We are #RooReady for fall semester classes. Learn more about the UMKC response to the global COVID-19 pandemic and get the latest updates and safety information from the CDC.

FERPA for Faculty and Staff

Exactly what do faculty and staff need to know about FERPA? And how do they take the course they've heard so much about? Get your answers here!

All information presented on this site is applicable to college level student records. FERPA provides privacy for all levels of education, but there are some differences in the provisions for elementary-secondary students and those for post-secondary students.

The educational institution must provide the student with an opportunity to review their own records, and to challenge the contents if the student believes their record contains an error.

UMKC cannot provide anyone other than the student with access to a student’s records except when the student provides a written release to UMKC which specifies the information to be released and the party which may receive the information.

  • The educational institution (hereafter UMKC) must provide the student with an opportunity to review their own records, and to challenge the contents if the student believes their record contains an error.
  • UMKC cannot provide anyone other than the student with access to a student’s records except when the student provides a written release to UMKC which specifies the information to be released and the party which may receive the information.

How Do I Take the FERPA Course?

To obtain faculty or staff access to Pathway, you must first pass a Final Exam over FERPA regulations. The FERPA exam is located in myLearn on the Human Resources website under Talent Management. You will have the ability to self-enroll in the tutorial.

FERPA training instructions (PDF)

More FERPA Information for Faculty and Staff


Family Educational Rights and Privacy Act. It also referred to occasionally as the Solomon Amendment or Buckley Act.

Education records

All personally identifiable information maintained by the college except information maintained by individual instructors or others for the sole use of the individual and which will not be shared with anyone else. The above definition excludes law enforcement records, health records, alumni records and employment records. Information or data may be recorded in any medium, including, but not limited to handwriting, print, computer media, video or audio tape, film, microfilm and microfiche.


Any person who is or has been in attendance at the University where the University maintains education records or personally identifiable information on such person. However, the term does not include a person who has not been in attendance at the University of Missouri. The term attendance does not include specific daily records of a student's attendance at the University.


A parent is defined as a natural parent, an adoptive parent, or the legal guardian of the student. Verify that a person is a parent by reviewing income tax return that shows the student as a dependent (I.R.S. Code of 1954) in the most recent tax year.


To permit access, transfer or communicate student information to any party in any form

Legitimate educational interest

The University discloses education records without a student's prior written consent under the FERPA exception for disclosure to school officials with legitimate educational interests. A school official is a person employed by the University in an administrative, supervisory, academic or research, or support staff position (including law enforcement unit personnel and health staff); a person or company with whom the University has contracted as its agent to provide a service instead of using University employees or officials (such as an attorney, auditor, or collection agent); a person serving on the Board of Curators; or a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his or her tasks. A school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the University.

Directory information

information that may be disclosed without the student’s signed, written consent. Directory Information may include: name, address, telephone number, e-mail address, dates of attendance, full- or part-time status, major field of study, degrees and awards received, most recent prior school attended, participation in sports and activities.

Non-directory Information

Information that CANNOT be disclosed without the student’s signed written consent. Non-directory information includes everything that is not included in directory information, for example grades and GPA.

The Family Educational Rights and Privacy Act of 1974 (FERPA) is the primary federal law that protects the confidentiality of student records. A student is defined as any person who is or has been in attendance at the University where the University maintains education records or personally identifiable information on such a person. FERPA does not apply to a student who has not been in attendance.

As an employee who works with student records, you must uphold all applicable federal laws and University policies designed to protect students' privacy. You are responsible for properly handling student information and are accountable for all information you release, even if the release is unintentional.

To avoid violations of the FERPA law, please DO NOT:

  • Post grades using student IDs, SSNs, or other personally identifiable data.
  • Link a student's name with their student ID or SSN in any public manner.
  • Leave completed homework assignments or exams or test in a stack for students to pick up by sorting through other students' papers.
  • Circulate a printed class list with student IDs, SSNs, or grades as an attendance roster.
  • Discuss the progress of any student with anyone (including parents) other than the student without the student's consent. The only exception would be a school official who has a legitimate educational interest to review the student records as defined by UMKC.
  • Provide lists of students enrolled in classes to external sources without approval from Registration and Records.
  • Provide anyone with student schedules or assist anyone other than eligible university employees in finding a student on campus.
  • Provide any student's address, phone or email information unless it is your job to do so.
  • Share your SSO and password that may provide access to Pathway, ImageNow, Blackboard, Canvas or other student data systems. You are responsible for all actives taken using your account in conjunction with the UM System Acceptable Use Policy.
  • Require a student to become a friend/follower on Facebook or Twitter or post/upload videos to external systems such as YouTube as a part of classroom instruction.


  • Ask for a photo ID to confirm the student's identity when they inquire about their own records
  • Respond only to inquiries that you are authorized to field. Refer all other inquiries to an authorized source, even if you have access to the information sought.
  • Password-protect your computer and files in which you store student records.
  • Keep all electronic recourses such as flash drives and PDAs in a secure or locked location.
  • Double check who you are sending sensitive information to via Outlook to ensure it is the correct person before hitting "send."
  • Use only University authorized email accounts when communicating with students.
  • Sign off when you have finished a computer task involving student data and applications where student data is stored.
  • Destroy electronic or printed materials that contain sensitive or restricted data when they are no longer needed.
  • Require a written release for a letter of recommendation if the release involves personally identifiable information such as grades, GPA, etc. Statements made by a person providing a recommendation based on personal knowledge do not require a written release.
  • Contact Registration and Records at 816-235-1213 when in doubt for guidance. Otherwise, always err on the side of caution and do not release student records to anyone unless you are sure it is okay.

For more information about FERPA, please visit the UM System Collected Rules and Regulations that govern Student Records or contact Amy Cole, Registrar.

  1. Only the student must be given access to review their own records. Almost all other access is restricted or an option that UMKC can approve or deny based upon our institutional policies.
  2. Virtually all UMKC academic records that can be identified as belonging to an individual student by name, student number or some other identifier are covered by FERPA.
  3. Posting grades is one of the most common challenges and one of the most frequent times when FERPA is violated. Special caution must be used to distribute grades in such a way that only the student can ascertain their own grade.
  4. Students are protected by FERPA from the time they first register in UMKC classes until they are deceased. UMKC continues to protect student privacy after a student is deceased but may release information in special circumstances.
  5. The student ID number is confidential. The Social Security number is also confidential. In fact, every piece of information UMKC has on file regarding a student may be confidential - if the student has invoked their right to classify "Directory Information" as restricted from release. The only way to know if a student has restricted the release of directory information is to look on the student system.
  6. It is sometimes possible to answer inquiries about a student's record in such a way that you avoid FERPA violations. Some common approaches include:
    • Answer using only generic information that is not specific to the student
    • If the student has not restricted the release of directory information, answer using directory information when possible
    • Provide the answer to the student instead of to a third party
    • Refuse to answer the inquiry if there is any doubt about violating a student's privacy
  7. FERPA gives UMKC a "reasonable" amount of time to answer inquiries, not to exceed 45 days. When you receive a request for student information (other than a subpoena), do not feel that you must respond immediately. If you have FERPA concerns, contact Registration and Records.
  8. Legitimate educational interest is defined by UMKC in broad terms to mean the following: All employees who need personally identifiable information from student records to do their job may access only that information necessary for them to do their job without first obtaining a signed written release from the student to access the information. Legitimate educational interest does not give an employee the right to access personally identifiable information from student records except that specific information that is necessary for them to do their job.
  9. FERPA is a federal law or regulation and not a UMKC policy or local or state law. It is more than 30 years old and well established in policy, procedure and practice.
  10. Whenever a UMKC employee is in doubt as to the privacy concerns of a request for information, that employee should do two things: Do not give out any information, and contact Registration and Records for assistance immediately.

These are the two major concepts or building blocks upon which FERPA was written: you must let the student see their own records, and no one but the student is permitted to see them.

FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are "eligible students." Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.

FERPA prohibits UMKC from disclosing personally identifiable information unless we first obtain a written release signed by the student and specifying exactly what information may be released and to whom it may be released.

Several exceptions to that basic requirement are included in FERPA. Most UMKC employees do not need to know all of the exceptions, and in fact most employees do not need to know any of the exceptions. If an employee believes disclosure is necessary and there is no student release on file to allow disclosure, it is best to consult Registration and Records or legal counsel before releasing information.

Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

  • School officials with legitimate educational interest
  • Other schools to which a student is transferring
  • Specified officials for audit or evaluation purposes
  • Appropriate parties in connection with financial aid to a student
  • Organizations conducting certain studies for or on behalf of the school
  • Accrediting organizations
  • To comply with a judicial order or lawfully issued subpoena
  • Appropriate officials in cases of health and safety emergencies
  • State and local authorities, within a juvenile justice system, pursuant to specific State law

Schools may disclose, without consent, "Directory Information," such as a student's name, address, telephone number, honors and awards and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in a PTA bulletin, student handbook or newspaper article) is left to the discretion of each school.

It is a violation of student privacy rights to disclose a student's grade on any homework, assignment, quiz, exam or final grade to anyone other than the student except as follows.

It is permissible to disclose information from the education record to other UMKC faculty and staff who need the information to perform their UMKC job. This is called a "Legitimate Educational Interest" and is one of the exceptions permitted by FERPA. A good example of legitimate educational interest is the advising and tutoring services on campus.

Instructors must develop methods of disclosing grades and other assessment results to students in their class in such a way that no one other than the student can know the grade assigned.

Some common methods or strategies used on the UMKC campus include:

  • Blackboard grading, which requires a student to log-on using a confidential password
  • E-mail notification to the UMKC e-mail address, which requires logon using a confidential password
  • Handing the student his or her grade in person if you know the student, or upon presentation of their student ID card
  • Mail students their grades in a self-addressed, self-stamped envelope

The Law School and some other schools on campus have used a method of assigning students a unique identifier which is not in any way connected to their Social Security number or student ID number. Grades can then be posted by this unique identifier in complete anonymity. It is important not to post grades in alphabetical or any other order which may be deciphered by students to determine which identifier belongs to which student.

When a project is submitted by a team of students, and when all students on the team are given the same grade, it is not a violation of FERPA for them to know each other's grade. It would, however, be a violation for the teams to know the grades of the other teams.

Grade distribution is one of the most common problem areas in FERPA and one that needs faculty diligence for compliance. A faculty member who knowingly or carelessly distributes grades without protecting students' privacy rights could be disciplined by UMKC which could include termination.

It is common for a parent to demand information from UMKC because they often pay the bills. It is also common for the parent of a minor to demand information.

This is an area where the FERPA rights of elementary and secondary students is different from the rights of post secondary students. The elementary and secondary education records of a student MUST be disclosed to the parent, but not necessarily to the student. The post secondary education records of a student must be disclosed to the student, but not necessarily to the parent, even if the parent is paying for tuition, etc.

In most cases, students are willing to sign a written release every time they want to authorize UMKC to disclose information from their education record to a parent. This is our preferred method of honoring the student's privacy rights.

Parents who claim their UMKC student on their federal income tax return as a dependent can submit page one of their 1040 form to Registration and Records or the Cashiers Office to prove that they meet the FERPA exception qualification of a parent that provides financial support for the student. Parents who qualify in this way will be given the same access rights that are given to the student – no more and no less – until that income tax return is out of date. Parents are encouraged to cut or mark out the dollar amounts on the copy of the income tax return before submitting it.

A parent who does not have the student's written release, and who does not provide a copy of their income tax return showing the student as a dependent, may engage an attorney to subpoena UMKC for release of the information they seek. This is not uncommon in divorce and child support cases when only one parent claims the student on their income tax return.

The key point to remember about parents is: the student and not the parent has a right to review post secondary education records. Parents have three options to gain access to the student's education record. The easiest and best option is to have the student provide a signed written authorization to UMKC specifying what information may be released to the parent. The second and third options, proof of financial support or a subpoena, may be used when a written release is not a viable option

A common request heard on campus is to verify attendance or graduation on a current or former student for employment purposes. These requests may come as a telephone call, a form in the mail, or in person. You may be presented with a standard release form signed by the student, or no signed release.

UMKC Registration and Records handles thousands of these types of inquiries every year. You are strongly encouraged to forward or direct all such inquiries to UMKC Registration and Records or the National Student Clearinghouse for a response.

One of the exceptions in FERPA permits us to disclose directory information to third parties, anyone who requests information from the education record. Since degrees and honors and awards are part of directory information at UMKC, we can usually answer employment inquiries without the student's signed written consent. However, we must verify that the student has not restricted the release of directory information before we respond.

If a student has opted to restrict the release of directory information, then we cannot disclose any information about the student without the signed written consent of the student. Some staff and faculty provide information without meaning to when responding to inquiries about a student who has restricted the release of directory information. For example, it is inappropriate to say: "That student has restricted the release of directory information so I cannot tell you anything about him." You just confirmed that this student has a record at UMKC and that they have taken steps to protect their privacy. We recommend saying: "I'm sorry but I have no information available regarding that person." It is perfectly acceptable when pushed by an inquirer to repeat yourself: "I'm really sorry, but I just do not have any information available on him." You are not denying the person attends UMKC and you are not confirming that the person attends UMKC. Tell an inquirer to contact the person in question if they want to verify educational records.

The standard release forms that we receive in UMKC Registration and Records are not always sufficient to meet FERPA's strict guidelines for the release of student information from the education record. For this reason, again, we strongly encourage staff and faculty on campus to refer all employment inquiries to UMKC Registration and Records for a response.

Another area of concern with employment is letters of recommendation which may be requested by students of faculty or advisors. It is important for you to file a copy of the student's written request for a letter of recommendation and to keep that written request in case it is needed later. Most requests for a recommendation include a "waiver" of the student's right to read or review the recommendation. If the student waives his or her rights to review such recommendations, then they are excluded from the student's right to review their own education record under FERPA.

UMKC does not disclose non-directory information over the telephone to employers or potential employers regardless of the receipt of a signed written release by the student. There is no reliable method of verifying who is on the other end of the telephone.

A faxed copy of a release form is nearly always considered valid and carries the same authority as the original unless otherwise stated on the release form. Release forms are not valid indefinitely. A release form which was signed by the student more than 60 days prior to the request for information may need to be validated by contacting the student.

FERPA was written to protect the privacy of education records and is only an issue when the release of information from an education record has been requested by someone other than the student.

When a health or safety emergency arises, or when an urgent situation occurs on campus involving law enforcement, cooperation with UMKC Police is essential. If you are in doubt as to the authenticity of the emergency, call the UMKC Police at 235-1515 immediately to verify that an urgent situation is in progress. All emergency personnel that come onto our campus will be escorted by UMKC police or will have notified UMKC police to their presence. FERPA does not prevent you from cooperating with emergency personnel —but you should only release information from an education record to emergency personnel when failure to do so might hinder them in performing their duties.

If a situation is not an emergency, then UMKC encourages all inquiries from law enforcement to be directed to the UMKC Police Department or UMKC Registration and Records for assistance. There have been numerous fraudulent attempts to receive information from education records by real and fake law enforcement officers. UMKC Registration and Records is able and willing to help these officers perform their duties, and we encourage you to direct all such inquiries to UMKC Registration and Records.

One common legal question on campus is what to do when a subpoena is served upon a faculty member, a staff member, a department or other unit on campus, for student information from the education record. Please do not ignore a subpoena but do not comply with it until you have consulted Registration and Records. We receive approximately one subpoena per month and as many as half of those are invalid. Upon receipt of a subpoena, we contact UM Legal Counsel and notify the student that we have been served with a subpoena (unless the subpoena is a criminal court case and specifies not to contact the student). Students have the right to contact an attorney to quash the subpoena, and FERPA requires us to notify the student before we comply with the subpoena.

Some subpoenas request information from multiple offices, such as financial aid, scholarship, academic, student discipline and similar records. A coordinated response to complex subpoenas is often prepared by UMKC Registration and Records or the Division of Student Affairs.

Officials who have a badge or gun or business card from a federal agency are not immune from the provisions of FERPA. Refer these officials to UMKC Registration and Records (except in an emergency) where they will be treated exactly like all other third party requests for student information from education records. If you receive a subpoena for information from an education record, contact UMKC Registration and Records immediately. Many steps need to take place to comply with a subpoena.

Using video conferencing to advise students is a new endeavor for some so below is some information related privacy. The bottom line is that FERPA principles do not change. 

Be sure that you are speaking with the student. You are under no obligation to share information if you are not certain that you are speaking with the student or someone to whom they have specifically given permission for you to share non-directory information. This information will be located in the Holds section of the Pathway student center by looking for “FERPA Consent to Release Info”.


Below are some Q&A’s:

What platforms are compliant under FERPA?

  • Zoom and Microsoft Teams are both FERPA compliant for video conferencing.
  • Different rules apply to the use of Zoom for a classroom setting. Additional information for instructors can be found here.


What are some basic principles for being FERPA compliant when using video conferencing?

  • Do NOT record the sessions. You would not record a session in your office and the same applies to video conferencing. 
  • If you are not already, use the “waiting room” feature on Zoom to avoid individuals cutting into conversations with other students and so that you have a chance to verify with whom you are speaking. This can also avoid Zoom Bombers, where unwanted participants join your Zoom or other virtual meetings and begin to post unwanted materials, take over the meeting controls, etc.
  • UM System has recommendations here.


How should I verify that I am working with the student?

  •  Ask students to login using their username and password.  Verify that the name, DOB and UMKC Student ID number match by asking them to provide you with the information. Should preferred name not match, verify that the primary name does. Then, you could advise them to update their preferred name as needed.


How do I ensure that our conversation may not be unintentionally overheard? 

  • When we notice students without headphones or there are obviously other individuals around, you might ask, "Hey, I notice that you don't have headphones on. Are you in a quiet place where it is okay for me to discuss your record and grades?" This ensures that the student knows you will be delving into things that they may not want siblings or parents/significant others to hear.
  • If they would like to allow another individual to access to the information you will discuss they can provide that permission by submitting the FERPA: Access to Student Records form to the Registration and Records Office WorkCenter.
    • In order to not delay your conversation they can provide the form to you immediately for your records. It must be sent to you via UMKC email.  


If they have their video off, how do I know that I am talking to the student?

  • If you cannot see the student, you should treat it as you would a phone call and ask for identifying information (ID#, etc.) If they challenge you about it, you can reassure them that this is for the protection of their private information.


What if I do not know what the student looks like because I have never met with him or her before?

  • Look up their photo in Pathway before entering into the video conferencing meeting.


Additional best practices and resources for Zoom and Microsoft Teams: