Confidentiality of Student Records

The Family Educational Rights and Privacy Act of 1974 (FERPA) is a federal law that protects the confidentiality of student education records. To implement FERPA, the University has formulated and adopted a written institutional policy governing the handling of these records.

The term "education records" under FERPA includes generally any record, whether in a printed, handwritten, audio, video, or computer media format, maintained by the University and containing information related to a student in his/her role as a student. Certain records are, however excluded by FERPA from this broad definition, such as those made by instructional, supervisory, and administrative personnel and kept in their sole possession, those made by campus police, and those made by a physician or other professional medical personnel in connection with treatment of the student.

Under FERPA and University policy, a student has a right of access to his/her education records and may inspect and review the information contained in them. To exercise this right, the student should present a request to the University office where the record is located, and a response will be made no later than 45 days later. In certain cases, a copy of the record may be provided, with a copying fee, as an alternative to actual inspection. Some records are not within this right of review, such as financial information from the student's parents and confidential letters or statements of recommendation where the student has waived the right of access.

A student who believes his/her education records contain information that is inaccurate, misleading, or in violation of his/her privacy rights may bring the matter to the attention of the appropriate records official. If by informal discussion with this official the student does not obtain the corrective action desired, the student will then be entitled to a hearing at which he/she may challenge the objectionable item. Additional information about hearing procedures will be given to the student at that time. The decision of the hearing official or panel shall be final. If the decision is adverse to the student, he/she may insert in the education record an explanatory statement about the disputed item.

A student's privacy interest in the education record is further protected by the rule against unauthorized disclosure. Generally, the University may not, without the student's consent, release the education record or personally identifiable information in it to other individuals or entities.

Disclosure in certain circumstances, however, is specifically excepted by FERPA from the foregoing rule. These circumstances include disclosure to certain parties–University officials who have a legitimate educational interest in the information, officials of institutions where the student is seeking to enroll, parties to which the student is applying for financial aid, the parent of a dependent student, etc.; disclosure to comply with a judicial order or lawfully issued subpoena; or disclosure in connection with a health or safety emergency. Under the first exception, "University officials" includes any UAH employee, and a "legitimate educational interest" means that the employee has a need for access to the record to perform appropriate tasks clearly within the area of responsibility of the employee, to perform a task related to the education or discipline of the student, or to provide a benefit or service relating to the student. Personally identifiable information will be transmitted by the University under these exceptions only upon the condition that the recipient not permit any other party to have access to it without the student's consent.

The University may also release what is called "directory information" without obtaining the student's consent. Directory information is limited to the following: the student's name, address (local and permanent), telephone number, email address, date and place of birth, enrollment status (full-time or part time), major field of study, participation in officially recognized activities and sports, dates of attendance, degrees and awards received, the previous educational institution most recently attended, and a photograph of the student. However, a student may prevent the release of even this information, if he/she wishes, by completing a form provided for this purpose in the Office of Student Records.

Any student who believes that his/her rights under FERPA have been violated by the University may notify and request assistance from the Provost and Executive Vice President for Academic Affairs. The student may also file a complaint with the Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Avenue, SW, Washington, DC 20202-5920.

Learn more about faculty and staff FERPA training.

FERPA Definitions

Directory Information

Information in a student's education record that is not generally regarded harmful or an invasion of privacy if disclosed. As such, part or all of this information may, at the sole discretion of the University, be released to a third party or the public generally.

Directory information includes the following student information:

  • Name
  • Address (local and permanent)
  • Telephone number (local and permanent)
  • Personal email address
  • Date and place of birth
  • Enrollment status (full-time or part-time)
  • Class standing (freshman, sophomore, junior, senior, or graduate student)
  • Major field of study
  • Dates of attendance
  • Degrees and awards/honors received
  • Most recent institution previously attended
  • Participation in officially recognized activities and sports
  • Weight and height statistics of athletic team members
  • Photograph

Education Record

An education record is understood to encompass generally those records, files, and other materials maintained by the University, whether in a printed, handwritten, audio, video, or computer media format, and containing information directly related to a student in his or her role as a student.

Personally Identifiable Information

Any recorded information or data from which the student's identity can readily be ascertained. It includes a student's name, address, social security number, the name of the student's parents or other family members, student number, etc. It also includes indirect identifiers, such as date and place of birth, mother's maiden name, etc.; other information that would allow a reasonable person in the campus community to identify the student; and information requested by an individual who the University reasonably believes knows the identity of the student to whom the record relates.


For the purposes of this policy, a student is defined as any individual who is or has been in attendance at the University as to whom education records are maintained by the institution. An applicant or prospective attendee is not regarded as a student. A person in attendance includes both one who is receiving instruction in person and one who, though not physically present in the classroom, is receiving instruction by paper correspondence, video conference, satellite, Internet or other electronic information and telecommunications technologies. A student in a work-study program is considered in attendance during both the "work" and "study" portions of the program.

University Official

Any University employee, any employee of the other institutions in the University of Alabama System, or any member of The Board of Trustees of The University of Alabama; any student carrying out an official, institutional function, such as service on a University committee, board, etc.; and any individual or entity that is, by an "outsourcing" arrangement, performing an institutional service or function for which the University would otherwise use an employee.

Legitimate Educational Interest

A legitimate educational interest shall be deemed to exist if the official has reasonable need for the information to perform an appropriate task clearly within the official's defined area of responsibility, to perform a task related to the education or discipline of the student, or to provide a benefit or service relating to the student, or if the information is relevant to the accomplishment of some task or to a determination about the student. The individual or entity performing "outsourced" services or functions must be under the direct control of the University with respect to the use and maintenance of the education record. The University will use reasonable methods to ensure that the foregoing officials are given access only to those records in which they have a legitimate educational interest.

Opting out

Complete the FERPA Information Restriction form.

A student in attendance at the University may, however, prohibit the release of directory information at any time by so requesting in writing (the so-called "opting out" request). A form for making such request is available in Registrar's Office in the Student Services Building. A request for non-disclosure will be honored until the student submits a new request in the Registrar's Office allowing disclosure of directory information. All non-disclosure forms shall be kept in the Registrar's Office, and release of directory information shall in every instance be cleared in advance with that Office to prevent unauthorized disclosure.

The fact that a student opts out of directory information disclosures shall not prevent the University from identifying a student by name or from disclosing a student's electronic identifier or institutional email address in class. The "opt out" right does not include the right to be anonymous in the classroom nor to impede routine classroom communications and interactions.