FERPA: Privacy of Records

FERPA – Right to Privacy

What is FERPA? FERPA stands for the Family Educational Rights and Privacy Act of 1974. This legislation protects the privacy of your student records and regulates how information is utilized. Release of student records at Oregon State University is bound by the federal law (FERPA), the Oregon Revised Statutes, and by the Oregon Administrative Rules.

*Students' FERPA rights begin when they are considered a student at OSU. The institutional definition of a student is when an individual has registered for START or has registered for classes, whichever comes first.

To learn more about FERPA, please review these sources:

FERPA Forms

Joint Consent to Release Information form

Some FAQs about the FERPA recommendation forms

FERPA Recommendation Letter - Internal

This form is to be used when there is a recommendation required for the college in which one is already a student. Some examples of when this form might be used is if a student is applying from a pre- program to a professional program or if a student is applying for a scholarship in their college or at the University.

FERPA Recommendation Letter - External

This form is to be used when there is a recommendation or reference that will be submitted external to Oregon State University.

    Confidentiality

    NO information may be released about students who have established confidentiality of their records.

    Students may restrict the release of their student information by completing a Confidentiality Request form. The Confidentiality Restriction prevents employees of OSU from providing any information, directory or confidential, to anyone. When a confidentiality restriction is in place we can only discuss a student’s record with the student if they are there in person with picture identification. For students who have a confidentiality restriction in place but are unable to visit the office in person, the student may communicate with OSU offices via their OSU-issued email address (ONID name @ oregonstate.edu).

    CORE Reports on FERPA Training

    Now that FERPA training is hosted on Qualtrics, there is no completion certificate as in the past. Instead, we have worked with the CORE team to provide reporting mechanisms on FERPA training completion. Two CORE reports will help in identifying if someone has taken and passed their FERPA training. BIC2910 searches all employees in a selected organization, indicating who has completed FERPA training in the organization. BIC2911 allows one to search ID numbers to see if someone or a group of people have taken and passed their FERPA training. Both reports will include all employees, including students and GTAs. Note: Results do not display. Please allow up to 48 hours after the passing of one's training for information to appear in CORE.

    Using Secure Credentials at OSU

    In conducting tasks associated with one’s official role at Oregon State University, particularly tasks that involve disclosures of protected information, using secure credentials is paramount. OSU provides all employees and students with oregonstate.edu email accounts that have been vetted for appropriate security measures. These measures are the steps OSU takes to protect data. Further, these oregonstate.edu email accounts link to a verifiable identity established with the University and meet the Family Educational Rights and Privacy Act for authentication. Third-party, personal accounts are not able to be verified as linked to a particular individual and, therefore, should not be used in discussing any student record information. This ensures email data remains protected through our contracted vendor and that email is sent from a verified identity.

    Clery Act

    The university posts campus security statistics in compliance with the Jeanne Clery Disclosure of Campus Security Policy and Campus Crime Statistics Act.

    Guidelines for Release of Information

    If you receive a request for information follow these guidelines to determine what, if any, information can be released.

    Retention & Statistics

    This section provides information about record retention requirements and statistical information available for the university.

    FERPA FAQs

    Q: I have been here at OSU for 18 years! Why do I need to re-do my FERPA training?

    A: The Office of the Registrar serves as the steward of student education data. Part of responsible stewardship is ensuring that those to whom the stewards provide access to student education data demonstrate proficiency in understanding their responsibilities under the Family Education Rights and Privacy Act (FERPA) of 1974. To ensure we are in compliance with federal law, the institution must have documentation that employees with access to student education data have successfully passed FERPA training. If someone completed FERPA training prior to January 2005, we will not have record of their proficiency and the employee or designated agent will be asked to take the training and quiz, as the law has changed since 2005. Additionally, we highly encourage parties to reengage in FERPA training biannually to remain current with one's FERPA knowledge.

    Q: Is it legal for me to email my class about class assignments and other work?

