Annual Notification of Rights

JHU is required to notify eligible students currently in attendance of their rights under FERPA. The annual notification of rights is provided in SIS, the JHU student information system, and is also included in the Johns Hopkins University Academic Catalogue.

Short Separator

Department of Education FERPA Publications

The U.S. Department of Education administers and enforces student privacy laws, including FERPA. In addition, they provide FERPA resources for students and educational officials.

Family Educational Rights and Privacy Act

Guidance for Eligible Students

Know Your Rights: FERPA Protections for Student Health Records

Online Training Modules

Protecting Student Privacy

Short Separator

FERPA Information for JHU Researchers

Principal investigators (PIs) may submit research projects that utilize educational records for review and approval of the Homewood Institutional Review Board (HIRB). If the HIRB team determines that a project plans to use JHU student educational records, the project will be routed to the Office of the University Registrar to complete an ancillary review for FERPA compliance purposes.

If applicable, the HIRB team and the OUR collaborate to ensure that FERPA language is included in student consent documents. Additionally, depending on the nature of the study and the extent to which education records will be used, a FERPA Studies Exception Agreement may be required.

Johns Hopkins IRB Guidance for Use of Student Education Records in Research

Short Separator

Frequently Asked Questions about FERPA

Directory Information

What is Directory Information?

The Family Educational Rights and Privacy Act (FERPA), a federal law that protects the privacy of student education records, defines “Directory Information” as “information contained in an education record of a student that would not generally be harmful or an invasion of privacy if disclosed.” 

Under the terms of FERPA, JHU is permitted to establish Directory Information that may be disclosed publicly, without student consent, provided that eligible students in attendance are given annual notice of (1) the education record information that JHU has designated as Directory Information; and (2) their right to restrict the university’s disclosure of their Directory Information.  

JHU has established the following as directory information:

  • Name of a student who is in attendance or who has been in attendance
  • Name pronunciation
  • Local address of a present or former student
  • Hopkins e-mail address of a present or former student
  • Local telephone number of a present or former student
  • Major field of study of a present or former student
  • Participation in Johns Hopkins Athletics (limited to hometown, sport, height, and/or weight)
  • Dates of attendance
  • Degrees and awards received, and pertinent dates
  • Honors
  • Photograph (still, video, audio)
  • Classification (enrollment status), and level of study

Students do not have a restriction on the disclosure of their Directory Information by default; they must elect to restrict disclosure. Restricted Directory Information is treated the same as all other private student record information and is disclosed by JHU only with consent of the student, except in several limited circumstances permitted under FERPA (including disclosure in health and safety emergencies and disclosure to “school officials” with a “legitimate educational interest.”) Please see JHU’s Annual Notification of Rights Under FERPA page for more information, including definitions of these terms. 

Who can restrict their Directory Information from disclosure?

FERPA provides students the right to restrict an educational institution’s disclosure of their Directory Information. 

For FERPA compliance purposes, Johns Hopkins University defines a student as an individual who is or has been in attendance at the university and for whom the university maintains education records. This definition includes early matriculants (fall semester admits attending summer term), former students, individuals who are taking classes for academic credit but have not been admitted to a degree or certificate program, visiting students, and alumni. This definition does not include prospective students, applicants who have been admitted but did not attend, applicants who have been denied admission, and individuals participating in lifelong learning/continuing education programs not taken for academic credit available through one of JHU’s academic divisions. Parents of individuals under the age of 18 in attendance at a university program that does not offer a postsecondary degree or certificate shall retain FERPA rights for the participant. 

Students are not able to restrict their Directory Information once they leave the university and lose access to SIS Student Self-Service. However, in compliance with FERPA, JHU will continue to honor valid requests to restrict disclosure of Directory Information that were made prior to a student leaving the university and losing access to SIS Self-Service.   

When can a student’s Directory Information be restricted?

