FERPA Compliance
The Family Educational Rights and Privacy Act of 1974 (20 U.S.C. § 1232g; 34 CFR Part 99) (FERPA) is a federal law regarding the privacy of student education records and the related requirements of educational institutions, primarily in the areas of education record access and release.
Educational institutions that receive funds under any program administered by the U.S. Secretary of Education must adhere to FERPA regulations. As a recipient of federal funding, Johns Hopkins University (JHU) and all schools operating within JHU are obligated to comply with FERPA.
Education Records
As defined by FERPA, education records are records that (1) are directly related to a student who is or has been in attendance at an educational agency or institution; and (2) are maintained by an educational agency or institution or by a party acting for the educational agency or institution. This encompasses information or data recorded in any medium, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.
Examples of education records include transcripts; class schedules; course work including papers, exams, grades, and evaluations; disciplinary records; internship program records; and student financial records. Records relating to an individual in attendance who is employed as a result of their status as a student are also considered education records under the terms of FERPA.
Education records are not:
- records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute for the maker of the record;
- records of the law enforcement unit of an educational agency or institution;
- records relating to an individual who is employed by an educational agency or institution that are made and maintained in the normal course of business, relate exclusively to the individual in that individual’s capacity as an employee, and are not available for use for any other purpose;
- records made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in their professional capacity or assisting in a paraprofessional capacity that are made, maintained, or used only in connection with treatment of the student and disclosed only to individuals providing the treatment (although the student may have those records reviewed by a physician or other appropriate professional of the student’s choice);
- records created or received by an educational agency or institution after an individual is no longer a student in attendance and that are not directly related to the individual’s attendance as a student; and
- grades on peer-graded papers before they are collected and recorded by an instructor.
Student Rights Under FERPA
FERPA grants eligible students the following rights:
- the right to inspect and review their education records;
- the right to request amendment of education records that they believe to be inaccurate, misleading, or otherwise in violation of their privacy rights;
- the right to consent to disclosures of personally-identifiable information contained in their education records, except to the extent that FERPA authorizes disclosure without consent; and
- the right to file complaints with the Department of Education concerning alleged failures by an educational agency or institution to comply with the requirements of FERPA.
Under the terms of FERPA, “eligible students” are those who have reached 18 years of age or are attending an institution of postsecondary education; and “attendance” includes, but is not limited to, attendance in person or by paper correspondence, videoconference, satellite, Internet, or other electronic information and telecommunications technologies for students who are not physically present in the classroom; and the period during which a person is working under a work-study program.
Inspect and Review
Overview
In compliance with FERPA, Johns Hopkins University (JHU) permits students to inspect and review their education records to the extent permitted by applicable law and regulations, with the following exceptions:
- Persons will not be permitted to inspect and review their education records maintained by a school or division in which they have not been in attendance.
- If the education records of a student contain information on more than one student, the student may inspect and review or be informed of only the specific information about that student.
- Students will not be permitted to inspect financial records or statements of parents.
- Students will not be permitted to inspect confidential letters and statements of recommendation which were placed in the education records of the student prior to January 1, 1975, provided that they were solicited with a written assurance of confidentiality or sent and retained with a documented understanding of confidentiality; and were used only for the purposes for which they were specifically intended.
- Students will not be permitted to inspect confidential letters and statements of recommendation which were placed in the education records of the student after January 1, 1975, respecting admission to an educational institution; respecting an application for employment; or respecting the receipt of an honor or honorary recognition, provided that the student has waived the right to inspect and review those letters and statements of recommendation.
- JHU will not disclose documents which do not come within the statutory and regulatory definition of the term “education records.”
Procedures: Inspecting and Reviewing Education Records
Students wishing to inspect and review their education records must submit a Request to Inspect and Review Education Records form.
JHU will comply with requests for access to records in a timely manner and no later than 45 days from the date of receipt of the official request. Copies of transcripts may be secured with payment of any applicable fee.
Request Amendment
Overview
In compliance with FERPA, JHU will provide students who believe that the information contained in their education records is inaccurate, misleading, or in violation of their privacy rights with an opportunity to seek correction of the records.
