# data[].attributes.body
The Privacy Act of 1974 was what initially brought protections to student information and records. It established protections for Personally Identifiable Information (PII).  The Family Educational Rights and Privacy Act (FERPA) (1974) was established under the Department of Education in that same year to protect student information.

# data[].attributes.headline
Audience - Employees and Students in Higher Education

# data[].attributes.subject
Audience - Employees and Students in Higher Education

# data[].attributes.body
While student privacy laws were initially created with K-12 schools in mind, they also included higher education under their umbrella, providing more structure for identifying, protecting, and sharing student information.

# data[].attributes.body
FERPA

Family Educational Rights and Privacy Act (FERPA), 20 U.S. Code § 1232g (1974). eCFR :: 34 CFR Part 99 -- Family Educational Rights and Privacy

# data[].attributes.attachment_link.description
The Office of the Federal Register publishes documents on behalf of Federal agencies but does not have any authority over their programs. We recommend you directly contact the agency responsible for the content in question.

# data[].attributes.body
Student records should be defined; what is included in a student record?  The adult/owner of that record should be able to determine who has access to their personal records and information. This should be clearly explained to the student (and possibly the parent) during the application process in order to set up the records’ access appropriately from the start. There are situations, however, where access will be granted to other entities, such as SEVIS records for certain international students, records regarding outcomes of sexual assault, military access to recruitment information, and others as required by law (Stone, 2002).

# data[].attributes.body
Family Educational Rights and Privacy Act (FERPA), 20 U.S. Code § 1232g (1974).  20 USC 1232g: Family educational and privacy rights (house.gov)

Privacy Act, 5 U.S. Code § 552a (1974). https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf

Stone, K. (2002). Revisiting the purpose and effect of FERPA. Stetson University College of Law 23rd Annual National Conference on Law and Higher Education. February 2002. Microsoft Word - Revisiting the Purpose of FERPA.doc (stetson.edu)

# data[].attributes.body
At the highest level, student information is governed through the US Department of Education. Complaints are handled through the Student Privacy Policy Office (SPPO), and the Chief Privacy Officer enforces compliance and penalties.

# data[].attributes.body
Some privacy topics are governed through state laws in addition to the US laws.  In Texas, the Student Privacy Act (2017) is regulated through the State Board of Education (SBOE).  SBOE rules are part of the state agency rules known as the Texas Administrative Code, which are collected and published under the Secretary of State. These are enforced by the Texas Higher Education Coordinating Board (THECB).

# data[].attributes.body
Family Educational Rights and Privacy Act (FERPA) (20 U.S. Code § 1232g; 34 CFR Part 99.60 - 99.67) eCFR :: 34 CFR Part 99 Subpart E -- What Are the Enforcement Procedures?

Student Privacy Act, Tex. Educ. Code § 32.151-157 (2017). EDUCATION CODE CHAPTER 32. COMPUTERS, COMPUTER-RELATED EQUIPMENT, AND STUDENT INFORMATION PROTECTION (texas.gov)

# data[].attributes.body
The Privacy Act of 1974

Privacy Act, 5 U.S. Code § 552a (1974). https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf

# data[].attributes.body
Texas Student Privacy Act (2017)

Student Privacy Act, Tex. Educ. Code § 32.151-157 (2017).
EDUCATION CODE CHAPTER 32. COMPUTERS, COMPUTER-RELATED EQUIPMENT, AND STUDENT INFORMATION PROTECTION (texas.gov)

# data[].attributes.attachment_link.title
EDUCATION CODE CHAPTER 32. COMPUTERS, COMPUTER-RELATED EQUIPMENT, AND STUDENT INFORMATION PROTECTION

# data[].attributes.attachment_link.description
EDUCATION CODE TITLE 2. PUBLIC EDUCATION SUBTITLE F. CURRICULUM, PROGRAMS, AND SERVICES CHAPTER 32. COMPUTERS, COMPUTER-RELATED EQUIPMENT, AND STUDENT INFORMATION PROTECTION SUBCHAPTER A. POWERS AND DUTIES OF STATE BOARD OF EDUCATION RELATING TO ELECTRONIC INSTRUCTIONAL TECHNOLOGY AND COMPUTER-RELATED EQUIPMENT Sec. 32.001. DEVELOPMENT OF LONG-RANGE PLAN.

