The following are observations and recommendations from Lesley’s General Counsel that faculty and staff should follow to remain in compliance with FERPA:
- The FERPA rules and guidelines prohibit universities from disclosing student education records like grades and evaluative comments to third parties without a student’s permission.
- Some email systems are vulnerable to interception.
- Because communications between faculty and students posted on the Blackboard learning management system remain with the Blackboard system, these communications are much more secure than non-Lesley email systems, and are somewhat more secure than the Lesley email system.
- Faculty are encouraged to use Blackboard Grade Center to post grades and evaluative comments:
- This is the better practice, and should be particularly observed with respect to transmitting grades.
- Posting feedback and grades to Blackboard Grade Center ensures that only the intended student can access his or her grades and evaluations within a secure Internet connection.
- Blackboard does have a feature that permits annotations of written work.
- In the meantime, for those who are more comfortable using email messages to communicate evaluative comments to students:
- Those email messages should be sent to and from lesley.edu addresses only.
- If a student sends you a paper from a non-lesley.edu account, you should respond by using the student’s lesley.edu address only.
- You should not forward emails from lesley.edu to your personal email accounts if the email messages contain personally identifiable information or student records.
- If you have reason to believe that someone other than your student has access to your student’s email account, do not send anything to that email address
- Do not allow anyone else to have access to your lesley.edu email account.
- GoogleDocs and other services are not secure, are not subject to contracts with the university, and we should not put student information on those sites or services (the attached FAQ addresses a few questions related to this). Note also that anything placed on GoogleDocs and other services may be “data mined” by Google or the service company.
More information is available in this FERPA Questions and Answers March 2015