Ohio University keeps student transcripts, other educational records, in secure online storage with limited access under FERPA law
Editor’s note: This is the second story in a two-part series about how FERPA affects student privacy and how Ohio University maintains FERPA-protected documents.
In an age of electronic security breaches, leaks and hacks, Ohio University has to be careful to protect the information it keeps about students.
That information includes social security numbers, grades and disciplinary records, which are kept private under the Federal Educational Rights and Privacy Act, or FERPA.
Though the university insists it won’t release documents protected under the law without consent of the student, it still has to make sure its information is secure.
“We take a standards-based approach to securing university data using federal cyber-security guidelines,” Sean O’Malley, OIT communications manager, said in an email. “This means that we identify relevant risks to student data and apply appropriate technologies and processes like encryption and access control to reduce the impact of threats to the confidentiality, integrity and availability of our student systems.”
Ohio University defines its students’ educational records as “any record, in any form or medium that is directly related to a student by way of personally identifiable information and is maintained by Ohio University or an agent acting on behalf of Ohio University,” according to university procedures.
A student’s educational record is not one comprehensive file but is maintained by multiple officials, or custodians, within the university.
{{tncms-asset app="editorial" id="324f2ec6-e883-11e4-bdde-737aa39d5a9d"}}
Only a small portion of a student’s FERPA records is kept in print form, such as a student’s academic advising records, which may be kept by individual faculty members.
All academic records of OU students who enrolled in 1985 or after are stored in an electronic database while the transcripts of students who attended OU prior to 1985 are stored in fireproof safes, secured within the Registrar’s office.
But academic records make up only a portion of a student’s overall educational record.
Many of these educational records are stored electronically in the university’s Student Information System, which includes information about grades, admissions and financial aid, University Registrar Debra Benton said.
Other records, such as information on a student’s residential housing, are stored on a separate online system.
{{tncms-asset app="editorial" id="534ca7de-ad6a-11e3-9039-0017a43b2370"}}
University employees requesting access to portions of a student’s FERPA record must sign an agreement promising to keep the information secret. That signed agreement then goes to the appropriate records custodian, who approves or denies the request, Benton said.
“It always falls back to the job duties or the responsibilities of the person as to whether or not they are granted access to that information,” Benton said.“I think this FERPA compliance statement is above and beyond what we’re required to do.”
That faculty member is then only granted access to the portion of those FERPA records that are relevant to the initial request.
“If you request access because you need to know if a student is enrolled, the access you’re granted is going to be different from the person who requests access because they need to review students at the end of the semester to determine their probationary status,” Benton said.
{{tncms-asset app="editorial" id="638b9558-ae3a-11e3-a506-001a4bcf6878"}}
Students may also request to review their university-maintained FERPA records at any time and have the right to request an amendment of those records under the law.
Student directory information, such as a student’s name, address and telephone number, is not considered information protected under FERPA — meaning it can be released to third parties upon request.
“Without the defined directory information, we would not be able to have a phone book or online directory of students,” Benton said.
Because FERPA laws protect students’ educational records from outside sources, parents of students under the law are ineligible from receiving records information without the students’ notification.
“Sometimes we walk that line with FERPA with talking with parents about their students,” said Dean of Students Jenny Hall-Jones.
{{tncms-asset app="editorial" id="73618ff5-7dd8-5e78-bd3a-212dc52da328"}}
One exception to the FERPA law includes health and safety emergencies that would directly affect the students’ families.
“We think and talk about a lot ‘should we reach out to a parent on this?’” Hall-Jones said.
No student records will be maintained that are not directly related to the basic purposes of the university, as noted in the university’s official policy on student records. But, “We retain a student’s academic transcript records forever,” Benton said.
Students who want to withhold their personal information from the directory can file a Confidential Status Request.
Schools must notify eligible students of their rights under FERPA each year.
OU Registrar Benton said she sends out an email notification every semester reminding students of their FERPA rights. This semester, the subject line of the email read “Important Privacy Notice — FERPA Rights.”
@bethanynbella
