FERPA

The institution designates what it considers directory information and notifies students annually of their rights. A student who wishes to keep directory information private files a request. For non-directory records (grades, transcript, aid details), the institution releases information only with the student’s consent or under an exception. Third-party requests are denied unless proper authorization is on file. Students may view their own records through the portal or by request.

Example: a parent calls an online university asking for a student’s grades. The registrar declines because the student has not signed a FERPA release. After the student submits an online consent form naming the parent, the institution may discuss the records with that parent.

HIPAA protects health information and rarely applies to typical student education records. State privacy laws may add requirements but do not replace FERPA. Directory information is the subset of data that may be released without consent unless the student has opted out.

Discussing a student’s academic or financial details with a parent or employer without a release. Assuming FERPA does not apply to online or adult students. Releasing non-directory information over the phone without verifying identity and authorization.