U.S. Department of Education Amendments to FERPA

On December 9, 2008, the U.S. Department of Education issued a new 289-page guide on the Family Educational Rights and Privacy Act (FERPA) legislation that protects the information contained in student records.  These new rules clarified some problem areas and allowed colleges more leeway to use their own judgment when determining when an institution can release student records.

"Rational Basis" for Disclosures

Following the mass shootings at Virginia Tech in 2007, there was much public discussion regarding the failure of university administrators to sound a warning regarding the student shooter, who had displayed behavior that many of his teachers and fellow students had found disturbing.  Administrators there and at other institutions considered FERPA an impediment to communications that might have prevented the tragedy.  The new amendments remove the "strict construction" standard previously used to define an emergency and replace it with a "rational basis" test.  Colleges are now able to disclose information they deem relevant in instances where, using their own best judgment, they determine a health or safety emergency exists.  This allows institutions to balance students' privacy rights with the safety of all members of the university.  However, before an institution releases any student information, it must have specific concerns and must carefully document the circumstances prompting the disclosures.

Contractors and Student Records

Many colleges, including Texas State, now outsource some student services to contractors.  As recently as March 2008, the U.S. Department of Education attempted to clarify the third-party relationship between contractors and student records, stating an institution had to have "direct control" over the contractor before allowing the contractor access to student records.  However, questions remained regarding what constitutes "direct control."

The new rules continue to use the term "direct control" but have relaxed the definition by stating that the contract with the third-party must reflect that the information contained in the student records is owned by the university and governed by FERPA. It also states that improper use of the records could result in a penalty.

     Additional Changes in the FERPA Amendments:

• Institutions can continue to use student identification numbers in college directories.
• An institution cannot require student victims of sexual assault to sign confidentiality pledges regarding results of disciplinary proceedings against assailants.
• Online students are now protected.
• Colleges may share information about transfer students.
• Guidelines are provided for what a contract between an institution and a group conducting research with student data, the "study exception," must contain.
• Guidelines are included for releasing student records scrubbed of identifying information.