For FERPA compliance purposes, Johns Hopkins University considers students to be in attendance on the first day of the first term in which the student is enrolled for academic credit in one or more classes as part of degree or non-degree offerings under any instructional delivery method/modality. On this date, also known as the student’s matriculation date, the new Directory Information (FERPA) screen will become functional in SIS Student Self-Service and students will have the ability to manage the disclosure of their Directory Information at any time. Additionally, once a student elects to restrict their Directory Information, the restrictions may be cancelled at any time.

Please note, SIS Self-Service may display multiple student records for a student. Common reasons for multiple student records include:

  • Enrollments as both an undergraduate and graduate student
  • Taking courses as a special/non-degree student and later enrolling in a degree program
  • Taking courses at multiple divisions across JHU

On or after the first day of the first term in which the student is enrolled for academic credit in one or more classes as part of degree or non-degree offerings, students who wish to restrict their directory information but do not see the Directory Information (FERPA) screen should check to confirm that they have chosen the correct student record in SIS Student Self-Service. 

Students are not able to restrict their Directory Information once they leave the university and lose access to SIS Student Self-Service. However, in compliance with FERPA, JHU will continue to honor valid requests to restrict disclosure of Directory Information that were made prior to a student leaving the university and losing access to SIS Self-Service. 

What possible difficulties can students expect as a result of restricting their Directory Information?

Restricted Directory Information is not disclosed to entities outside JHU without the student’s consent. If students do not grant consent for their restricted Directory Information to be shared, they can expect to encounter situations including, but not limited to, the following: 

  • Financial institutions, rental agencies, and other entities offering services or student discounts may have difficulty verifying enrollment or degrees earned at JHU 
  • Prospective employers may have difficulty verifying enrollment or degrees earned at JHU 
  • JHU will not be able to notify news outlets regarding student honors and awards 
  • JHU will not be able to include restricted Directory Information in university publications 
  • Students may have difficulty accessing some third-party applications and systems used by the university or by their academic departments/divisions 

What are some of the special considerations for performing arts students who wish to restrict the disclosure of their Directory Information?

Performing arts students may have some unique Directory Information considerations to keep in mind, including the following:

  • Audition and Networking Opportunities: Networking can be in important factor contributing to success in the performing arts. Restricting Directory Information may limit performing arts students’ visibility and accessibility to industry professionals and potential collaborators.
  • Event and Performance Participation: Student Directory Information is often used to communicate event details and performance-related information to arts patrons outside of JHU. Restricting Directory Information may result in performing arts students’ information being removed from event notices, programs, and performance invitations.
  • Awards and Recognition: Performing arts students often receive recognition and awards for their achievements. These types of acknowledgements may require the use of a student’s Directory Information for public announcements or accolades. Restricting Directory information may result in performing arts’ students information being removed from such communications.

Performing arts students should balance their unique circumstances with their personal information privacy concerns. Students who wish to place overall restrictions on the use of their Directory Information, while still allowing individual exceptions for certain situations should review the FAQ below titled “How can students consent to case-by-case disclosures of restricted Directory Information?

Performing arts students and other students with similar considerations who would like more information about Directory Information restrictions can request support using the Office of Student Enrollment and Account Management (SEAM)’s online form.

How can students consent to case-by-case disclosures of restricted Directory Information?

Students may consent to the disclosure of restricted Directory Information to specific parties for specific purposes, including the situations listed above, by submitting a Student Information Release Authorization form. Submission of the Student Information Authorization form does not remove or alter a student’s Directory Information restrictions, it only authorizes the university to release specified student information (which may include restricted Directory Information) on a one-time basis. 

How does restricting Directory Information affect what is visible in MyProfile?

MyProfile is the JHU user entry into the Johns Hopkins Enterprise Directory (JHED). Restricting Directory Information does not affect what is visible in MyProfile/JHED. Students who wish to update their information or adjust their visibility settings in MyProfile/JHED must login to the myJH homepage at http://my.jh.edu and make changes by clicking on the MyProfile icon. Students with questions about MyProfile/JHED can submit a SEAM support request.  

