% FERPA Reference Sheet for Colorado School of Mines Registrar Student Employees
\documentclass[12pt]{article}
\usepackage[margin=1in]{geometry}
\usepackage{enumitem}
\usepackage{hyperref}
\usepackage{setspace}
\usepackage{array}
\usepackage{longtable}
\usepackage{color} % hyperref loads its own color package (xcolor), so this is technically redundant but harmless.

\hypersetup{
    colorlinks=true,
    linkcolor=blue,
    urlcolor=blue,
    citecolor=blue,
}

\title{Family Educational Rights and Privacy Act (FERPA) Reference Sheet \\
for the Colorado School of Mines Registrar's Office}
\author{}
\date{\today}

\begin{document}
\maketitle

\section*{Purpose}
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records and gives students certain rights. Student employees of the Registrar’s Office at Colorado School of Mines (Mines) routinely handle education records and must understand their responsibilities under FERPA. This reference sheet summarizes key concepts, lists the types of information that may or may not be disclosed, and outlines common exceptions that permit disclosure without prior written consent.

\section*{Key Definitions}
\begin{description}[leftmargin=!,labelwidth=4cm]
    \item[Education Record] Any record directly related to a student and maintained by Mines or a party acting on the institution’s behalf. Records are not limited to paper files; they include electronic data, emails, class lists, advising notes, and other formats. The term “education record” does \emph{not} include:
    \begin{itemize}
        \item \textbf{Sole possession notes} used only as personal memory aids and not shared with others.
        \item \textbf{Law-enforcement unit records} created and maintained by a campus police or security unit for law-enforcement purposes.
        \item \textbf{Employment records} relating solely to an individual as an employee (unless the employment is contingent on student status, such as work-study positions).
        \item \textbf{Treatment records} created by healthcare professionals solely for treatment and not shared.
        \item \textbf{Alumni records} containing information obtained after a person is no longer a student and not related to their attendance.
    \end{itemize}

    \item[Personally Identifiable Information (PII)] Data that can identify a student directly or indirectly, such as name, address, student ID number, or a combination of demographic and other information that would allow a reasonable person to identify the student. PII from education records requires protection.

    \item[Directory Information] Information contained in an education record that would not generally be considered harmful or an invasion of privacy if disclosed. Directory information \emph{may} be released without prior consent provided Mines has given public notice and an opportunity to opt out. Mines has designated the following as directory information:
    \begin{itemize}
        \item Student name
        \item Student address (local and permanent)
        \item Telephone numbers (local and permanent)
        \item University email address
        \item Photographs and videos maintained by the institution, including student ID pictures
        \item Date of birth
        \item Major, minor and field of study
        \item Dates of attendance and enrollment status (e.g., full-time/part-time)
        \item Degree status (expected graduation or conferral dates), previous institutions attended
        \item Participation in officially recognized activities and sports; weight and height of athletic team members
        \item Classification level (Freshman, Sophomore, Junior, Senior, Graduate, etc.)
        \item Mines-recognized academic honors and awards
    \end{itemize}
    Mines retains discretion to refuse disclosure of directory information when it believes disclosure would infringe student privacy, and lists of directory information are generally not released for non-Mines purposes.

    \item[Legitimate Educational Interest] A school official has a legitimate educational interest when they need to review an education record to fulfill their professional responsibilities. At Mines this includes faculty, administrators, clerical and professional employees, and student employees who manage student records information.

