FERPA FAQs

General FAQs

When do the student's FERPA rights begin?

According to the law, a person becomes a student for purposes of FERPA when they are "in attendance" at an institution. In attendance means a student is officially registered for at least one class and that class has started.

When do the student's FERPA rights end?

Deceased students are not covered under FERPA; however, it is the University's policy not to release educational records of deceased students after the student's death. We recommend that anyone requesting information on a deceased student be referred to the Office of the Registrar.

Is there any student information that can be released without the student's permission?

FERPA permits each institution to define a class of information as "directory information." FERPA permits public disclosure of directory information without the student's consent.

What is directory information?

Directory information may appear in public documents and may otherwise be disclosed by the University for any purpose in its discretion, without the student’s consent. The following categories of information have been designated as directory information at Missouri State University:

  • Name
  • Address*
  • Telephone number*
  • Campus email address
  • Field of study, including majors, minors, certifications, and pre-professional areas of study
  • Classification (e.g. sophomore)
  • Enrollment status (full-time, part-time, or less than part-time)
  • Participation in officially recognized activities and sports, including photographs of athletes
  • Dates of attendance, including matriculation, drop, and withdrawal dates
  • Degrees and certificates received including date awarded
  • Awards received, including Dean's list, scholastic honors, departmental honors, memberships in national honor societies, athletic letters, and University-funded scholarships (excluding those that are need-based)
  • Previous education institutions attended

* The University maintains a number of different address and telephone types for students. Three (residence hall, current mailing, and primary/permanent) are considered directory information. General requests for student addresses (e.g., requests for an "address directory of current students") will be fulfilled by providing one address for each student based on availability according to the following hierarchy: (1) residence hall; (2) current mailing, and (3) primary/permanent. General requests for student telephone numbers will be generated in similar fashion.

All non-University contact information provided for purposes of the emergency notification system is not considered directory information. Cell phone numbers, unless provided as a residence hall, current, or primary/permanent telephone number, are not considered directory information.

Can a student prevent the release of their directory information? What are the options?

Student has two options:

Option 1: The People Search website is the University's official directory of students, faculty, and staff. A request to exclude information from People Search may be completed by currently enrolled students in My Missouri State>My Profile channel>Update Online People Search Preferences. To be removed from anything other than People Search, including the Outlook Address Book, a FERPA hold must be completed. Read more about People Search and your options regarding display of your information.

Option 2: A FERPA hold may be requested by currently enrolled students. This non-disclosure option means that the University may not release any directory information about the student (except as permitted under the provisions of FERPA). The University may not even acknowledge to third parties that the person is a student at the institution. Requests for confidentiality are in effect until student submits a FERPA Hold Removal form.

Are there any conditions under which student education records, other than “directory information”, may be disclosed without the student's consent?

Yes, FERPA does contain some exceptions to the written consent rule. Those exceptions allow disclosure without consent:

  • To University officials (including third parties under contract) with legitimate educational interests
  • To comply with a judicial order or lawfully issued subpoena
  • To appropriate parties in a health or safety emergency in order to protect the student or others
  • To parents in cases of drug or alcohol violation when the student is under the age of 21
  • To the provider or creator of a record to verify the validity of that record (e.g. in cases of suspected fraud)
  • To organizations conducting research studies on behalf of the University, provided there is a written agreement between the University and the research organization
  • To officials at an institution in which the student seeks or intends to enroll or is currently enrolled

Who are "University officials"?

A university official is a person employed by the University in an administrative, supervisory, academic, research, or support staff position (including law enforcement unit personnel and health staff). Also considered university officials are members of the Board of Governors, a person or company with whom the University has contracted (such as an attorney, auditor, or collection agent), temporary employees, student workers, and graduate assistants employed by the university.

What constitutes "legitimate educational interest"?

