Fall 2007 Freshman Retention Analysis Report
FERPA Overhaul at a Large University K. Celeste Campbell, Ph.D., University Registrar Oklahoma State University AACRAO March 2011
The Impetus: 2009 FERPA Amendments Family Educational Rights and Privacy Act, originally enacted
by Congress in 1974. Major amendments became effective January 8, 2009. The essence of FERPA is to give a student the right to inspect his or her education record and to protect the privacy of these records.
A Collaborative Approach Toward Ensuring Compliance Registrar identified seven areas for examination. Campus executive group examined the seven areas and devised
an action plan. Other system institutions were included. A first step was institutional policy revision.
Institutional Policy Revision Policy revision required participation from many groups. Included mandatory FERPA training: “It is the policy of Oklahoma State University that faculty, staff, and other employees or volunteers serving as school officials with legitimate educational interest complete university-sponsored FERPA training before obtaining access to student education records.” (OSU Policy 20701) Modified definition of “legitimate educational interest.”
Articulated procedures related to release of student information
in response to health/safety threat. Updated procedures for student challenges to the content of educational records.
Major Areas Addressed with the Overhaul Properly document if information is released in response to a
health/safety threat. Document release to allowable authorities/agencies to track further release. Do not release directory information to a 3rd party if the student is identified by SSN or other non-directory information. Control educational records so that school officials obtain access to only those records in which they have legitimate educational interest (FERPA training requirement). Modify methods of authenticating identity of students and others before releasing records.
Spotlight: Awareness and Training Created a FERPA website: http://www.okstate.edu/registrar/ Developed an online tutorial for faculty and staff. Registrar and Associate Registrar offered several FERPA two-
hour training sessions through human resources. Implemented a communication plan to inform faculty and staff of the training requirement. Suspended SIS access for individuals who had not met the training requirement. Required training before setting up new SIS access. By Sept 2010, tutorial completions = 4,145; As of 2/21/11, completions = 4,390.
Spotlight: Authenticating Identity Institutions must use “reasonable methods” to identify and verify
the identity of parents, students, school officials, and others to whom they disclose education records. The use of “widely available” information to verify identity, such as name, date of birth, SSN or student ID number, is not considered reasonable. Identity verification must include at least one element that is known or possessed only by that person, for example, photo ID, random PIN, password.
Before
After
Admissions records student email address from application as “personal email” (type P) in SIS.
Admissions records student email address from application as “alternate email” (type A) in SIS.
SIS PIN defaults to date of birth.
SIS PIN defaults to random number.
Students know initial SIS PIN.
OSU distributes initial SIS PIN to new students via alternate email address.
Initial O-Key account activation requires student to provide name, SSN and date of birth.
Initial O-Key account activation also requires PIN (ability to have O-Key send PIN to alternate email during activation).
O-Key password resets require answer to challenge question.
O-Key password resets require unique, one-time token.
Results More than 4,000 faculty and staff members completed
FERPA tutorial. Leaders are mindful of FERPA when making decisions. Faculty and staff are thinking about FERPA and utilize the Registrar’s Office as a FERPA resource.
Questions or Comments
The Impetus: 2009 FERPA Amendments Family Educational Rights and Privacy Act, originally enacted
by Congress in 1974. Major amendments became effective January 8, 2009. The essence of FERPA is to give a student the right to inspect his or her education record and to protect the privacy of these records.
A Collaborative Approach Toward Ensuring Compliance Registrar identified seven areas for examination. Campus executive group examined the seven areas and devised
an action plan. Other system institutions were included. A first step was institutional policy revision.
Institutional Policy Revision Policy revision required participation from many groups. Included mandatory FERPA training: “It is the policy of Oklahoma State University that faculty, staff, and other employees or volunteers serving as school officials with legitimate educational interest complete university-sponsored FERPA training before obtaining access to student education records.” (OSU Policy 20701) Modified definition of “legitimate educational interest.”
Articulated procedures related to release of student information
in response to health/safety threat. Updated procedures for student challenges to the content of educational records.
Major Areas Addressed with the Overhaul Properly document if information is released in response to a
health/safety threat. Document release to allowable authorities/agencies to track further release. Do not release directory information to a 3rd party if the student is identified by SSN or other non-directory information. Control educational records so that school officials obtain access to only those records in which they have legitimate educational interest (FERPA training requirement). Modify methods of authenticating identity of students and others before releasing records.
Spotlight: Awareness and Training Created a FERPA website: http://www.okstate.edu/registrar/ Developed an online tutorial for faculty and staff. Registrar and Associate Registrar offered several FERPA two-
hour training sessions through human resources. Implemented a communication plan to inform faculty and staff of the training requirement. Suspended SIS access for individuals who had not met the training requirement. Required training before setting up new SIS access. By Sept 2010, tutorial completions = 4,145; As of 2/21/11, completions = 4,390.
Spotlight: Authenticating Identity Institutions must use “reasonable methods” to identify and verify
the identity of parents, students, school officials, and others to whom they disclose education records. The use of “widely available” information to verify identity, such as name, date of birth, SSN or student ID number, is not considered reasonable. Identity verification must include at least one element that is known or possessed only by that person, for example, photo ID, random PIN, password.
Before
After
Admissions records student email address from application as “personal email” (type P) in SIS.
Admissions records student email address from application as “alternate email” (type A) in SIS.
SIS PIN defaults to date of birth.
SIS PIN defaults to random number.
Students know initial SIS PIN.
OSU distributes initial SIS PIN to new students via alternate email address.
Initial O-Key account activation requires student to provide name, SSN and date of birth.
Initial O-Key account activation also requires PIN (ability to have O-Key send PIN to alternate email during activation).
O-Key password resets require answer to challenge question.
O-Key password resets require unique, one-time token.
Results More than 4,000 faculty and staff members completed
FERPA tutorial. Leaders are mindful of FERPA when making decisions. Faculty and staff are thinking about FERPA and utilize the Registrar’s Office as a FERPA resource.
Questions or Comments
