Note: University clients should consult campus legal counsel or the Office of General Counsel for questions related to these FAQs.

Q. What is the process for disclosing a student's own education records to the student?
A. Upon the request of a student, the appropriate university official will review the student's education records as stated in the request to identify information that the student is not entitled to receive (such as confidential recommendations, information about other students, among other things) and redact or remove that information. The university may then permit the student to review those records.  The university is not required to provide copies of the requested records unless it is not practicable for the student to inspect and review the records.  FERPA requires that this opportunity be provided within 45 days of the request.  

Q. What is the process for disclosing education records to others?
A. The process for disclosing education records to others is as follows:

  • The university official will determine if the requesting party may access the records and follow the appropriate procedure for providing the records depending on the basis for access.  Considerations include: whether the request is governed by FERPA and what, if any, basis for disclosure is involved and whether the request is governed by the Wisconsin Public Records Act.
  • The University official will review the record for information to which the requester is not entitled and remove that information from the file through separation or redaction, as appropriate.
  • The university official will provide access to the disclosable records as soon as practicable, but within 45 days for requests subject to FERPA.
  • If the education records contain personally identifiable information and are disclosed to third-parties, the university should inform the requester that the requester may not re-disclose the information to someone else without the written consent of the student.
  • Update the record of disclosures as appropriate.

Q. What is the process for disclosing education records pursuant to a subpoena or court order?
A. The process for disclosing education records pursuant to a subpoena or court order is as follows:

  • The university official shall review the subpoena or order to ensure it is valid. The subpoena must be issued by a court or agency that has authority to issue an order or subpoena in Wisconsin. 
  • If it is a valid subpoena or order, the university official will collect and review the records for compliance with the subpoena or order.
  • The university official will notify the subject of the subpoena or order in writing unless the subpoena or order directs otherwise.   The notice to the subject should inform the individual that the university will comply with the subpoena and disclose the records unless notified by the subject within a reasonable period of time that the individual has sought to contest the subpoena in a court of law.
  • Update the record of disclosures as appropriate.

Q. Does FERPA protect the education records of former students?
A. Yes. FERPA protects the education records of former students.

Q. Does FERPA protect information about former students collected after the students have graduated from the institution?
A. No. Information about former students (i.e., alumni records) collected after the students have graduated from the institution is not considered an education record, so it is not protected by FERPA.

Q. Does FERPA protect the education records of deceased students?
A. No. Please note that other laws and policies may apply for persons seeking the education records of a deceased student.

Q. What is a health or safety emergency?
A. A health safety emergency is an event in which education records may be released to third parties without the consent of the student.  Generally, a health or safety emergency occurs when the appropriate university official determines that there exists an immediate threat to an individual’s health or safety and such a disclosure is required to prevent or mitigate risk. 

Q. What should a faculty member do if a student asks for a reference to be provided to an employer or to another institution?
A. The faculty member will need a release from the student indicating the student's consent for the faculty member to disclose education records or information from education records if the faculty member is going to give an oral or written reference on behalf of a student that includes such information.  If the faculty member provides a written reference directly to the student, no release is required.

Q. What is a legitimate educational interest for those who have access to student education records?
A. Generally, those individuals who need to review an education record to fulfill their job responsibilities have a legitimate educational interest in reviewing the record. Those individuals usually must be employed by or act as an agent of the institution, or be under contract with the institution.  The titles of such individuals should be provided in the annual FERPA notice.

Q. What is directory information?
A. FERPA allows an institution to disclose directory information to third parties without the student's consent.  The university must provide annual notice to students concerning the institution's definition of directory information and permit students to "opt out" of such disclosure.  FERPA regulations define the categories of personally identifiable information that may constitute directory information.

Q. What are desk drawer notes?
A. The records of instructional, supervisory, and administrative personnel, and ancillary educational personnel, which are in the sole possession of the maker and which are not revealed to any other person may be considered "desk drawer notes" and are not considered education records under FERPA.

Q. What are campus law enforcement records?
A. Records that are created by a campus law enforcement unit for a law enforcement purpose and that are maintained by the unit.  These records, while in the custody of campus law enforcement, are not considered education records under FERPA.

Q. What about records relating to work-study students?
A. Records relating to work-study students are education records protected by FERPA.

Q. What about records relating to a student's disability and accommodations provided for that disability?
A. Records relating to students with disabilities are education records protected by FERPA. Disability records must be maintained separately from other education records because of the sensitive and private information contained therein. The best practice is to maintain student disability records in the institution's disability services office. Access to these records is on a need-to-know basis. NOTE: Student medical records provided to an institution during the disability accommodation process are not education records, but have separate protections under state law.

Overview of the Family Educational Rights and Privacy Act (FERPA) at UW System Institutions

The Federal Family Educational Rights and Privacy Act of 1974, known as “FERPA,” (20 U.S.C. § 1232g; 34 C.F.R. Part 99) governs access to student education records maintained by educational institutions, including those of the University of Wisconsin System. FERPA’s purpose is to protect the privacy of students’ education records and to ensure that students have access to their own records. Under FERPA, the presumption is that a student’s records are private and not available to the public without the consent of the student. UW System employees responding to requests for student information must be aware of the unique, protected status of such information.

To Whom Does FERPA Apply?

FERPA applies to “eligible students.” An eligible student is any individual who has been or is “in attendance” at an institution of post-secondary education at any time and about whom the institution maintains records. “In attendance” is defined by the institution and can include correspondence courses and on-line courses. The age of the student is irrelevant under FERPA.

