Dear FERPA Professor,
Would you please assist with this question/situation? I have a parent/mother who impersonated a student (her daughter) on the telephone. The parent called in had all the correct information to identify herself over the phone to our front desk staff. The caller was presumably checking the status of transfer credit. The call evolved into a problem and was transferred to a manager. The manager assumed they were talking to the student and gave a generic status and promised to call her back with an update.
The next day the student was called at the same number. The person who answered our call identified herself as the student and she was given another update to her dissatisfaction which again escalated to a higher level intervention.
Since the two calls took place, we have found out that the student’s parent impersonated the student and tried to force information from our staff.
What is your recommendation in terms of addressing this issue with the student? Should this be documented for the student’s file? What implications are there with FERPA? We do not have a student release of information on file for the student.
Thank you in advance for your assistance.
Karen Serned
__________________________________________________________________
Dear Karen,
FERPA requires that institutions use reasonable methods to authenticate prior to disclosing information to the requester. See §99.31(c) of the FERPA regulations which you can find on page 162 of the 2012 AACRAO FERPA Guide. Items such as SSN, DOB, mother’s maiden name, or the student ID number are not considered reasonable to authenticate under the regulations because this information is too easily obtained or known by others. Secret pins, passwords, security questions, or other information known or possessed by the student, for example, would be considered reasonable.
If the information given to the caller was not from the student's education records then no inappropriate disclosure took place. If it was from the education record, then such a disclosure occurred and your institution is required to record the disclosure in the student's file, noting the records disclosed. See §99.32(a) of the FERPA regulations on page 163 of the Guide.
I hope this is helpful in responding to your inquiry.
The FERPA Professor
Please check out our Ask the FERPA Professor archives for more insight from the professor.
Want the Professor to come to your campus? Visit our FERPA compliance training page.
Send your questions for the FERPA Professor to connect@aacrao.org.