    \item[Eligible Student] A student who has reached 18 years of age or is attending an institution of postsecondary education. FERPA rights transfer from parents to the student when a student becomes eligible.
\end{description}

\section*{Student Rights Under FERPA}
Students have several fundamental rights under FERPA:
\begin{itemize}
    \item \textbf{Right to Inspect and Review:} Students may inspect and review their education records maintained by Mines.
    \item \textbf{Right to Request Amendment:} Students may request correction of records they believe are inaccurate or misleading.
    \item \textbf{Right to Control Disclosure:} Students generally must consent in writing before PII from their education records is disclosed. Students may authorize Mines to release records to parents, employers, insurers or others by signing a written consent specifying the records, purpose and recipient.
    \item \textbf{Right to File a Complaint:} Students can file a complaint with the U.S. Department of Education concerning alleged violations of FERPA.
\end{itemize}

\section*{Information You \emph{Can} Disclose Without Written Consent}
\subsection*{Directory Information}
Directory information (listed above) may be disclosed without consent as long as:
\begin{enumerate}[label=\arabic*)]
    \item Mines has provided public notice of the types of information designated as directory information and has given students the opportunity to restrict disclosure.
    \item The student has not opted out of directory information disclosure. Mines provides an annual FERPA notice and a procedure for students to restrict disclosure.
\end{enumerate}
\textbf{Practice Tip:} Even though directory information may be disclosed, release it only when there is an appropriate purpose. Do \emph{not} provide lists of directory information to outside parties for marketing or solicitation, and refer unusual requests to a supervisor.

\subsection*{Observations and Personal Knowledge}
FERPA governs disclosure of education records but does not prohibit sharing information based on personal observations or knowledge that is not derived from education records. For example, if you witness a student struggling or acting strangely, you may discuss your concerns with appropriate campus officials because the information is not from an education record.

\section*{Information You \emph{Cannot} Disclose Without Written Consent}
\begin{itemize}
    \item \textbf{Personally identifiable information from education records.} You must not disclose a student’s student ID number, Social Security number, grade point average, grades, courses taken or current class schedule without written consent. Even confirming whether a student is enrolled in a particular course can reveal protected information.
    \item \textbf{Non-directory data.} Any information not designated as directory information by Mines (e.g. advisor notes, transcripts, disciplinary records, financial information, academic standing) requires written consent or a specific FERPA exception.
    \item \textbf{Private communications.} Do not discuss a student’s records in public areas, with other students or staff who do not have a legitimate educational interest. This applies to oral, written and electronic communications.
    \item \textbf{Access to entire records.} Student employees may only access the records necessary to perform assigned duties and should not browse or search other students’ records.
\end{itemize}

\section*{Disclosure \textit{Without} Consent: Common FERPA Exceptions}
FERPA allows disclosure of PII without written consent under specific conditions. Student employees should consult a supervisor before relying on an exception. Key exceptions include:
\begin{enumerate}[label=\arabic*)]
    \item \textbf{School Officials with Legitimate Educational Interest:} Mines may disclose education records to school officials (including contractors, consultants and volunteers) who have a legitimate educational interest. The official must perform a task related to the student’s education, discipline or service, be under Mines’ direct control and use the information only for the authorized purpose.
    \item \textbf{Other Institutions:} Records may be disclosed to officials of another school in which a student seeks or intends to enroll.
    \item \textbf{Financial Aid:} Information may be disclosed to determine eligibility, amount or conditions of financial aid, or to enforce the terms and conditions of the aid.
    \item \textbf{Health or Safety Emergency:} Information may be disclosed to appropriate parties when there is an articulable and significant threat to the health or safety of a student or others. Disclosures should be limited to the period of the emergency and only the information needed to address the emergency should be shared. Mines must record the emergency and the parties to whom information was disclosed.
    \item \textbf{Judicial Orders or Subpoenas:} Mines may comply with a lawfully issued subpoena, but will make a reasonable effort to notify the student unless the order prohibits disclosure.
    \item \textbf{Dependent Student’s Parents:} Parents of an eligible student may access records if they provide evidence that the student is claimed as a dependent on the parents’ most recent federal income tax return.
    \item \textbf{Disciplinary Proceedings:} The final results of a disciplinary proceeding involving an alleged perpetrator of a crime of violence or non-forcible sex offense may be disclosed to the victim, and in certain cases to anyone when the student is found responsible.
    \item \textbf{Alcohol or Controlled Substance Violations:} Mines may inform parents of students under 21 if the student has violated laws or policies regarding alcohol or controlled substances.
    \item \textbf{Sex Offenders and Other Specific Situations:} FERPA allows disclosure of information about registered sex offenders and to comply with the Solomon Amendment (military recruiter requests) or other specific statutory requirements.
\end{enumerate}
When in doubt, do not disclose. Refer requests to a supervisor or the Privacy Office.

