[ARCHIVED] New FERPA requirements for cross-listed courses!

[John_Lowe]

With this statement that just came out today from LeRoy Rooker, what will be Instructure’s take on this interpretation of FERPA?  What will your institution's take be on this interpretation?

Ask the FERPA Professor| resources| AACRAO

Essentially, LeRoy Rooker’s statement is that an institution can allow a student to see other students in a course for which the student is officially registered, but cannot allow a student to see (or be seen by) other students in another (cross-listed) class in the LMS.  To me, it sounds like the door remains open for true cross-listed, in-person courses (like a Psychology and Neuroscience course which are really one-in-the-same, but some students register as PSY and others as NEU) since those students meet at the same time in the same physical classroom with each other.  But this new interpretation seems to shut down courses where one instructor teaches 4 sections of the same Accounting course and simply wants to cross-list those into one course shell in Canvas for the sake of their own convenience and the students would not normally see each other in the physical classroom since they are 4 separate Accounting classes.

Thoughts?  Comments?  Alternate interpretations of LeRoy's answer?  How will you adapt in Canvas?

Deactivated user​, Deactivated user​,  @Renee_Carney ​,  @scottdennis ​, mitch​,  @jared ​

[richard-jerz · Accepted solution]

"I can think of many reasons why a student in Class A would not want to be identified by students in Class B, but reasons do not matter, .."

Kelly, out of curiosity, might you be able to give some reasons?

In a physical classroom, a student in class A can be identified by any other student in Class A, and this doesn't seem to be a problem.  Also, a student in Class B can walk by the Class A classroom and see who is in it.  In fact, anyone can walk by a classroom and see who is in it.  (Will schools need to cover all classroom windows?)

Yes, reasons do not matter, but if there is not solid logic behind the reason, maybe the rule should be challenged.

(I am probably the only one who does not understand this, so I look forward to some explanations.  I anticipate being sorry that I asked.)

[richard-jerz]

Sorry, but I don't quite understand this Title IX issue.  If there is only one section of a course and the course is completely face-2-face, what does Title IX say the school needs to do for this athlete that is not to have contact with others?

[John_Lowe]

 @richard-jerz , if there really is only one section of a course as you describe, that would certainly be tricky to resolve, but I don't think that is a Canvas issue and cross-listing multiple sections wouldn't apply which is what LeRoy's Rooker's statement was discussing. Thankfully, I do not work in the Title IX office where those determinations would have to be made.

[richard-jerz]

Yes, tricky, but I still wonder how this would be resolved?

I might be reading too much into this FERPA issue, but I thought that it involved the issue that students in one section should not know the names of students in another section.  I cannot think through this yet to understand why students cannot know the identity of students who might have enrolled in a course in another section.

Let's say that there is one very popular course called "Social Media" and that it is limited to 20 students.  Let's also say that this course serves two departments, Business and Psychology.  Let's say that the school wants to provide equal opportunity for both departments to have their students enrolled in it, so two sections are created allowing 10 students per section.  Then these 20 students show up for the first day of class.  Is FERPA saying that the students in one section cannot know the names of students in another section?

Clearly, I understand that directory information should remain private. Is the real issue a "list of students?"  Is a list of students considered to be directory information?

[John_Lowe]

Hi,  @richard-jerz ​.  The questions you just asked are why this recent publication from LeRoy Rooker was so shocking to so many institutions.  Like you, we've never really considered this to be a problem before.  LeRoy's interpretation of FERPA seems to indicate that this is a problem if a student has opted-out of disclosing directory information and the instructor uses cross-listed courses.

To expand upon your scenario, I don't think that this really applies to true cross-listed sections -- meaning 10 students from 2 departments that really meet together in the same classroom at the same time.  For all practical purposes, that really is the same class.  I believe that LeRoy's statement applies to convenience cross-listing of courses -- meaning that one instructor teaches five sections of the same class at five different times with five different groups of students but chooses to dump them all together in one Canvas course for their own personal convenience.

