As an employee of UW–Madison, you may have access to protected student information as part of your job. This page provides an overview of your responsibilities under FERPA to protect student data, regardless of your position with the university.
The Office of the Registrar is here to be a resource for you and answer any questions you may have.
Understanding FERPA
To make sure you are complying with FERPA, it is important that you understand a few key definitions.
Refer to the FERPA Overview page for more information.
Releasing and Sharing Information
Education records, including student restricted directory information, generally may not be released to anyone other than school officials without the written consent of the student.
FERPA allows you as a UW–Madison school official to share information from a student’s education record with other UW–Madison school officials who need to review information in an education record in order to fulfill their professional responsibilities (called a legitimate educational interest) without the student’s written consent. This can include private nondirectory information and directory information that a student has otherwise restricted from release to third parties. Generally, if you need specific information to perform your job duties, you will have access to it.
Disclosure of education record information to a UW–Madison school official having a legitimate educational interest does not constitute authorization for that person to transmit, share, or disclose any or all of that information to a third party who does not have a legitimate educational interest.
If you have access to the Student Information System (SIS) and/or Advising Gateway, you can check if a student has placed a FERPA restriction on their personal information and what information they have restricted.
A good rule of thumb: when in doubt, don’t give it out.
Obtaining Student Consent
Unless it is another school official with a legitimate educational interest, do not share private or withheld student information with others, including other students, without first obtaining the student’s written consent.
Written consent must:
- Specify the records to be released;
- Identify the party or class of parties to whom the records should be released; and
- Indicate the reason for the release.
The Office of the Registrar has a single-use release form students can fill out to allow you to share otherwise protected information. Even if a student grants permission for you to share information from their education record, FERPA does not compel you to do so.
Reporting a FERPA Violation
In the event you accidentally share protected student information, or if you come across something that appears to be an improper disclosure of student information, contact the Office of the Registrar right away for support. We can provide you with instructions on what to do to address the situation. We may be required to conduct an investigation and issue findings; this is done to ensure the potential risks are minimized and prevent future incidents.
Dos and Don’ts In the Classroom
Do:
- Use listservs or blind copy (BCC) when sending email to multiple students.
- Give students a way to privately submit their papers and other academic work to you directly (e.g., in class) or in a secure location (your locked departmental mailbox). Return papers and other academic work directly to the student.
- Maintain the privacy of all student academic work (paper and electronic) at all times: in your office, at home, and in transit.
- Communicate with students using their official wisc.edu email addresses.
- Get written consent from a student before writing/sharing a letter of recommendation, and before including the student’s grades/GPA in the recommendation.
- Make sure each student receives their own grade only.
- Post grades via the LMS and hand back exams individually.
Don’t:
- Don’t put students’ personally identifiable information in your subject lines, email messages, social media posts, websites, or CVs.
- Do not allow students to sort through materials that include classmates’ work, such as in a box outside an office door.
- Do not share class lists or rosters that include student names, email addresses, etc., without getting permission from your students. Some of your students may have restricted access to that information. Do not include campus ID numbers on class lists.
- Do not post grades in public places or share with other students.
- If a guest lecturer or other visitor is present during a class, do not discuss individual students’ work, assessments, or grades. You should also refrain from using students’ last names.
- Don’t share your login information with others for any purpose, including with teaching assistants to enter grades.
- Do not merge separate offerings of a course in Canvas unless it supports educational or pedagogical goals (under FERPA, administrative convenience is not a reason to merge courses).
Student Safety and Emergencies
The Office of Student Assistance and Support (OSAS) coordinates reporting and interventions for “students of concern”: any student who may be experiencing personal, financial, health, mental health challenges or is displaying behaviors that may interfere with their own success or disrupt the learning of others.
FERPA allows school officials to share critical information about students of concern with appropriate parties. Your observations of a student’s behavior are not subject to FERPA, and in a situation where you are concerned about a student, you can share this information with relevant parties without worrying about FERPA.
Visit OSAS’ website for more information about referring a student of concern and what happens after a referral.
Legitimate Educational Interest In Practice
The following scenarios offer examples of when you may – and may not – have a legitimate educational interest in reviewing information from a student’s education record.
This is an accordion element with a series of buttons that open and close related content panels.
Scenario 1: You are an instructor and want to know how a student did in a course that is a prerequisite for one you are teaching. Do you have a “need to know” this information?
You would have a legitimate educational interest in whether or not the student has satisfied the requirements to take your course. You would NOT have a legitimate educational interest to know what grade the student received in the prerequisite course.
Scenario 2: You are on a school/college/department scholarship committee. The scholarship requires students to have a certain GPA. Do you have a “need to know” this information?
Yes. If GPA is a criteria, you would have a legitimate educational interest to review the student’s record and determine eligibility.
FAQs
This is an accordion element with a series of buttons that open and close related content panels.
Does FERPA apply to non-credit courses? What about employee trainings?
Under FERPA, institutions are allowed to determine how “in attendance” is defined. UW–Madison requires that a student be pursuing a for-credit credential (degree, certificate, etc.) to be considered “in attendance” and be covered under FERPA. As such, FERPA would not apply to employee-facing courses or to continuing education courses that are not for credit and/or leading to degree completion. However, the non-credit courses that are required to be completed by students “in attendance” at UW-–Madison based on their pursuit of a for-credit credential would be considered part of the student’s educational record and FERPA would apply.
Do FERPA requirements change based on how a course is taught (in-person, online, hybrid)?
No. Students’ FERPA rights do not change based on whether a course is taught in-person, online, or in a hybrid setup.
Does FERPA require me to share directory information?
FERPA allows you to share a student’s directory information if they do not have a restriction on its release, but the law does not compel you to share it. If you run into a scenario in which you are unsure of how to proceed or uncomfortable sharing this information, contact the Office of the Registrar for support.
While FERPA does not require you to share this information, other laws like the Wisconsin Public Records Law may. Refer inquiries to UW–Madison’s Public Records Custodian.