FERPA Frequently Asked Questions

All university employees are considered school officials and are required by law to maintain the confidentiality of student records. Any employee who maintains specific records is considered a record custodian. At the University of Florida, the Office of the University Registrar (O.U.R.) is the official custodian for academic records. 

The release of any non-directory information about a student to any person outside the university community or to any university personnel without a legitimate educational interest violates federal and state law, as well as university regulations. Student employees have the same obligations to maintain confidentiality of student records as any other employee. 

If a caller requests information about a student who has a privacy hold, an employee cannot provide any information about that student; in fact, one cannot even acknowledge that the individual is a UF student. Any student who has placed a privacy hold on their record must conduct all business in person after presenting photo identification. If the student is unable to appear in person, additional authentication will be required. If there is any question regarding whether or not specific information can or should be provided, always err on the side of caution and consult a supervisor. An employee can contact the Registrar to determine if a student has a privacy hold. 

Faculty must have a legitimate educational interest in order to access a student's academic record. A university official has a legitimate education interest when they need to access student education records for the purpose of performing an appropriate educational, research, or administrative function for the university. 

All employees must utilize reasonable measures to preserve the confidentiality, security, and integrity of the University of Florida information systems and the information contained therein. All employees should practice appropriate security measures:

• Never disclose, share, or loan your username(s) and password(s) to anyone (e.g., another employee, faculty member, supervisor, student assistant, etc.). Department staff or supervising faculty should obtain individual log-on information for graduate/teaching assistants. Security access for the student records system is available from the Office of the University Registrar. 
  
  
• Never use generic/group IDs when accessing confidential academic record information.
  
  
• Ensure that remote access to, retrieval, and transmission of confidential academic record information is accomplished through a secure and encrypted connection.
  
  
• Never leave your computer workstation unattended while signed on without appropriate screen locking (e.g., a password-protected screen saver).
  
  
• Never leave personal login information (e.g., username, password, network mapping, etc.) in view of unauthorized persons.
  
  
• Never program (or "hot-key") automatic access to confidential academic record systems. 

FERPA protects the privacy of all educational records, regardless of the medium in which those records are maintained. Therefore, it is important to remember that the same principles of confidentiality apply to paper records, electronic data, and other forms of media. 

Treatment records are records on a student who is eighteen years of age or older, or is attending an institution of postsecondary education, which are made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his professional or paraprofessional capacity, or assisting in that capacity, and which are made, maintained, or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment, except that such records can be personally reviewed by a physician or other appropriate professional of the student’s choice. 

Faculty should discuss a student's academic record only with that student or with university employees in the performance of official duties. 

While academic, counseling and disciplinary records all constitute education records, they are maintained separately at the University of Florida. The Registrar's Office maintains students' academic records. To review other records, such as counseling or disciplinary, please contact the relevant department or unit or the Office of the University General Counsel (123 Tigert Hall; 352-392-1358.) If a student wants access to his/her academic record, they must complete a Request to Review Academic Record and submit it to the Office of the University Registrar. If the student chooses to fax or mail the form, it must include his/her notarized handwritten signature, along with a copy of their federal or state ID. Within 10 business days, the Office of the University Registrar will set up an appointment for the student to view the requested record. 

UF is not required to permit students to inspect and review the following: 

• Financial information submitted by parents 
• Confidential letters of recommendation filed before January 1, 1975
• Confidential letters of recommendation filed after January 1, 1975 to which a student waived his/her right to inspect.

Note: If an education record contains information about more than one student, a student may access only the part of the record that pertains to him/her. 

In certain instances, the law does not require the university to obtain the student's consent before disclosing information from his/her education record. All disclosures to third parties without student consent are maintained as a part of the student's education record. The most common examples of disclosures that do not require a student's consent include: 

• Disclosures to school officials with a legitimate educational interest.
• Disclosures to other institutions where the student seeks to enroll or is enrolled.
• Disclosures in connection with the receipt of financial aid (validating eligibility).
• Disclosures to state/local officials in conjunction with legislative requirements.
• Disclosures to organizations conducting studies to improve instruction, or to accrediting organizations.
• Disclosures to parents of dependent students in which the student has drug and/or alcohol violations that have occurred twice in one semester or three times during enrollment, regardless of how much time elapses between violations. If a student is hospitalized as a result of drug or alcohol use, the Dean of Students Office may inform his/her parents if doing so is necessary to protect the student's health or safety. This policy is outlined in the Code of Student Conduct. All questions related to this policy should be directed to the Dean of Students Office (202 Peabody Hall; 352-392-1261).
• Disclosures in compliance with a judicial order or lawfully issued subpoena.
• Disclosures for a health/safety emergency.
• Disclosures of information from disciplinary proceedings to the alleged victims of violent crimes or sexual offenses.
• Disclosures of name, sanction and outcome of disciplinary proceedings (public information), only when found in violation, and only for crimes of violence. 

