FERPA Resources and FAQs

The Family Educational Rights and Privacy Act (FERPA), a federal law that protects the privacy of student education records, defines “Directory Information” as “information contained in an education record of a student that would not generally be harmful or an invasion of privacy if disclosed.” 

Under the terms of FERPA, JHU is permitted to establish Directory Information that may be disclosed publicly, without student consent, provided that eligible students in attendance are given annual notice of (1) the education record information that JHU has designated as Directory Information; and (2) their right to restrict the university’s disclosure of their Directory Information.  

JHU has established the following as directory information:

• Name of a student who is in attendance or who has been in attendance
• Name pronunciation
• Local address of a present or former student
• Hopkins e-mail address of a present or former student
• Local telephone number of a present or former student
• Major field of study of a present or former student
• Participation in Johns Hopkins Athletics (limited to hometown, sport, height, and/or weight)
• Dates of attendance
• Degrees and awards received, and pertinent dates
• Honors
• Photograph (still, video, audio)
• Classification (enrollment status), and level of study

Students do not have a restriction on the disclosure of their Directory Information by default; they must elect to restrict disclosure. Restricted Directory Information is treated the same as all other private student record information and is disclosed by JHU only with consent of the student, except in several limited circumstances permitted under FERPA (including disclosure in health and safety emergencies and disclosure to “school officials” with a “legitimate educational interest.”) Please see JHU’s Annual Notification of Rights Under FERPA page for more information, including definitions of these terms. 

FERPA provides students the right to restrict an educational institution’s disclosure of their Directory Information. 

For FERPA compliance purposes, Johns Hopkins University defines a student as an individual who is or has been in attendance at the university and for whom the university maintains education records. This definition includes early matriculants (fall semester admits attending summer term), former students, individuals who are taking classes for academic credit but have not been admitted to a degree or certificate program, visiting students, and alumni. This definition does not include prospective students, applicants who have been admitted but did not attend, applicants who have been denied admission, and individuals participating in lifelong learning/continuing education programs not taken for academic credit available through one of JHU’s academic divisions. Parents of individuals under the age of 18 in attendance at a university program that does not offer a postsecondary degree or certificate shall retain FERPA rights for the participant. 

Students are not able to restrict their Directory Information once they leave the university and lose access to SIS Student Self-Service. However, in compliance with FERPA, JHU will continue to honor valid requests to restrict disclosure of Directory Information that were made prior to a student leaving the university and losing access to SIS Self-Service.   

For FERPA compliance purposes, Johns Hopkins University considers students to be in attendance on the first day of the first term in which the student is enrolled for academic credit in one or more classes as part of degree or non-degree offerings under any instructional delivery method/modality. On this date, also known as the student’s matriculation date, the new Directory Information (FERPA) screen will become functional in SIS Student Self-Service and students will have the ability to manage the disclosure of their Directory Information at any time. Additionally, once a student elects to restrict their Directory Information, the restrictions may be cancelled at any time.

Please note, SIS Self-Service may display multiple student records for a student. Common reasons for multiple student records include:

• Enrollments as both an undergraduate and graduate student
• Taking courses as a special/non-degree student and later enrolling in a degree program
• Taking courses at multiple divisions across JHU

On or after the first day of the first term in which the student is enrolled for academic credit in one or more classes as part of degree or non-degree offerings, students who wish to restrict their directory information but do not see the Directory Information (FERPA) screen should check to confirm that they have chosen the correct student record in SIS Student Self-Service. 

Students are not able to restrict their Directory Information once they leave the university and lose access to SIS Student Self-Service. However, in compliance with FERPA, JHU will continue to honor valid requests to restrict disclosure of Directory Information that were made prior to a student leaving the university and losing access to SIS Self-Service. 

Restricted Directory Information is not disclosed to entities outside JHU without the student’s consent. If students do not grant consent for their restricted Directory Information to be shared, they can expect to encounter situations including, but not limited to, the following: 

• Financial institutions, rental agencies, and other entities offering services or student discounts may have difficulty verifying enrollment or degrees earned at JHU 
• Prospective employers may have difficulty verifying enrollment or degrees earned at JHU 
• JHU will not be able to notify news outlets regarding student honors and awards 
• JHU will not be able to include restricted Directory Information in university publications 
• Students may have difficulty accessing some third-party applications and systems used by the university or by their academic departments/divisions 

Performing arts students may have some unique Directory Information considerations to keep in mind, including the following:

• Audition and Networking Opportunities: Networking can be in important factor contributing to success in the performing arts. Restricting Directory Information may limit performing arts students’ visibility and accessibility to industry professionals and potential collaborators.
• Event and Performance Participation: Student Directory Information is often used to communicate event details and performance-related information to arts patrons outside of JHU. Restricting Directory Information may result in performing arts students’ information being removed from event notices, programs, and performance invitations.
• Awards and Recognition: Performing arts students often receive recognition and awards for their achievements. These types of acknowledgements may require the use of a student’s Directory Information for public announcements or accolades. Restricting Directory information may result in performing arts’ students information being removed from such communications.