What else should students know about Directory Information?

Under the terms of FERPA, students may not use the right to restrict their Directory Information to prevent the university from disclosing or requiring a student to disclose their name, identifier, or institutional email address in a class in which the student is enrolled; or requiring a student to wear, to display publicly, or to disclose a student ID card or badge that exhibits information that may be considered Directory Information. 

Students should also be aware that restricting their Directory Information does not prohibit “school officials” with a “legitimate educational interest” from having access to the information. For example, an administrative staff member working in a student’s academic department may still have access to the student’s name, Hopkins email address, phone number, and other Directory Information data elements even if the student has restricted their Directory Information from disclosure. For additional information, please visit the OUR’s FERPA Compliance website.

How can advisors, SEAM agents, and other JHU staff and faculty see a student’s Directory Information status in the Student Information System (SIS)?

Student data access is determined by SIS roles. SIS administrative users with access to student records will be able to see a student’s Directory Information restrictions in the “FERPA Information” section of the Student/Person > Summary screens. SIS administrative users will also see a shield icon in the blue screen header next to the name of students who have restricted Directory Information.

In addition, “FERPA flags” and other indicators of restricted Directory Information appear in internal and external systems used across the university, including:

SIS Self-Service Faculty Class Roster

SIS Self-Service Advisee List

Student Case Management (SCM)

Student Lookup

What else should advisors, SEAM agents, and other JHU staff and faculty know about Directory Information?

As a reminder, restricted Directory Information is treated the same as all other private student record information. A student’s restricted Directory Information should not be disclosed to the general public, to parties outside the university, or to other JHU school officials who do not have a legitimate educational interest in the information. Definitions of “school officials” and “legitimate educational interest” are available on the OUR’s FERPA Compliance website.

All JHU employees, including administrative users of SIS, are urged to use their best judgement in sharing student any education record information. If any employee is unsure about releasing student information to another party, whether they are internal or external to JHU, please contact the Office of the University Registrar at FERPA@jhu.edu. The OUR staff is available to provide guidance for handling any type of request for student information. To ensure FERPA compliance, internal and external requests for student data should be directed to the OUR. 

General

How does JHU determine if an employee has a “legitimate educational interest” in information from a student’s education records?

JHU defines “legitimate educational interest” as is any action or interest affecting the academic and administrative situation of a student who is the subject of the education record; and any action or interest relating to the planning, execution, and evaluation of academic and administrative programs of the University and organizations and institutions with which the University is affiliated, or which are utilized by the University.

Employees are urged to use their best judgement in sharing student education record information with other employees. If an employee is unsure about releasing information to another party, whether they are internal or external to JHU, please contact the Office of the University Registrar at FERPA@jhu.edu to discuss the situation.

When submitting a Request to Inspect and Review Education Records, why is there no option for a student to request to inspect/review “all records” at JHU?

The Office of the University Registrar works directly with divisional and functional offices to facilitate these requests, so it is critical that students are specific regarding the education records they wish to inspect/review. There is no exhaustive list of records maintained by JHU, and policies regarding maintenance of records vary across the University. Students will be notified if the records they request are not available, or if the office from which they have requested records does not have any maintained records for the student.

How can a faculty or staff member determine if a student has a Student Information Release Authorization on file?

A student can complete a Student Information Release Authorization in order to consent to the disclosures of student education record information to third parties. Faculty and staff members who need to determine if a student has a release authorization on file should consult with their divisional records/registrar office or FERPA@jhu.edu.

Teaching/Learning

Should academic departments or other university entities publish directories of student names or other personally identifiable information online?

No – Even though a student’s name and several other education record data elements have been designated as “Directory Information” at JHU, university entities should not publish lists/directories of student names or other personally identifiable information publicly online, unless the student has provided affirmative written consent. Because students may restrict/cancel restrictions on the disclosure of their Directory Information anytime at their own discretion, it is impractical for university entities to continually be monitoring their students’ Directory Information status in order to remain compliant with FERPA.

