AACRAO 2011 FERPA Update and Q & A's
AACRAO 2011 FERPA Update and Q & A’s
Seattle, WA March 16, 2011
§ 99.31(a)(6) § 99.31(a)(6) Organizations conducting studies FERPA states that a school may disclose education records to organizations conducting studies “for, or on behalf of” the disclosing school but does not explain what that means. Amended regulations clarify that a school does not have to initiate the research request or agree with or endorse the conclusions or results of the study. The school must agree with the purposes of the study and retain control over the information from the education records it discloses.
§ 99.31(b) § 99.31(b) De De--identification of information FERPA permits release of information without consent from education records if all personally identifiable information has been removed. Amended regulations provide objective standards to inform schools when information releases may be considered to be dede-identified. These standards apply to individual, redacted records, and statistical information from education records in both student level and aggregate form. Amended regulations clarify the permitted use of dede-identified data releases for research purposes.
§ 99.31(a)(6) The school must have a written agreement with the receiving organization that: – Specifies the purpose, scope and duration of the study or studies and the information to be disclosed; – Requires the organization to use the information from education records only to meet the purpose or purposes of the study stated in the agreement; – Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate interests; – Requires organization to destroy or return all personally identifiable information when no longer needed for purposes of the study; and – Specifies the time period in which the information must be returned or destroyed.
Statistical Methods for Protecting Personally Identifiable Information in Aggregate Reporting NCES Technical Brief issued December 21,2010 Examines what protecting student privacy means in a reporting context. Even with aggregation, unintended disclosures of personally identifiable information (pii (pii)) may occur.
– Implement objective standards schools can use to determine when information from education records can be released as dede-identified data.
Brief illustrates those practices that work better than others in protecting against disclosures of student pii. pii.
1
FERPA issues on the horizon: Suspect's Downward Spiral JANUARY 13, 2011 TUCSON, Ariz.— Ariz.—Students and faculty at Pima Community College feared for their safety as Jared Lee Loughner's increasingly erratic behavior led to a series of encounters with campus police in the eight months before he was suspended from school last fall, police reports show. After he was accused of shooting 19 people last Saturday, school officials described his behavior while at Pima as odd and disruptive. But police reports show in chilling detail that the behavior frightened students and teachers. Experts Back School's Handling of Loughner JANUARY 14, 2011 The release of documents detailing how Pima Community College responded to incidents involving suspected Arizona shooter Jared Lee Loughner largely show the school acting diligently while underscoring the limits of its capabilities and responsibilities, experts said Thursday. "They did identify this student and get him off campus," said LeRoy Rooker, a former official with the U.S. Department of Education who helped rewrite federal privacy regulations after the 2007 Virginia Tech shootings. "It's not their job to get him mental health care." The documents released late Wednesday cover a series of disruptive incidents and runrun-ins with campus police leading up to Mr. Loughner's suspension from the school in September.
Use of student “education records” for accountability purposes: • unified longitudinal data sharing across State and Federal agencies • privacy vs. accountability • privacy vs. security
Current status of FERPA Data Quality Campaign sponsored discussion (9(9-2-09) concerning unified longitudinal data sharing with Assistant Secretaries from: – U.S. Department of Education – U.S. Department of Labor – U.S. Department of HHS
Department of Education officials announced at the NACUA Annual meeting in June that: – FPCO would be moved under the new ED Privacy Officer – New FERPA regulations would be forthcoming
2
LeRoy S. Rooker Senior Fellow AACRAO One Dupont Circle, NW Washington, DC 2003620036-1135 (202) 293293-9161 x. 1059 [email protected]
3
Seattle, WA March 16, 2011
§ 99.31(a)(6) § 99.31(a)(6) Organizations conducting studies FERPA states that a school may disclose education records to organizations conducting studies “for, or on behalf of” the disclosing school but does not explain what that means. Amended regulations clarify that a school does not have to initiate the research request or agree with or endorse the conclusions or results of the study. The school must agree with the purposes of the study and retain control over the information from the education records it discloses.
§ 99.31(b) § 99.31(b) De De--identification of information FERPA permits release of information without consent from education records if all personally identifiable information has been removed. Amended regulations provide objective standards to inform schools when information releases may be considered to be dede-identified. These standards apply to individual, redacted records, and statistical information from education records in both student level and aggregate form. Amended regulations clarify the permitted use of dede-identified data releases for research purposes.
§ 99.31(a)(6) The school must have a written agreement with the receiving organization that: – Specifies the purpose, scope and duration of the study or studies and the information to be disclosed; – Requires the organization to use the information from education records only to meet the purpose or purposes of the study stated in the agreement; – Requires the organization to conduct the study in a manner that does not permit personal identification of parents and students by anyone other than representatives of the organization with legitimate interests; – Requires organization to destroy or return all personally identifiable information when no longer needed for purposes of the study; and – Specifies the time period in which the information must be returned or destroyed.
Statistical Methods for Protecting Personally Identifiable Information in Aggregate Reporting NCES Technical Brief issued December 21,2010 Examines what protecting student privacy means in a reporting context. Even with aggregation, unintended disclosures of personally identifiable information (pii (pii)) may occur.
– Implement objective standards schools can use to determine when information from education records can be released as dede-identified data.
Brief illustrates those practices that work better than others in protecting against disclosures of student pii. pii.
1
FERPA issues on the horizon: Suspect's Downward Spiral JANUARY 13, 2011 TUCSON, Ariz.— Ariz.—Students and faculty at Pima Community College feared for their safety as Jared Lee Loughner's increasingly erratic behavior led to a series of encounters with campus police in the eight months before he was suspended from school last fall, police reports show. After he was accused of shooting 19 people last Saturday, school officials described his behavior while at Pima as odd and disruptive. But police reports show in chilling detail that the behavior frightened students and teachers. Experts Back School's Handling of Loughner JANUARY 14, 2011 The release of documents detailing how Pima Community College responded to incidents involving suspected Arizona shooter Jared Lee Loughner largely show the school acting diligently while underscoring the limits of its capabilities and responsibilities, experts said Thursday. "They did identify this student and get him off campus," said LeRoy Rooker, a former official with the U.S. Department of Education who helped rewrite federal privacy regulations after the 2007 Virginia Tech shootings. "It's not their job to get him mental health care." The documents released late Wednesday cover a series of disruptive incidents and runrun-ins with campus police leading up to Mr. Loughner's suspension from the school in September.
Use of student “education records” for accountability purposes: • unified longitudinal data sharing across State and Federal agencies • privacy vs. accountability • privacy vs. security
Current status of FERPA Data Quality Campaign sponsored discussion (9(9-2-09) concerning unified longitudinal data sharing with Assistant Secretaries from: – U.S. Department of Education – U.S. Department of Labor – U.S. Department of HHS
Department of Education officials announced at the NACUA Annual meeting in June that: – FPCO would be moved under the new ED Privacy Officer – New FERPA regulations would be forthcoming
2
LeRoy S. Rooker Senior Fellow AACRAO One Dupont Circle, NW Washington, DC 2003620036-1135 (202) 293293-9161 x. 1059 [email protected]
3