Legitimate educational interest is the need to review an education record in order for a university official to carry out his or her responsibilities in order to: perform an administrative task outlined in the official’s duties; perform a supervisory or instructional task directly related to the student’s education; or perform service or benefit for the student such as health care, job placement, or financial aid.
It is important to understand several points related to "legitimate educational interest:"

  • Curiosity is not a legitimate educational interest. Just because you have access to view the record of your neighbor's son, does not mean that you have a legitimate educational interest in his grades and cumulative GPA.
  • Simply the fact that you are a university employee does not constitute legitimate educational interest. Your need to know must be related to your job responsibilities in support of the university's educational mission. In other words, records should be used only in the context of official business in conjunction with the educational success of the student.
  • Your legitimate educational interest is limited. While you may have a need to access education records for students in your college, you do not necessarily have a similar need to view records of students outside your college. In other words, access to information does not authorize unrestricted use.

Specific FAQs for faculty and staff

What information should never be released to a third party without written consent from the student?

  • Social security number: A student’s social security number may not be used either alone or in combination with other data to identify a student when disclosing or confirming directory information, unless the student has provided written consent. Instead, other directory information should be used to identify students. When a person submits a student’s social security number along with a request for directory information, the person should be informed that the University has not used the social security number to locate the student’s records and that the University’s response does not confirm the accuracy of the social security number supplied with the request for directory information.
  • Citizenship
  • Gender
  • Ethnicity
  • Religious preference
  • Grades
  • GPA
  • Daily class schedule: This is very important. Local police authorities may be trying to find your student. Parents may be asking what classes the student is in today. You can't give that out. This even means to parents who are paying the bills. If it is a health or safety related emergency, contact the Registrar, Dean of Students, or General Counsel to determine if an exception for disclosure can be made.

Does "written consent" have to be collected on paper?

No. In recent years, the U.S. Department of Education has clarified that an electronic signature may substitute for a written one. In order to qualify as an electronic signature, appropriate authentication must occur. A student accessing their My Missouri State account satisfies the requirements for an electronic signature. Since students must log in to My Missouri State using their BearPass access accounts, an email note from a student's @missouristate.edu email address satisfies FERPA's written consent requirement. However, other email systems are not as strict, an email received from a Gmail, Yahoo mail, or AOL mail account for example would NOT qualify as written consent.

What is the definition of education records?

Education records include those records which contain information directly related to a student and which are maintained by the university or by a person acting for the university. In accordance with FERPA guidelines, the following are not education records: law enforcement records, student employment records, medical records, and alumni records. The regulations also exclude from the definition of education records any record that is in the sole possession of the maker of the record where the record is used only as a personal memory aid for the maker and the record is not accessible or revealed to any other person (except a temporary substitute for the maker of the record).

Are student-related comments and notes covered by FERPA?

Yes, unless these notes fall into the category of "sole possession" records (see definition above), then they are part of the student's education record and subject to FERPA. Since FERPA gives the student the right to review any or all of his/her education record, these notes could be included in that review. Therefore, it is important that notes or comments be factual and objective and that University employees who are recording notes or comments avoid making value judgments or using inappropriate language.

Is a student’s attendance record in a specific class considered directory information?

No. If a third party asks an instructor about a specific student’s attendance in his/her class, the information should not be released without the student’s written consent.

May an instructor send a sign-in sheet around class for his or her attendance record?

There is no problem with this practice so long as only the names are on the sheet, with no numbers or dates, and it is only used in the classroom; it cannot be posted outside the classroom, physically or online, for students to sign or view. Additionally, past sign-in history should not be available on any daily sign-in sheet. The regulations specifically provide that a student, even if he or she opts out from directory information disclosures, cannot prevent an institution from displaying the student name, institutional email address, or electronic identifier in class.

If a representative from an agency is doing a security clearance check, how should I handle the request?

  • Review the release to ensure it indicates authorization of educational records; a generic release or medical release is not sufficient in order to release information from the student’s educational record.
  • Check ID of the person to make sure the release is valid.
  • It is recommended that you keep a copy of the release and ID for one year.

Can I disclose non-directory information in an email to the student?

  • Yes, if the email is sent directly to the Missouri State student email account.
  • No, if the email address is one other than an Missouri State account (i.e., Hotmail, Yahoo, etc); only directory information should be released in this case (unless you have the student’s written consent.)

Is it a FERPA violation if an instructor or department leaves graded papers/exams in a stack outside of an office for students to pick up?

  • Yes, anytime non-directory information such as grades, student ID, GPA, etc. is easily accessible and/or viewable by someone other than the student himself or herself, it is a FERPA violation.