Training and Support

FERPA

Understanding FERPA and the Use of Cloud Services

With the current trend toward offering more online and remote instruction, there are a growing number of companies providing cloud-based solutions for education. When considering whether or not to adopt a specific online service or platform for student use, you must understand how they manage and share data in order to protect student privacy.

It is the faculty’s responsibility to stay informed about their role in protecting student privacy and security in the online environment. 

The Family Educational Rights and Privacy Act of 1974, better known as FERPA, is a federal law that protects student education records at schools like the University of Illinois. Among other things, FERPA requires that the university not disclose information from students’ records without the written consent of the student.

FERPA-protected information includes:

  • Educational Data (student grades and other academic records)
  • Personally Identifiable Data (student social security numbers, birthdates, UINs)
  • Directory Data (student names, addresses, telephone numbers, email addresses)

Little-known fact: The placement of student data (including Directory Data) into a cloud service is legally a ‘disclosure’ to a third party and by default, requires written consent from each individual student whose data in being disclosed unless one of the legal exceptions to consent has been met.

The Office of the Registrar (https://registrar.illinois.edu) is the steward of all student records for the University of Illinois and by university policy, is responsible for ensuring that all uses of student data are FERPA-compliant. The Registrar’s Office provides an online FERPA tutorial for anyone looking to improve their understanding of FERPA regulations.

Available Campus Platforms

Campus has a variety of online platforms that should meet the needs of most instructors. We recommend that you restrict your official course use to the platforms listed here – Online Platforms @ UIUC (see attached spreadsheet)

If you intend to use a tool that is NOT currently on the above list, you should consider the following guidelines provided by the Registrar for determining when FERPA requirements are triggered by the use of cloud services:

  1. Will any student data (including directory data) be placed in the solution by university faculty/staff, either individually or loaded in bulk, as opposed to students placing their own information in the system?
  2. Will student data (including directory data) be placed into a particular cloud solution without students’ individual written consent, or by the students themselves as a condition of taking a course or attending the university?
  3. If student usage of the solution is OPTIONAL, will students who decline to use the solution be placed at an academic disadvantage (e.g. students who use the solution may receive additional academic credit)?
  4. Will students use their university ID to log in to the solution?

If your answer to any of these four questions is yes, then FERPA requirements are triggered. The solution cannot be used for FERPA-protected data.

You should first consider whether you can revise your use of the tool so that you can honestly answer no to all of these questions. If you are unable to adapt your use to protect student data, then you should consider requesting a campus risk assessment of the platform or service. The campus risk assessment process generally takes three months or more and requires consistent participating from the requesting party. You cannot use the solution for FERPA-protected data until the assessment has reached completion.

If your unit is considering purchasing a cloud-based solution, you should review additional information at FERPA and the Purchase of Cloud Services

Avoiding Unintentional Disclosure

Whether or not the platform you use is FERPA-compliant, following these guidelines will help you avoid unintentional disclosure of protected student data.

DO NOT:

Instead, DO THIS:

Discuss a student’s grades with his/her parent or anyone else

Refer calls from parents to the Office of the Dean of Students (333-0050)

Post grades by class roster, even with names blacked out

 

Post grades by unique number known only to you and the student, and sort your class list into numerical order by these unique numbers

Include grades/GPA in letters of reference without permission

 

Get written permission from the student to share the grades/GPA, or write the recommendation without this information

Publish personal student information such as name, contact info, schedule etc.

 

Remember that some students have contact information flagged for non-release for a wide variety of reasons

Email groups of students in ways that show student email addresses

Place student email addresses in the blind copy field to prevent disclosure

Create third party website accounts for students

Have the students create their own account

Require students to create accounts using their university email address

Allow students to choose how to set up their own account

Require students to share or post their work in any open online environment

Be sure that all student work is protected and viewable only by the instructor and their classmates

Additional Resources

Campus Administrative Manual – Family Educational Rights and Privacy Act of 1974

U.S. Department of Education Resources: Protecting Student Privacy

Cloud-based storage solutions for campus

Open Educational Resources

If you teach a topic that is often taught at other universities, chances are that online resources already exist that you can leverage for your remote teaching. These resources may not present the material in the exact manner that you would, but consider them with an open mind as a way to help you maintain teaching continuity in an extreme situation. View a full list of Open Educational Resources to assist in your course transition or creation.

Instructor Workshops and Teaching Sessions

CITL is dedicated to promoting, enhancing, and assessing teaching effectiveness and student learning. We assist faculty, academic units, and teaching assistants in improving instruction. In addition to the events listed below, we are always available for individual consultations or special activities within a department or college. Please check back often to see what events have been added.