FERPA

Artificial Intelligence (AI) policies

• When using student information, the University allows only certain AI tools. To see a list of approved tools visit the Appropriate Use of AI Tools page.
• Log into your UMN account to use any AI tool.
• Only include the minimum amount of student information needed.

Accessing information

• Access student information only if you have a legitimate educational purpose. For example, an advisor may need to access schedules and grades to support a student’s help request. This access is limited to a specific need and time, do not access student information outside of those needs.
• Do not look up information about students for any personal reasons.

Storing information

• Store student information in a secure manner that is only available to those who are entitled to it.
• Password-protect files, encrypt data on your computer, and use anti-virus software.
• Do not store student information on personal computers, on the hard drives of shared computers, on portable devices such as “flash” drives, or on laptops. 

Sharing information

• When in doubt, do not share information.
• Share student information within the University only with those who have a legitimate educational purpose. For example, University employees may need to access a student’s financial aid information to carry out their defined job. In such a case, only share financial aid information. Do not share any student records outside of a specific need and time.
• Before releasing any information about a student, check PeopleSoft or APLUS for a student’s suppression status. 
• Spouses, parents/guardians, and employers are not entitled to more information than anyone else. Students may grant access to parents and guests to view their records, direct parents and others to the Parent and Guest Access page.
• Do not provide anyone with student schedules or assist anyone in finding a student on campus.
• Do not provide anyone with lists or files of students enrolled in your classes.
• Requests for lists of students from a member of the public or someone not affiliated with the University should be referred to the University's Data Request Center.
• Do not post grades or return graded materials in such a way that one student can see or ascertain the grade of another. (See the grading resources page for more detailed information about safe handling grading information.) Visit the FERPA Guidance Related to Online / Remote Classes and Work for the most recent guidance regarding online class formats and remote work arrangements.
• Do not discuss the progress of any student with anyone other than the student (including parents) without the signed and dated written consent of the student.
• Obtain a student's written permission for any material you put in a letter of recommendation, or give the letter to the student for distribution.

Under FERPA, students have the right to access, review, and suppress some or all of their personal records. In case of rights violations, students can also file a complaint with the FERPA Office in Washington.

Upon request students can:

• Inspect and review information in their educational records.
• Challenge and correct inaccurate information.
• Suppress the release of directory information.
• View a copy of the institutional policy.

Suppression of student information

Students may request suppression of their personal information in MyU. Suppressed student information does not hide it from University staff who need the information in order to carry out their defined job functions, such as advisors or One Stop Student Services counselors. If a student works at the University, public employment information will not be hidden.

Students have five options for information suppression:

• Suppress only the student's phone number.
• Suppress only the student’s address.
• Suppress both the student’s phone number and address
• Suppress the student’s phone number, address, and email.
• Suppress all student information. In this instance, information cannot be released to third parties without written permission.

Students' information can be public, limited, or private, and it can be suppressed upon student request. 

• Directory information is publicly accessible information 
• Limited directory information is only available to student groups, staff, and faculty.
• Private information may not be released except under certain, prescribed conditions as noted in the Board of Regents policy. 

You must verify the student’s identification before disclosing any private data. 
To verify identification, employees must check student ID/government issued ID or confirm at least three data points in addition to their name: 
You must use at least three data points to verify the identity of the student.
At least two of those data points must be from the first list, and one can be from the second list. 
Please document which data points you used.
At least two data points must be from this list:

• Student ID number
• Specific courses taken and term taken
• Grades earned for specific courses
• Last contact with the office providing service

You can select one from this list: 

• Phone number (on record in PeopleSoft)
• Personal email address - not their @umn.edu email address (on record in PeopleSoft)
• Address (on record in PeopleSoft)

Scenarios

• In Person - student provides photo ID (U Card preferred). If student doesn't have photo ID, and isn't fully suppressed, we can use photo in APLUS.umn.edu  
• Phone or Zoom - confirm three data points
  • If calls are transferred from a different unit, confirm identity has been checked before talking with the student
  • Calls should not be cold transferred
  • If the student has someone else present on the call/Zoom; 
    • Confirm the individual has Parent Guest Access (PGA); or 
    • Have the student provide permission in writing (using University email or the Student Information Release Authorization form (SIRA)) that you can discuss the student’s information with the individual
• Email - 
  • University assigned email - no further authentication is necessary
  • Non-University email - see Guidance on FERPA and communicating with students via email

In short: when a student (either current or former) has access to a valid umn.edu email account, you should use that account. In other cases, the student may provide written permission to use another email address. See Guidance on FERPA and communicating with students via email for more detail.