This is the situation that I believe that Ask the FERPA Professor| resources| AACRAO  addresses and the situation that I believe could be dramatically helped at a technical level by enabling a section-based privacy-wall option between cross-listed sections.  In your scenario, the instructor would naturally want to disable that privacy wall.  In the convenience cross-listing scenario, the privacy wall probably needs to stay in place.

[richard-jerz]

I appreciate your response, but I do think that we are talking the same thing.

Having 5 sections of the same course is only being done because of resource limitations (not a big enough classroom for all, or a timing issue to spread availability ) or other administrative issues.  It is the same course, isn't it?  It is listed in the University Course Catalog only once.  Again, the five sections are the same course.

To expand upon this, let's say that this professor with 5 sections invites a guest speaker to the university, someone like the U.S. Vice President.  And let's say this professor decides to require all five sections to attend a special presentation by this Vice President, makes this mandatory, and takes attendance.  Aren't students seeing students from the other sections?  Would FERPA say one cannot do this?

Or maybe the university has 5 sections for smaller group discussions (and defines these as sections for registration purposes), but requires a common larger "lecture" on one day of the week.  Does this violate FERPA rules since students in different sections can see others?

My point is that sections are created for a variety of administrative (often very good) reasons.  When we have a great resource like Canvas that allows us to capitalize on a single very efficient resource, I find it odd that FERPA would say "you can't do this."

Might we be into an "interpretation" issue?  I searched a little for the actual FERPA rules and couldn't find it.  It's probably just me, but could someone post the exact URL to this new rule?

[John_Lowe]

Hi,  @richard-jerz ​.  The new "rule" is actually a post on the AACRAO website by LeRoy Rooker, director of the United States Department of Education's Family Policy Compliance Office.  As such, LeRoy's interpretations of FERPA are considered by most institutions to be actionable.  Your institution may feel differently, but I'd encourage you to have those conversations with your institution's Registrar and CIO.

The link you request is: Ask the FERPA Professor| resources| AACRAO

Pay special attention to his use of the word "attending" and I think that may help answer how your institution may address the various scenarios you describe.

[kmeeusen]

John:

Perfect explanation, and I hope  @richard-jerz ​ that this one example helps.

It is not all students, all the time. Under FERPA institutions are permitted to disclose "Directory" information about a student under some very specific conditions. Also under FERPA, a student has the right to "Opt out" of having their directory Information disclosed by the institution. It is that subset of students who choose to opt out, for whatever reason, that raises this issue for cross-listed courses.

KLM

[John_Lowe]

I don't want to spread the conversation too thin, but I wanted to share a blog post that I just published.  In it, I summarize this and other privacy issues in Canvas, and I included a list of recent feature requests, InstructureCon presentations, and discussions about these types of privacy issues.

The Need For Privacy: FERPA and Title IX

[Nancy_Webb_CCSF]

I wish there were no requirement to keep sections of the same course separate, ​ @kmeeusen . FERPA applies to student records. There is an exemption to FERPA for officials who learn something that's in a student record if it's learned by observation and not by accessing records. Is observing that a student is in a online class (by another student) different from revealing a record? It's all about records.  Would that observation exemption help us in cross-listed classes? I have been struggling with the wording of the question asked that has started this whole discussion. Ask the FERPA Professor| resources| AACRAO

The answer begins "The language concerns the student who has opted out of disclosures under the "directory information" exception to signed consent." I agree, the answer seems to me to be referring to a student who's opted out of disclosure.  Are we sure it applies to students who haven't opted out?  But there is other evidence.

I found this quote which supports the idea that classes must be kept separate, one legal opinion; if you equate class with section. From Student Records – General Counsel North Carolina State University:

"Electronic class discussion: email and online presentations of papers

usually become “education records once received by a university

employee.”  However, communications and posting of written work for

electronic discussion among students in a class does not require the

signed and dated specific written consent of the students, provided that

(a) electronic postings of student work do not contain grades or

comments of the professor, (b) the students perform the posting rather

than the professor, (c) students are notified prior to or at the time of

enrollment that posting of their work is a course requirement, and (d)

the posted work is available only to members of the class."