What Records are Covered by FERPA?

FERPA protects from disclosure “education records,” broadly defined to include all records directly related to a student and maintained by an educational institution or someone acting on its behalf (e.g., contractors). Records can be in any format, including email messages, other computer records, videos, etc.

However, the definition excludes, among other records:

  • campus law enforcement records (if certain criteria are met);
  • certain notes made by employees for their own personal use;
  • certain employment records;
  • certain medical treatment records; and
  • alumni records containing information obtained after a student’s graduation.

NOTE: “Education records” does not include information obtained through personal observation.

Who Has Access to Education Records?

Generally, there are four categories of individuals who can obtain access to education records in the manner defined under FERPA:

  1. Students
  2. Parents of Students
  3. School Officials
  4. Others

How is Access Obtained?

Students. Students may have access to their own education records with few exceptions.  Those exceptions include parental financial information, confidential letters of recommendation, and portions of their own education records containing information about other students.

Parents. Parents generally have no automatic right of access to the education records of their children.  Institutions may provide parents access to the education records of the student in some cases:

  • With the consent of their child (see below);
  • If the child is identified as a dependent on the parents’ tax return;
  • If there is a health and safety emergency involving their child;
  • If their student is under 21 years old and has been found responsible for a drug or alcohol violation through the campus disciplinary proceedings.
  • The final results of a disciplinary proceeding involving a crime of violence or non-forcible sex offence, under certain circumstances.

School Officials. School officials who have a legitimate educational need to access students’ records may do so.

Others. Members of the public, employees of certain agencies, court officials and others may access education records when the following circumstances apply:

  • The student has given consent (see below);
  • The information has been designated directory information (see below);
  • A health or safety emergency is involved;
  • If the individual is a victim of certain types of violent offenses, s/he may obtain certain information;
  • The recipient is an employee of an institution to which the student is seeking or has transferred;
  • The final results of a disciplinary proceeding involving a crime of violence or non-forcible sex offense, under certain circumstances;
  • Organizations conducting studies on behalf of the institution (if certain criteria are met);
  • To comply with a subpoena or court order;
  • For audit and evaluation by certain state and local officials.

NOTE: FERPA permits, but does not require, these disclosures. When disclosure is contemplated under these provisions of FERPA, it may be appropriate to consult with counsel to apply the balancing and notification requirements of the Wisconsin Public Records Law.

What Does it Mean for a Student to Consent?

A student’s valid consent means an informed, written consent which:

  • specifies the record(s) to be disclosed;
  • states the reason for disclosing the records; and
  • identifies the person(s) to whom disclosure may be made.

What is “Directory Information”?

“Directory information” is personally-identifiable student information which the U.S. Department of Education has concluded is permissible for institutions to release without a student’s consent. Such information may include the students’:

  • Name
  • Address
  • Telephone number
  • Date and place of birth
  • Major field of study
  • Dates of attendance
  • Grade level
  • Enrollment status
  • Participation in activities and sports
  • Weight and height of athletes
  • Degrees, honors, awards
  • Most recent education institution(s) attended
  • Photograph

Note: Directory information may never include social security number.

What Must an Institution Do Under FERPA?

Annual Notice. Annually, the institution must advise students of:

  • Right to inspect and review their own records;
  • Right to seek amendment of their records;
  • Right to consent to disclosure;
  • Right to file a complaint with the Department of Education;
  • Right to opt out of directory information (provide a definition of directory information);
  • Definition of school officials and legitimate educational interest;
  • Records transfer policy.

Record of Disclosures. As part of the education record of each student, each institution must maintain a record of disclosures which contains the following information:

  • The names of all individuals, agencies, or organizations that have requested, or obtained, access to the student’s records and the legitimate educational interest of those accessing the information; and
  • Any disclosures that are made under the health and safety emergency exception, the circumstances surrounding that decision to disclose and to whom disclosures were made.

However, there is no need to record:

  • access by the institution’s own employees;
  • release of “directory information”; or
  • release of information with a student’s written consent.

Authentication of Requestors. Institutions must use “reasonable methods” to identify and authenticate the identity of those who access records. Such methods may include requesting a combination of some of the following: the requestor’s photo identification; all or part of the student’s ID number; the student’s date of birth; the student’s PIN; a password; a personal security question.

What Other Information is Important to Know Under FERPA?

FERPA Complaints. Students may file a complaint with the U.S. Department of Education. Generally speaking, however, students may not file a lawsuit against the institution for a violation of FERPA.

Penalties for Violation of FERPA. Penalties for uncorrected violations may include a cutoff of federal funding to the institution.

Military Access to Education Records. The Solomon Amendment (10 U.S.C. § 982; 32 C.F.R. 216, 65 F.R. 2056) is not a part of FERPA, but it allows military organizations access to information ordinarily restricted under FERPA for the purpose of military recruiting. Specifically, the Solomon Amendment permits Department of Defense entities to physically access institutional facilities to recruit students, and to obtain students’ names, addresses, phone numbers, age, class, and degree program once every term. Institutions are exempt from these requirements if they do not collect this information, or if they do not normally provide this information to prospective employers. The Solomon Amendment only applies to enrolled students over age 17.

Institutions that violate the Solomon Amendment risk loss of funding from several federal agencies, including the Departments of Defense, Education, Health and Human Services, and Labor. If a component of the institution violates the Solomon Amendment, larger system funding may be affected.