Under the Family Educational Rights and Privacy Act of 1974, as amended (FERPA), Appalachian State University is restricted in releasing student information without the consent of the student. The statute also gives the student the right to inspect his or her education records, and to place additional limits on the disclosure of those records. Complete information about FERPA is available on the U.S. Department of Education FERPA website.
Detailed information about the implementation of FERPA at Appalachian State University can be found in the University Policy Statement.
What is an education record?
In the broadest sense, education records are any records maintained by the University from which a student can be personally identified. As a result, almost all of the information that Appalachian State University maintains on students is considered a part of the education record, regardless of the format in which the information is kept. This means that education records include, but are not limited to: grades, transcripts, class schedules, personal information, course management (WebCT) information, advising information, financial aid information, individual student information found in reports, and student photos. (Exceptions are listed in the "University Policy Statement" indicated above.)
In addition to the student, who has access to the education record?
Within the University, only an employee (faculty or staff) who has a "legitimate educational interest" in the education record has access.
What is "legitimate educational interest"?
An employee has a "legitimate educational interest" if that employee is:
- performing a task that is specified in his or her position description or by a contract agreement
- performing a task related to a student's education
- performing a task related to the discipline of a student
- providing a service or benefit relating to the student or student's family, such as advising, job placement, financial aid or housing assistance
- maintaining the safety and security of the campus
If otherwise confidential information is needed to resolve a crisis or emergency situation, an educational institution may release that information if the institution determines that the disclosure is "necessary to protect the health or safety of the student or other individuals" (34 C. F. R. 99.36). Factors to be considered in making this assessment are: the severity of the threat to the health or safety of those involved; the need for the information; the time required to deal with the emergency; and the ability of the parties to whom the information is to be given to deal with the emergency. In crisis or emergency situations, requests for non-directory information should be referred to the University Registrar (828-262-2050) or the University Police (828-262-8000 or 828-262-2150).
Disposing of information properly
All material containing confidential information (such as class rosters, tests, papers, etc.) should be destroyed in a manner that insures that the data cannot be retrieved.
The University recommends that confidential student information -- i.e., all information other than "Directory Information" --should be transmitted by e-mail only through the official e-mail account assigned to each employee and student. Further, the e-mail should be limited to communication between the University employee and the individual student, or between University employees with a "legitimate educational interest" (see above) in the student about whom the e-mail is concerned. As an example of what is proscribed, confidential information about a particular student should never be included in an e-mail sent to all members of a class in which that student is or has been enrolled.
The public posting of grades by student name or student identification number is prohibited. Students may view their grades through their AppalNET account.
Graduate/Teaching assistants and student employees
Graduate/Teaching assistants and students employed by the University must follow all FERPA regulations as outlined for faculty and staff, including accessing only records in which they have a "legitimate educational interest."
Health Insurance Portability and Accountability Act (HIPAA)
Information on computer systems
Non-directory student information on a computer system should be treated in the same way as printed material. This information should not be left accessible, unattended or stored in an unsecured environment.
Locating a student
The University does not include the student's "Local Address," or "Schedule of Classes" within "Directory Information." These items have been deliberately excluded in order to make the student's physical location difficult to obtain by someone external to the University. In an emergency and upon request, however, the Registrar's Office will attempt to locate the student, inform him or her of the emergency, and provide the name and telephone number of the person making the request, leaving the decision and therefore the responsibility with the student.
Parental (Legal Guardian) Access
Faculty and staff should be aware that at the post-secondary level parents do not have an inherent right to the student's education records. Access can and will be provided, but only under the following circumstances:
- The student can provide access in AppalNET using the Parent Portal consent process.
- In the absence of student consent, the parents (or legal guardians) must provide a copy of their Federal Income Tax form filed for the most recent tax year, indicating that the student was claimed as a dependent. The tax form should be sent directly to the Registrar's Office and must be accompanied by a signed letter identifying the student and specifying the education information being requested.
- Individual employees may decline to provide requested information if they determine that disclosure would be detrimental to the student-institution relationship or impede efficient and effective University operations.
Written permission from the student is required for a letter or statement of recommendation if the letter or statement of recommendation will include confidential (i.e., non-directory) information from the student's education record.
Responses to an inquiry from the media
FERPA generally does not allow an institution to discuss a student's educational record publicly. A university official should not assume that a student's public discussion of a matter constitutes implied consent for the university official to disclose anything other than directory information in reply. Additionally, university employees should follow university policy regarding the release of information to the media.
Returning academic assignments
Examinations, term papers, or any other graded materials containing personally identifiable student information (e.g., name, student ID number) should be returned directly to the student or made available for pick-up in the departmental office in a manner that ensures the privacy of each student's grade.
Student Identification Numbers
It should be understood that the nine-digit "student identification number" used by the University is the primary means of identifying the individual student. It provides access to most, if not all, of the student's confidential information stored electronically by the University so should be protected. When a student applies for admission, undergraduate or graduate, he or she is assigned a contrived nine-digit identification number. The Social Security Number, should the student provide it, is never used as the "student identification number."
The public posting of student pictures in which the students are identified by name or "student identification number" is prohibited. The University can and does publish pictures of students -- e.g., recruitment brochures, commencement programs, etc. -- but should not, without consent, identify the individual student(s) within the publication.
Subpoenas and court orders
The University will release otherwise confidential information from the educational record in compliance with a lawfully issued subpoena or court order, but only after an attempt to notify the student that the University has received the request and intends to comply. (This delay in compliance is required by FERPA; it allows the student time to challenge the subpoena or court order. Exception: if the subpoena or court order specifically prohibits notifying the student, compliance by the University will be immediate.)
What are the penalties for violation of FERPA?
Employees who violate the University's policy on compliance with FERPA are subject to employment discipline under policies applicable to their respective classifications.
If you have questions or concerns about FERPA regulations, please contact the University Registrar at 828-262-2050 or by e-mail at firstname.lastname@example.org or the Office of the University Attorney at 828-262-2751.