compare and contrast the code of conduct from the public university with the student handbook of SNHU.
rmerel1
TheFamilyEducationalRightsandPrivacyActandPermissiveDisc-1.pdf
Western Michigan University ScholarWorks at WMU
Dissertations Graduate College
4-2012
The Family Educational Rights and Privacy Act and Permissive Disclosure: W hat Information are Post- Secondary Institutions Disclosing and W hy? Christine Glah Greer Western Michigan University, [email protected]
Follow this and additional works at: https://scholarworks.wmich.edu/dissertations
Part of the Educational Administration and Supervision Commons, and the Social and Philosophical Foundations of Education Commons
This Dissertation-Open Access is brought to you for free and open access by the Graduate College at ScholarWorks at WMU. It has been accepted for inclusion in Dissertations by an authorized administrator of ScholarWorks at WMU. For more information, please contact [email protected].
Recommended Citation Greer, Christine Glah, "The Family Educational Rights and Privacy Act and Permissive Disclosure: What Information are Post- Secondary Institutions Disclosing and Why?" (2012). Dissertations. 28. https://scholarworks.wmich.edu/dissertations/28
THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT AND
PERMISSIVE DISCLOSURE: WHAT INFORMATION ARE
POST-SECONDARY INSTITUTIONS DISCLOSING
AND WHY?
by
Christine Glah Greer
A Dissertation
Submitted to the
Faculty of The Graduate College
in partial fulfillment of the
requirements for the
Degree of Doctor of Philosophy
Department of Educational Leadership, Research and Technology
Advisor: Andrea Beach, Ph.D.
Western Michigan University
Kalamazoo, Michigan
April 2012
THE GRADUATE COLLEGE
WESTERN MICHIGAN UNIVERSITY
KALAMAZOO, MICHIGAN
Date February 21,2012
WE HEREBY APPROVE THE DISSERTATION SUBMITTED BY
Christine Glah Greer
ENTITLED The Family Educational Rights and Privacy Act and Permissive Disclosure:
What Information are Post-Secondary Institutions Disclosing and Why?
AS PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE
DEGREE OF Doctor of Philosophy
Educational Leadership, Research and Technology
(Department)
Educational Leadership
(Program)
APPROVED
.^yAAfir^
Dissertation Review Committee Chair
Dissertation Review Committee Member
c£^l^i^l2> IC- ^ggg JU^a^n—
Dissertation Review Committee Member
Date >Va im.
THE FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT AND
PERMISSIVE DISCLOSURE: WHAT INFORMATION ARE
POST-SECONDARY INSTITUTIONS DISCLOSING
AND WHY?
Christine Glah Greer, Ph.D.
Western Michigan University, 2012
This study focuses on the response of universities to the permissive disclosure
clauses of the Family Educational Rights and Privacy Act (FERPA). FERPA has been
amended nine times; some of these amendments permit universities to disclose personally
identifiable information without the permission of students.
The purpose of this study is to determine how prevalent disclosure is under the
permissive disclosure clauses of FERPA and if universities use the concept of risk
management to make decisions regarding disclosure. This will inform administrators of
trends in disclosure and provide data universities can use when formulating or revising
policy.
This is a relational study and utilizes quantitative methods. The chief student life
officers at 1,975 baccalaureate degree granting institutions in the United States were
emailed a web-based survey. There was a 14.3% response rate. They were asked if their
university discloses information under specific circumstances and why they choose to
disclose or not disclose.
The results show that the majority of universities have made decisions about all
but one of the permissive disclosure clauses. The exception is the disclosure of results of
disciplinary hearings concerning violent crimes to the general public. There is still a
large percentage of universities that have not made and published decisions about the
permissive disclosure clauses of FERPA as required by law. There is also a large
percentage of universities that have made decisions but have not published those
decisions.
