Skip to main content

FERPA for Faculty

Vanderbilt University is committed to the protection and confidentiality of student education records, adhering closely to the guidelines established by the Family Educational Rights and Privacy Act. The Family Educational Rights and Privacy Act (FERPA) is a federal law designed to protect the privacy of education records, to establish the right of students to inspect and review their education records, and to provide guidelines for the correction of inaccurate and misleading data through informal and formal hearings.

Training Resources

FERPA Tutorial: This tutorial is designed to provide a base-level knowledge of the rules governing the release of student information. The tutorial takes 10-15 minutes to complete.

FERPA Presentation: This document is used for campus presentations on the basics of FERPA.

FERPA Training: The Office of the University Registrar provides in-person training several times per year. Please inquire about FERPA training opportunities for individual schools/departments by sending email to university.registrar@vanderbilt.edu.

FERPA FAQ: Frequently asked questions regarding the protection of student records.

Campus Practices

Obtaining consent from students

Once a student begins attending an institution of post-secondary education, all privacy rights move to that student. The general principle is that student education records are considered confidential and may not be released to third parties (including parents) without the written consent of the student.

Such things as progress in a course, deficiencies in a subject area, scores and grades on papers, exams, etc., are all examples of information that make up part of the student's education record. This information is protected under FERPA and requires student consent for release. Faculty wishing to speak with a parent about a student’s academic performance should check with their department’s director of undergraduate studies or director of graduate studies, or with their school's dean's office, to confirm that the student’s consent to release academic information is on file.

Posting Grades

The public posting of grades by a student's name or personally identifiable information (e.g., student ID number or SSN) without the student's written permission is a violation of FERPA even if the students' names are obscured. Please use the Online Grading application, which includes the appropriate security controls, to post student grades. Once the grades are posted in Online Grading, they are available for student view in the secure YES application.

Returning graded papers and assignments

Distributing graded work in a way that exposes the student's identity or leaving personally identifiable graded papers unattended is no different from posting grades publicly. If the papers contain "personally identifiable" information, then leaving them unattended for anyone to see is a violation of FERPA. If graded assignments cannot be distributed in class, it is acceptable to leave the assignments with a departmental assistant who can verify a student's identity by viewing the Vanderbilt ID card or a driver's license prior to releasing the assignment to the student.

Sending FERPA-protected data via email

FERPA-protected data should never be sent via email, as this is not a secure method of transmitting sensitive data. Restricted information such as grades, GPA, or personally identifiable information such as Social Security number should never be sent through email. Please take care not to forward or reply to emails which are sent to you containing sensitive data without removing such data prior to transmission. Consider using Box for Vanderbilt if you need to transmit student education records electronically. For assistance using Box for Vanderbilt refer to Vanderbilt University Information Technology's detailed user guides or the Office of the University Registrar's document sharing user guide.

Storing and transferring FERPA-protected data via Box and other cloud services

Due to federal, state and local laws, and university policies and standards, Box and other cloud computing services should not be used to store, collect, or share sensitive data regulated by FERPA. Vanderbilt's Box Storage page provides more information concerning data storage guidelines. Consider using Box for Vanderbilt if you need to transmit student education records electronically. For assistance using Box for Vanderbilt refer to Vanderbilt University Information Technology's detailed user guides or the Office of the University Registrar's document sharing user guide.

Crisis Situations/Emergencies

If non-directory information is needed to resolve a crisis or emergency situation, an education institution may release that information if the institution determines that the information is "necessary to protect the health or safety of the student or other individuals." In the case of an emergency, contact the appropriate individuals (e.g., Vanderbilt Police Department, Dean of Students, the Office of the Provost, or Vanderbilt Student Health Center) and describe the situation that led you to make the call. Document with whom you spoke, when you called or were called, and the details of your conversation.

Letters of Recommendation

Written permission of the student is required for a letter of recommendation if any information included in the recommendation is part of the "education record" (grades, GPA, and other non-directory information) or is an assessment of a student's performance, such as her/his rank in the class. Statements made from personal observation or knowledge do not require a signed release.

Whom to contact with questions/concerns

If you have questions about FERPA, please contact the Office of the University Registrar by email at university.registrar@vanderbilt.edu or by phone at (615) 322-7701.