Dear FERPA Professor
I need your assistance. I am working with our Registrar as it pertains to our FERPA Verification. We are 100% online and our students contact us via phone, chat, text, and/or email.
Currently, the students are required to provide two of the following:
- Last 4 of SS#
- Answer to challenge question (Student provides question)
- Student ID
We plan to remove the last four digits of the SS# as one of the verification items, and we have the following inquiry:
- Are two items required? We know it is probably more secure, but we want to know if it is required.
- If two are required, may one of them be directory information, like a student ID?
Thanks,
Ms. Blue
Dear Ms. Blue,
FERPA does not establish a process for authenticating the identity of a student but rather requires that an institution use reasonable authentication methods in so doing. See §99.31(c) of the FERPA regulations which you can find on page
162 of the 2012 AACRAO FERPA Guide. Also, on page 181 of the Guide, you can find a discussion of what is considered reasonable in authenticating identity. The preamble to the 2009 regulations clarified that d.o.b., SSN, or student ID numbers are not considered reasonable.
This is because too many parties, other than the student, could know or possess this information. This does not mean, however, that an institution cannot request such information from the student, only that it is not considered reasonable
in authenticating the student's identity.
I hope this is helpful in answering your questions.
The FERPA Professor