The Family Educational Rights and Privacy Act (FERPA) of 1974, as amended, is a federal law that protects the privacy and confidentiality of personally identifiable information contained within student education records. The University of Alabama complies with FERPA’s confidentiality protections and adheres to procedures dealing with student education records and directory information recommended by the American Association of Collegiate Registrars and Admissions Officers (AACRAO).
- “In attendance” is defined as having registered for his/her first course at the University.
“Education records” are defined by FERPA to include any records, files, documents, or other materials that contain personally identifiable information directly related to a student and that are maintained by The University of Alabama or by officials acting for the University. With certain limited exceptions, education records are confidential and cannot be disclosed without the prior written consent of the student. FERPA allows for the disclosure of certain information defined as “directory information” (see definition below) to third parties without the student’s permission, unless the student opts out of disclosure (see Section III of Student Rights under FERPA).
- Personal observations and conversations with students are not considered as “education records.” Peer-graded papers not yet collected and recorded by a teacher are also not included in this definition. Additional records not considered to be education records include:
-
-
- Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record;
- Records maintained by the University’s Department of Public Safety that are maintained solely for law enforcement officials and which are not made available to persons other than law enforcement officials of the same jurisdiction;
- Employment records: records related solely to the employment of a “student” by the institution, provided that the student is not “employed as a result of his or her status as a student.”
- Treatment records that are (i) made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity; (ii) made, maintained, or used only in connection with treatment of the student; and (iii) disclosed only to individuals providing the treatment.; and
- Alumni/former student records containing information about a student no longer in attendance and not directly relating to the individual’s attendance as a student.
-
“Personally identifiable information” is any information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. Personally identifiable information includes the student’s name, family member’s names, address of student or family, social security number, CWID, and indirect identifiers such as date of birth, Mother’s maiden name, biometric records, etc. It also includes information requested by a person who the educational institution reasonably believes knows the identity of the student to whom the education record relates.
-
- “Biometric record” is defined as a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting.
“Directory Information” includes data contained in a student education record that would not generally be considered harmful or an invasion of privacy if disclosed. The following information from a student’s education record is defined by The University of Alabama as “directory information,” which may be disclosed under FERPA without the student’s permission, unless the student opts out of disclosure. Asterisked items are available in the online directory.
- Name*
- Preferred Name*
- Date of Birth, Local and Permanent Address (for Census purposes only)
- Class/Level
- UA School/College(s)
- Major(s)/Degree Program(s)
- Home City, State, and Country of Permanent/Home Address
- Permanent/Home Mailing Address (only for University purposes and University-affiliated organizations and University-recognized academic honor societies/organizations)
- Degree(s) Earned and Date(s)
- Academic Awards and Honors
- UA email address* (only for University purposes and University-affiliated organizations and University-recognized academic honor societies/organizations)
- Prior Postsecondary Institution(s) Attended
- Dates of Attendance
- Full-/Part-Time Enrollment Status
- Participation or membership in officially recognized activities, social or Greek organizations, and sports (or in intercollegiate athletic teams)
- Weight and height of members of intercollegiate athletic teams
In compliance with the FERPA, The University of Alabama sends an annual notification of a student’s rights under FERPA to the crimson email address for all currently enrolled students each fall semester. These rights include:
1. The right to inspect and review their education records.
2. The right to request the amendment of their education records that the student believes are inaccurate or misleading.
3. The right to limit disclosure of personally identifiable information from the student’s education records, except to the extent that FERPA authorizes such disclosure without consent.
4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with FERPA.
Students should submit written requests that identify the record(s) they wish to inspect to the Office of the University Registrar, 206 Student Services Center, The University of Alabama, Box 870134, Tuscaloosa, AL 35487. The University Registrar or designee will make arrangements for access and will notify the student of the time and place where records may be inspected. If the University official to whom the request was submitted does not maintain the records, that official will advise the student of the correct official to whom the request should be addressed.
Requests from current students may also be submitted via email from their crimson account to registrar@ua.edu.
FERPA does not guarantee a student the right to a copy of his/her education record. The University will generally provide access by providing a copy of the records at a cost to the student only if failure to provide a copy would effectively deny the student access to the records. The University may use a third party to maintain a record for the student’s inspection. Copies of part or all of the student’s education record will not be issued to the student or any other party as long as there are delinquent financial obligations owed by the student to the University.
The right of inspection and review does not entitle a student to review (1) financial statements of the student’s parents; (2) confidential letters and statements of recommendation to which a student has waived his/her right to inspect and review; or (3) portions of records that contain information about more than one student (in which case the University must first redact personally identifiable information about the other student(s)).
A student may submit a written request per Section I above identifying the specific record(s) they want to be changed as well as an explanation of why they believe the record is inaccurate or misleading. This request may not include amendments to the accuracy/fairness of grades in courses or any other assessment of academic performance.
