Ask the FERPA Professor

By Dr. Helen B. Garrett

Teaching an Old FERPA Dog New Tricks

One might think that there would not be much more this “old” University of Washington Registrar could learn about the Family Educational Rights and Privacy Act (FERPA). But, there is, and like you, there will always be more to learn. I first learned about FERPA at my first AACRAO Annual meeting in 1997. I have been geeking out on this federal privacy law alongside AACRAO Senior Fellow, LeRoy Rooker, and training others ever since I was a new registrar. 

For example, our university counsel was the one who taught me just recently that the terms “student records” and “alumni records” do not appear in the actual FERPA federal law. Go ahead, use Control-F and check it out for yourself. I find it amazing that I have used these terms in my training for 25 years without knowing this.

The other new approach that I have focused on since the pandemic when FERPA was in the spotlight around Zoom recordings and other relevant issues is to focus always on the term Education (notice, not Educational) Records defined as 1) Directly related to a student and 2) Maintained by the institution or a party acting for the institution. As a result, I have learned to reference this definition and then to apply this phrase when responding to FERPA questions of who can access education records at your institution with “School Officials with a legitimate educational purpose and a need to know”. And the “need to know” is that they need access to the education record to perform their duties, not just to satisfy a curiosity.

I have presented at AACRAO many times on how to conduct a “FERPA Policies and Procedures Audit” to remain compliant with FERPA 34 CFR § 99.7 “What must an educational agency or institution include in its annual notification.” I always stress how important it is to audit your annual notice and to make sure that it includes that parents or eligible students have the right to:

1. Inspect and review student education records
2. Seek amendment of these records
3. Consent to disclosure of personally identifiable information
4. File a complaint with the Department of Education when there is a violation of their FERPA rights

What I had not realized until our university general counsel reviewed our annual notice lately was that we had not met the requirement to define what constitutes a school official and what constitutes a legitimate educational interest. We are working together to rectify this and I know, when the edits are complete, that our annual notice will be compliant with FERPA when we are done.

These simple adjustments to how I frame FERPA when responding to questions and guiding my colleagues have made a huge difference in easing the burden of applying FERPA and remaining in compliance. I share these new tricks, as one who many AACRAO colleagues may consider a seasoned FERPA expert, and to assure you that there are always nuances to this federal privacy law that we can better understand as well as grace and patience for everyone responsible for compliance on our campuses.

I encourage you to follow LeRoy Rooker’s “Ask the FERPA Professor” column in AACRAO Connect, to attend any FERPA sessions offered at your state, regional, and national “CRO” meetings, and to lean on your fellow FERPA experts when you need reassurance, guidance, or best practices in upholding FERPA.

After all, if this old UW Husky is still learning new tricks after a quarter of a century training others on FERPA, that means we are all on this educational journey together and there is always room to learn more.