The majority of universities always or usually disclose in safety emergencies and
health emergencies, to employees with a legitimate educational interest, hearings results
to victims of violent crimes, and alcohol and drug violations to parents. The majority of
universities only sometimes or never disclose information to parents of dependent
children and hearing results concerning violent crimes to the general public, to parents of
victims, and to parents of perpetrators. The results indicate that universities do consider
risk when making decisions regarding the permissive disclosure clauses of FERPA.
Concern for students overrides concern for the institution when making disclosure policy
decisions.
Copyright by
Christine Glah Greer
2012
ii
ACKNOWLEDGMENTS
Thank you to my advisor, Dr. Andrea Beach, who quickly read everything I sent
her, and was unerringly patient and kind and offered wonderful advice. And thanks to
the other members of my committee, Dr. Louann Bierlein Palmer and Dr. Diane
Anderson, who read and responded with great enthusiasm and very helpful suggestions.
Thank you to my cohort, who kept me laughing and motivated.
Thank you to my colleagues at Northern Michigan University, who loaned me
vacant offices in which to write; encouraged, approved and covered days off for writing;
helped me with formatting issues that drove me crazy; gave me Jimmy Cliff’s “You Can
Get It If You Really Want It;” and always thought I could do it—your support meant
more than you will ever know.
And finally, I want to thank my family. My children, Kreg, Devin, Anastasia, and
Connor, were young when I started this project and are all in college now—thank you for
understanding when I was distracted and exhausted. Thank you to my husband, Kreg,
who never questioned my decision to start this program, made me laugh when I needed it
most, but somehow never managed to read past page three without nodding off. And
thank you to my mother, Kathleen Glah, who actually did read an entire early draft and
told me it was interesting!
Yes, Connor, it is finally time to write “in conclusion.”
Christine Glah Greer
iii
TABLE OF CONTENTS
ACKNOWLEDGMENTS………………………………………………………………..ii
LIST OF TABLES…………………………………………………………………….......x
CHAPTER
1. INTRODUCTION ....................................................................................................1
Purpose of the Study ........................................................................................10
Conceptual Framework ....................................................................................11
Methods............................................................................................................13
Delimitations and Limitations..........................................................................14
Chapter 1 Summary .........................................................................................14
2. REVIEW OF THE LITERATURE ........................................................................16
The Family Educational Rights and Privacy Act ............................................16
Amendments to FERPA………………………………………………18
Prior FERPA Studies ......................................................................................25
Knowledge of FERPA………………………………………………...25
Effect of FERPA on References………………………………………26
Prior FERPA Research Relevant to this Study ...............................................27
iv
Table of Contents - continued
CHAPTER
FERPA Policies……………………………………………………….27
Legitimate Educational Interest………………………………………28
Release to Parents of Dependents .........................................................29
Parental Notification of Alcohol and Drug Violations..........................29
Prior Permissive Disclosure Research Summary ..................................31
Risk Management ...........................................................................................32
Strategies of Risk Management.............................................................34
Risk Management and Decision-Making ..............................................35
Strategic Risk Management/Enterprise Risk Management ...................36
Prior Studies on Risk Management in Education ...........................................37
How My Research Differs ..............................................................................39
Chapter 2 Summary ........................................................................................40
3. METHODOLOGY .................................................................................................42
Research Questions .........................................................................................42
Research Design..............................................................................................43
Study Participants ..................................................................................43
v
Table of Contents - continued
CHAPTER
Measures..........................................................................................................44
Data Collection and Analysis Procedures .......................................................46
Limitations of Study .......................................................................................50
Chapter 3 Summary ........................................................................................51
4. RESULTS ...............................................................................................................52
Data Considerations ........................................................................................52
Sample Description .........................................................................................53
Research Questions………………………………………………………….58
Research Question 1: To What Extent Have Universities Made
Decisions About the Permissive Disclosure Clauses of FERPA……..58
Research Question 2: To What Extent do Universities Disclose
Student Information Under the Permissive Disclosure Clauses of
FERPA?……………………………………………………………….60
Research Question 3: What Reasons do Universities Give for Either
Disclosing or Not Disclosing Information Under the Permissive
Disclosure Clauses of FERPA...............................................................62
Factors for those who disclose .....................................................64
vi
Table of Contents - continued
CHAPTER
Factors considered for each clause by those who disclose……..65
Factors for those who never disclose…………………………...68
