FERPA FAQs for Faculty and Staff

FERPA Basics

GW defines eligible students as individuals “in attendance” at the institution, therefore “students” for purposes of GW’s Policy, beginning on the first day of classes. 

At GW, “school officials” are

i) individuals employed in an administrative, supervisory, academic, research, or support staff position;

(ii) individuals employed by GW-hired contractor or the contractor itself;

(iii) Board of Trustees members; and (iv) students serving on an official committee (e.g., disciplinary or grievance committee) or assisting another school official in performing their tasks.  

The term "parent" is defined as including natural parents, a guardian, or an individual acting as a parent in the absence of a parent or a guardian.

Education records are records, files, emails, documents, and other materials which: 

  • contain information directly related to a student (personally identifiable Information);

and

  • are maintained by the University or by an educational agency or institution or by a person acting for such agency or institution.

Records not covered under FERPA:

  • Private Instructor/Supervisor/Administrator records
  • Law enforcement records created for legal purposes
  • Employment records (only those university positions where student status is not a pre-requisite for employment);
  • Alumni records; Student medical records; non matriculant records.

FERPA permits a school non-consensually to disclose personally identifiable information from a student's education records when such information has been appropriately designated as directory information. "Directory information" is defined as information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed.

FERPA permits schools to define their list of directory information.

The following is GW's list of directory information:

  • Student’s name; local address (including email); Telephone numbers;
  • Likeness used in university publications, including photographs;
  • Names and addresses of emergency contacts;
  • Dates of attendance; School or division of enrollment; Enrollment status; Field of study; Class; Credits hours earned; Degrees or certificates earned; Honors received;
  • Participation in university-recognized organizations and activities (including intercollegiate athletics); Height, weight, and age of members of athletic teams
  • Date of Birth will be considered directory information only for the purpose of compliance with applicable laws.
  • The student;
  • Under FERPA, if an “eligible student” would like someone (a parent, a third party) to view their education records, the student should provide written consent to the school, permitting that person to access the record(s).
  • Under FERPA, a school may disclose information from a student’s education records, without student consent to specific entities, such as a State education office, or for specific purposes, such as to comply with a court order. 

A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University.

Under FERPA, a school may not generally disclose personally identifiable information from an eligible student's education records to a third party unless the eligible student has provided written consent.

However, there are a number of exceptions to FERPA's prohibition against non-consensual disclosure of personally identifiable information from education records. Under these exceptions, schools are permitted to disclose personally identifiable information from education records without consent, though they are not required to do so.

Students also have the right to inspect/review their education records, and they have a right to request amendments to their education records.

Details about students' rights over their education records, under FERPA, can be found on the Office of the Registrar's website.

FERPA requires that a consent for disclosure of education records:

(i) be signed;

(ii) be dated;

(iii) specify the records to release;

(iv) state the purpose of disclosure; and

(v) identify the party to which disclosure should be made.

GW’s consent form can be found on the Registrar’s website. 

Forms should always be submitted to the Registrar for verification and record-keeping.

 

No, as mentioned above, student consent must be specific, signed, and dated.

As such, oral consent for disclosure of information from education records would not meet FERPA’s consent requirements.

Yes, FERPA permits electronic consent.

In order to qualify as an electronic signature, appropriate authentication must occur.

Contact the Office of the Registrar for further guidance.

FERPA allows the University the right to disclose education records or identifiable information to third parties without the student's consent, under certain circumstances.

For example:

  • when the disclosure involves directory information;
  • disclosure is made to other school officials who have a legitimate educational interest;
  • if there is a “health or safety emergency”
  • disclosure is made to parents/guardians of the student in very limited circumstances;
  • to comply with lawfully issued subpoena or judicial order;
  • to schools in which the student applies or intends to transfer; or
  • in certain student disciplinary cases.

Contact the GW Office of General Counsel with further questions related to FERPA exceptions.

 


GW's requirements for access and safe handling of FERPA regulated information

  • Access student records only for purposes in scope of your job.
  • Keep student information secure, regardless of its form (print / electronic /audio /video /photo).
  • According to GW’s Data Classification, student education records information is categorized as REGULATED information. For guidance about safe access, storage and handling of regulated university information, check GW’s Data Protection Guide.
  • Follow University Records Retention Schedule and securely dispose of regulated information (check disposal requirements for regulated data included in the GW’s Data Protection Guide)

Disclosures of student education records under FERPA

Information from education records that has been appropriately designated as "directory information" by the University may be disclosed without prior consent.

However, students may request non-disclosure of their directory information, by submitting the Confidentiality Request Form available on the Office of the Registrar Forms page.

Always check student privacy and permission status (contact the Office of the Registrar for help) before releasing directory information about that student.

