7 questions to help you manage FERPA

One of the ongoing considerations with FERPA on campus is training.  With new staff, faculty and students arriving on a regular basis, people changing roles that might impact their use of or access to student data, and the desire to stay current, training seems to be never-ending.  And, to some extent, that’s true. However, that doesn’t mean that it needs to be a daunting task. Taking a planful approach can make all the difference.

Let’s talk through a series of questions that should help anyone more effectively manage FERPA training on your campus.

1.  Do you have a FERPA policy on your campus?

Having a FERPA policy is not required, but it is really helpful for several reasons.  First of all, having a FERPA policy is a great resource for faculty, staff and administrators on campus when FERPA-related questions or issues come up.  And, a policy is also a wonderful resource with questions from students and their families.

Having a basic policy is also valuable to use with training of new faculty and staff, as well as people who are changing their responsibilities with access to student information.

A campus policy should provide a thorough framework, but not necessarily be in so much detail that you try to anticipate every question or issue.  Having that level of detail is often too constraining and doesn’t provide enough flexibility for our changing environment.

If you have a campus FERPA policy, a related question is, “Where can it be found by people who will want to use it?”  If folks can’t find it, how can it be a useful resource? Consider having it available on appropriate websites, e.g. the Registrar’s office, legal and/or compliance offices, and a campus policy site if you have one.  Copies of the policy should be included within the Student Handbook, and having summative fliers of the information available is also really handy.

Don’t forget that, at least annually, you must notify students of their FERPA rights.  That notification can be in a variety of venues, but cannot just be a link to information.  So, for example, an email to students with some basic policy information AND a link to additional resources would be appropriate, but simply sending them a link to information would not be sufficient.

2.  Who is responsible for training on your campus?

In many, if not most, of our campuses, the Registrar’s Office has the most practical knowledge about FERPA, and so it’s logical that we would be responsible to manage training.  But, it could also be the responsibility of an IT, legal or compliance office on campus. Working together often insures that the training is as complete and comprehensive as possible.

3.  What training is required on your campus?

A logical part of your campus policy is a set of expectations about training.  Who needs to have training? What type of training? Are there ongoing training requirements?

A fairly common approach is to make sure that someone who will have access to student records and/or data must have appropriate training before having that access provided.  For example, before a new adviser on campus is given security access to student records, he or she must complete some FERPA training. That would be true for both paper and electronic records.  

Training should be relevant to the specific user.  There may be training for access to student records that is separate from training for someone who will just be working with student data.  Training for faculty is typically different from training for staff. Training for a staff member in the Registrar’s Office might be different from training for a staff member in Student Affairs.

Is training required just once – e.g. when someone assumes a role that requires access to student information for the first time, or is there any expectation of ongoing training?  Some institutions require an annual update with their FERPA training. Would there be additional training if someone changes positions and the new role has different/broader access to student data?  As noted earlier, there will always be new faculty, staff, administrators and students; and always people changing their roles as those roles relate to student information access.

4.  What level of accountability do you have for those who have access to student data?

It’s important that people understand their expectations when given access to student data.  Having that access is often an important part of their position, and losing that access if they abuse that privilege can significantly impact their ability to do their job.  It’s good to have someone who will have access to student information sign off (whether in paper or electronic format) on their rights and expectations of having that access.  And, do you have tracking capabilities within your student systems so that you can at least see who made transactions in the system? That will be very important if you suspect some is abusing his or her student data access privilege.   

5.  How is your training conducted?

First of all, “one size fits all” is not likely the best approach.  Our faculty, staff and students effectively learn in different ways.  So, you may want to consider multiple options for training and providing FERPA-related information.

In today’s increasingly online environment, many institutions are using online training tools.  Those tools might be just informational, but many online tools also incorporate some type of assessment or evaluation.  If the people going through the training don’t pass the test, he or she isn’t provided access to student information. Taking an online approach to training is often the most cost-effective as well.

Sometimes it’s more helpful to provide training in a more personalized manner – e.g. through a workshop or session on campus.  Those might be provided on request, or on some regular basis. Since you know that you will always have new faculty or staff, perhaps offering training on a monthly basis would make sense.  Certainly providing some training in the summer or fall with new, incoming faculty and new teaching assistants is particularly effective.

As noted earlier, making training as relevant as possible for the audience helps the members of the audience better understand and apply FERPA to their work.  Issues that more frequently come up with faculty are not likely to be the same as those impacting staff in the Registrar’s Office. By utilizing case studies and examples relevant to the audience, the training is much more effective.  It’s also appropriate to have documentation to support the training so that folks have reference materials after the training. And, the level of detail needed will also vary significantly among training groups. If you assume that everyone needs everything you will lose many in your audience.

And, remember to have a bit of fun with your FERPA training, particularly if doing something in-person.  Although registrars tend to be enthralled with FERPA, many others find it pretty boring and administrative.  So, keep the audience engaged in the training by making it both relevant and fun.

6.  What resources do you have available?

There are many resources available to us regarding FERPA – both from policy/information and training perspectives.

AACRAO has a wealth of information, both online and in publication form.  Linking to “FERPA” under “Resources” and then “Compliance” on the AACRAO website provides easy access to materials and information.  AACRAO now offers an online tutorial for FERPA training, priced to align with your institutional size and needs. The AACRAO 2012 FERPA Guide is an industry “best seller,” and includes some excellent examples of training materials.  And AACRAO Senior Fellow LeRoy Rooker brings his many years as the former Director of the Federal Department of Education’s Family Policy Compliance Office (FPCO - the office with the responsibility for administering FERPA) to a key consulting role within AACRAO. He is available to answer questions as well as provide training or an evaluation for your campus. All of those services/resources are accessible through the AACRAO website.

The FPCO also has extensive resource information available through their website:  https://www2.ed.gov/policy/gen/guid/fpco/index.html

7.  How do you keep current?

Although there haven’t been significant changes to FERPA regulations lately, we always want to make sure that we are keeping current with information and requirements.  AACRAO will keep us informed of any changes, and there are always FERPA-related sessions at each of AACRAO’s major conferences. AACRAO also schedules FERPA workshops throughout the year, often in conjunction with a “Registrar 101” course.  Check AACRAO’s website for future offerings.

While FERPA training is an ongoing challenge, it is manageable with a little strategic thinking and planning.  Good luck!

If you would like more information on FERPA or have questions for the author, please contact consulting@aacrao.org or call (202) 355-1056.