Open-ended question about how disclosure decisions are made.72
Open-ended question regarding factors given greatest weight in
in decision-making ......................................................................74
Open-ended question regarding student development. ................76
Open-ended question regarding other factors considered. ..........78
Research Question 4: Has the Issue of Risk to the University
Played a Part in the Decisions Regarding Disclosure Under
FERPA? ................................................................................................80
Open-ended question regarding risk.. ..........................................85
Research Question 5: Does Institutional Type, Location, Size of
the Student Body, or Size of the On-campus Population Impact
Whether Universities Disclose or Do Not Disclose Under the
Permissive Disclosure Clauses of FERPA? To What Extent Do
These Factors Influence an Institution's Use of Risk Management
in the Decision to Disclose or Not Disclose .........................................88
Public or private............................................................................88
vii
Table of Contents - continued
CHAPTER
Highest degree offered.. ................................................................91
Location ........................................................................................93
Size of institution.. ........................................................................99
Full-time enrollment. ..................................................................107
Part-time enrollment.. .................................................................114
On-campus residents. ..................................................................114
Predictors? ..................................................................................120
Open-ended question for those who answered “don’t know”….120
Chapter 4 Summary of Findings ...................................................................122
Research Question 1 ...........................................................................122
Research Question 2 ...........................................................................123
Research Question 3 ...........................................................................124
Research Question 4 ...........................................................................125
Research Question 5 ...........................................................................126
5. DISCUSSION .............................................................................................……..130
Restatement of the Problem ..........................................................................130
viii
Table of Contents - continued
CHAPTER
Review of Methodology ...............................................................................131
Key Findings .................................................................................................132
Implications of the Research .........................................................................141
Discussions of the Findings Related to the Literature .......................141
FERPA policies.. .........................................................................141
Legitimate educational interest and parents of dependent
children ........................................................................................142
Parental notification of alcohol and drug violations. ...................143
Risk management.. ......................................................................145
Recommendations for Practice……………………………………...147
Limitations of the Study .....................................................................150
Recommendations for Further Research .......................................................152
Closing ..........................................................................................................155
REFERENCES ................................................................................................................157
APPENDICES………………………………………………………………………….164
A. Survey Instrument………………………………………………………………...164
ix
Table of Contents - continued
APPENDICES
B. Human Subjects Institutional Review Board Application……………………….195
C. Letter From the Human Subjects Institutional Review Board…………………...213
x
LIST OF TABLES
1. Statistical Analysis for Research Questions ...................................................................47
2. Responses by Titles of Respondents ...............................................................................54
3. Responses by Public or Private University .....................................................................55
4. Responses by Highest Degree Offered by the Institution ...............................................55
5. Responses Per Region of the United States ....................................................................56
6. Response by Size of Enrollment and On-campus Population ........................................57
7. Has Your Institution Made a Policy Decision for Each of the Following Permissive
Disclosure Clauses of FERPA? ......................................................................................59
8. Has Your Institution Made a Policy Decision for Each of the Following Permissive
Disclosure Clauses of FERPA? (combined yes, published with yes, unpublished and
compared to no) ..............................................................................................................60
9. The Extent to Which Universities Disclose Student Information Under the Permissive
Disclosure Clauses of FERPA ........................................................................................62
10. The Extent to Which the Following Factors are Considered When Making Policy
Decisions About FERPA ...............................................................................................63
11. The Extent to Which the Following Factors are Considered When Making Policy
Decisions About FERPA; Means and Standard Deviations ..........................................64
12. The Extent to Which Factors are Considered by Universities that Make Policy
Decisions to Disclose Under Each Permissive Disclosure Clause of FERPA ...............67
13. The Extent to Which Factors are Considered by Universities that Make Policy
Decisions to Not Disclose Under Each Permissive Disclosure Clause Of FERPA
(N=294) ..........................................................................................................................71
