FERPA 101 - Healthy Schools Campaign
FERPA 101 December 4, 2017 Michael Hawes Director of Student Privacy Policy U.S. Department of Education United States Department of Education Privacy Technical Assistance Center 2
The U.S. Department of Education’s Role in Protecting Student Privacy Administering and enforcing federal laws governing the privacy of student information Family Educational Rights and Privacy Act (FERPA) Protection of Pupil Rights Amendment (PPRA) Raising awareness of privacy challenges Providing technical assistance to schools, districts, and states Promoting privacy & security best practices 2 2 United States Department of Education, Privacy Technical Assistance Center 2
Family Educational Rights and Privacy Act (FERPA) Gives parents (and eligible students) the right to access and seek to amend their children’s education records Protects personally identifiable information (PII) from education records from unauthorized disclosure Requires written consent before sharing PII – unless an exception applies 3 2 United States Department of Education, Privacy Technical Assistance Center 3
To which educational agencies and institutions does FERPA apply? Elementary Secondary Postsecondary 4 2 U E S D D E P T O F United States Department of Education, Privacy Technical Assistance Center 4
Just what is an Education Record? “Education records” are records that are – 1) directly related to a student; and 2) maintained by an educational agency or institution or by a party acting for the agency or institution. 5 2 United States Department of Education, Privacy Technical Assistance Center 5
Personally Identifiable Information (PII) Direct Identifiers e.g., Name, SSN, Student ID Number, etc. (1:1 relationship to student) Indirect Identifiers e.g., Birthdate, Demographic Information (1:Many relationship to student) “Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.” (§ 99.3) 6 2 United States Department of Education, Privacy Technical Assistance Center 6
Exceptions to FERPA’s Written Consent Requirement 7 2 United States Department of Education, Privacy Technical Assistance Center 7
Directory Information Exception May include: ü name, address, phone number, and e-mail address ü photograph ü date and place of birth ü Most recent school attended; grade level and major field of study ü dates of attendance (e.g., year or semester) ü participation in officially recognized sports and activities; height and weight of athletes, ü degrees, honors, and awards received, and Can never include social security number Can’t disclose non-directory information with directory information 8 2 United States Department of Education, Privacy Technical Assistance Center
Directory Information Exception Annual notice must be given to parents Students may choose to “opt-out” of the disclosure of directory information Schools may adopt a limited directory information policy that allows for the disclosure of directory information to specific parties, for specific purposes, or for both. 9 2 United States Department of Education, Privacy Technical Assistance Center 9
FERPA: School Official Exception PII may only be disclosed from education records without consent to other school officials within institution or to third parties acting as school officials, if they: 10 Perform an institutional service or function for which the agency or institution would otherwise use employees; Are under the direct control of the agency or institution with respect to the use and maintenance of education records; Only use PII from education records for the purposes for which the disclosure was made; Meet the criteria specified in the school’s annual notification of FERPA rights 2 United States Department of Education, Privacy Technical Assistance Center
Health or Safety Emergencies Exception Disclosure is necessary to protect the health or safety of the student or others. There is an articulable and significant threat to the health or safety of a student or other individuals. Appropriate parties typically means local, State, or federal law enforcement, trained medical personnel, public health officials, and parents. Must be related to an actual, impending, or imminent emergency. School makes determination on case-by-case basis. 11 2 United States Department of Education, Privacy Technical Assistance Center
Research & Evaluation under FERPA FERPA does not have a “research” exception to the parental consent requirement. Instead, research and evaluation using PII from education records is typically performed using either FERPA’s: Studies Exception, or the Audit and Evaluation Exception to the requirement for parental consent. 12 2 United States Department of Education, Privacy Technical Assistance Center 12
Audit/Evaluation Exception Allows PII from education records to be shared without consent, for certain audits or evaluations, with: “Authorized representatives” of certain FERPA-permitted entities”: Comptroller General of U.S., U.S. Attorney General, U.S. Secretary of Education, and State or Local Educational Authorities; Must be to audit or evaluate a federal- or state-supported education program, and if there is a written agreement that meets certain requirements. 34 CFR Section 99.31(a)(3) 13 2 United States Department of Education, Privacy Technical Assistance Center 13
FERPA: Studies Exception PII from education records may be disclosed in connection with certain studies conducted “for or on behalf of” schools, school districts, or postsecondary institutions if: Studies must be for the purpose - Developing, validating, or administering predictive tests; - Administering student aid programs; or - Improving instruction There is a written agreement with the individual/organization performing the study that meets certain requirements. 14 2 United States Department of Education, Privacy Technical Assistance Center
How should you obtain the student data you need for your grants? 15 2 United States Department of Education, Privacy Technical Assistance Center
Will you be publishing data? Remember: FERPA’s definition of PII includes anything linked or linkable to the student Aggregate data may still contain PII! 16 2 United States Department of Education, Privacy Technical Assistance Center
