Privacy of Student Information

Family Educational Rights and Privacy Act (FERPA)

The Family Educational Rights and Privacy Act (FERPA) is a federal law designed to protect the privacy of a student's education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student, or former student, who has reached the age of 18 or is attending any school beyond the high school level. Students and former students to whom the rights have transferred are called eligible students.

When an individual requests student information from a university, the university must respond in accordance with FERPA guidelines. The Department of Education's FERPA guidelines act as the foundation. In other words, JHU/JHM cannot exceed them. However, the university can be more restrictive. JHU/JHM is slightly more restrictive, and some schools within JHU/JHM are more restrictive than the university's guidelines in the directory information they release.

What Information May an Institution Disclose?

JHU/JHM may disclose directory information, or personally identifiable information not deemed harmful to the student if released. This information includes:

• The name of a student who is in attendance or who has been in attendance
• The local, home and e-mail addresses of a present or former student
• The telephone number of a present or former student
• The date and place of birth of a present or former student
• Names of parents and spouse
• The major field of study of a present or former student
• Participation of a student or former student in officially recognized activities and sports
• Dates of attendance
• Degrees and awards received and pertinent dates
• The previous educational agencies or institutions attended by a student and dates of attendance
• Photograph
• Classification and level of study
  

What Information May Not Be Disclosed (Protected Under FERPA)?

According to the American Association of Collegiate Registrars and Admissions Officers (AACRAO), the following is not considered directory information and may not be disclosed in any way (except to a school official with a legitimate educational interest, or to a third party with a signed and dated consent from the student):

• Student identification numbers
• Social security numbers
• Ethnicity/race/nationality
• Gender

If an individual requests student information not included under the term directory information, the University must obtain written permission (signed and dated) from the student before disclosing this information.

What Information May Universities Collect from Students and What Collection Method May Be Used?

FERPA does not address collection of data, as its emphasis is on maintaining the right of privacy. Basically, the method of collection is whatever fashion the institution determines (e.g., Internet Web form, mail-in survey, over the phone). Inherent in that determination is that in transmitting the information to the institution, the institution ensures that the information is protected and that when disclosing the collected information, the institution follows FERPA guidelines for disclosure. Thus, security in collection is indirectly inferred. See the guidelines on web security for detailed information.

What is JHU/JHM's Policy on FERPA?

JHU/JHM may not disclose education records about students nor allow inspection of student records without written permission by the student. An education record is defined as a record maintained by an educational institution and includes information that makes a student personally identifiable. Examples of personally identifiable information are: name, address, telephone number or Social Security Number or another student identifier. A record can be information maintained in any way, including (but not limited to) handwriting, film, audio, video, computer media, print or microfilm.

Who Is the FERPA Contact at JHU/JHM?

The University's General Counsel's Office is the legal advisor for ensuring compliance with the statute. However, the responsibility flows to the administrative offices that deal with student data on a consistent basis. Generally, FERPA questions are referred to each division's registrar. The registrars are viewed as the advisors for FERPA-related issues/questions since they deal with the bulk of student data in various ways. The registrar is also the contact for enrolled students who have questions about privacy rights and access to their information. Internally, they advise administrators, faculty, etc., about properly handling student information to ensure regulatory compliance. If a question or issue confronts the registrar that exceeds the scope of their guidelines, they then involve General Counsel.

For More Information on FERPA

U.S. Department of Education Family Policy Compliance Office
American Association of Collegiate Registrars and Admissions Officers
JHU/JHMI's FERPA policy

If there is any doubt about the methods for collecting, storing, or displaying sensitive information on web sites, the Johns Hopkins legal departments (410-516-8128) should be contacted for a definitive answer about Hopkins' liability and responsibility.