Only to members of the class, my bolding. Another interesting page from NC State; FERPA Privacy Checklist for Online Course Hosting – General Counsel

Until somebody asks the U.S. Department of Education to define an online class to include multiple sections of the same course, same semester, same instructor, it seems like sections have to be kept separate unless students sign a FERPA waiver.  It might be the law.  Note that face-to-face instructors can have their sections meet together and it's not a violation.

I just hope the addition of a checkbox to set the entire section to restrict students to their section gets created before Spring 2017 semester starts.  I also wish discussions were included in this restriction - really everything.  Using groups to separate discussions is a real bother.

[jbrady2]

 @Nancy_Webb_CCSF  So, applied to my example where a math faculty wants to combine multiple sections of the same course into an online conference tool for the purpose of demonstrating math problems, if there is no student work being received to be considered an "education record," would this opinion not apply?  Or, if students ask questions about specific problems for the instructor to demonstrate, would those questions then be considered "student work" and, therefore, "education records"?  It all still seems so very vague. 

[Nancy_Webb_CCSF]

Very good question,  @jbrady2 ​.  I agree it is vague, and I am no authority. There are many complaints online about FERPA being vague, and needing court cases to resolve issues.  Every single school seems to need its own legal opinion.  Since LeRoy Rooker is the defacto authority, do you think we can ask him?  Does one have to be a paid member of ACCRAO?

[kmeeusen]

nancy:

Nice summary, but FERPA also covers a category of "Directory Information"

"The Family Educational Rights and Privacy Act (FERPA), a Federal law, requires that [School District], with certain exceptions, obtain your written consent prior to the disclosure of personally identifiable information from your child’s education records.  However, [School District] may disclose appropriately designated “directory information” without written consent, unless you have advised the District to the contrary in accordance with District procedures."

Students have the option of opting out of  the disclosure of directory information FERPA Model Notice for Directory Information | Family Policy Compliance Office .

KLM

[jbrady2]

Some of the vagueness of FERPA is what constitutes directory information.  Does the law leave this up to the individual institution to decide so long as it is not something that could obviously include an educational record?  Also, if directory information includes items such as name and school email addresses, I know that since our students use a version of MS Outlook branded for our school, all a student has to do is start typing in the name of another student (Our institution uses an email address pattern that uses the first initial of the first name followed by last name and sometimes a number, so if you know someones name, it would not be difficult to determine the email address.) into the address bar and the program starts returning matching results, so if a student has opted-out of release of directory information, would Outlook, in this case, need to be modified to not allow the particular student's email to be returned for matching results?

[jbrady2]

I forgot to mention that my institution defines directory information to include the following information:

• name, address, and listed telephone numbers
• date of birth
• majors
• participation in officially recognized activities and sports
• weight and height (of members of athletic teams)
• dates of attendance
• degrees and awards
• most recent previous educational institutions
• enrollment status

This seems like a lot of personal information from the outset that would be available if the student did not opt-out.

[kmeeusen]

Jeffrey:

FERPA defines Directory information as, "as information contained in the education records of a student that would not generally be considered harmful or an invasion of privacy if disclosed. Typically, "directory information" includes information such as name, address, telephone listing, date and place of birth, participation in officially recognized activities and sports, and dates of attendance. A school may disclose "directory information" to third parties without consent if it has given public notice of the types of information which it has designated as "directory information," the parent's or eligible student's right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as "directory information." The means of notification could include publication in various sources, including a newsletter, in a local newspaper, or in the student handbook. The school could also include the "directory information" notification as part of the general notification of rights under FERPA. The school does not have to notify a parent or eligible student individually. (34 CFR § 99.37.)"

To a certain extent, this would be school specific, as the school need to inform students and parents of what they define as directory information, and how that information might be disclosed by the school, and then provide students or parents a mechanism for opting out of those disclosures.

FPCO Frequently Asked Questions

I hope this helps,

KLM

[jbrady2]

Yes, very helpful.  Thank you.  Also, thanks for the link.  Now I have a place to browse for further answers, having never really had to deal with FERPA questions until recently.

[kmeeusen]

Not a problem Jeffrey!

FERPA can be a pain, and as some commentator noted above, in the vaguer areas of FERPA it will take a court decision to pin down the definitions.