# data[].attributes.body
General Education Provisions Act (GEPA) (2010)

contains provisions that are applicable to the majority of federal education programs administered by the U.S. Department of Education. Section 444 establishes FERPA.

# data[].attributes.body
Family Educational Rights and Privacy Act (FERPA), 20 U.S. Code § 1232g (1974).  eCFR :: 34 CFR Part 99 -- Family Educational Rights and Privacy

General Education Provisions Act (GEPA) § 444 (2020). https://www.govinfo.gov/content/pkg/COMPS-732/pdf/COMPS-732.pdf

# data[].attributes.body
Owasso ISD v Falvo (2002) determined that peer grading did not violate student privacy rights and helped further establish what does constitute protected information.

Gonzaga v Doe (2002) established that FERPA does not create rights that can be enforceable through Civil action for deprivation of rights 42 U.S. Code § 1983.

# data[].attributes.body
Civil Action for Deprivation of Rights 42 US Code § 1983 (1979). 42 U.S. Code § 1983 - Civil action for deprivation of rights | U.S. Code | US Law | LII / Legal Information Institute (cornell.edu)

Gonzaga University v. Doe, 536 U.S. 273 (2002). Gonzaga Univ. V. Doe, No. 01-679. - Federal Cases - Case Law - VLEX 890305699

Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426, 122 S. Ct. 934, 151 L. Ed. 2d 896 (2002). Owasso Isd No. I-011 v. Falvo, 00-1073 - Federal Cases - Case Law - VLEX 886919768

# data[].attributes.body
One overarching regulation or mandate for FERPA is The Privacy Act of 1974. It established a code of practices for the privacy of Personally Identifiable Information (PII) that extended beyond privacy acts of specific other sectors. This topic would likely also fall under a larger umbrella of Civil Rights.
Privacy Act, 5 U.S. Code § 552a (1974).

# data[].attributes.body
The legal and ethical liability on the part of my organization would include ensuring compliance as best we can.

I-Sight software lists 10 steps of compliance that ring true:

1. RAISE AWARENESS

2. CONFIRM THAT IT APPLIES

3. UNDERSTAND INFORMATION TYPES

4. UNDERSTAND PROVIDED RIGHTS

5. LEARN THE EXCEPTIONS

6. PICK COMPLIANT VENDORS

7. TRAIN YOUR STAFF

8. IMPLEMENT COMPLIANT POLICIES

9. ENCRYPT FILES AND EMAILS

10. IMPLEMENT OTHER TOOLS

With the top contributor to compliance and risk management being to raise awareness (I-Sight.org, 2022).

# data[].attributes.body
Training for Stakeholders (US Department of Education, 2022).

# data[].attributes.attachment_link.title
FERPA 101: For Colleges & Universities | Protecting Student Privacy

# data[].attributes.attachment_link.description
This online training course was developed by PTAC as an introduction to the Family Educational Rights and Privacy Act (FERPA), and its requirements relating to the privacy and security of Personally Identifiable Information (PII) in student records.

# data[].attributes.body
Required Periodic Training System-Wide UTS

Ensure that all officers, faculty, staff, and any other individuals who will create and/or access the institution’s Education Records receive training to provide general information about FERPA prior to their initial access to System Education Records. In addition, all such individuals must receive periodic training that addresses the particular FERPA requirements that apply to the categories of Education Records they would be expected to access, create, or disclose (UTS 183, 2022).

# data[].attributes.body
Training for Specific Institutions (UT Tyler, 2022)

# data[].attributes.attachment_link.title
UT Tyler Registrar | FERPA Tutorial | FERPA

# data[].attributes.attachment_link.description
A FERPA tutorial for faculty and staff to test their knowledge.

# data[].attributes.body
https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html

Know the Exceptions

FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

School officials with legitimate educational interest;

Other schools to which a student is transferring;

Specified officials for audit or evaluation purposes;

Appropriate parties in connection with financial aid to a student;

Organizations conducting certain studies for or on behalf of the school;

Accrediting organizations;

To comply with a judicial order or lawfully issued subpoena;

Appropriate officials in cases of health and safety emergencies; and

State and local authorities, within a juvenile justice system, pursuant to specific State law. (US Department of Education, 2021).