    A: Use of students' email addresses is acceptable for academic and educational purposes; the students' oregonstate.edu (ONID) addresses are the only officially recognized OSU email addresses and are available on Banner and Canvas rosters. Email addresses other than ONID addresses are not directory information and cannot be released. If you plan to make electronic communication a part of class requirements, be sure to include that information in the course syllabus that every student receives. Students who do not want to use email for their class work need to be aware of the requirement so that they can adjust their schedule accordingly. Many professors find it useful to set up a list serve for their class. Network Engineering has a useful site for list serves, see OSU List Support. Use of students' ONID email addresses is acceptable for academic and educational purposes, and they must only be distributed to people who have an educational need to know. When in doubt, contact the Office of the Registrar.

    Q: Doesn’t it violate FERPA if I include confidential students (students who have established confidentiality of their records) in a mass email to all of my students?

    A: Yes, it does. When you send email to a list of students in the To: line, then everyone can see all of the members on the list. It is important to exclude confidential students from the list. Then, you can send an individual email, with the same content as for all the other students, but addressed only to the confidential student. If you have more than one confidential student, you should send an individual email to each one of them.

    Q: May I post grades?

    A: You may post grades as long as only you and the individual student know who the grade is for. That is, you cannot use the students' names or their Student ID numbers. You can create a unique identifier (such as a number, NOT part of the Student ID number) for each of your students and post grades by that identifier. Be sure NOT to arrange the list in alphabetical order, even though the names are not printed. (NOTE: Do not pass a sign-up sheet around the class asking students to write down their unique identifier. All of the students who see the list will have access to the identifiers of other students.)

    Q: May I distribute students' graded exams and papers by putting them in a self-serve box so that students can easily pick up their papers?

    A: Distributing students' exams and papers in this way violates their confidentiality by making confidential records available to the public. This is not an acceptable practice.

    Q: I want to have my students use a social media platform to engage about our course content. Can I do this?

    A: Yes, you can. However, there are some guidelines to consider. Please see this resource guide on how to do so while maintaining students' FERPA rights.

    Q: What information may I give to a parent who wants to know how their student is doing—what their grade is in a particular class, or what their overall GPA is? What if the parent says they know their student got a D- and wants to know what can be done.

    A: You cannot discuss any specifics about the student's grades. Use a conditional response: "If a student in my class earned a D-, I would suggest…" You also can advise the parent on how the student can get their grades if they don't have them: Web or student transcript from the Office of the Registrar.

    Q: What information may I give if the student is a dependent and the parent can prove it with tax records?

    A: While federal law authorizes the release of records to parents of dependent students, it does not require it. The Oregon statute does not include release to parents as an authorized disclosure; since state law is more restrictive than the federal law, the university is bound by the state law. Only directory information may be released to parents of dependent or independent students.

    Q: What information may be given if the student is no longer enrolled?

    A: Only the same information as if the person were still enrolled as a student. Be sure to check whether the student had imposed confidentiality before leaving the university; if so, the confidentiality remains in effect.

    Q: If a student filed a confidentiality request when they were a student, but have since graduated, does that confidentiality request get revoked?

    A: No. A student, whether current or former, remains confidential until they revoke the confidentiality request.

    Q: What information may be given if the student is deceased?

    A: When a student dies, FERPA no longer applies, but since there may be other issues related to disclosure, the inquiry should be referred to the Office of the Registrar.

    Q: What if the caller is the Corvallis police, the FBI, or a representative of a government agency?

    A: A student's permission is required to release their records to these representatives. Refer the caller to the Office of the Registrar.

    Q: What if the Corvallis police, the FBI, or a representative of a government agency only want the student's class schedule?

    A: Class schedules are not directory information and may not be released. FERPA restrictions apply equally to law enforcement officials. Do not release the class schedule; refer the caller to the Office of the Registrar.

    Q: What if the FBI or federal agent says they need information about a student under the new anti-terrorism legislation?

    A: The USA PATRIOT Act (2001) and other legislation specify guidelines for release of information. Refer all such inquiries to the Office of the Registrar so that we can assure appropriate compliance.

    Q: What information may I write in a letter of recommendation?

    A: You can discuss information provided to you by the student, such as information from their resume, and information that you have gained in your academic relationship with the student. You cannot discuss any non-directory information (e.g. their grade in a course you taught) without the student's specific written consent.

    Q: The student organization I advise wants to invite all of the students in our major to their meeting. May they get a list of all students in our major along with their addresses?