Performing arts students should balance their unique circumstances with their personal information privacy concerns. Students who wish to place overall restrictions on the use of their Directory Information, while still allowing individual exceptions for certain situations should review the FAQ below titled “How can students consent to case-by-case disclosures of restricted Directory Information?“

Performing arts students and other students with similar considerations who would like more information about Directory Information restrictions can request support using the Office of Student Enrollment and Account Management (SEAM)’s online form.

Students may consent to the disclosure of restricted Directory Information to specific parties for specific purposes, including the situations listed above, by submitting a Student Information Release Authorization form. Submission of the Student Information Authorization form does not remove or alter a student’s Directory Information restrictions, it only authorizes the university to release specified student information (which may include restricted Directory Information) on a one-time basis for the intended purpose.

MyProfile is the JHU user entry into the Johns Hopkins Enterprise Directory (JHED). Restricting Directory Information does not affect what is visible in MyProfile/JHED. Students who wish to update their information or adjust their visibility settings in MyProfile/JHED must login to the myJH homepage at http://my.jh.edu and make changes by clicking on the MyProfile icon. Students with questions about MyProfile/JHED can submit a SEAM support request.  

Under the terms of FERPA, students may not use the right to restrict their Directory Information to prevent the university from disclosing or requiring a student to disclose their name, identifier, or institutional email address in a class in which the student is enrolled; or requiring a student to wear, to display publicly, or to disclose a student ID card or badge that exhibits information that may be considered Directory Information. 

Students should also be aware that restricting their Directory Information does not prohibit “school officials” with a “legitimate educational interest” from having access to the information. For example, an administrative staff member working in a student’s academic department may still have access to the student’s name, Hopkins email address, phone number, and other Directory Information data elements even if the student has restricted their Directory Information from disclosure. For additional information, please visit the OUR’s FERPA Compliance website.

Student data access is determined by SIS roles. SIS administrative users with access to student records will be able to see a student’s Directory Information restrictions in the “FERPA Information” section of the Student/Person > Summary screens. SIS administrative users will also see a shield icon in the blue screen header next to the name of students who have restricted Directory Information.

In addition, “FERPA flags” and other indicators of restricted Directory Information appear in internal and external systems used across the university, including:

SIS Self-Service Faculty Class Roster

SIS Self-Service Advisee List

Student Case Management (SCM)

Student Lookup

As a reminder, restricted Directory Information is treated the same as all other private student record information. A student’s restricted Directory Information should not be disclosed to the general public, to parties outside the university, or to other JHU school officials who do not have a legitimate educational interest in the information. Definitions of “school officials” and “legitimate educational interest” are available on the OUR’s FERPA Compliance website.

All JHU employees, including administrative users of SIS, are urged to use their best judgement in sharing student any education record information. If any employee is unsure about releasing student information to another party, whether they are internal or external to JHU, please contact the Office of the University Registrar at [email protected]. The OUR staff is available to provide guidance for handling any type of request for student information. To ensure FERPA compliance, internal and external requests for student data should be directed to the OUR. 

Please also be aware of the possibility of “implicit disclosure” when considering disclosure of a student’s directory information. FERPA prohibits institutions from disclosing or confirming directory information if non-directory information is used alone or combined with other data elements to identify, or help identify, the student or the student’s records. In other words, disclosing directory information such as name and Hopkins email is not permissible if the disclosures originate from a request for name and Hopkins email of all underrepresented minority (URM) students. Disclosing name and Hopkins email in this scenario would also disclose, indirectly, a student’s URM status.

JHU defines “legitimate educational interest” as is any action or interest affecting the academic and administrative situation of a student who is the subject of the education record; and any action or interest relating to the planning, execution, and evaluation of academic and administrative programs of the University and organizations and institutions with which the University is affiliated, or which are utilized by the University.