\section*{Parental Rights and Dependent Students}
At the postsecondary level, the FERPA rights belong to the student; parents have no inherent right of access. Mines may share a student’s records with parents only when:
\begin{itemize}
    \item The student provides written consent specifying the records to be released and the purpose.
    \item The parent submits proof that the student is claimed as a dependent on the parent’s latest federal tax return.
    \item The disclosure is pursuant to a subpoena or another FERPA exception (such as a health or safety emergency). Always coordinate with the Registrar’s Office before releasing records to parents under an exception.
\end{itemize}

\section*{Handling Requests and Maintaining Records}
\begin{itemize}
    \item \textbf{Verify Identity.} Before discussing education records, verify the identity of the requester (e.g., ask for photo ID, student ID number, or secure login). Do not share information with unknown callers or individuals.
    \item \textbf{Use Official Channels.} Send PII only through secure, university-approved systems. Do not transmit student information via personal email, unencrypted devices or personal cloud accounts.
    \item \textbf{Record of Disclosures.} For disclosures under certain exceptions (e.g., health or safety emergency), the law requires that Mines record the justification and the parties receiving the information.
    \item \textbf{Data Retention and Disposal.} Retain student records only as long as required by Mines’ retention schedule, and dispose of them securely (e.g., shredding physical documents, permanently deleting electronic files). Do not dispose of records while there is an outstanding request for access.
    \item \textbf{Report Violations.} Immediately report suspected unauthorized disclosures or data breaches to the Privacy Office or Registrar. Provide details so that corrective action and any required notifications can be made.
\end{itemize}

\section*{Examples of Common Scenarios}
\subsection*{1. Third-Party Verification of Enrollment or Degrees}
\textbf{Scenario:} A prospective employer requests verification of a student’s GPA and degree status. \textbf{Action:} Without written consent, provide only directory information (e.g., degree status and dates of attendance). Do not disclose GPA or grades. Employers requiring additional information should obtain the student’s written consent.

\subsection*{2. Parents Inquiring About Grades}
\textbf{Scenario:} A parent calls asking for their student’s grades. \textbf{Action:} Unless the student has provided written consent or the parent provides evidence of dependency, you cannot release grades. Explain that FERPA grants rights to the student. Suggest the parent speak with the student.

\subsection*{3. Health or Safety Emergency}
\textbf{Scenario:} A student employee notices a classmate collapse and informs emergency responders. The student’s allergy information is in the health records. \textbf{Action:} Under the health or safety emergency exception, the employee may disclose relevant health information to first responders to protect the student. The disclosure should be documented in the student’s record.

\subsection*{4. Law Enforcement Request}
\textbf{Scenario:} Police present a subpoena requesting attendance records. \textbf{Action:} Refer the request to the Registrar and the Office of General Counsel. Mines may disclose records to comply with a subpoena, but the student typically must be notified beforehand unless the subpoena explicitly prohibits disclosure.

\subsection*{5. Class Roster Posted in a Public Space}
\textbf{Scenario:} An instructor asks a student employee to post a class roster with student names and ID numbers on a hallway bulletin board. \textbf{Action:} Do not post rosters containing PII (such as ID numbers or grades) in public areas. Distribute class rosters securely through the learning management system or other authorized channels.

\section*{Final Reminders}
\begin{itemize}
    \item Always err on the side of protecting student privacy. When uncertain, do not disclose and consult with a supervisor.
    \item Only access student records necessary for your duties and avoid discussing them in public or with unauthorized individuals.
    \item Keep up-to-date with Mines’ FERPA training requirements and policies. Direct questions to the Privacy Office (\href{mailto:privacy@mines.edu}{privacy@mines.edu}) or the Registrar.
\end{itemize}

\end{document}