    A: Yes, major is directory information as are student name and current address. The current address is maintained by the student, and may be the student's address in Corvallis or at some other location. Other addresses are not releasable. You should address your request for this information to the Office of the Registrar. For more information on requesting information, see our Data Requests page.

    Q: What if a student organization wants a list of X ethnicity students to invite them to their function. May they get a list of all X ethnicity students?

    A: Student organizations should work with Student Leadership and Involvement on submitting requests for this data. The contact for these type of requests is Danté Holloway.

    Q: What if someone requests a list of all of the students from X country?

    A: Refer all such requests to the Office of the Registrar.

    Q: My advisee is at home ill with a bad cold, so her sister stopped by to pick up her PIN. Is it OK to give it to her so that my advisee can register?

    A: The PIN is not directory information and may not be released to anyone but the student.

    Q: A community organization that I belong to wants to sell exam week care packets to parents; our organization will then deliver them to the students. May we get a list of parents' names and addresses?

    A: Parents' names and addresses are not directory information and may not be released.

    FERPA Resources

    FERPA can be confusing at times. We created this page to provide you with resources to better understand and uphold FERPA as it pertains to your professional responsibilities at Oregon State University.

    **This page is currently under construction; resources will be added periodically. If there's something you'd like to see here, please contact us!**

    FERPA tips for Instructors/Teaching Faculty

    Audio and Visual Recording in an Education Setting

    Instructional Use of Social Media Policy

    Procedures for Joint Consent to Release Information Form (Financial Aid, Registrar, Student Accounts, Academic Advising)

     

     

     

    FERPA Training Module

    FERPA Training Module at OSU

    The Office of the Registrar at OSU hosts a FERPA training module and quiz that is required for employees and affiliates to gain access to student information systems and is highly recommended for any employee or affiliate who works with students.

    There are two training modules:

    1. One for general employees (staff, teaching and professional faculty, administration) and,
    2. One for student employees (TAs, GTAs, student workers)

    Individuals should participate in the training relevant to their designated role at OSU.

    FERPA Employee Training Access

    OSU non-student employees (i.e., staff, professional faculty, teaching faculty, administration) can access the online FERPA training and quiz module through the MyOSU Portal, under the “Employee” tab.

    Once in the “Employee” tab, look for the section called “Employee Quick Links,” located on the right side of the screen. In that section, you should see a plus (+) sign next to “FERPA Training”—click that plus sign and then look for the “Faculty/Staff Training” link. Select that link. Please see the image below for visual instructions. Please note that the certificates produced by the old online FERPA training are no longer being accepted. If you need to provide evidence of FERPA training, you will need to take the training module hosted on the Portal. Once you have passed, you will be asked to submit your information, such as your name, OSU ID number, ONID email, department, and phone number. We will then designate in Banner that you have passed your FERPA training. If you do not have access to the Employee tab, you will want to contact Human Resources.

    Screen shot of MyOSU

    FERPA Student Training Access

    Graduate Teaching Assistants (GTAs), Undergraduate Teaching Assistants (TAs), and student employees serving in a role wherein they will encounter student data should participate in the online FERPA training and quiz module. This module is housed on the MyOSU Portal, under the “Employee” tab. Once in the “Employee” tab, look for the section called “Employee Quick Links,” located on the right side of the screen. In that section, you should a plus (+) sign next to “FERPA Training”—click that plus sign and then look for the “GRA, GTA & Student Employee Training” link. Please see the image below for visual instructions. Please note that the certificates produced by the old online FERPA training are no longer being accepted. If you need to provide evidence of FERPA training, you will need to take the training module hosted on the Portal. Once you have passed, you will be asked to submit your information, such as your name, OSU ID number, ONID email, department, and phone number. We will then designate in Banner that you have passed your FERPA training.

    If you are a supervisor of a TA or student serving in a role that encounters student data and the student is not an employee of OSU, please contact the Office of the Registrar for assistance.

    Screen shot of MyOSU

    Guidelines for Release of Information

    What, if anything, can I release?

    The following steps provide a simple means to determine what information may be released. Release of any information other than that listed in Step 3 may have serious legal implications. If you receive a request for information other than what is covered in these steps, refer the inquirer to the Office of the Registrar. Refer ALL inquiries under the USA PATRIOT Act to the Office of the Registrar.

