Faculty handling of student data
All IU faculty are responsible for ensuring they understand the FERPA regulation and IU policies and procedures related to the safeguarding and release of student information. The following resources are here to help you!
The FERPA Tutorial for Faculty is designed to give instructors a base-level knowledge of the rules governing release of student information. The tutorial will take approximately 30 minutes to complete.
Best practices & procedures
Obtaining consent to discuss education records
Once a student begins attending an institution of post-secondary education, all privacy rights move to that student away from the parents. Such things as progress in a course, deficiencies in a subject area, scores and grades on papers, exams, etc. are all examples of information that make up part of the student's education record. This information is protected under FERPA and the parents may not have access unless the student has provided written authorization that specifically identifies what information may be released to the parent(s). As a faculty member, to communicate with parents (or other third parties) at the student’s request, obtain written consent from the student.
The public posting of grades either by the student's name, university identification number (UID), Social Security number, all, or in part, or any other personal identifier (username, address, phone etc.) is a violation of FERPA, even if the names are obscured. Consider using Canvas or university tools with built-in security mechanisms.
Returning graded papers and assignments
Distributing graded work in a way that exposes the student's identity or leaving personally identifiable graded papers unattended is no different from posting grades publicly. If the papers contain "personally identifiable" information, then leaving them unattended for anyone to see is a violation of FERPA. Using readily available tools (e.g., Canvas) to distribute grades or graded papers should be given first consideration. Other possible solutions for distributing grade information to students would be to leave graded papers (exams, quizzes, and homework) with an assistant or secretary who would ask students for proper identification prior to distributing them.
Use of email
You may use IU email to communicate about a specific student with another IU school official if the employee has a legitimate educational interest to view the information. You must ensure that you do not communicate any critical data (SSN, bank account information, driver’s license, etc.) It is important to review that you have selected the correct recipient as we have several students and affiliates with similar names in the address book, and a common mistake is to select the wrong recipient and provide restricted data to a student or official that does not have a business need. If you are communicating about several students, it is recommended to use the Secure Share for critical data: At IU, what is Secure Share, and how do I use it?
Letters of recommendation
Written consent from the student is required for a letter of recommendation if any information included in the recommendation is part of the "education record" (grades, GPA and other non-directory information) or is an assessment of student performance, such as his or her rank in the class. Statements made from personal observation or knowledge do not require a signed release.
Personally identifiable student information provided for purposes of instruction and advising should not be used for academic research without additional approval and review by the Human Subjects office. See policy RP-11-004 Research with Human Subjects. Before any research is published or shared with others, ensure that all data shared in aggregate form is properly de-identified to avoid a FERPA violation or unauthorized disclosure to third parties. IU’s disclosure avoidance procedure is to restrict any cell size that is smaller than 10 when paired with restricted data.
It is important that you train your Graduate Assistants and any students working for you on FERPA responsibilities and the importance of safeguarding student data. You should require all assistants to take the FERPA tutorial and never share your passphrase or credentials.
Questions? Contact your campus registrar for information regarding student privacy.