KLM

[mgaither]

In my opinion, there are several problems with a checkbox as a waiver (second opt-out):

1. Cultural disparity: The students who would, most often, not select the waiver, would be those who have the greatest distrust of the "system" - typically, those who are socio-economically disadvantaged.
2. By creating a separate situation for students who are not combined in an electronic space versus those who can interact in the equivalent physical space (which is a violation of FERPA), we are creating an inequity in the education system. This seems to be a violation of the Equal Education Opportunity Act (EEOA) of 1974. I believe this is why FERPA is intentionally left vague... Too many opportunities to conflict with other laws.

Separately:

• The 2008 DOE step-by-step analysis of FERPA (see below), clearly states that peer work (discussions, etc.) can be shared, graded by peers, etc. prior to being graded by the instructor.

Finally:

• Since anonymity is the question (which, under FERPA, is not allowed in the classroom), are students prevented from attending a second section of a course to make-up an absence?

Mark

According to the Department of Education’s Family Educational Rights and Privacy Act Final Rule on Title 34, Subsection CFR 99, Section-by-Section Analysis from December 2008, regarding Education Records (page 2):

Peer-grading (Owasso Indep. Sch. Dist. No. I-011 v. Falvo, 534 U.S. 426 (2002)). Under FERPA a school may not disclose a student’s grades to another student without the prior written consent of the parent or eligible student. “Peer-grading” is a common educational practice in which teachers require students to exchange homework assignments, tests, and other papers, grade one another’s work, and then either call out the grade or turn in the work to the teacher for recordation. Even though peer-grading results in students finding out each other’s grades, the U.S. Supreme Court in 2002 issued a narrow holding in Owasso that this practice does not violate FERPA because grades on students’ papers are not “maintained” under the definition of “education records” and, therefore, would not be covered under FERPA at least until the teacher has collected and recorded them in the teacher’s grade book, a decision consistent with the Department’s longstanding position on peer-grading. The Court rejected assertions that students were “parties acting for” an institution when they scored each other’s work and that the student papers were, at that stage, “maintained” within the meaning of FERPA. Among other considerations, the Court expressed doubt that Congress intended to intervene in such a drastic fashion with traditional State functions or that the “federal power would exercise minute control over specific teaching methods and instructional dynamics in classrooms throughout the country.” The final regulations create a new exception to the definition of “education records” that excludes grades on peer-graded papers before they are collected and recorded by a teacher. This change clarifies that peer-grading does not violate FERPA. No changes from the NPRM.

Department of Education Published Document: http://www2.ed.gov/policy/gen/guid/fpco/pdf/ht12-17-08-att.pdf

[gschultz]

 @John_Lowe ​ thanks for the discussion,  I am going to have to expand my exploration beyond Canvas sections.  As many of the courses in canvas use LTI integrations with the books vendors such as, Connect / ALEKS (McGraw-Hill), MyLabs (Pearson), and  Cengage Brain to name a few. Do these applications allow students to see each other?

[CindiKerns]

In our testing we have found that the LTIs treat the class as one entity without regard to section numbers. This has led to the drastic step of not combining any sections unless they are cross listed in the course catalog and meet as one class face-to-face. All of which has resulted in a duplication of administrative tasks for faculty. Lots of unhappy campers on campus this semester.

[jbrady2]

 @gschultz ​ As far as I understand, and this is only from having worked with faculty, the faculty member must go into MyLab and create a new "section" for their course, and they create separate ones that they then link to each course.  For this reason, I would think that the students are kept separate from one another unless they are already in the same course.

[arovner]

We have run this FERPA discussion by our Registrar who told us that LeRoy Rooker is the one who knows and if we can't lock things down then we won't be able to cross-list any courses.  Fall quarter starts on Sept.21 so the clock is ticking. To say that the faculty will be "upset" if we aren't allowed to cross-list is an UNDERSTATEMENT!  We are a cc but with many online courses.  We have approx 80 courses already cross-listed and faculty aren't even on contract until mid-September.

Stressed in Shoreline.

[mgaither]

I have to disagree that "convenience" is the only reason why students may interact in two different sections. There is a strong body of evidence that integrated studies (learning communities) combining multiple disciplines, provide students the benefit of sharing information in cross-curricular teams. In addition, in Business Administration, we expect students to function in cross-sectional teams - this is especially true where students are expected to function in cross-sectional teams in the LMS supported face-to-face courses.

[mgaither]

Hello All, This is a follow-up to my earlier post...

I’m sure many of you have or will go to the source of this situation... The posting by LeRoy Rooker on the AACRAO website in response to a question regarding directory information references specifically, student's opting-out of sharing directory information – Please follow the link to the question and Mr. Rooker’s response.

You will notice as you read Mr. Rooker’s response, the sharing of information to other classes only applies when a student “has opted-out of disclosures” – consequently, the student has to go through the process of informing the college that they do not want their directory information shared.

Each institution determines what is shared in the student directory, in the case of my college, we only share the student name and the Google Education email address. Anything else that is shared is done so by the student as a choice they make during any individual student-initiated sharing process.

Thanks to Lucas Myers for providing these references from sources for similar interpretations of the FERPA guidelines:

• https://mailman.stanford.edu/pipermail/baregistrar/2015-October/000509.html
• http://www.aum.edu/docs/default-source/Registrar-Office-Documents/ferpa-for-faculty-for-website.pdf?...
• https://reg.msu.edu/Read/PDF/FERPA%20CSI%20MACRAO%202012.pdf  (slide 47)

Mark

[cms_hickss]

I've been reading/following the discussion here and I would like to know what you would think about combining lab sections?

Scenario: You have a course that requires both a lecture and a lab (students register separately for them). The class has 250 students. The labs have 10 students. Under the concept of not combining sections so students don't know who else is taking the class, would you combine the lab sections?

[kmeeusen]

Susan:

Under our school's interpretation of FERPA, this would be permissible!

KLM

[richard-jerz]

Kelley, I am not trying to be bothersome.  But what logic is used in this scenario that would allow the labs to be combined?

[kmeeusen]

That the students from the ten labs are all participants in the same lecture course, and that the labs are just  components of that lecture course, and I wouldn't be surprised if the college schedule and the course syllabus describe the structure or the course in just that way.\

"A student cannot use the right to opt out of directory information to remain anonymous in the classroom, either in person or in a distance education classroom."

Make sense, or is my interpretation incorrect.  I always want to learn more and better, so hammer  me!

KLM

[richard-jerz]

Kelley, thanks for your follow-up comments.  So let me think about this a little.  Let's say that there is to a course that has 500 students in it.  Let's say that we allocate a common time on the first week for all 500 students to meet in a common auditorium, and the instructor provides the same introductory information to all 500 students during this first meeting, same place, same time.  Then, we break this course down into (lab) sections of 100 students each for the remainder of the semester.  It appears that following this logic, that the 5 sections that happen to continue to meet at different times would be allowed to be combined in Canvas because it is the same course, right?

[kmeeusen]

Rick:

Yes, that would be my interpretation, but as I like to remind folks I could be wrong.

KLM

[richard-jerz]

Kelley, I certainly understand.  I too am not an expert, I am just trying to give some ideas to see where this takes us.

It appears that our logic suggests that as long as you do something face-to-face with the entire class which exposes class members to each other, it might okay to combine Canvas sections.  This is of course interesting.  If, for example, you had a guest speaker come to talk to the class, had a common place and time for all sections (such as Friday night, including a social hour) where students saw each other, and required attendance, combining sections might be okay.

[cms_hickss]

I'd also throw in Computer Testing Labs since some teachers require f2f, mix-mode and even online students to take their exams in a monitored lab setting.

[mgaither]

Hello Everyone,

I am at a loss on how to preface this question... I am simply going to ask for your help:

As a Business Administration instructor, how do I teach my student's the critical business skills necessary to function in a virtual team, if I am not allowed to create cross-sectional groups in Canvas?

For me and my students, this is at the heart of this problem.

Looking for a solution,

Mark

[mgaither]

A couple of clarifications regarding some interesting arguments on this issue:

1. FERPA pertains to permanent student records -  I would argue a class section is a transient record that never sees the light of day.
2. The Clery Act is specific to student safety.
3. An electronic record in the online classrooms creates a trail of harassment, stalking, etc.
4. When you register in a patient portal in HIPAA, you sign away your HIPAA rights to the company that manages the patient portal - read the terms of agreement.

Mark

[kmeeusen]

Mark:

FERPA also applies to directory information and the student's right to opt out of the sharing of otherwise public directory information. Learn more at Family Educational Rights and Privacy Act (FERPA)

I hope this helps,

KLM

[rniolon]

Hi

Just a follow-up point... "When you register in a patient portal in HIPAA, you sign away your HIPAA rights to the company that manages the patient portal - read the terms of agreement."

Yes and no. Yes, they have access to it all the health information about you that your provider does. No you don't have any choice about it if you intend to see the same provider. But no you do not sign away all rights. For example, you are still entitled to an accounting of all access to your records, and the company who runs the portal is bound by a Business Associate's Agreement with the provider to treat it with the same confidentiality your provider does. And... ultimately... you still have the choice to find another provider. Many people would say the choice of seeking another provider is not worth the hassle, and stay. Some would not though.

Again... HIPAA frameworks may not really be applicable here, so maybe I should not have tried changing the frame, but it helps me frame my considerations about how much effort and forethought is reasonable and how much is overkill...

[jmelson]

Preliminary caveat: IANAL, etc., etc.

I'm arriving late to this conversation, but is anyone besides me having trouble reconciling the original AACRAO post that kicked all this off with the Supreme Court's ruling in Owasso Independent School District v. Falvo? (That's the case that established peer grading does not violate FERPA.) It seems to me the logic behind the unanimous opinion should apply to the question of merging sections of online courses as well. The ruling itself was fairly narrow, but it includes a general statement toward the end that strikes me as relevant:

We doubt Congress meant to intervene in this drastic action with traditional state functions. Under the Court of Appeals' interpretation of FERPA [overturned by this ruling], the federal power would exercise minute control over specific teaching methods and instructional dynamics in classrooms throughout the country. The Congress is not likely to have mandated this result, and we do not interpret the statute to require it.

Owasso Independent School Dist. No. I-011 V. Falvo (00-1073) 534 U.S. 426 (2002)

The decision of whether to cross-list (merge) course sections in an LMS like Canvas is almost certainly a question of "specific teaching methods and instructional dynamics" -- isn't it? After all, the request to combine class sections is the direct result of an instructor's classroom management choices and, quite possibly, instructional aims. Despite everything that's been said previously, I'm having a very hard time accepting that it's perfectly fine for instructors to make choices requiring students to grade one another's homework and then announce the scores to the entire class (as Owasso v. Falvo explicitly permits), but those same instructors are prohibited from structuring their courses in ways that could, almost entirely incidentally, allow a student to identify by name a student in another class section.

It's hard to read that decision without thinking the court was sending a pretty clear message that they believed (at least in 2002) that FERPA was being wrongly used to intervene in routine instructional and local administrative decisions it was never meant to address. Obviously, they weren't ruling on the present issue of combined online course sections, and--to paraphrase the common investment refrain--past decisions do not predict future decisions. But it doesn't seem like a stretch to think the court really wouldn't be all that keen to tell instructors they couldn't have their class sections share the same online class space.

Again, IANAL, so all of the above may be worth absolutely nothing. But surely I'm not the only person thinking about the issue this way?

[ProfessorBeyrer]

Thanks  @jmelson ​ for your answer and uncovering that direct quote from the decision. Though IANAL as well, I find that those who are like it when they get help with legal research.

[mjennings]

Just an FYI, this feature request closes today and would help a lot in regards to how merged sections with groups work when you need to keep students in the same sections. Go vote!!

[gnoack]

HI all,

I've talked with our admissions staff.  They believe that we can stay compliant with FERPA by simply naming the course in Canvas without section titles.

Basically, she said that students can not view course enrollment for any other classes. Multiple sections would be included in this definition. If you want to combine all sections and not identify students as being in a particular section then that would be permissible. BIO 101 Sections A, B, C, D all listed in Canvas as BIO 101.

Thoughts?