14. Responses to Open-ended Question Regarding the Process Used to Make Decisions
About Disclosure Under FERPA ...................................................................................74
xi
List of Tables – continued
15. Responses to Open-ended Question Regarding Factors Given the Greatest Weight
When Making Decisions About Disclosure ...................................................................76
16. Responses to Open-ended Question Regarding the Extent Student Development
Considerations Play a Role in Decisions About Disclosure ..........................................78
17. Responses to Open-ended Question Regarding Other Factors that Play a Role in
Decisions About Disclosure ...........................................................................................80
18. The Extent to Which the Following Risk Factors are Considered When Making
Policy Decisions About Disclosure ...............................................................................81
19. The Extent to Which Legal Risk is Considered When Universities Make Policy
Decisions to Disclose Under the Permissive Disclosure Clauses of FERPA ................84
20. The Extent to Which Legal Risk is Considered When Universities Make Policy
Decisions Not to Disclose Under the Permissive Disclosure Clauses of FERPA .........85
21. Responses to Open-ended Question Concerning Consideration of Risk Management
in Decisions to Disclose or Not Disclose (N=80) ..........................................................87
22. Significant Differences Regarding the Extent Factors are Considered by Public and
Private Institutions When Making Policy Decisions about FERPA ..............................89
23. Significant Differences Regarding Whether Public and Private Universities Disclose
or Do Not Disclose the Results of Hearings to Parents of Victims and Parents of
Perpetrators? ..................................................................................................................90
24. Significant Differences Regarding Whether Institutions Have Made a Policy
Decision to Disclose Alcohol and Drug Violations to Parents (Highest Degree
Offered) ..........................................................................................................................92
25. Significant Differences Regarding the Extent to Which the Importance of Student
Privacy Rights is Considered When Making Policy Decisions about FERPA
(Highest Degree Offered) ..............................................................................................93
26. Significant Differences Regarding the Extent to Which These Factors are
Considered When Making Policy Decisions about FERPA (Location) ........................97
xii
List of Tables – continued
27. Significant Differences Regarding Whether Institutions Do or Do Not Disclose the
Results of Hearings to Victims of Violent Crimes (Location) ......................................99
28. Significant Differences Regarding Whether the Institution Has Made Policy
Decisions About Disclosure (Size of Institution) .........................................................101
29. Size of Institution Influences Whether Policy Decisions are Made Under These
Clauses ..........................................................................................................................102
30. Significant Differences Regarding Whether Institutions Do or Do Not Disclose
Under The Permissive Disclosure Clauses (Size of Institution) ...................................105
31. Size of Institution Influences Whether Universities Disclose Under These Clauses ...107
32. Significant Differences Regarding Whether the Institution Has Made Policy
Decisions about Disclosure (Full-time Enrollment) .....................................................109
33. Number of Full-time Students Influences Whether Policy Decisions are Made
Under These Clauses.....................................................................................................110
34. Significant Differences Regarding Whether Institutions Do or Do Not Disclose
Under the Permissive Disclosure Clauses (Full-time Enrollment) ...............................112
35. Number of Full-time Students Influences Whether Universities Disclose Under
These Clauses................................................................................................................113
36. Significant Differences Regarding Whether Institutions Have Made Policy
Decisions About Disclosure (On-campus Residents) ...................................................115
37. Size of On-campus Population Influences Whether Policy Decisions are Made
Under These Clauses.....................................................................................................116
38. Significant Differences Regarding the Extent to Which Minimization of Risk to the
Institution is Considered When Making Policy Decisions About FERPA
(On-campus Residents) .................................................................................................117
39. Significant Differences Regarding Whether Institutions Do or Do Not Disclose
Under the Permissive Disclosure Clauses (On-campus Residents) ..............................119
xiii
List of Tables – continued
40. Size of On-Campus Population Influences Whether Universities Disclose Under
These Clauses................................................................................................................120
41. Responses to Open-ended Question Concerning Why Respondents Answered
“Don’t Know” to Any Question in the Survey .............................................................121
42. Key Findings That Are the Most Interesting and the Most Relevant to Current
Practice Regarding FERPA...........................................................................................140
43. Comparison of Greer Research with Previous Research Involving Disclosure Under
FERPA and Risk Management .....................................................................................146
1
CHAPTER 1: INTRODUCTION
The Family Educational Rights and Privacy Act (FERPA) was enacted by the
federal government in 1974. It is a regulation designed to protect the privacy of
educational records. It gives parents of K-12 students specific rights concerning their
child’s records, whereby they can access their child’s educational records, seek to have
the records amended, and request that directory information not be released to the public.
These rights transfer to the student when he or she enrolls in a school beyond high
school. This effectively means that parents are not granted access to any educational
records of their child once he or she is enrolled in college, unless the student grants them
access or the institution chooses to do so under one of the permissive disclosure clauses.
Institutions of higher education that receive any form of federal funding must follow the
stipulations of FERPA. All public institutions and any private institutions that use federal
money for grant programs, research, or financial aid are required to abide by FERPA.
Colleges and universities that strictly adhered to the new law upon its passage in
1974 were put into the very uncomfortable position of not being able to disclose any
student information to parents. Yet it was not the intention of James Buckley, the framer
of the act, to keep the parents of college students from obtaining information about their
children (Weeks, 2001). Senator Buckley introduced the legislation that bears his name
directly on the Senate floor in 1974. It was offered as an amendment to other legislation
being considered at the time. This means that the legislation never went through
committee proceedings. There were, therefore, no opportunities for interested parties to
express their concerns about the content of the amendment (Weeks, 2001).
When the Act was passed, there was a flurry of complaints from students, parents,
2
and higher education administrators. Within one month of the passage of FERPA,
Buckley responded to the concerns of his constituents by introducing amendments to the
act. These were made retroactive to the date the act became effective and permitted
disclosure to parents of dependent children and disclosure of health and safety
information (Weeks, 2001). “Too many colleges hide behind the Buckley Amendment to
escape responsibility to parents. Professors and others will state they cannot provide
information to parents. That is not true, however, if the student is a dependent and the
college agrees to permit such disclosure” (Weeks, 1985, p. 24). Buckley discussed
addressing two fundamental questions when deciding how to implement FERPA:
First, what is an appropriate policy for the college in regard to disclosure of
student records to parents, and what rationale supports the policy? And second,
what are the costs and benefits of disclosure to parents if, in the professional
judgment of the administrator, the disclosure relates to the health and welfare of
the student? (Weeks, 2001, p. 49)
While it is now clear that colleges may, under certain circumstances, give information to
parents, it is unclear how many colleges do so. Also unclear are the reasons why colleges
choose to disclose or choose not to disclose.
FERPA has subsequently been revised nine times since it was signed into law.
Some of these revisions included permissive disclosure clauses which made it possible to
disclose more information from students’ records to parents and the general public.
Permissive disclosure means that, in certain situations and under certain guidelines,
information may be released without the student’s permission. Post-secondary
institutions are given the power to make decisions about permissive disclosure, and their
3
administrators may make the decisions as to how much information to disclose and to
whom they will disclose (Gehring, 1994). “Campus offices may respond to parents’
inquiries in different ways based on their particular philosophy or their interpretation of
the Buckley Amendment requirements” (Weeks, 2001, p. 42). This creates
inconsistencies among institutions and sometimes within the same institution (Daniel,
Evans, & Scott, 2001).
Administrators at universities receive questions that involve FERPA regulations
almost daily and compliance with FERPA is a constant concern. It is considered by
many to be the major legal issue that university administrators face (Lowery, 2005).