If the University does not agree to amend a record as requested, the student will be notified and informed of the right to a hearing, subject to the following provisions:
- Hearings will be conducted within a reasonable time frame;
- Students will be given notice of date, location and time of hearing;
- The hearing will be conducted by an official of the institution, named by the Provost/Vice President of Academic Affairs, who does not have a direct interest in the outcome of the hearing;
- Students can present evidence relevant to the issue and may be represented by individuals including attorneys; and
- Decisions will be given in writing in a reasonable period of time and will be based solely on evidence presented at the hearing.
With certain limited exceptions, education records are confidential and cannot be disclosed without the prior written consent of the student. FERPA allows for the disclosure of certain information defined as “directory information” (see Definitions) to third parties without the student’s permission, unless the student opts out of disclosure.
Steps Required to Prevent Disclosure of Directory Information
The University of Alabama assumes that a student’s failure to specifically request the blocking of access to any element of “directory information” constitutes approval for disclosure. To prevent the University from disclosing any “directory information” to third parties, current students must designate a confidentiality hold request through myBama. To take this action, access the Student page of myBama. In the Academic and Student Services channel, expand the Academic Records and Curriculum menu and select “Update Directory Information/Confidentiality Hold”. Select “Yes” and then submit.
Former students may submit a signed request to the Office of the University Registrar indicating this desired action. Such requests should include the student’s legal name as well as any former names while attending UA.
The request to prevent disclosure of “directory information” will remain in effect permanently, including after departure from the University, unless subsequently changed by the student.
Persons and Entities Entitled to Review a Student’s Education Records Without the Student’s Prior Written Consent
Notwithstanding the general rule that a student must provide written consent to the release of personally identifiable information from his/her records, FERPA permits (but does not require) limited disclosure to the individuals/entities identified as:
-
- School officials with a legitimate educational interest. A “school official” may include:
- a person employed by the University in an administrative, supervisory, academic, research or support staff position, including but not limited to law enforcement unit personnel, health staff and in-house attorneys;
- contractors, consultants, volunteers or other outside parties with whom the University has contracted or delegated certain educationally-related functions to provide service under retainer or agreement; including but not limited to collection agency, outsourced service company, agent, attorney, auditor, etc.;
- a person serving on the Board of Trustees;
- a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his/her tasks.
- “Legitimate educational interest” is defined as any authorized interest or activity undertaken in the name of the University for which access to an education record is necessary or appropriate to the proper performance of the undertaking. A school official has a legitimate educational interest if, in the judgment of the individual/office responsible for requested information, the official needs to review an education record in order to fulfill his or her professional responsibility. The information sought and provided must be pertinent to and used within the context of official University business and not for a purpose extraneous to the official’s area of responsibility.
- Release of a student’s education record to a school official having legitimate educational interest does not constitute institutional authorization to transmit, share, or disclose any or all of the information to a third party, within or outside the University. An unauthorized disclosure of personally identifiable information from the education records of the student is prohibited.
- Parents of a student who is claimed as a dependent, as defined by Section 152 of the Internal Revenue Code of 1986. A student is a dependent if the parent claims the student as a dependent for the current tax reporting year.
- A “parent” includes a natural parent, a guardian, or someone acting as a student’s parent in the absence of a parent or guardian.
- All students will be presumed to be non-dependents unless (1) the student verifies that he/she is a dependent student, or (2) the parent(s) provide their most recent filed IRS tax return with evidence to the contrary.
- Divorced or separated parents of dependent students may be provided equal access to records, unless the University is provided with evidence of a court order, state law, or legally binding document that specifically revokes those rights, or unless the University, in the exercise of its discretion, deems such disclosure ill-advised.
- Information may be disclosed to parents and legal guardians of students under the age of 21, without the student’s consent, regarding the student’s violation of any federal, state or local law, or any rule or policy of the institution governing the use, possession, or distribution of alcohol, narcotics, or other controlled substances.
- Officials of another school in which a student seeks or intends to enroll or is enrolled so long as disclosure is for purposes related to student’s enrollment or transfer.
- Authorized representatives of the Comptroller General and of the Attorney General of the United States, the Secretary of the Department of Education, or state and local educational authorities in connection with the audit or evaluation of federal- and state- supported programs, or for enforcement of or compliance with legal requirements applicable to federally-supported education programs.
- Veterans Administration officials not covered by FERPA but specified under Title 38, section 3690 (c), United States Code.
- Persons or organizations providing financial aid to students, or determining financial aid decisions, but only to the extent necessary to determine eligibility, or the amount or condition of such aid, or to enforce the terms of said aid.
- Appropriate persons, including parents, in connection with an emergency, if knowledge of the information is necessary to protect the health or safety of the student or other individuals. The totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals will be taken into account, and the University will disclose only if there is an articulable and significant threat. The threat and the parties to whom the University discloses information will be recorded.
- Organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, and administer predictive tests, to administer student aid programs, or to improve instruction, but only if personal identification of the student is not made to individuals outside the organization and the information is destroyed when no longer needed for their projects.
- Accrediting organizations carrying out their accrediting functions.