Integrated Data Systems PTAC Guidance on Integrated Data Systems and Student Privacy (January 2017) 17 2 United States Department of Education, Privacy Technical Assistance Center
PTAC Resources https://studentprivacy.ed.gov/ Help Desk (privacyTA@ed.gov) Guidance and Best Practice Documents o Data Sharing under FERPA o Data Security o Data Governance and much, much more. Videos o FERPA for Parents and Students o Designing a Privacy Program and many others. 18 United States Department of Education 2 United States Department Education, Privacy Technical Assistance Center Privacy Technical AssistanceofCenter
CONTACT INFORMATION United States Department of Education, Privacy Technical Assistance Center (855) 249-3072 (202) 260-3887 privacyTA@ed.gov student.privacy.ed.gov (855) 249-3073 19 2 United States Department of Education, Privacy Technical Assistance Center
Lara Cartwright-Smith, JD, MPH www.healthinfolaw.org
HIPAA Privacy Rule Basics HIPAA Privacy Rule Applies to records held by Covered Entities (CEs) Information covered Not covered Consent for disclosures Permissive disclosures Required disclosures mainly health care providers and insurers/plans) Business Associates (BAs) who work on behalf of CEs and use or maintain PHI Protected Health Information (PHI) individually identifiable health information held or transmitted by CE or BA Includes a limited data set (LDS) Partially de-identified by excluding 18 identifiers, such as name, address, SSN. Health information in records that are governed by FERPA; De-identified information. In general, CEs may not disclose PHI without written authorization by the person who is the subject of the information. For minors, state law re: parental consent applies. Treatment, Payment, Healthcare Operations (TPO); Required by state law (inc. health and safety); For research, public health practice, and quality improvement, but only LDS (partially de-identified). Minimum necessary standard applies in most cases (except treatment). To individual or their designated recipient. www.healthinfolaw.org
Where FERPA applies, HIPAA doesn’t Under HIPAA, “protected health information” (PHI) does not include: – Employment or education records held by a CE; – Information in records subject to FERPA; or – De-identified information. Health records maintained a school that are “education records” or “treatment records” of eligible students under FERPA are excluded from the definition of PHI. Therefore, neither the HIPAA Privacy Rule nor the HIPAA Security Rule applies to schools where the only records kept meet the definition of education or treatment records under FERPA. www.healthinfolaw.org
Schools typically will only have to comply with FERPA, not HIPAA Student health records maintained by a person or entity acting on behalf of a school subject to FERPA are education records, not PHI. If FERPA applies, its stricter standards govern, even if HIPAA would allow disclosure. Schools may receive information from HIPAA-covered entities, such as a provider or health plan. Once the information is added to a student’s school record, it’s covered by FERPA, not HIPAA. – Receiving such information does not make the school a business associate under HIPAA. www.healthinfolaw.org
Research & Evaluation under FERPA FERPA does not have a "research" exception to the parental consent requirement. Instead, research and evaluation using PII from education records is typically performed using either FERPA's: Studies Exception, or the Audit and Evaluation Exception to the requirement for parental consent. 12
FERPA transfer from the parents to the student, and he or she is known as an "eligible student" under FERPA. We will talk specifically about these rights as we get into this presentation. This means that the parents no longer have "rights" under FERPA, but there are provisions in FERPA that will permit a
potential violation of FERPA. FERPA law requires annual notice of institutional FERPA policy. Policies and procedures provide documents for continued training and reference, especially in light of faculty and staff turnover. While FERPA law does not mandate training, it's obviously a good idea. OVERVIEW
FERPA violation is confirmed and ensure privacy related communications sent to students impacted by a FERPA violation include links to the FERPA website, Regulation FIU-108, Access to Student Education Records, and/or other applicable contact information. A log of FERPA requests and potential violations was created during the audit. The
Dec 17, 2018 · medical/counseling records at the college or university the student attends; FERPA does. Treatment Records under FERPA are handled in most ways like Protected Health Information under HIPAA, but not in all ways. A student does not have a FERPA right to “inspect and review” unshared treatment r
They will be happy to answer your questions or provide additional training. 1. As federal law, FERPA trumps Florida's open records lawsand as the University and many of our students rely on federal grants and financial aid, it is vital FSU comply with FERPA . Microsoft PowerPoint - FERPA Template - White 06-27-2017 Author: sehubbard
has completed annual FERPA training on _ (Print Date) I confirm that I have received a copy of Snead State's policy and procedures regarding confidentiality of student records. _ (Signature) Title: Microsoft PowerPoint - FERPA Training [Read-Only] Author: vcarr Created Date: 9/5/2012 7:57:30 AM .
FERPA Rights Begin/End for a Student When: A student is in attendance as defined by JSU At JSU this means the student officially completed registration, is enrolled and attending courses Students continue to have FERPA rights even after they have left or graduated from JSU Student FERPA Rights are only terminated upon death of the student
An automotive cooling system usually consists of radiator, water pump, thermostat, radiator pressure cap, and electric cooling fan (Maple, 2008). The radiator is the main component as it was designed to remove heat from an engine block by using specified coolants. Generally, the coolant of the radiator is either water or water and ethylene glycol (anti-freezing fluid), which flows inside the .