FERPA allows the University the discretion to disclose student education records or student personally identifiable information to third parties without the student's consent under certain circumstances (FERPA Exceptions).

FERPA Exceptions are listed in the "FERPA Basics" section of this guidance.

Faculty should not be encouraged to disclose student education record information, without student’s consent, unless there is a legitimate interest to do so (if they need to review the education record in order to fulfill their professional responsibility).

FERPA applies to the disclosure of education records and of personally identifiable information (PII) from education records that are maintained by the University.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation, rather than from the student’s education records.

While the rights under FERPA transfer from the parents to the student when the student turns 18 or enrolls in the University at any age, FERPA allows ways in which the University may share education records on the student with his or her parents.

The university retains discretion to disclose such information, if one of the following conditions has been met:

  • The student has provided consent through the Student Consent form. Contact the Office of the Registrar office to confirm whether the student’s written (signed and dated) consent to release education records has been submitted.
  • In connection with a health or safety issue
  • Submission of evidence that the student was declared a dependent on the most recent Federal Income Tax forms, as defined by the Internal Revenue Code of 1986, Section 152, through the Financial Dependency form

If you have any specific questions regarding this process, please contact the Office of the Registrar at (202) 994-4900 or [email protected].

If you received a subpoena, in your capacity as a GW school official, it is the University’s obligation to respond. 

Guidance on what to do when you received a subpoena or a legal notice, can be found on the GW Office of General Counsel website (link below).

Subpoenas and other Legan Notices

If the student requested the University not to release any information, university employees may not even acknowledge that the person is or has ever been a student here. You might say, "I have no information to release." If the caller questions that statement, refer them to Office of the Registrar - (202) 994-4900 or [email protected].

Yes, you may write a recommendation letter for a student, if requested, in support of their application for employment. However, information contained in education records may not be disclosed without the student's written consent. Please have the student for whom you are writing recommendation complete a Student Consent for Faculty/Staff Recommendation form if you plan to include academic information such as individual grades, specific course performance, cumulative GPA, test scores, academic honors, or current academic status. Retain a signed copy of this form in your files.

Statements made from your own personal observations or knowledge of the student do not require a written consent because personal observation/knowledge is not based on information learned from an education record. 

While FERPA does not specifically prohibit the disclosure of personally identifiable information from a student’s education records over the telephone, it does require that the University / school official making the disclosure, uses reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the school may discloses personally identifiable information from education records.

Check the Privacy of Student Records Policy for guidance on how to authenticate a requestor’s identity.

Remember: You can only discuss or share student information with the student or with others who have authorized access.

Yes. FERPA requires that institutions use reasonable methods to verify the identity of students, school officials, parents and others to whom information from education records is disclosed.

Contact the GW Office of the Registrar for help with verifying the identity of a requestor.

Email is an easy way to communicate with students. Prior to sending an email, it’s important to evaluate the risk associated with sending student information and recognizing if it is personally identifiable information (PII).

The Department of Education provides guidance related to communicating to students via email, in this short video: Email and student Privacy



With regards to communicating grades, students should be referred to GWeb to check their grades or they can request a transcript from the Office of the Registrar.

No, you should not display student grades or scores in association with social security numbers, names, initials, student ID numbers (GWID), birthdays, phone numbers or any other identifying information.

Even without identifying information, you should not post the grades in alphabetical order.

No. Without student consent, graded papers and exams may not be shared with, or be made accessible publicly.

Leaving papers, graded exam books or lab reports containing student names and grades in publicly accessible places, is prohibited by FERPA, because it leads to student education records information being made publicly accessible.

Similarly, leaving graded tests in a stack for students to pick up by sorting through the papers of all students, is a violation of FERPA requirement for protecting the privacy of student education records information.

No, GWID is not considered directory information and therefore you may not disclose a student’s GWID to a third party without the student’s written consent.

You should not link the name of a student with that student’s University ID number in any public manner.

You should not use student GWid in a class attendance roaster. You can track attendance on a list that contains only students’ names or a blank sign-in sheet.

Photo rosters are routinely shared in class, to facilitate class interaction and discussion.

Yet, sharing / disclosing class roasters and student photos beyond the class attendees is a FERPA violation. 


Photos, Videos and Lecture Recordings under FERPA 

As with any other “education record,” a photo or video of a student is an education record, subject to specific exclusions, when the photo or video is: 

(1) directly related to a student;

and

(2) maintained by the University or by a party acting on behalf of the University.

If a recording made by the University includes only the instructor, it is not a student record and FERPA does not limit its use.

