Regulations Now Allow for Electronic Releases
more than thirty years, the Family Educational Rights and Privacy
Act (FERPA) has dictated how faculty and staff at American colleges
and universities maintain records about their students.
FERPA's lifetime, the statute has changed with the times. The Supreme
Court some years ago held, for example, that the law does not provide
students a right to sue an institution over alleged FERPA violations.
controversial were amendments Congress made to the Act after September
11. The PATRIOT Act yielded changes to FERPA in an effort to allow
federal investigators greater access to student records.
this year, however, the US Department of Education modified the
federal regulations that implement FERPA with an eye toward bringing
the law into the information age.
FERPA, an institution must keep personally identifiable information
in a student's education records in a confidential manner. The term
"education records" includes records that are directly
related to a student and maintained by either the institution or
a party acting for the institution.
important right that FERPA extends to the college and university
student is the right to authorize release of confidential information
out of that student's education records to a third party.
to certain exceptions detailed in the law, FERPA holds that an institution
may disclose such information only upon express authorization by
the student. For years, that authorization could be evidenced only
by a written release signed by the student.
FERPA regulations further required that the written release specify
the records to be disclosed, state the purpose of the disclosure,
and identify the party or class of parties to whom the disclosure
was to be made.
the new changes to those regulations, a college or university may
now honor an authorization that comes in "electronic form."
This electronic consent must identify and authenticate "a particular
person as the source of the electronic consent" and indicate
"such person's approval of the information contained in the
institutional officials no doubt welcome the Department of Education's
efforts to make FERPA procedures comport with digital technology,
the regulation by itself does not provide an approved protocol for
releasing confidential information upon receipt of an "electronic
the same time it issued the new regulation, however, the Department
also provided some assistance to institutional officials in amending
their procedures for the release of records. Specifically, the procedures
colleges and universities presently follow in honoring electronic
signatures in electronic student loan transfers may also guide officials
in releasing student records.
procedures would allow, for example, the use of a personal identification
number or password known only to the institution and the student,
or a computer image that is created from the scanned image of the
borrower's handwritten signature. All other requirements of the
regulation on release of records to a third party remain intact.
The electronic consent must still be dated and specify the records
to be disclosed, the purpose of the disclosure, and the party to
whom the disclosure is to be made.
to the recent changes, though, consent need not take the form exclusively
of a paper document.
in the Fall 2004 Edition of In Brief