Steps to Take for FERPA compliance in online courses

  1. Carefully review and monitor the privacy settings of any third party or social media service.
  2. Be aware of the personal information someone has to provide to use the service.
  3. Know who has access to the content your students post to the social media site.
  4. Make sure you understand how the social media company can re-use and mine that content.
  5. Notify your students of the privacy settings and company access to the content they post or upload.
  6. One strategy is to restrict personal information on course related public channels, including student names. Allow students to select any user name they desire and any leave personal information, including names, off the channel profile. A list of links posted inside a password protected online course site will allow faculty to locate those student channels. This serves to facilitate sharing while protecting student privacy.
  7. Faculty should include a statement in their syllabus about proper conduct and expectations for both students and faculty in third party tools. See Sample FERPA Syllabus statement below.
  8. Faculty should have students fill out a consent-to-release form if a third party tool is being used in a course that has the potential to collect education records. The student should sign a form for each tool. Download a sample consent form (PDF).
  9. As an instructor, do not release non-directory or personally identifiable information about a student to a third party, vendor, or person without the student's written authorization.
  10. Never release information, especially the following education records, to a third party, vendor, or service provider that is not an official partner of NCTC: Student number, Grades/Exam Scores, Grade Point Average, Social Security Number, Parent or Student Address/Phone, Detail of Registration Information (i.e., courses, times), Race, Ethnicity, or Nationality, Gender, Date of Birth, Total Credits, Number of Credits Enrolled in a Quarter, Emergency Contact
  11. Never publicly post of grades anywhere (online or offline) either by the student's name, student number, or social security number without the student's written permission. Only use the official NCTC method for posting grades in Canvas or using another authorized tool.
  12. Do not send grades via non NCTC e-mail. The institution will be held responsible if an unauthorized third party gained access, in any manner, to a student's education record through any electronic transmission method. Students use a wide variety of e-mail tools that may or may not be secure. Release grades via the Canvas gradebook or another NCTC authorized, password protected tool. Communication about grades can also take place in the Canvas gradebook or Canvas Conversations to avoid the use of email.
  13. The student has a right to inspect and review any course records you maintain on him/her except for 'sole possession records.' A sole possession record is a record you never share with anyone else (see exception below) and maintained solely by you. If other faculty and department members can inspect those notes, they are not sole possession and become education records and fall under the related FERPA. for example, in an online course, notes regarding a student or their performance that is shared or will be shared with another educator online or offline are not 'sole possession records' (see exception below).
  14. FERPA considers Teaching Assistants to be an extension of the faculty member. Faculty members may even share their sole-possession records with their TA.