Procedures: Requesting Amendment of Education Records
Students seeking to amend their education records must submit a Request to Amend Education Records form, which must clearly identify the part of the record the student seeks to amend and provide a rationale for their request.
If a student’s request is denied, the student will be informed of the decision and of their right to a hearing. Students seeking a hearing must submit a Request for a Hearing Under FERPA form.
The appropriate dean/designee will hold a hearing within 14 days of the receipt of the official request. JHU will provide the student with reasonable advance notice of the date, time, and place of the hearing, which will be closed to all except the University’s representative(s), the student, the student’s representative or attorney, and witnesses. During the hearing, the student will be afforded a full and fair opportunity to present evidence relevant to the issue of whether the information is inaccurate, misleading or in violation of their privacy rights. Upon the conclusion of the hearing, the student will be informed in writing of the dean/designee’s decision within a reasonable period of time after the hearing. The decision must be based solely on the evidence presented at the hearing, and must include a summary of the evidence and the reasons for the decision.
If, as a result of the hearing, the dean/designee decides that the information is inaccurate, misleading, or otherwise in violation of the student’s privacy rights, the record will be amended accordingly and the student will be informed of the amendment in writing. If the dean/designee decides that the information is not inaccurate, misleading, or otherwise in violation of the privacy rights of the student, the student may place in the education record a statement commenting upon the information and/or any reason for disagreeing with the dean/designee’s decision.
Consent to Disclosures
Overview
In compliance with FERPA, JHU may not disclose personally identifiable information from the education records of a student without the prior written consent of the student, except in the following circumstances:
- to university and school officials who have legitimate educational interests;
- if the disclosure is information the University has designated as directory information;
- to a contractor, consultant, volunteer, or other party to whom the University has outsourced institutional services or functions and is considered a university or school official performing an institutional service or function for which the University would otherwise use employees and is under the direct control of the university with respect to use and maintenance of education records;
- to officials of another educational institution in which the student seeks or intends to enroll, or where the student is already enrolled so long as the disclosure is for purposes related to the student’s enrollment or transfer (copies of the disclosed records will be made available to the student upon request);
- to authorized representatives of the U.S. comptroller general, the secretary of the U.S. Department of Education, the attorney general of the United States, or state and local educational authorities;
- to organizations conducting studies for, or on behalf of, the University for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instruction;
- to accrediting organizations to carry out their accrediting functions;
- to parents of a dependent student, as defined in section 152 of the Internal Revenue Code of 1986;
- to parents of a student under the age of 21 the student’s violation of any federal, state or local law, or of any rule or policy of the University governing the use or possession of alcohol or a controlled substance, where the University determines that the student has committed a disciplinary violation;
- to comply with a judicial order or lawfully issued subpoena, with the condition that the University makes a reasonable effort to notify the student of the order or subpoena in advance of compliance so that the student may seek protective action, if applicable;
- in a health or safety emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals;
- in connection with a disciplinary proceeding at an institution of postsecondary education; and
- in connection with financial aid for which a student has applied or which a student has received.
The University may also disclose:
- to the victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense, the final results of the disciplinary proceeding conducted by the University with respect to that crime or offense; and
- the final results of a disciplinary proceeding, where the University determines as a result of that disciplinary proceeding that a student alleged to be a perpetrator of a crime of violence or a nonforcible sex offense has committed a violation of University rules or policies with respect to the allegation made against the student. Disclosure of final results may include name of the student who is the alleged perpetrator, any violation committed and any sanction imposed (including description of disciplinary action, date imposed and the sanction’s duration).
FERPA imposes limitations on the redisclosure of personally-identifying information from student education records. JHU may disclose personally identifiable information from an education record only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the eligible student, and that information disclosed from student records may be used only for the purposes for which the disclosure was made.
Personally Identifiable Information
Under FERPA, personally-identifiable information includes, but is not limited to, the following:
- the student’s name;
- the name of the student’s parent or other family members;
- the address of the student or student’s family;
- a personal identifier, such as the student’s social security number, student number, or biometric record;
- other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;
- other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; and
- information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.
