This article applies to: Family Educational Rights and Privacy Act (FERPA) and Information Technologies
First, check the Regulated Data Chart to see if the tool is approved for Personally Identifiable Information (PII, also see What is Covered by FERPA).
Productivity software such as Microsoft 365 (previously Office 365), Box, Google Docs, and their associated products, while approved for FERPA, are not approved for high-risk personal identifiers, even though PII is covered under FERPA.
However, combined directory information that identifies a student is approved in these systems. For instance, you may have a student’s name, email address (including the NetID), phone number, or other contact information, along with their class group assignments. Except for FERPA-suppressed PII, never store high-risk information in these systems (see What is Covered by FERPA), and store the minimum you need for class purposes. Where FERPA-suppressed PII has been included in a file, the entire file should be regarded as High-Risk, and appropriate care must be taken when storing and sharing High-Risk data.
Cybersecurity criminals accumulate data about individuals from multiple sources. The more information they have about a person, the more likely they are to identify a person and be able to act on that information. Therefore, everyone is responsible for minimizing the number of copies of High-Risk data and ensuring necessary occurrences are appropriately protected. The only approved place for long-term storage of high-risk PII is Cornell student systems of record, like PeopleSoft. (Also see When and How to Share Information.)
Minimum security standards must be applied when storing FERPA data on Cornell or personally owned devices, including laptops, desktops, smartphones, tablets, etc. (see Can I store any FERPA data on my computer or smartphone?). Cornell Secure File Transfer (SFT) is the only approved service if High-Risk or other highly sensitive data must be available to another Cornell official outside an approved system. With SFT, a file is usually uploaded and downloaded to a personal device; these should be secured according to Cornell’s minimum security standards (see Can I store any FERPA data on my computer or smartphone?). These files should be removed from the device as soon as the data is stored in an approved system of record like PeopleSoft.
Yes - if forming groups is necessary to fulfill course requirements, then it falls within a course instructor’s professional responsibilities, and sharing the information is allowed.
While students can request that their directory information be suppressed (so it is not displayed, searchable, or shareable), a student may not use the right to opt out of directory information disclosures to prevent school officials from identifying the student by name or disclosing the student’s electronic identifier or institutional email address in class. As long as a student is enrolled in a class, the requirements for classroom participation supersede any data restrictions placed by the student with the institution.
Yes. You can respond to student grade inquiries if the request is made directly from a student’s Cornell email address. The best practice is to refer the student to a system of record, such as a Learning Management System like Canvas or the student information system, PeopleSoft. However, disclosing grades via Cornell email is okay when a student seeks clarification or needs additional information. Grades should only be emailed to the student directly and never to third parties. Other than in the student-initiated communication above, never forward or reply to emails containing sensitive data without removing such data before transmission.
If a student communicates with you from a non-Cornell email address, the email and any attachments will be processed or hosted by systems not subject to Cornell’s FERPA and security contract language and cybersecurity protections, thus increasing the risk.
Consider including guidance in your class introduction, discussion with TAs, and syllabus about the risks of using email, the institution’s legal obligation to protect students’ privacy and sensitive information like grades, the secure locations where grades will be posted, and preferred ways to discuss grades.
No. Student grade rosters and attendance sheets should not be sent via email.
To collaborate on class education records, we recommend setting up a Cornell-approved, cloud-based file library where TAs can post files in a folder for their section. The course instructor can then be granted access to the folder(s). You can use Box, Microsoft 365 (OneDrive, SharePoint, and Teams), or Google Suite (Google Docs, Drive, and Sites).
The recommended choices are:
Never store High-Risk Personally Identifiable Information. (See Information Protected by FERPA) Grades and other educational records for class use can be stored but transferred to PeopleSoft and then deleted. Storing other records, such as graded electronic papers and email exchanges with students, is also acceptable. In any case, record retention rules apply. (See Data Retention Rules.)
If it is existing, supported software, it will be listed on the Regulated Data Chart, which shows which data can be stored in the software, and in most cases, you can sign in with your NetID email address (NetID@cornell.edu). Please note this only applies to the instance of the software managed by Cornell as it is legally subject to Cornell’s contract provisions and security controls.
New acquisitions or renewals of software (free or purchased) must go through the Cornell IT Governance and Procurement process to ensure software agreements include Cornell’s approved FERPA language, which describes the vendor’s legal obligations under FERPA.
Caution about click-through agreements: Click-through software license agreements presented by a vendor during online purchases are bound to the person clicking it and not to the institution unless there’s a contract that overrides it. Such agreements, even if purchased by a Cornell payment method such as a P-Card, can hold you personally liable for the agreement. The Procurement Office will guide you through the purchase process or contact the Division of Financial Affairs Shared Service Center for more information.
Educational records must not be retained beyond the retention period defined in Data Retention Policy 4.7. As of October 1, 2023, Policy 4.7 sets:
At the end of the retention period, these materials must be disposed of appropriately.
Sole Possession records are notes on class activities or observations you keep for your use only.
Sharing is restricted despite being listed as exempt information by the Department of Education. They may only be shared with a temporary substitute for the record maker. Sharing beyond the maker or a substitute, even internally, would cause them to lose their exempt status.
The criteria that must be met for notes to be considered sole possession are:
For FERPA questions or requests, such as for any disclosure of information outside the institution, please contact the University Registrar.
For questions or suggestions about these documents, please submit them using this Service Desk form.
For federal government resources, see the Department of Education website Protecting Student Privacy.
Comments?
To share feedback about this page or request support, log in with your NetID