Is it acceptable for faculty, TAs, and other instructional staff to use their personal, non-JHU email accounts for work-related communication involving students/student record information?

No – Use of personal, non-JHU email accounts for work-related communication involving students/student record information is a violation of JHU’s Acceptable Use policy and puts the university at risk regarding required compliance with FERPA. Faculty, TAs, and other instructional staff should always use their official JHU email address for work-related communication involving student education record information.

What are the FERPA considerations of recording class sessions?

Depending on how they are created or edited, class recordings, along with associated transcriptions and/or chat logs, may constitute educational records that are subject to the Family Educational Rights and Privacy Act (FERPA). Please see Guidelines for Recording Class Meetings for additional information.

What are the FERPA considerations of using generative AI tools in teaching and learning activities?

JHU’s teaching and learning centers have created guidelines for use of generative AI tools. Please see Generative AI Tool Guidance for additional information.

Who can access student information in Canvas?

UIS maintains a robust Canvas at JHU site that houses information about the system, including details pertaining to FERPA considerations when using Canvas.

Parents/Families

Can a parent or legal guardian of a student have access to the student’s education records?

At the post-secondary level, parents/legal guardians are unable to access a student’s education records without written authorization from the student. Pursuant to FERPA, JHU may disclose information from a student’s education records to parents/legal guardians of students who are claimed as dependents for federal income tax purposes. For more information, visit the Family Engagement website.

Will JHU notify parents/legal guardians of students if the student is found to be in violation of the Student Conduct Code?

JHU, at its discretion, may notify the parents/legal guardians of students under the age of twenty one (21) at the time of disclosure if a student is found responsible for Student Conduct Code violations.  These violations include alcohol and drug policies, as well as cases that result in suspension and expulsion.

Will JHU notify parents/legal guardians of students if the student becomes ill or injured?

JHU may notify parents/legal guardians when there is a health or safety emergency involving a student if they claim the student as their dependent for federal income tax purposes, or if they are listed as the student’s emergency contact. For more information, visit the Family Engagement  website.

Systems and Data

How does the OUR evaluate student data requests for FERPA compliance?

When the OUR receives a request for student data, the request is evaluated against the criteria set forth in FERPA’s “school official” exception to consent. In order for a school official to have access to student education records, the official must have a legitimate educational interest in the records being accessed. Legitimate educational interest means that the official has a need to access the student education records for the purpose of performing an appropriate university function, such as a task specified in the school official’s position description or a task related to the student’s education or services/benefits relating to the student. JHU’s definitions for “school official” and legitimate educational interest” are available on the FERPA Terms and Definitions page of this website.

What steps should be taken to ensure FERPA compliance when implementing third-party systems or contracting with vendors who will utilize student data?

Please contact the Office of the University Registrar at FERPA@jhu.edu if you are planning to implement a third-party system or contract with an outside vendor who will need to utilize student data. The OUR will work with you to ensure that usage of systems and/or engagement with third-party vendors is FERPA-compliant.

Violations/Noncompliance

What happens if JHU does not comply with FERPA?

If JHU does not comply with FERPA, the U.S. Department of Education may issue a notice to cease the noncompliant practice and ultimately could withhold federal funding. Other penalties dependent on the type of record and the nature of the disclosure could also be imposed.

What are some examples of FERPA violations that the JHU community should be aware of?

Each of the following represents a possible FERPA violation:

  • Discussing student record information in a manner in which the conversation may be overheard by others
  • Sharing passwords with others
  • Posting grades in a manner in which students are identifiable to others
  • Listing students enrolled in a particular academic program on a departmental website
  • Leaving student documents or reports with student information unattended, unsecured, or in view of others
  • Uploading a class roster, student information, or student work to a non-approved service, system or app that has not been reviewed for FERPA compliance

Please reach out to the Office of the University Registrar at FERPA@jhu.edu for assistance with addressing possible FERPA violations.