Employees are urged to use their best judgement in sharing student education record information with other employees. If an employee is unsure about releasing information to another party, whether they are internal or external to JHU, please contact the Office of the University Registrar at [email protected] to discuss the situation.

The Office of the University Registrar works directly with divisional and functional offices to facilitate these requests, so it is critical that students are specific regarding the education records they wish to inspect/review. There is no exhaustive list of records maintained by JHU, and policies regarding maintenance of records vary across the University. Students will be notified if the records they request are not available, or if the office from which they have requested records does not have any maintained records for the student.

A student can complete a Student Information Release Authorization in order to consent to the disclosures of student education record information to third parties. Faculty and staff members who need to determine if a student has a release authorization on file should consult with their divisional records/registrar office or [email protected].

No – Even though a student’s name and several other education record data elements have been designated as “Directory Information” at JHU, university entities should not publish lists/directories of student names or other personally identifiable information publicly online, unless the student has provided affirmative written consent. Because students may restrict/cancel restrictions on the disclosure of their Directory Information anytime at their own discretion, it is impractical for university entities to continually be monitoring their students’ Directory Information status in order to remain compliant with FERPA.

No – Use of personal, non-JHU email accounts for work-related communication involving students/student record information is a violation of JHU’s Acceptable Use policy and puts the university at risk regarding required compliance with FERPA. Faculty, TAs, and other instructional staff should always use their official JHU email address for work-related communication involving student education record information.

Depending on how they are created or edited, class recordings, along with associated transcriptions and/or chat logs, may constitute educational records that are subject to the Family Educational Rights and Privacy Act (FERPA). Please see Guidelines for Recording Class Meetings for additional information.

JHU’s teaching and learning centers have created guidelines for use of generative AI tools. Please see Generative AI Tool Guidance for additional information.

UIS maintains a robust Canvas at JHU site that houses information about the system, including details pertaining to FERPA considerations when using Canvas.

At the post-secondary level, parents/legal guardians are unable to access a student’s education records without written authorization from the student. Pursuant to FERPA, JHU may disclose information from a student’s education records to parents/legal guardians of students who are claimed as dependents for federal income tax purposes. For more information, visit the Family Engagement website.

JHU, at its discretion, may notify the parents/legal guardians of students under the age of twenty one (21) at the time of disclosure if a student is found responsible for Student Conduct Code violations.  These violations include alcohol and drug policies, as well as cases that result in suspension and expulsion.

JHU may notify parents/legal guardians when there is a health or safety emergency involving a student if they claim the student as their dependent for federal income tax purposes, or if they are listed as the student’s emergency contact. For more information, visit the Family Engagement  website.

When the OUR receives a request for student data, the request is evaluated against the criteria set forth in FERPA’s “school official” exception to consent. In order for a school official to have access to student education records, the official must have a legitimate educational interest in the records being accessed. Legitimate educational interest means that the official has a need to access the student education records for the purpose of performing an appropriate university function, such as a task specified in the school official’s position description or a task related to the student’s education or services/benefits relating to the student. JHU’s definitions for “school official” and legitimate educational interest” are available on the FERPA Terms and Definitions page of this website.

Please contact the Office of the University Registrar at [email protected] if you are planning to implement a third-party system or contract with an outside vendor who will need to utilize student data. The OUR will work with you to ensure that usage of systems and/or engagement with third-party vendors is FERPA-compliant. Additional information is available above in the section titled FERPA Information for University Contracts (Including New Contracts and Renewal Agreements for Third-Party Software Products/Platforms).

If JHU does not comply with FERPA, the U.S. Department of Education may issue a notice to cease the noncompliant practice and ultimately could withhold federal funding. Other penalties dependent on the type of record and the nature of the disclosure could also be imposed.

Please reach out to the Office of the University Registrar at [email protected] for assistance with addressing possible FERPA violations.

Each of the following represents a possible FERPA violation:

• Discussing student record information in a manner in which the conversation may be overheard by others, or directly sharing information derived from one student’s records with another student
• Posting grades in a manner in which students are identifiable to others
• Listing students enrolled in a particular academic program on a departmental website
• Leaving student documents or reports with student information unattended, unsecured, or in view of others
• Uploading a class roster, student information, or student work to a non-approved service, system or app that has not been reviewed for FERPA compliance

Please reach out to the Office of the University Registrar at [email protected] for assistance with addressing possible FERPA violations.