FERPA for Faculty
Vanderbilt University is committed to the protection and confidentiality of student education records, adhering closely to the guidelines established by the Family Educational Rights and Privacy Act. The Family Educational Rights and Privacy Act (FERPA) is a federal law designed to protect the privacy of education records, to establish the right of students to inspect and review their education records, and to provide guidelines for the correction of inaccurate and misleading data through informal and formal hearings.
Training Resources
FERPA Tutorial: This tutorial is designed to provide a base-level knowledge of the rules governing the release of student information. The tutorial takes 10-15 minutes to complete and is available to Vanderbilt employees only. VUMC employees can access the VUMC-based FERPA tutorial here.
FERPA Presentation: This document is used for campus presentations on the basics of FERPA.
FERPA Training: The Office of the University Registrar provides in-person training several times per year. Please inquire about FERPA training opportunities for individual schools/departments by sending email to university.registrar@vanderbilt.edu.
FERPA FAQ: Frequently asked questions regarding the protection of student records.
Campus Practices
Obtaining consent from students
Once a student begins attending an institution of post-secondary education, all privacy rights move to that student. The general principle is that student education records are considered confidential and may not be released to third parties (including parents) without the written consent of the student.
Such things as progress in a course, deficiencies in a subject area, scores and grades on papers, exams, etc., are all examples of information that make up part of the student's education record. This information is protected under FERPA and requires student consent for release. Faculty wishing to speak with a parent about a student’s academic performance should check with their department’s director of undergraduate studies or director of graduate studies, or with their school's dean's office, to confirm that the student’s consent to release academic information is on file.
Posting Grades
The public posting of grades by a student's name or personally identifiable information (e.g., student ID number or SSN) without the student's written permission is a violation of FERPA even if the students' names are obscured. Please use the Online Grading application, which includes the appropriate security controls, to post student grades. Once the grades are posted in Online Grading, they are available for student view in the secure YES application.
Returning graded papers and assignments
Distributing graded work in a way that exposes the student's identity or leaving personally identifiable graded papers unattended is no different from posting grades publicly. If the papers contain "personally identifiable" information, then leaving them unattended for anyone to see is a violation of FERPA. If graded assignments cannot be distributed in class, it is acceptable to leave the assignments with a departmental assistant who can verify a student's identity by viewing the Vanderbilt ID card or a driver's license prior to releasing the assignment to the student.
Sending FERPA-protected data via email
FERPA-protected data should never be sent via email, as this is not a secure method of transmitting sensitive data. Restricted information such as grades, GPA, or personally identifiable information such as Social Security number should never be sent through email. Please take care not to forward or reply to emails which are sent to you containing sensitive data without removing such data prior to transmission. Consider using OneDrive if you need to transmit student education records electronically.
Storing and transferring FERPA-protected data
Due to federal, state and local laws, and university policies and standards, cloud computing services. Consider using OneDrive if you need to transmit student education records electronically. FERPA-protected data may not be stored outside of central university student systems maintained and protected by VUIT. All requests for storage and maintenance for FERPA-protected data outside of central university systems must be approved by the university registrar.
Crisis Situations/Emergencies
If non-directory information is needed to resolve a crisis or emergency situation, an education institution may release that information if the institution determines that the information is "necessary to protect the health or safety of the student or other individuals." In the case of an emergency, contact the appropriate individuals (e.g., Vanderbilt Police Department, Dean of Students, the Office of the Provost, or Vanderbilt Student Health Center) and describe the situation that led you to make the call. Document with whom you spoke, when you called or were called, and the details of your conversation.
Letters of Recommendation
Written permission of the student is required for a letter of recommendation if any information included in the recommendation is part of the "education record" (grades, GPA, and other non-directory information) or is an assessment of a student's performance, such as her/his rank in the class. Statements made from personal observation or knowledge do not require a signed release.
Whom to contact with questions/concerns
If you have questions about FERPA, please contact the Office of the University Registrar by email at registrar@vanderbilt.edu or by phone at (615) 322-7701.