Under FERPA, when a student reaches 18 years of age or enrolls at a postsecondary institution such as the University of Florida, the rights afforded to the parents of a student automatically transfer to the student. Students may authorize third parties, including parents, by logging into their ONE.UF portal using the pathway ONE.UF > Academics > Authorize Information Release. The student has the ability to add or remove an authorized third party at any time. However, a parent still may have access to the education record if: 

• The information requested is directory information and there is no privacy hold on the student's record.
• The information is released in response to a lawful subpoena. (As a courtesy, UF will make a reasonable attempt to notify the student of disclosures to the student's parents or in response to a subpoena. The student should ensure that he/she has a current address on file or such notification will not reach him/her.) 

Students may prevent the release of directory information to third parties by placing a privacy hold on their academic record. Only current students may request privacy holds; once a student graduates or leaves UF, they cannot request a privacy hold. Once a privacy hold is in place, the student must transact all university business in person with photo identification. The privacy hold will expire only when the student requests its removal in writing, regardless of withdrawal, graduation or death. To place a privacy hold, the student would fill out a Restriction of Directory Information (Full Privacy Hold) and submit it via the secure upload. Directory information is still available to UF employees with legitimate educational interest, and in other situations where consent is not required by law. 

To access directory information, the student would log on to the One.UF portal with their GatorLink username and password and follow the prompts. The student can choose which elements they to restrict from the directory, leaving some and deleting others. 

If a student believes his/her education record is inaccurate, misleading or in violation of his/her right to privacy, the student may ask that such information be removed or amended. Please note: The right to request amendment of the academic record does not apply to challenging a grade. 

Persons who applied for admission are protected when they pay their tuition deposit or when they initially register at the University of Florida. 

FERPA rights for admitted students begin when they are considered to be in attendance at UF. Attendance commences upon formal enrollment for college-credit courses approved and scheduled by the university. 

Students who have graduated or who no longer attend UF have the same FERPA rights as current students with regard to disclosure of and access to their UF education records. Privacy holds cannot be requested after graduation. 

If a recording made by UF includes only the instructor, it is not a student record and FERPA does not limit its use. If the recording includes students asking questions, making presentations or leading a class (other than TAs), and it is possible to identify the student, then the portions containing recordings of the student do constitute protected educational records. Educational records can only be used as permitted by FERPA or in a manner allowed by written consent from the student. 

Maybe. There are several ways to use recordings that include student participation. 

• The instructor may obtain individualized FERPA consent from the students in the recording which allows use of that portion of the recordings. This type of consent can be obtained on a case-by-case basis or from all the students at the outset of a class.
• Recordings can be edited to either omit any student who has not consented to the use of their voice or image, or be edited to de-identify the student in the recording (which can include avoiding or removing any mention of the student’s name, blurring the student’s image, altering voice recordings, etc.). For questions related to de-identification, please contact the Privacy Office.
• Recordings can also be planned so that students (such as those asking questions during a class) are not shown in the video or referred to by name (another way to de-identify the student). 

If access is limited to other students in the class, FERPA does not limit or prevent its use and does not require obtaining written consent. This allows instructors to create access for students in the class to watch or re-watch past class sessions.

If access will not be limited to students in the class, plan the recordings accordingly. Make sure not to show students who are asking questions and don’t refer to the students by name. Avoid repeating the student’s name in the recording (de-identifying students removes the need for specific consent from each student depicted). If a student happens to appear on camera, their identity can be edited out or a written consent can be obtained. 

Because student presentations make it more difficult to de-identify the student, the instructor should obtain FERPA consent from the student making a presentation. 

Any use of recordings must comply with FERPA, either through consents or de-identification of students depicted. 

As a general rule of thumb, recording is not permitted. The only exception is if the recording has been approved as an accommodation for the student’s disability to provide meaningful access to the educational experience. The UF Disability Resource Center can offer additional guidance on this topic. 

Students cannot be compelled or required to give consent, though the instructor may edit the student out of the recording or de-identify him or her even if the student refuses to consent. 

Some best practices to consider include encrypting emails containing FERPA PII, using strong passwords to access your email, only sharing the minimum necessary amount of PII, double-checking recipients’ email addresses (especially when emailing from your phone), and placing sensitive information in a secure attachment. Please review UF’s policy about electronic mail on Regulation and Policy Hub. 

If an instructor intends to record one or more sessions of an online course, a statement should be included in the course syllabus informing students that portions of the course will be recorded.  Any opt-out methods that will be available to students, such as turning their cameras off, can also be included in this statement. 

Thereafter, the instructor may also include reminders at the beginning of each course session that will be recorded.  Instructors should be consistent so that any recorded sessions include the same notification.