FERPA Data Handling Best Practices

When requesting or collecting sensitive information from a student’s record, stop and consider:

• Why do I need this information?
• Is it required as part of my job duties?
• Can I fulfill my purpose without it?
• Do I have a plan for protecting this information once it is collected?

If you must retain the sensitive information you have collected, stop and consider:

• Is it absolutely necessary to retain a local copy of the information?
• Does the university store the same information elsewhere?
• Can you access the information from the primary university source, rather than creating another copy that will require special attention to protect?

If you must store the sensitive information you have collected, stop and consider:

• Is the student record information you are storing in an electronic format appropriately secured?
• Never store this information on personal storage areas, such as personal flash drives/discs, home computers, external email, or external online storage services.
• Verify that you are using a secured file server.
• Have you ensured that all paper student records are appropriately access-controlled?
• Do you log off or lock your workstation when you step away?

When using the sensitive information you have accessed, stop and consider:

• Never use student record information for personal gain or profit, for the gain or profit of others, to satisfy curiosity, or to engage in academic, personal, or research misconduct.
• Use student record information only for the purpose for which it was accessed or collected.
• Immediately report any misuse of student record information to your supervisor.

Before transmitting sensitive information electronically, stop and consider:

• FERPA-protected data should never be sent via email, text or Instant Message (IM). These are not secure methods of transmitting sensitive data.
• Ensure you are utilizing one of the VUIT-managed file storage/sharing applications as listed in the  Data Classification Guidance .
• Be careful not to forward or reply to emails which are sent to you containing sensitive data without removing such data prior to transmission.