University and School Officials
University and school officials are administrators and staff members of the University; persons serving on the Johns Hopkins University Board of Trustees; students serving on official committees such as disciplinary or grievance committees; and contractors, consultants, volunteers or other parties to whom JHU has outsourced institutional services or functions, provided that the outside party is under the direct control of the University with respect to the use and maintenance of education records and performs an institutional service or function for which the University would otherwise use employees.
Legitimate Educational Interest
A legitimate educational interest is any action or interest affecting the academic and administrative situation of a student who is the subject of the education record; and any action or interest relating to the planning, execution, and evaluation of academic and administrative programs of the University and organizations and institutions with which the University is affiliated, or which are utilized by the University.
Directory Information
Directory information is information contained in the education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. Under the terms of FERPA, universities are permitted to establish directory information that may be released upon request without the student’s consent at the discretion of the institution, provided that the student has not restricted such information from disclosure.
JHU has established the following as directory information:
- Name of a student who is in attendance or who has been in attendance
- Name pronunciation
- Local address of a present or former student
- Hopkins e-mail address of a present or former student
- Local telephone number of a present or former student
- Major field of study of a present or former student
- Participation in Johns Hopkins Athletics (limited to hometown, sport, height, and/or weight)
- Dates of attendance
- Degrees and awards received, and pertinent dates
- Honors
- Photograph (still, video, audio)
- Classification (enrollment status), and level of study
Procedures: Restricting Release of Directory Information
Students who wish to restrict the release of any or all of their directory information must submit a Request to Prevent Disclosure of Directory Information form.
Please note: JHU will be unable to release restricted directory information to outside entities such as prospective employers, insurance agencies, parents, relatives, the news media, and honor societies.
Procedures: Authorizing Release of Information
In compliance with FERPA, JHU must obtain written consent before disclosing non-directory information from a student’s education record. Non-directory information includes, but is not limited to, grades, disciplinary records, tuition and fees assessments, admission records, and financial aid. Students who wish to authorize JHU to release non-directory information from their education record must submit a Student Information Release Authorization form. Students must submit a separate form for each third party to whom they grant access to their education record. Students must also identify the specific information that should be released. The specific information to be released will be made available only if requested by the authorized third party.
JHU has determined that requests from parents of dependent students (as defined in section 152 of the Internal Revenue Code of 1986) should be accompanied by a written letter of permission from the student whose record is requested, unless JHU releases records to parents without consent of the student pursuant to the exclusions established by FERPA.
Students may elect to include an expiration date on the authorization form, or they may revoke the authorization at any time by submitting a Request to Revoke Release Authorization form. Completed authorization release forms will be in effect indefinitely if the student does not elect an expiration date or submit a Request to Revoke Release Authorization form.
JHU discloses personally identifiable information from students’ education records only on the condition that the party to whom the information is disclosed will not disclose the information to any other party without the prior consent of the student. Any party to whom student education record information is disclosed may use the information only for the purposes for which the disclosure was made.
File Complaints
Overview
Under the terms of FERPA, students have the right to file complaints concerning alleged violations of FERPA regulations with the U.S. Department of Education.
Procedures: Filing Complaints
Complaints concerning alleged violations of FERPA regulations should be addressed to the U.S. Department of Education at the following address:
U.S. Department of Education
Student Privacy Policy Office
400 Maryland Avenue, SW.
Washington, DC 20202-8520
Complaints must be made within 180 days of the alleged violation or the date that the student knew or reasonably should have known of the alleged violation, and contain specific allegations giving reasonable cause to believe that a violation occurred.
Questions?
For any questions regarding JHU’s FERPA compliance protocols, please submit a support request through the Office of Student Enrollment and Account Management (SEAM) or contact the Office of General Counsel. Additional information, forms, and frequently asked questions about FERPA are available on the Office of the University Registrar’s FERPA Resources website.
Date of Last Revision: 7/7/2022
Related Policies/Procedures: Personally Identifiable Information; Privacy Statement for Websites and Mobile Applications; Records Retention and Destruction