    All access and use at Oregon State University of the Social Security Number is prohibited except for meeting federal or state requirements, compliance and reporting.

    You may copy these guidelines as needed, or request additional copies from the Office of the Registrar. We suggest that you keep a copy by your telephone for ready reference.

    Step 1

    Check the confidentiality of the student's records. Has the student restricted the release of all information?

    • Look at the grade roster or class roster. If a student's record is confidential you will see a dash before the student's name.
    • Sign on to Banner and go to SGASTDN or SGASTDQ or SPAIDEN. Enter the student's ID number. If this student's information is confidential, Banner will show *CONFIDENTIAL* in the upper left portion of the form. You also can see this on SAAADMS, SFAREGS, SFASRPO, SHATERM, SPAPERS, and other forms that access the student's record.
    • If you do not have access to Banner, ask someone who has access to check the student's record for you, or call the Office of the Registrar for help, 541-737-4048.
    Step 2

    If the student's record is CONFIDENTIAL, you must respond to the inquiry in a way that does not acknowledge the student's existence on campus. Example: "There is no information available on that person." If the person inquiring persists, you might suggest that they ask the student in question to contact the Office of the Registrar directly, or refer the caller to the Office of the Registrar.

    Step 3

    If the student's records are NOT confidential, then determine what information about the student is being requested. Oregon State University will provide only the following Directory Information to all inquiries without students' written consent. Non-directory Information may not be released without written consent.

    Step 4

    If anything other than the above information is requested the request should be denied. Refer all inquiries from law enforcement officials directly to the Office of the Registrar. If there are other unusual and extraordinary circumstances, refer the request to:

    NO information may be released about students who have established confidentiality of their records.

    Directory Information

    The following directory information is public record and may be released to any inquiry, unless the record in Banner is marked as confidential.

    Student's name

    Current mailing address (CM address in Banner) and telephone number 

    OSU ONID email address

    Campus office address

    Class standing (e.g., freshman, sophomore, etc.)

    Student level (undergraduate, graduate, etc.)
    College

    Major field of study 

    Honors

    Full-time or part-time enrollment status

    Status as a graduate teaching assistant or graduate research assistant and hours of service

    Participation in officially recognized activities and sports

    Dates of attendance

    Anticipated graduation date

    Degrees and awards received

    Date(s) of degree(s)

    Most recent previous educational institution attended by student

    These policy guidelines are in accordance with Oregon Revised Statutes (ORS 351.065), the Federal Family Educational Rights and Privacy Act of 1974 (PL 93-380) [34 CFR Part 99], and Oregon Administrative Rule 576-020-0005.

    Non-Directory Information

    This information is protected and MAY NOT BE RELEASED. If there are unusual and extraordinary circumstances refer the request to the Office of the Registrar, B102 Kerr Administration Building, 541-737-4048.

    Student's Gender

    Current email address (not ONID email address)
    Month and day of birth

    Transcript: Official or unofficial

    Transcript: Student copy

    Social Security Number (complete or partial)

    Student ID Number (whether SSN or generated ID). All access and use at Oregon State University of the Social Security Number is prohibited except for meeting federal or state requirements, compliance and reporting.

    Grades earned

    Credits earned

    Graduation status; course work yet to be completed (Cannot report whether student has applied for graduation)

    Residency status

    Fees paid

    Class rank

    Current academic status (probation; suspension; petitions; readmit status. That a student has applied can be released, but the status of the application cannot be released.)

    VA, Social Security Status

    GPA (Grade-Point Average)

    Class schedule

    Parent or guardian name or address

    All other information about a student

    These policy guidelines are in accordance with Oregon Revised Statutes (ORS 351.065), the Federal Family Educational Rights and Privacy Act of 1974 (PL 93-380) [34 CFR Part 99], and Oregon Administrative Rule 576-020-0005.

    Records Retention & Statistics

    Information Online

    Learn more about alert notification, directory information, registration information, and more at Student Information Online in the General Catalog.

    Records Retention

    What records do we retain? How long do we keep them? Refer to the General Records Retention Schedule that govern the maintenance of Curriculum and Instruction Records, Financial Aid Records, Students Records, and more. [Note: This link may not work in IE. Try Firefox and Google Chrome.] The Oregon Secretary of State records retention schedule is located here. It offers more specific retention requirements.

