Data Model Concepts - UMKC-Law/DataSharingAgreement GitHub Wiki

FERPA Roles, Transactions, Data and System:

1. FERPA Roles:

Student:

  • Eligible Student: Once a student reaches 18 years of age or attends a postsecondary institution, he or she becomes an "eligible student," and all rights formerly given to parents under FERPA transfer to the student.
  • Minor Student: Prior to a student reaching 18 years of age or attending a postsecondary institution, he or she is a "minor student," and privacy rights vest with their parents under FERPA.
  • Dependent Student: A student whom either parent has claimed as a dependent on the parent's most recent income tax statement, in accordance with Section 152 of the Internal Revenue Code.

Parents:

The custodial and noncustodial parents alike of a Student.

School:

Educational agencies and institutions that receive funding under any program administered by the US Department of Education.

Third Party

Authorized Governmental Official:

Authorized representatives of the Comptroller General of the United States, the Attorney General of the United States, the U.S. Secretary of Education, and State and local educational authorities.

2. FERPA Transactions:

Prohibited Disclosure Transactions:

Unauthorized disclosure of personally identifiable information from educational records is prohibited.

Fair Information Practice Disclosures:

  • Either an eligible student or a Parent of a minor student have:

The right to access the student's educational records;
The right to seek to have the records amended;
The right to consent to disclosure of personally identifiable information from the records (except in certain circumstances specified in the FERPA regulations); and
The right to file a complaint with the Department.

Disclosure to Parent of Dependent Student:

A school is permitted to disclose personally identifiable information from education records without consent when the disclosure is to the parents of a "dependent student" as that term is defined in Section 152 of the Internal Revenue Code. Generally, if either parent has claimed the student as a dependent on the parent's most recent year's income tax statement, the school may non-consensually disclose the eligible student's education records to both parents under this exception.

Disclosure to Government Official for Oversight and Compliance:

A school may non-consensually disclose personally identifiable information from education records to Authorized Governmental Official for audit or evaluation of Federal or State supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs.

Disclosure of Directory Information:

A school is permitted to disclose personally identifiable information from a student's education records without consent when such information has been appropriately designated as directory information.

Administrative Processes:

  • Seek Amendment: An eligible student has the right to seek to have the records amended.
  • The eligible student has the right to have control over the disclosure of personally identifiable information from the records (except in certain circumstances specified in the FERPA regulations)
  • File a Complain: An eligible student has the right to file a complaint with the United States Department of Education.

Notice of Rights

  • Annual Notification of Rights: Under FERPA, a school must annually notify eligible students in attendance of their rights under FERPA. The annual notification must include information regarding an eligible student's right to inspect and review his or her education records, the right to seek to amend the records, the right to consent to disclosure of personally identifiable information from the records (except in certain circumstances), and the right to file a complaint with the Office regarding an alleged failure by a school to comply with FERPA. It must also inform eligible students of the school's definitions of the terms "school official" and "legitimate educational interest."

3. FERPA Data:

  • Educational Records: The term "education records" is defined as those records that contain information directly related to a student and which are maintained by an educational agency or institution or by a party acting for the agency or institution.

  • Directory Information: The term directory information is defined as information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed. Directory information could include information such as the student's name, address, e-mail address, telephone listing, photograph, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, the most recent previous educational agency or institution attended, grade level or year (such as freshman or junior), and enrollment status (undergraduate or graduate; full-time or part-time).