- Persons in compliance with a judicial order or a lawfully issued subpoena, provided that the institution makes a reasonable attempt to notify the student in advance of compliance. The student bears the responsibility for keeping an up-to-date address on file in the Office of the University Registrar. Certain law enforcement-related subpoenas, however, can mandate the release of information without notification to the student of either the subpoena or the information released.
- An alleged victim of any crime of violence or of a non-forcible sex offense, but only of the final results of any institutional disciplinary proceeding against the perpetrator of that crime with respect to the crime, and regardless of the outcome of the proceeding. Also, if the University determines through its disciplinary proceeding that a student has committed a violation of the University’s rules or policies with respect to an alleged crime of violence or non-forcible sex offense, the University may reveal to anyone the “final results,” which are limited by FERPA to include only the name of the student being disciplined, a description of the violation committed, and any sanction imposed by the University on that student. Final results of disciplinary proceedings reached prior to October 7, 1998 may not be released.
- University officials in defense of a claim. If a parent or eligible student initiates a legal claim or otherwise takes any adversarial position in writing against the University, the University may disclose to the court or other entity that has authority to take specific action against the University, the student’s education records that are necessary for the University to defend itself.
- Information about registered sex offender. Information provided to the University under a community notification program concerning a student required to register as a sex offender.
- Return of record to creator. If the University has created any record, it may disclose that information to teachers and other school officials with legitimate educational interests, such as persons who need to verify the accuracy or authenticity of the information. Likewise, the University may return a record to its identified source to be able to verify its authenticity.
- For requests directly related to the Solomon Amendment for military recruitment purposes.
- School officials with a legitimate educational interest. A “school official” may include:
-
- Students have the right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA. The name and address of the office that administers FERPA is:
-
- Student Privacy Policy Office
- 400 Maryland Avenue SW
- Washington DC 20202-4605
- U.S. Department of Education
- FERPA rights cease upon death. However, it is the policy of The University of Alabama that no records of deceased students be released to third parties after the date of death, unless specifically authorized by the executor of the deceased’s estate or by the next of kin.
Current students have the option of designating access to their academic record to parents and/or guardians via their myBama account. This FERPA release allows, but does not require, faculty and staff at the University of Alabama to speak with the designated person about the student’s educational record.
The ‘Record Release to Parent/Guardian’ link resides under the Academic Records and Curriculum menu located under the Academic and Student Services channel of the Student page in myBama. Students may designate access only to individuals that are listed as an emergency contact, which they may also enter through their myBama account. To deactivate a previously assigned release, students must submit this request in writing to the Office of the University Registrar.
- Good practice by faculty and staff members requires that they maintain, use, and report student data in compliance with the requirements of FERPA and the University’s Policy. The following statements provide practical guidelines to follow:
- Do refer requests for student record information to the proper educational record custodian.
- Do keep only those individual student records necessary for the fulfillment of your teaching or advising responsibilities.
- Do keep any personal records relating to individual students separate from their educational records. Private notes of a professor/staff member concerning a student that are intended for professor’s/staff member’s own use are not part of the student’s educational record.
- Do insure privacy when asking for student’s CWID. When on the telephone, be aware that the student may not be in a private environment.
- Do ask for only the last four digits of the CWID on exams and other documents, when needed, to identify different students with the same name.
- Do properly dispose of all papers and documents that contain the CWID.
- Do not include the CWID in the subject line of an e-mail message.
- Do not include the complete CWID in the body of e-mail messages and attached documents.
- Do not include the CWID on any document mailed by surface mail where the CWID is visible on the document or in a window envelope.
- Do not display student scores or grades publicly in association with the student name, CWID, social security number, or other personal identifier. Scores or grades may be posted using a code known only to you and the student.
- Do not put papers or lab reports containing student names and grades in publicly accessible places. Students are not to have access to the scores and grades of others in the class.
- Do not request information from the educational record custodian without a legitimate educational interest and the appropriate authority to do so.
- Do not share student educational record information with other faculty or staff members of the University unless their official responsibilities provide for a legitimate educational interest.
- Do not ask for the CWID on any document that will be viewed by anyone other than a University employee with an educational need to know. Examples:
- On exams, homework assignments and attendance rosters – if other students may view these documents.
- On questionnaires, surveys and other documents soliciting additional personal information.
- On checks payable to the University or to the student.
- On non-academic documents such as an appointment sign-in sheet.
Understanding FERPA Releases
FERPA release codes may also be found on form SGASADD (student attribute block) in Banner Admin.
Values are:
DDR Release to Parents
DFR Release to Father
DMR Release to Mother
DGR Release to Guardian
On the General Person SPAIDEN form in the Emergency Contact tab, the student must have specified an individual(s) with appropriate contact information. Note that the Emergency Contact relationship (mother, father, parent, guardian) equates to relationship on the FERPA release.
If you are unable to determine the individual to whom a student has granted a FERPA release, you may contact the Office of the University Registrar at 205-348-2020 or registrar@ua.edu.