# data[].attributes.body
Use De-Identified Data:

Best practices to reduce potential risks to student privacy, including, whenever possible, use of de-identified or aggregate data in place of Education Records or Personally Identifiable Information from Education Records (UTS 183, 2022).

# data[].attributes.attachment_link.readable_text
Sec. 1 Purpose.

The purpose of this Policy is ensure that each University of Texas System (UT System) institution and UT System Administration (System Administration) have procedures in place to ensure that access to and maintenance of Education Records complies with the Family Educational Rights and Privacy Act (FERPA), other applicable state and federal law, and UT System policies.

Sec. 2 Principles

UT System holds the protection of student education records as a primary responsibility. UT System requires all institutions and System Administration to foster a culture of privacy awareness and ensure that all necessary parties are informed on proper use and disclosure of such information.

Sec. 3 Policy Statement

It is the Policy of UT System to protect the privacy and records access rights of current and former students of its institutions by complying with FERPA at all times. It is also the Policy of UT System to ensure that Education Records, including records maintained by third parties acting on behalf of an institution or System Administration, are:

a) properly identified as Education Records;

b) maintained confidentially and securely;

c) available for inspection and review as authorized by FERPA; and

d) available to The Board of Regents of the UT System (the Board) and/or System Administration, as permitted by FERPA, to allow the Board and System Administration to carry out their respective duties and responsibilities under Texas and federal law.

Sec. 4 Applicability

This Policy applies to all UT System institutions and System Administration.

Sec. 5

Each UT System institution and System Administration shall adopt FERPA-compliant written procedures approved by the UT System Office of General Counsel (OGC) to ensure that its employees, third party contractors, volunteers, and other all other individuals understand their respective responsibilities under FERPA, and to ensure that Education Records are maintained confidentially and securely at or on behalf of each UT System institution and System Administration.

Sec. 6

At a minimum, each UT System institution, and as applicable, System

Administration, must:

a) identify each office and department that creates or maintains Education Records or outsources the creation or maintenance of Education Records;

b) identify the location of such Education Records, including Education Records for which the responsibility for creation and/or maintenance has been outsourced to a third party;

c) designate a qualified official to oversee the institution's compliance with FERPA and this Policy;

d) publish requirements, in addition to those in UTS 165, that employees and others, as applicable, must follow to ensure the security and confidentiality of any Education Record created, accessed, or maintained by that individual, including, but not limited to:

i. prohibitions on re-disclosure of education records to third parties;

ii. requirements addressing the removal of education records in paper form from the institution;

iii. requirements addressing the creation and maintenance of Education Records in non-paper form on a non-System owned or controlled information resource, which must track the applicable requirements of the Acceptable Use Policy Template appended to UTS 165; and

iv. best practices to reduce potential risks to student privacy, including, whenever possible, use of de-identified or aggregate data in place of Education Records or Personally Identifiable Information from Education Records;

e) implement a process to review each proposed contract or other transaction that involves a third party to determine if it will or could result in access to, or creation or maintenance of, the institution's Education Records by a third party. If a proposed contract or other transaction could result in third-party access to Education Records, the contract must identify the records and ensure that terms are included in either the contract or a separate non-disclosure agreement that require the third party to comply with FERPA, as well as the institution's applicable data security policies;

f) adopt, as part of its Handbook of Operating Procedures, the OGC Model FERPA Policy or a policy determined by OGC to contain the essential requirements of the OGC Model FERPA Policy, including the Model Policy's definitions of "Directory Information" and "University Officials"; and

g) ensure that all officers, faculty, staff, and any other individuals who will create and/or access the institution's Education Records receive training to provide general information about FERPA prior to their initial access to System Education Records. In addition, all such individuals must receive periodic training that addresses the particular FERPA requirements that apply to the categories of Education Records they would be expected to access, create, or disclose.

Definitions

Education Records- records directly related to a Student and maintained by a UT System institution or party acting for the institution, as well as Personally Identifiable Information about a Student that is derived from an Education Record.

