FERPA Regulations Now Allow for Electronic Releases

For more than thirty years, the Family Educational Rights and Privacy Act (FERPA) has dictated how faculty and staff at American colleges and universities maintain records about their students.

Over FERPA's lifetime, the statute has changed with the times. The Supreme Court some years ago held, for example, that the law does not provide students a right to sue an institution over alleged FERPA violations.

More controversial were amendments Congress made to the Act after September 11. The PATRIOT Act yielded changes to FERPA in an effort to allow federal investigators greater access to student records.

Earlier this year, however, the US Department of Education modified the federal regulations that implement FERPA with an eye toward bringing the law into the information age.

Under FERPA, an institution must keep personally identifiable information in a student's education records in a confidential manner. The term "education records" includes records that are directly related to a student and maintained by either the institution or a party acting for the institution.

One important right that FERPA extends to the college and university student is the right to authorize release of confidential information out of that student's education records to a third party.

Subject to certain exceptions detailed in the law, FERPA holds that an institution may disclose such information only upon express authorization by the student. For years, that authorization could be evidenced only by a written release signed by the student.

The FERPA regulations further required that the written release specify the records to be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure was to be made.

With the new changes to those regulations, a college or university may now honor an authorization that comes in "electronic form." This electronic consent must identify and authenticate "a particular person as the source of the electronic consent" and indicate "such person's approval of the information contained in the electronic consent."

While institutional officials no doubt welcome the Department of Education's efforts to make FERPA procedures comport with digital technology, the regulation by itself does not provide an approved protocol for releasing confidential information upon receipt of an "electronic consent."

At the same time it issued the new regulation, however, the Department also provided some assistance to institutional officials in amending their procedures for the release of records. Specifically, the procedures colleges and universities presently follow in honoring electronic signatures in electronic student loan transfers may also guide officials in releasing student records.

Those procedures would allow, for example, the use of a personal identification number or password known only to the institution and the student, or a computer image that is created from the scanned image of the borrower's handwritten signature. All other requirements of the regulation on release of records to a third party remain intact. The electronic consent must still be dated and specify the records to be disclosed, the purpose of the disclosure, and the party to whom the disclosure is to be made.

Thanks to the recent changes, though, consent need not take the form exclusively of a paper document.

Published in the Fall 2004 Edition of In Brief