    Statistical & Historical Data (Institutional Research)

    Enrollment rates, graduation rates, and other data are provided by Institutional Research.

    Student Records - Right to Privacy

    Index


    Notice to Students Regarding Privacy of Records

    The Family Educational Rights and Privacy Act (FERPA) of 1974 (Public Law 93-380), as amended, Oregon Revised Statutes 351.065, and Oregon Administrative Rule 580-013-0005 of the State Board of Higher Education afford students certain rights with respect to their education records. They are:

    1. The right to inspect and review the student’s education records within 45 days of the day the university receives a request for access. Students should submit to the registrar, dean, head of the academic department, or other appropriate official, written requests that identify the record(s) they wish to inspect. The university official will make arrangements for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the university official to whom the request was submitted, that official shall advise the student of the correct official to whom the request should be addressed.
    2. The right to request the amendment of the student’s education record that the student believes are inaccurate or misleading. Students should write the university official responsible for the record, clearly identify the part of the record they want changed, and specify why it is inaccurate or misleading. If the university decides not to amend the record as requested by the student, the university will notify the student of the decision and advise the student of his or her right to a hearing regarding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.
    3. The right to consent to disclosures of the personally identifiable information contained in the student’s educational record, except to the extent that FERPA authorizes disclosure without consent. One exception that permits disclosure without consent is disclosure to school officials with legitimate educational interests. A school official is a person employed by the university in an administrative, supervisory, academic or research, or support staff position (including health staff and members of the Law Enforcement Unit); a person or company with whom the university has contracted; a person or company acting as consultant or volunteer for the university; a person serving on the Board of Trustees; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. A school official has a legitimate educational interest if the official needs to review an educational record in order to fulfill his or her professional responsibility.
    4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by Oregon State University to comply with the requirements of FERPA.

    The name and address of the office that administers FERPA is:
    Family Policy Compliance Office
    U.S. Department of Education
    400 Maryland Avenue, SW
    Washington, DC 20202-5920
    1-800-USA-LEARN (1-800-872-5327)
    Website: https://www2.ed.gov/policy/gen/guid/fpco/index.html

    Revised Directory Information Effective May 2014:

    Oregon State University will provide the following "directory" information to all inquiries without students’ written consent:

    • student’s name
    • current mailing address and telephone number
    • current OSU ONID email address
    • campus office address
    • class standing (e.g., freshman, sophomore, etc.)
    • student level (undergraduate, graduate, etc.)
    • college
    • major field of study
    • honors
    • full-time or part-time enrollment status
    • status as a graduate teaching assistant or graduate research assistant and hours of service.
    • participation in officially recognized activities and sports
    • dates of attendance
    • anticipated graduation date
    • degrees and awards received
    • date(s) of degree(s)
    • most recent previous educational institution attended by student

    A student may request in writing that all of the above directory information be kept confidential. This option may be exercised by filing a written, dated, and signed request at the Office of the Registrar at any time. The restriction remains in effect until revoked by the student even if the student leaves the university or graduates.

    The procedures for exercising the above rights are explained in Oregon Administrative Rules 576-020-0005 through 576-020-0065.

    Release of Student Information to Military Recruiters (Solomon Amendment)

    Oregon State University provides information about students that is requested by military recruiters under requirements of the Solomon Amendment (As of Oct. 23, 1998 [63 Fed. Reg. 56819] and the Interim Rule published Jan. 13, 2000 [65 Fed. Reg. 2056] by Department of Defense). Under this federal law military recruiters may request the following information: Name, current mailing address (as provided by the student) including email address, current telephone number (as provided by the student), age, class level (e.g., freshman, sophomore, etc.), and academic major. The information may be requested for the immediately previous term, current term, or future term for all students age 17 and older who are or were registered at OSU for at least 1 credit in the requested term. Recruiters may request this information each term. Recruiters may not obtain any information that is not in the above list of student recruiting information. For example, they may not request any of the following: Social Security Number or ID Number, place of birth, race/ethnicity/nationality, grades and GPA, grades of low-performing students, religious affiliation, names of students with loans in default, veteran status, or names of students no longer enrolled at OSU. Institutions that do not comply with the Solomon Amendment risk losing federal funding from the departments of Defense, Education, Health and Human Services, Labor, and Transportation. Institutions do not risk losing student-aid funding such as Perkins Loans, Federal SEOG or Work-Study funds.