Family Educational Rights & Privacy Act (FERPA) - 20 U.S.C. 1232g and 34 CFR Part 99.

Personally Identifiable Information- information derived from an Education Record that can be used alone or in combination with other information known to a requestor or the university community, to identify a student. It includes, but is not limited to: the student's name; the name of the student's parent or other family members; the mailing or email address of the student or student's family; a personal identifier, such as the student's social security number, student number, or biometric record;

Student- any individual who is or was enrolled at a UT System institution and any other individual who is included within a UT System's institution's FERPA policy's definition of a student.

University Official - an individual or entity identified by the University as requiring access to an Education Records in order to fulfill his or her professional duties.

# data[].attributes.attachment_link.title
UTS 183 Maintenance of Education Records Subject to the Family Educational Rights and Privacy Act (FERPA)

# data[].attributes.attachment_link.description
Sec. 1 Purpose. The purpose of this Policy is ensure that each University of Texas System (UT System) institution and UT System Administration (System Administration) have procedures in place to ensure that access to and maintenance of Education Records complies with the Family Educational Rights and Privacy Act (FERPA), other applicable state and federal law, and UT System policies.

# data[].attributes.body
I-Sight.org. 2022. Ten key steps to FERPA compliance. https://www.i-sight.com/resources/ferpa-compliance-10-key-steps/

The University of Texas System, UT System Policy Library. UTS 183 Maintenance of Education Records Subject to the Family Educational Rights and Privacy Act (FERPA). UTS 183 Maintenance of Education Records Subject to the Family Educational Rights and Privacy Act (FERPA) | University of Texas System (utsystem.edu)

Under what conditions is prior consent not required to disclose information?   34 CFR § 99.31 (2022). eCFR :: 34 CFR 99.31 -- Under what conditions is prior consent not required to disclose information?

US Department of Education. (2021). Family Educational Rights & Privacy Act. Family Educational Rights and Privacy Act (FERPA)

US Department of Education. (2022, July 1). FERPA 101: For Colleges and Universities. FERPA 101: For Colleges & Universities | Protecting Student Privacy (ed.gov)

UT Tyler. (2022).  The Office of the Registrar. UT Tyler Registrar | FERPA Tutorial | FERPA

# data[].attributes.body
CAS Principle V - Fidelity

We are faithful to an obligation, trust, or duty.

We maintain confidentiality of interactions, student records, and information related to legal and private matters

We avoid conflicts of interest or the appearance thereof

We honor commitments made within the guidelines of established policies and procedures

We demonstrate loyalty and commitment to institutions that employ us

We exercise good stewardship of resources (CAS, 2022).

# data[].attributes.body
These are my take-aways for how to best be compliant with the FERPA laws in higher education:

Take the applicable ed.gov training courses so that you can know recent changes or additions

Train, train, train employees. Require periodic FERPA training for All staff.

reinforce the laws

reinforce the ethics

become an expert; know the do's and don'ts

Make it clearly aware with the incoming student/parent what the privacy law means for them.  Parents will not have any access unless the college student allows it. This can be for finances, grades, or other paperwork.

Post signage explaining FERPA as a refresher for students

Use de-identified data when possible.

Build your fidelity and maintain your integrity - maintain needed confidentiality

# data[].attributes.body
Privacy Act, 5 U.S. Code § 552a (1974). https://www.govinfo.gov/content/pkg/USCODE-2018-title5/pdf/USCODE-2018-title5-partI-chap5-subchapII-sec552a.pdf

Student Privacy Act, Tex. Educ. Code § 32.151-157 (2017). EDUCATION CODE CHAPTER 32. COMPUTERS, COMPUTER-RELATED EQUIPMENT, AND STUDENT INFORMATION PROTECTION (texas.gov)

# data[].attributes.attachment_caption
A 6-minute audio file explaining the Privacy Act of 1974 (Audiopedia, 2015)

# data[].attributes.body
Audiopedia. (2015, November 10), Privacy Act of 1974. [Video]. Privacy Act of 1974 - YouTube

Privacy Act, 5 U.S. Code § 552a (1974).  Office of Privacy and Civil Liberties | Privacy Act of 1974 (justice.gov)