If the recording made by the University includes students asking questions, making presentations or leading a class, and it is possible to identify the student, then the portions containing recordings of the student do constitute protected educational records. Educational records can only be used as permitted by FERPA or in a manner allowed by a written consent from the student.

Note: Students are not permitted to record instructors, where the instructor has made it clear that recording is not permissible. 

Use of some applications or services may introduce security or privacy vulnerabilities into the University systems. 

To ensure compliance with FERPA requirements and promote a safe, secure computing environment,  only virtual collaboration platform(s) selected and approved by the University for conducting classes and delivering lectures should be used when recording classes and lectures.

Refer to Tools for Instructional Continuity and the GW Guidance for use of Virtual Meeting, Event or Collaboration Platforms for more information.

Faculty and staff should check with their IT support team to see if the application or service is approved for use in the classroom.

If you plan to share the recording outside the class roaster, you should make sure that no student PII is included in the recording.

Follow best practices advice below, to make sure that student PII is not included in the class video recording:

  • Plan the recordings so that they do not show students who are asking questions, don’t refer to the students by name, and avoid repeating the student’s question in the recording (de-identifying the students removes the need for a specific consent from each student depicted).
  • If a student happens to appear on camera, their identity can be edited out.      
  • Verify attendance and student identities, prior to recording, but do not ask for confidential or sensitive Information (e.g., date of birth, social security number) through online platforms.
  • In case of student presentations, because it is more difficult to de-identify the student in such situation, the instructor should contact the Office of the Registrar, to ensure FERPA consent is obtained from the student making a presentation, prior to share the recording.

Yes. You should notify students in advance about recording classes/lectures.

Notification can be included in the course syllabus. Example:

This course / lecture may be audio/video recorded. The recording will be made available to students in this class.

As part of your participation in this course, you may be recorded. If you do not wish to be recorded, please contact the GW Privacy Office ([email protected]) the first week of class (or as soon as you enroll in the course, whichever is latest) with your privacy concern.

Yes, Faculty / Class Lecturers have the right to object to students recording and/or distributing their lectures, in order to maintain privacy of information discussed in the classroom and for protection of copyright .

Yet, the instructor’s right to privacy or concern over copyright does not override the student’s right to accommodation.

To inform your students about your concern for privacy and protection of copyright, you may include the following notification in the course syllabus:

Students are prohibited from recording/distributing any Class Activity without permission from the instructor, except as necessary as part of approved accommodations for students with disabilities. Any approved recordings may only be used for the student’s own private use.

No.  Under FERPA, a student may not use his or her right to opt out of directory information disclosures to prevent school officials from identifying the student by name or disclosing the student’s electronic identifier or institutional e-mail address in class.

Yes, if access is limited to students in the same class, FERPA does not limit or prevent its use and does not require obtaining a written consent.

This allows instructors to create access for students in the class to watch or re-watch past class sessions.

Yes, only if students participating in the video cannot not be identified.

  • Recordings can be edited to de-identify the students in the recording (which can include avoiding or removing any mention of the student’s name, blurring the student’s image, altering voice recordings, etc.). 
  • Recordings can also be planned so that students (such as those asking questions during a class) are not shown in the video or referred to by name (another way to de-identify the student).

Yes, as long as the respective students are completely de-identified or the recording is not shared outside the class roaster.


Remote Proctoring - Privacy Q&As

Remote proctoring allows students to take an assessment at a remote location while ensuring the integrity of the exam.

GW provides remote proctoring systems for online distance learning, for the administration of quizzes and exams for GW courses.

The use of these remote proctoring systems provide assurance to faculty members that remote testing is secure and trustworthy.

Remote proctoring systems require students to confirm their identity and, during the exam, these systems monitor students through video.

In some limited cases (high stakes exams – midterms, finals), a human proctor may be required to monitor the student remotely.

Yes. Letting students know exactly what to expect in an online proctoring session is vital and can substantively reduce the stress of what many see as an invasion of privacy.

Regardless of the remote proctoring system used, Faculty and Class Instructors must ensure that students receive advance notice of the information being collected, by whom (remote proctoring system), how (video recording or live proctoring) and for how long that information will be retained. The notice should be clear on student identification requirements for taking the exam (type of ID needed) and the fact that, as a requirement to ensure the exam’s integrity, they will be recorded for the entire duration of the exam. 

If in-person examination is not possible, remote monitoring (video recording or live remote proctoring) during an exam may be required at the discretion of the instructor for ensuring the integrity of an exam and a condition for taking the exam.

Remote proctoring systems will have access to some student personal information – e.g. ID information, likeness, living space images, etc.

That information is protected against unauthorized disclosure, under FERPA, through the privacy and protection terms and conditions included in the contracts between GW and the providers of remote proctoring systems / services.