I am a graduate student at a US university. I work for a professor as a TA. Recently, we graded students' tests by scanning them, and marking them electronically. After submitting grades, the professor asked me to email the electronic copies of the tests back to the students. Not being one to do work by hand that a computer can do for me, I wrote up a little program to email the tests for me. It all worked pretty well. I mentioned my program to another professor (not the one I work for), suggesting that he could use my code if he wanted. But he said that he thought emailing tests may be insecure, and might be a FERPA violation. Is he right? I did make sure to use an SSL encryption when sending the tests, but I don't know how secure this really is.

  • 1
    My impression has been that the law is not really clear as to what kind of security measures are required, and as a result, each institution makes its own policies on issues like this, deciding how they want to balance convenience against potential liability. So you probably have to ask someone at your own institution. – Nate Eldredge Oct 24 '15 at 4:08
  • What e-mail addresses did you mail the tests to? The students? Or the parents? Did you make sure those e-mail addresses belong to the students? Not the parents? – scaaahu Oct 24 '15 at 4:10
  • @scaahu Absolutely to the students. The emails I used came from directly from the students' accounts with the school. This is the same email by which they would receive all official university communications. – Alex S Oct 24 '15 at 4:12

It is not a FERPA violation per se, but it might be a violation of university policy which is put in place to guarantee the privacy of student records. This is analogous to the law corresponding to the IRB requirement -- the US government doesn't say what the rule and procedure must be, just what the purpose is and that there must be rules and procedures. The main consideration is that student records can't be "shared" with unauthorized parties, the the university has an obligation to be sure that only authorized parties receive access to these records. My institution classifies all electronic communication with students as "student records", and requires all student records to be viewed and stored only on official university computers on campus, encrypted, and sent to an official campus email address. Technically, this means that if a student emails me a question, I can't reply until I'm on campus using an authorized university computer, and my response has to be encrypted.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.