FERPA and Identity Authentication

FERPA regulations (34 CFR §99.30-31) require universities to use “reasonable methods” to authenticate the identity of students, parents/family members, school officials, and other requesting parties before disclosing students education records. In order to ensure that only appropriate individuals have access to student’s information, FERPA states the University must implement various forms of authentication to establish the identity of the requester of the information. Regardless of whether information requested is considered less sensitive (directory information) or highly sensitive (educational records), it is best practice to use, at a minimum, two types of Personally Identifiable Information (PII) to authenticate identify before student information is released. PII refers to any information that can be used to identify, contact, or locate an individual, either alone or combined with other easily accessible sources. When requesting PII, it is best practice to use student’s directory information (less sensitive) to authenticate identity.

NOTE: Social Security Number should never be asked or accepted to authenticate an individual’s identity. FERPA prohibits institutions from disclosing or confirming student information if the requestor provides a student’s SSN as it is considered a threat to the student’s identity. For example, if an alleged student or third party provides a student’s SNN, by releasing additional student information, you are confirming that SNN is correct and matches that student.

Best Practices for Identity Authorization

IN PERSON:

Student Self-Request

1. Ask fir student's full name and/or YSU ID#
2. Verify student valid photo ID

Third Party Request

1. Ask for students full name and/or YSU ID #
2. Verify that third party is listed on FERPA Form
3. Verify third party valid photo ID

PHONE:

Student Self-Request with YSU ID #

1. Ask student’s YSU ID#
2. Ask for student’s full name

Student Self-Request without YSU ID #

1. Ask for student’s full name
2. Ask for Personally Identifiable Information**

Third Party Request with YSU ID #

1. Ask for YSU ID #
2. Ask for third party name
3. Verify that third party is listed on FERPA form

Third Party Request without YSU ID #

1. Ask for student’s full name
2. Ask for third party name
3. Verify that third party is listed on FERPA Form
4. Ask for Personally Identifiable Information**

EMAIL:

Student Self-Request with YSU ID #

1. Student’s YSU email address serves as first PII
2. Ask for student’s YSU ID #

Student Self-Request with personal email

1. Ask for student’s YSU ID#
2. Ask for student’s full name
3. 3. Ask for Personally Identifiable Information**

Third Party Request with personal email

1. Ask for student’ full name and/or YSU ID #
2. Ask for third party’s full name
3. Verify that third party is listed on FERPA Form
4. Ask for Personally Identifiable Information**
5. CC email response to student’s YSU email account

University personnel should only use their official YSU email when corresponding with students or third party.

**Example Questions for Personalty Identifiable Information

• What is the student’s middle name?
• What is the student’s mailing address?
• What is a course the student has taken?
• What is student’s academic major?
• Is the student full time or part time?
• What was the student entering term at YSU?
• What degree did the student earn?
• What year did student graduate?