    Use of Social Security Number (SSN)

    You are requested to provide voluntarily your Social Security Number to assist OSU (and organizations conducting studies for or on behalf of OSU) in developing, validating, or administering predictive tests and assessments; administering student aid programs; improving instructions; internal identification of students and alumni; collection of student debts; or comparing student educational experiences with subsequent workforce experiences. When conducting studies, OSU will disclose your Social Security Number only in a manner that does not permit personal identification of you by individuals other than representatives of OSU (or the organization conducting the study for OSU) and only if the information is destroyed when no longer needed for the purposes for which the study was conducted. By providing your Social Security Number, you are consenting to the use identified above. This request is made pursuant to ORS 352.004, ORS 352.107, and ORS 352.146. Provision of your Social Security Number and consent to its use is not required and if you choose not to do so you will not be denied any right, benefit, or privilege provided by law. You may revoke your consent to the use of your Social Security Number at any time by contacting: Office of the Registrar, Oregon State University, Corvallis, OR 97331-2130; 541-737-4331.

    All access and use at Oregon State University of the Social Security Number is prohibited except for meeting federal or state requirements, compliance, and reporting.

    Students Rights to Privacy of Records Tutorial (FERPA)

    A brief online tutorial that explains students’ rights may be viewed at http://registrar.oregonstate.edu/ferpa-training-module.

    OSU Directory

    The OSU Campus Directory is a directory of staff and student names, addresses and telephone numbers. This information is extracted at the end of the second week of the fall term and is published annually and posted on the OSU website. To find students, faculty and staff, use the Search box for Find people and pages or go to http://directory.oregonstate.edu/

    Students who do not want information to be included in either the printed or electronic version should indicate that in their Directory Profile on the Web before the end of the second week of fall term. Just log in to MyOSU at https://myosu.oregonstate.edu and under Update Personal Profile select OSU Directory Preferences, then follow the instructions on that page.

    Update Your Current Mailing Address

    This is the only address the university will use if it needs to send you information. The university no longer maintains separate local and home student addresses. Students are responsible for making sure their current address listing is correct and for updating it at the end of each term if necessary. Students may change their current mailing address listing at the Office of the Registrar or by logging in to MyOSU, https://myosu.oregonstate.edu/, and under Update Personal Profile clicking on 'Update Address or Phone Number'.

    You will be asked to verify your address at the beginning of each term. The first time you access your student information on the Web through MyOSU, you will see a message asking you to change or confirm your address. Please update your address information at that time.

    OSU Alert Notification System

    The Alert website (http://main.oregonstate.edu/alerts) keeps the OSU community apprised of emergency situations related to campus and serves as an entry point to the OSU Alert Notification System. You can use the portal link on this page to provide emergency contact information in order to receive proactive notifications in the event of an emergency and you can visit this website to get regular updates. This system allows public safety officials to create emergency alerts that contain a recorded voice message, an email message, and a text message and send them to the current database of contact information for all employees and students. In crisis situations, the system will try all means of contacting each person in the database, and uses sophisticated means to verify contact so that we know we have reached everyone we could.

    To verify your emergency contact information, go to https://www.getrave.com/login/oregonstate. Sign in with your ONID login and password, and review/update contact information. It is recommended that you add a cell phone or other text-capable device to receive an urgent message if an incident is under way. Additional features are now available.

    Student Photo Roster

    Getting to know students is an important means by which instructors and advisors can improve the quality of the learning environment.

    Accessing Student Photo Roster System:
    1. Login to MyOSU at https://myosu.oregonstate.edu.
    2. Under Update Personal Profile, select OSU Directory Preferences.
    3. Check or uncheck the checkbox "Photo Viewable to Advisor".
    4. Check or uncheck the checkbox "Photo Viewable to Instructor".
    5. Click the "Submit Changes" button to update your Directory Profile.

    To view your choices regarding opting in or out of the Student Photo Roster System, please view it online using the instructions above.

    Selecting the "opt in" option for instructors means that all instructors of record associated with the student’s current classes will be able to view the photograph.

    Students can change their minds at any time.