October 11, 2005
Brad Bartel, Ph.D.
Fort Lewis College
2500 Berndt Hall
1000 Rim Drive
Durango, Colorado 81301-3999
Dear Dr. Bartel:
This responds to your December 10, 2004, letter in which you advised this Office of an unauthorized disclosure of information from students' education records by a professor at Fort Lewis College (College). This office administers the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and provides technical assistance to educational agencies and institutions to ensure compliance with the statute and regulations, which are codified at 34 CFR Part 99.
Your letter states that a faculty member published an article in which student term papers were quoted with students identified by first name and tribal affiliation. You indicated that the scope of this violation was small in that the personally identifiable information would be apparent only to those who were in the classroom and to select individuals on campus. You explained further that this disclosure was an aberration and that the College has a standard practice of training faculty and staff on FERPA compliance on a bi-annual basis, along with various emails through the year. According to your letter, the College has also undertaken a two-part solution to avoid any further FERPA violations by adding workshops for existing and new faculty as needed, and defining and posting a list of documents that are defined as "educational records."
Under FERPA, no funds administered by the Secretary of Education shall be made available to an educational agency or institution that has a policy or practice or disclosing education records, or personally identifiable information from education records, without the prior written consent of a parent except as authorized by law. 20 U.S.C. § 1232g(b)(1) and (b)(2). While the law does not prescribe specific methods to be used to protect education records from unauthorized access or disclosure, the prohibition in FERPA against disclosing personally identifiable information from education records without consent clearly does not allow an educational agency or institution to leave education records unprotected, whether in paper, film, electronic, or any other format. We interpret this provision to mean that an educational agency or institution must use physical, technological, administrative and other methods, including training, to protect education records against unauthorized access and disclosure in ways that are reasonable and appropriate to the circumstances in which the records are maintained.
The term "education records" is defined as records that are directly related to a student and maintained by an educational agency or institution, or by a party acting for the agency or institution. See 34 CFR § 99.3 ("Education records"). This definition covers student term papers that have been collected and maintained by a teacher or other school official acting on behalf of the College. The FERPA regulations specify that a parent (or eligible student, as defined in § 99.3) must provide a signed and dated written consent in accordance with the requirements of § 99.30 before personally identifiable information from education records is disclosed, unless the disclosure falls within one of the exceptions set forth in § 99.31. The regulations define "personally identifiable information" as the student's (or family member's) name, address, personal identifier, and personal characteristics or other information that would make the student's identity easily traceable. 34 CFR § 99.3 ("Personally identifiable information"). Disclosure of student's first name and tribal affiliation in a small community, such as the College, would make a student's identity easily traceable and, therefore, is prohibited under FERPA unless the student has provided written consent.
There is no indication from the information you have provided that the FERPA violation that occurred, as described in your letter, was due to the College's failure to take reasonable and appropriate steps to protect the education records it maintains. Further, it appears that once the College became aware of the problem it promptly investigated the breach and took reasonable and appropriate steps to prevent any further unauthorized disclosures by adding workshops for existing and new faculty on FERPA issues. In that regard, the College's FERPA training should include specific instruction on the type of violation that you reported to this Office. We would also ask you to provide specific instruction on this matter to the professor who published the student information in question except that it is our understanding that this individual no longer provides services for the College. Failure to take these steps could constitute a policy or practice of violating FERPA by permitting the disclosure of personally identifiable information from education records without the required prior written consent.
In the absence of a complaint or any additional information, we will consider this matter closed. Please do not hesitate to contact this Office again if we may be of assistance in ensuring that the College remains in compliance with FERPA.
LeRoy S. Rooker
Family Policy Compliance Office