4. FERPA Systems:

  • Student Information Systems:
  • Parent Portal
  • Educational Apps and Services
  • Mobile Devices
  • School Networks and Enterprise Software

Other Provisions Relevant to Educational Records:

The above is partial recitation for purposes of demonstrating a format and approach to uniform description of relevant requirements and constraints pertaining to Protected Data. There are several other exceptions to FERPA's prohibition against non-consensual disclosure of personally identifiable information from education records, some of which are briefly mentioned below. Under certain conditions (specified in the FERPA regulations), a school may non-consensually disclose personally identifiable information from education records:

  • to organizations conducting studies for or on behalf of the school making the disclosure for the purposes of administering predictive tests, administering student aid programs, or improving instruction;
  • to comply with a judicial order or a lawfully issued subpoena;
  • to the victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense concerning the final results of a disciplinary hearing with respect to the alleged crime; and
  • to any third party the final results of a disciplinary proceeding related to a crime of violence or non-forcible sex offense if the student who is the alleged perpetrator is found to have violated the school's rules or policies. The disclosure of the final results only includes: the name of the alleged perpetrator, the violation committed, and any sanction imposed against the alleged perpetrator. The disclosure must not include the name of any other student, including a victim or witness, without the written consent of that other student.

As stated above, conditions specified in the FERPA regulations at 34 CFR § 99. 31 have to be met before a school may non-consensually disclose personally identifiable information from education records in connection with any of the exceptions mentioned above.

Several other relevant provisions of FERPA apply to circumstances such as a student's violation of any Federal, State, or local law, or of any rule or policy of the institution, governing the use or possession of alcohol or a controlled substance; A health or safety emergency involving a son or daughter, even if the parents do not claim the student as a dependent; A school must inform eligible students of how it defines the terms "school official" and "legitimate educational interest" in its annual notification of FERPA rights; and several other factors, contingencies or situations.

In addition, other relevant legal requirements applicable to parties in the roles above exist, notably including the Protection of Pupil Rights Amendment (PPRA) (20 U.S.C. § 1232h. Regulations: 34 CFR Part 98) which applies to the programs and activities of a State educational agency (SEA), local educational agency (LEA), or other recipient of funds under any program funded by the U.S. Department of Education, and governs the administration to students of a survey, analysis, or evaluation that concerns one or more of the following eight protected areas:

  • political affiliations or beliefs of the student or the student’s parent;
  • mental or psychological problems of the student or the student’s family;
  • sex behavior or attitudes;
  • critical appraisals of other individuals with whom respondents have close family relationships;
  • legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers;
  • religious practices, affiliations, or beliefs of the student or student’s parent; or,
  • income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

Among many other things, PPRA requires LEAs to work with parents to develop and adopt policies on the following items, unless the LEA or SEA had established comparable policies on or before January 8, 2002:

· The right of parents to inspect, upon request, a survey created by a third party before the survey is administered or distributed by a school to students and the procedure for granting a request by a parent for such access; · Arrangements to protect student privacy that are provided by the LEA in the event of the administration of a survey to students containing one or more of the eight protected items of information noted above (including the right of parents to inspect, upon request, a survey that concerns one or more of the eight protected items of information); · The right of parents to inspect, upon request, any instructional material used as part of the educational curriculum for students, and the procedure for granting a request by a parent for such access; · Administration of physical exams or screenings of students; · The collection, disclosure, or use of personal information (including items such as a student’s or parent’s first and last name, address, telephone number or social security number) collected from students for marketing purposes, or to sell or otherwise provide the information to others for marketing purposes, including the LEA’s arrangements for protecting student privacy in the event of collection, disclosure, or use of information for these purposes; and · The right of parents to inspect, upon request, any instrument used in the collection of personal information for marketing or sales purposes before the instrument is administered or distributed to a student and the LEA’s procedure for granting a parent’s request for such access. · LEAs must notify parents of their rights under PPRA and of these policies at least annually at the beginning of the school year. LEAs must also notify parents within a reasonable period of time if any substantive change is made to the policies. (This notification requirement may be included in the general notification of rights under PPRA.) An LEA is not required to develop and adopt new policies if the SEA or LEA had in place on January 8, 2002, policies covering the requirements set forth in this law. However, the LEA must still provide annual notice of these policies to parents.

In addition, an LEA must “directly” notify, such as through U.S. Mail or email, parents of students who are scheduled to participate in the specific activities or surveys listed below and provide an opportunity for parents to opt their child out of participation in the specific survey or activity.

HIPAA:

CORI: