Federal Regulations

For a complete list of Federal regulations pertaining to Universities see http://www.higheredcompliance.org/matrix/

Family Education Rights and Privacy Act (FERPA)

The primary law that governs the privacy of educational information is the Family Education Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g(b).

FERPA is the keystone federal privacy law for educational institutions. FERPA generally imposes a cloak of confidentiality around student educational records, prohibiting institutions from disclosing “personally identifiable education information,” such as grades or financial aid information, without the student’s written permission. FERPA also grants to students the right to request and review their educational records and to make corrections to those records. The law applies with equal force to electronic records as it does to those stored in file drawers.

Generally, institutions must have written permission from the student in order to release any information from a student’s education record. However, FERPA does allow institutions to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):

1. School officials with legitimate educational interest;
2. Other schools to which a student is transferring;
3. Specified officials for audit or evaluation purposes;
4. Appropriate parties in connection with financial aid to a student;
5. Organizations conducting certain studies for or on behalf of the school;
6. Accrediting organizations;
7. To comply with a judicial order or lawfully issued subpoena;
8. Appropriate officials in cases of health and safety emergencies; or,
9. State and local authorities, within a juvenile justice system, pursuant to specific State law.

Institutions may disclose, without consent, “directory” information, such as a student’s name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, institutions must tell students about directory information and allow students a reasonable amount of time to request that the school not disclose directory information about them.

Institutions must notify parents and eligible students annually of their rights under FERPA. The actual means of notification, such as a special letter, student handbook, or newspaper article, is left to the discretion of each institution.

While violations of FERPA do not give rise to private rights of action, the U.S. Secretary of Education has established the Family Policy Compliance Office, which has the power to investigate and adjudicate FERPA violations and to terminate federal funding to any institution that fails to substantially comply with the law.

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was enacted to protect the rights of patients and participants in certain health plans. In 2000, the federal Department of Health and Human Services adopted copious regulations granting consumers the right to receive written notice of the information practices of entities subject to HIPAA.

Colleges and universities that are affiliated with health care providers are considered covered entities, and participant organizations must provide written notice of their affiliated health care provider’s electronic information practices. Most employer-sponsored health plans also are considered to be “entities” subject to HIPAA. As a result, various compliance obligations are imposed on colleges and universities that sponsor and administer such plans.

HIPAA generally requires covered entities to:

1. Adopt written privacy procedures that describe, among other things, who has access to protected information, how such information will be used, and when the information may be disclosed;
2. Require their business associates to protect the privacy of health information;
3. Train their employees in their privacy policies and procedures;
4. Take steps to protect against unauthorized disclosure of personal health records; and,
5. Designate an individual to be responsible for ensuring the procedures are followed.

Electronic Communications Privacy Act (ECPA)

The Electronic Communications Privacy Act (ECPA) broadly prohibits the unauthorized use or interception by any person of the contents of any wire, oral or electronic communication. Protection of the “contents” of such communications, however, extends only to information concerning the “substance, purport, or meaning” of the communications.

In other words, the ECPA likely would not protect from disclosure to third parties information such as the existence of the communication itself or the identity of the parties involved. As a result, the monitoring by institutions of students’ network use or of network usage patterns, generally, would not be prohibited by the ECPA, as long as the substance of the communication was not made public.

The ECPA will come into play when an institution is forced to monitor or intercept student, faculty, or employee electronic communications such as e-mail. The effect of the law may depend on the type of person being monitored and the person’s association with the institution, as a student, faculty member, or employee, and whether the communication system is considered a public or private system.

The ECPA also contains specific exceptions allowing disclosures to law enforcement agencies under certain circumstances.

USA Patriot Act

The USA Patriot Act can effect educational institutions in many ways. Probably the most significant effect is that it potentially prohibits institutions from revealing the very existence of a law enforcement investigation. All institutions should ensure that they have worked with their legal staff to produce written procedures on how to deal with law enforcement information requests. Any institution employee faced with a request from law enforcement should follow these procedures.

TEACH Act

The TEACH Act relaxes certain copyright restrictions to make it easier for accredited nonprofit colleges and universities to use technology materials in educational settings. Institutions that want to take advantage of the relaxed copyright restrictions must limit “to the extent technologically feasible” the transmission of such content to students who actually are enrolled in a particular course, and they must use appropriate technological means to prohibit the unauthorized retransmission of such information.

In other words, the TEACH Act may require institutions to implement technical copy protection measures and to authenticate the identity of users of electronic course content.

Gramm – Leach – Bliley Act (GLBA)

The Gramm – Leach – Bliley Act (GLBA), enacted in 1999, was largely directed at financial institutions and creates obligations to protect customer financial information. However, it has been determined that colleges and universities are also covered by the act.

The GLBA has two major sections: privacy and security. The Federal Trade Commission’s (FTC) regulations implementing the GLBA specifically provide that colleges and universities will be deemed to be in compliance with the privacy provisions of the GLBA if they are in compliance with FERPA. Therefore, GLBA privacy requirements should not affect educational institutions. They should therefore focus mainly on the security sections of the GLBA.

The information security, or Safeguard, section has five major requirements that a USG participant organization must follow:

1. Designate one or more employees to coordinate the security safeguards;
2. Identify and assess the risks to customer information in each relevant area and evaluate the effectiveness of the current safeguards;
3. Design and implement a safeguards program and regularly monitor and test it;
4. Select appropriate service providers and contract with them to implement safeguards; and,
5. Evaluate and adjust the program in light of relevant circumstances or the results of testing.

Computer Fraud and Abuse Act (CFAA)

The Computer Fraud and Abuse Act (CFAA) criminalizes unauthorized access to a “protected computer” with the intent to obtain information, defraud, obtain anything of value or cause damage to the computer. A “protected computer” is defined as a computer that is used in interstate or foreign commerce or communication or by or for a financial institution or the government of the United States. A participant organization may use this law when there has been a break-in of their computer systems.

International Traffic in Arms Regulations (ITAR)

Published by the US State Department in its International Traffic in Arms Regulations (ITAR): The ITAR addresses items, software and technologies that are primarily defense-related in application. The list of ITAR controlled technologies is known as the “Munitions Control List”.  Questions concerning ITAR compliance should be first directed to the Office of Research Services and Sponsored Programs who will involve ITS as may be prudent in developing compliance capabilities.

Export Administration Regulations (EAR)

Published by the US Commerce Department in its Export Administration Regulations (EAR). EAR addresses “dual use” items, information and software that are primarily commercial in nature but also have potential military applications.  EAR’s list of controlled technologies is called the Commodity Control List (CCL)   IT Services works with researchers and others within the University to ensure methods and technologies are EAR compliant.   Questions concerning EAR compliance should be first directed to the Office of Research Services and Sponsored Programs who will involve ITS as may be prudent in developing compliance capabilities.

Last updated: 4/1/2022