the Office of the Registrar before releasing student information.

Legitimate Educational Interest

A legitimate educational interest exists when a University official needs access to a student's education record in order to fulfill their professional responsibilities. This may include performing a task specified in the employee’s job description, performing a task related to the student’s education, performing a task related to student discipline, or providing a service or benefit to the student.

Curiosity is not a legitimate educational interest. Accessing a student's record because you know the student personally, are related to the student, or are simply interested in the information is prohibited.

Class Recordings

Class recordings that include only the instructor may generally be shared for instructional purposes.

Recordings that include identifiable student participation should be made available only to students enrolled in the course (or officially cross-listed section) unless the participating students have provided appropriate consent or another FERPA exception applies.

Faculty and Staff Responsibilities

All employees with access to student records are expected to:

• Access student records only when necessary to perform assigned job responsibilities.
• Protect the confidentiality of student information in all formats.
• Verify the identity of individuals requesting access to student information before releasing records.
• Use only your official USD-issued email account when communicating with students or with other University officials regarding student education records. Personal email accounts should never be used to transmit or discuss protected student information.
• Keep paper and electronic records secure.
• Use secure University-approved methods when transmitting sensitive student information.
• Hold conversations involving student records in private settings whenever possible.
• Avoid publicly displaying non-directory information, including grades, student identification numbers, or other personally identifiable information.
• Follow University record retention and information security requirements.
• Report suspected privacy breaches or unauthorized disclosures to the Office of the Registrar immediately.

Communicating with Students

Before discussing a student's education record, faculty and staff should make reasonable efforts to verify the student's identity.

When meeting with a student in person, request a University-issued or government-issued photo ID when appropriate.

When communicating electronically, faculty and staff should use the student's official USD email address and send messages only from their official USD-issued email account. Likewise, communications with other University officials regarding a student's education record should occur only through official University systems and USD-issued email accounts. Using institutional email helps verify identity, protect student privacy, and support compliance with FERPA and University information security standards.

If you are uncertain whether information may be shared, contact the Office of the Registrar before disclosing any education record information.

Best Practices

• Lock your computer when stepping away from your workspace.
• Avoid leaving printed student information unattended.
• Use only University-approved methods to transmit sensitive student information.
• Do not discuss student information in public or shared spaces where others may overhear.
• Dispose of records containing student information securely.
• If you are unsure whether information may be released, contact the Office of the Registrar before responding.