# data[].attributes.body
One local policy that applies to the Privacy Act is the University of Texas at Tyler’s Handbook of Operating Procedures (HOP) 5.2.3 This policy informs individuals of their rights under FERPA and outlines what constitutes compliance with FERPA , The Texas Public Information Act and UTS 183, the UT System regulations. This policy sets the expectations at the specific location/college. (University of Texas at Tyler 5.2.3, 2021)

# data[].attributes.attachment_caption
UT Tyler Handbook of Operating Procedures

# data[].attributes.body
UT Tyler Policy (University of Texas at Tyler, 2022)

# data[].attributes.attachment_link.description
Information about The University of Texas at Tyler Handbook of Operating Procedures including: Student Affairs, Business Affairs, Faculty and Academic Policies and more.

# data[].attributes.body
UT System policy (UTS 183, 2022)

# data[].attributes.attachment_link.readable_text
Sec. 1 Purpose.

The purpose of this Policy is ensure that each University of Texas System (UT System) institution and UT System Administration (System Administration) have procedures in place to ensure that access to and maintenance of Education Records complies with the Family Educational Rights and Privacy Act (FERPA), other applicable state and federal law, and UT System policies.

Sec. 2 Principles

UT System holds the protection of student education records as a primary responsibility. UT System requires all institutions and System Administration to foster a culture of privacy awareness and ensure that all necessary parties are informed on proper use and disclosure of such information.

Sec. 3 Policy Statement

It is the Policy of UT System to protect the privacy and records access rights of current and former students of its institutions by complying with FERPA at all times. It is also the Policy of UT System to ensure that Education Records, including records maintained by third parties acting on behalf of an institution or System Administration, are:

a) properly identified as Education Records;

b) maintained confidentially and securely;

c) available for inspection and review as authorized by FERPA; and

d) available to The Board of Regents of the UT System (the Board) and/or System Administration, as permitted by FERPA, to allow the Board and System Administration to carry out their respective duties and responsibilities under Texas and federal law.

Sec. 4 Applicability

This Policy applies to all UT System institutions and System Administration.

Sec. 5

Each UT System institution and System Administration shall adopt FERPA-compliant written procedures approved by the UT System Office of General Counsel (OGC) to ensure that its employees, third party contractors, volunteers, and other all other individuals understand their respective responsibilities under FERPA, and to ensure that Education Records are maintained confidentially and securely at or on behalf of each UT System institution and System Administration.

Sec. 6

At a minimum, each UT System institution, and as applicable, System

Administration, must:

a) identify each office and department that creates or maintains Education Records or outsources the creation or maintenance of Education Records;

b) identify the location of such Education Records, including Education Records for which the responsibility for creation and/or maintenance has been outsourced to a third party;

c) designate a qualified official to oversee the institution's compliance with FERPA and this Policy;

d) publish requirements, in addition to those in UTS 165, that employees and others, as applicable, must follow to ensure the security and confidentiality of any Education Record created, accessed, or maintained by that individual, including, but not limited to:

i. prohibitions on re-disclosure of education records to third parties;

ii. requirements addressing the removal of education records in paper form from the institution;

iii. requirements addressing the creation and maintenance of Education Records in non-paper form on a non-System owned or controlled information resource, which must track the applicable requirements of the Acceptable Use Policy Template appended to UTS 165; and

iv. best practices to reduce potential risks to student privacy, including, whenever possible, use of de-identified or aggregate data in place of Education Records or Personally Identifiable Information from Education Records;

e) implement a process to review each proposed contract or other transaction that involves a third party to determine if it will or could result in access to, or creation or maintenance of, the institution's Education Records by a third party. If a proposed contract or other transaction could result in third-party access to Education Records, the contract must identify the records and ensure that terms are included in either the contract or a separate non-disclosure agreement that require the third party to comply with FERPA, as well as the institution's applicable data security policies;

f) adopt, as part of its Handbook of Operating Procedures, the OGC Model FERPA Policy or a policy determined by OGC to contain the essential requirements of the OGC Model FERPA Policy, including the Model Policy's definitions of "Directory Information" and "University Officials"; and

g) ensure that all officers, faculty, staff, and any other individuals who will create and/or access the institution's Education Records receive training to provide general information about FERPA prior to their initial access to System Education Records. In addition, all such individuals must receive periodic training that addresses the particular FERPA requirements that apply to the categories of Education Records they would be expected to access, create, or disclose.

Definitions

Education Records- records directly related to a Student and maintained by a UT System institution or party acting for the institution, as well as Personally Identifiable Information about a Student that is derived from an Education Record.

Family Educational Rights & Privacy Act (FERPA) - 20 U.S.C. 1232g and 34 CFR Part 99.

Personally Identifiable Information- information derived from an Education Record that can be used alone or in combination with other information known to a requestor or the university community, to identify a student. It includes, but is not limited to: the student's name; the name of the student's parent or other family members; the mailing or email address of the student or student's family; a personal identifier, such as the student's social security number, student number, or biometric record;

Student- any individual who is or was enrolled at a UT System institution and any other individual who is included within a UT System's institution's FERPA policy's definition of a student.

University Official - an individual or entity identified by the University as requiring access to an Education Records in order to fulfill his or her professional duties.

# data[].attributes.attachment_link.title
UTS 183 Maintenance of Education Records Subject to the Family Educational Rights and Privacy Act (FERPA)

# data[].attributes.attachment_link.description
Sec. 1 Purpose. The purpose of this Policy is ensure that each University of Texas System (UT System) institution and UT System Administration (System Administration) have procedures in place to ensure that access to and maintenance of Education Records complies with the Family Educational Rights and Privacy Act (FERPA), other applicable state and federal law, and UT System policies.

# data[].attributes.body
The University of Texas at Tyler. (2022) Handbook of Operating Procedures (HOP). Handbook of Operating Procedures | UT Tyler HOP | Faculty & Student Academic Policies

The University of Texas at Tyler, Handbook of Operating Procedures (HOP) 5.2.3 Student Records Family Educational Rights and Privacy Act (FERPA) (2021). University of Texas at Tyler - 5.2.3 Student Records Family Educational Rights and Privacy Act (FERPA) (smartcatalogiq.com)

The University of Texas System, UT System Policy Library. UTS 183 Maintenance of Education Records Subject to the Family Educational Rights and Privacy Act (FERPA). UTS 183 Maintenance of Education Records Subject to the Family Educational Rights and Privacy Act (FERPA) | University of Texas System (utsystem.edu)

# data[].attributes.body
When you work in the Registrar's office, data integrity is in the very definition of what you do, and FERPA is common.  However, I have never looked as deeply at FERPA as I have in this course.  Researching FERPA introduced me to the parents, grandparents and many of the cousins to this Act, and it provided a much larger legal context for:

what FERPA is

where it came from

what it is similar to

what has happened because of it

and what has happened to affect it

# data[].attributes.body
Connection with the ethical standards of this profession, using the Shared Principles from CAS, did not strike me as very different.  This may be because I already work in this field and realize the expectations of the office, and because these principles are already familiar.  Identifying them has been a good exercise because it can highlight principles that might not be used as much in this area yet are still important to the profession (CAS, 2022).

# data[].attributes.body
Council for the Advancement of Standards in Higher Education (CAS), (2022). CAS Statement of Shared Ethical Principles. http://standards.cas.edu/getpdf.cfm?PDF=D67207DB-A711-46AA-86038F4A48ACF434

# data[].attributes.body
The Duty Framework compliments FERPA (Bonde & Firenze, 2013).

A Framework for Making Ethical Decisions | Science and Technology Studies (brown.edu)

# data[].attributes.body
Both the Principle and Framework revolve around Duty.  FERPA is a set of rules to follow regarding privacy, and to dutifully do the right thing will achieve the end goal.

# data[].attributes.body
Bonde, S. and Firenze, P. (2013). A framework for making ethical decisions. Brown University. A Framework for Making Ethical Decisions | Science and Technology Studies (brown.edu)

Council for the Advancement of Standards in Higher Education (CAS), (2022). CAS Statement of Shared Ethical Principles. http://standards.cas.edu/getpdf.cfm?PDF=D67207DB-A711-46AA-86038F4A48ACF434