Being found in violation of FERPA could result in the loss of all federal funding for the
university. While this explains why universities are so concerned about FERPA, in
actuality no complaints filed against universities with the Department of Education have
resulted in withdrawal of funds (American Association of Collegiate Registrars and
Admissions Officers [AACRAO], 2010).
Many of the revisions to the act over time have made it possible to disclose more
information from students’ records. These amendments allow universities to disclose
information to the following groups without the written consent of the student:
1. officials within the institution who have a legitimate educational interest;
2. organizations conducting studies for educational agencies;
3. accrediting organizations for use in accrediting functions;
4. parents of dependent students as defined in the Internal Revenue Code;
5. persons in an emergency situation, if the knowledge is necessary to protect
students or other persons;
4
6. victims of a violent crime, the results of pertinent disciplinary hearings;
7. the general public, results of disciplinary hearings for a crime of violence,
if the student is found responsible for the offense;
8. parents of a student under the age of 21, accused of violating alcohol or
drug policies; and
9. the university community, information concerning registered sex offenders
(Department of Education, Legislative History, paragraph 20).
Universities are not required to give out information in these situations; however,
they are permitted to do so. The university is permitted to make the decisions regarding
these issues. “The institution must, however, by law, have a written policy that spells out
these discretionary decisions and several other items and that must be available upon
request (Gehring, 1994, p. 70).
When the 1998 Higher Education Act that included the FERPA amendment
concerning alcohol and drug violations was passed, many universities were quick to
change their policies concerning parental notification (Hall, 2003; Palmer, Lohman,
Gehring, Carlson, & Garrett, 2001). Research conducted by Watts (2003) and Henning
(2004) uncovered the reasons that universities moved in this direction. Henning
concluded that universities adopted parental notification because of a perceived problem
with alcohol abuse on campus and the belief that a parental notification policy would help
with this problem. Watts concluded that the main reason for universities to adopt a
parental notification policy was the change in FERPA itself and the intention to impact
alcohol consumption on campus. Lowery, Palmer and Gehring (2005) also researched
why universities either had or did not have a policy to notify parents of alcohol or drug
5
violations. Of the 110 universities in their study that did not have policies of parental
notification, 11% stated that state law prohibits them from notifying parents; 27% said
that there was no need for a policy because of the nature of the student body (commuters
and nontraditional students); and 16% said that such a policy is in contradiction to student
development theory. Of the 160 universities with a parental notification policy, 44% said
that they notify parents because the university is concerned about alcohol abuse; 19%
stated they have a policy because of the 1998 FERPA amendment; 18% cited the 1998
amendment and parental concerns as reasons for their policy (Lowery, Palmer, &
Gehring, 2005).
While this research is helpful in understanding the use of parental notification
policies for alcohol and drug violations, there is no comparable research available for the
other permissive disclosure sections of FERPA. Disclosure in health and safety
emergencies has become a topic of debate on university campuses. Parents of students
who exhibit self-destructive behavior, either threats or actions, are often not notified by
the university. While there is no court-imposed mandate to notify parents in these
situations, knowledge of such behavior may make the university liable for damages
(Baker, 2005). Tribbensee states, “Courts are moving toward imposing a duty on
colleges and universities to share information with parents and families, if that
information might prevent a suicide” (as cited in Lowery, 2005, p. 49). There may also
be a liability issue if the university knows that a crime of violence occurred on campus
but does not notify the public of the outcome of a disciplinary hearing in which a student
was found responsible for the violent act (Lowery, 2005).
This makes it very important for universities to undertake periodic FERPA policy
6
reviews. Each permissive disclosure section should be addressed and a decision made.
Universities need to be clear about what they do and why they do it. As universities
consider policy development or reviews, it would be helpful for administrators to know
how other universities handle the permissive disclosure sections of FERPA. Decisions to
revise could then be made in light of prevailing practices. Sayer (2005) researched
FERPA policies at colleges and universities in Nebraska and reported that administrators
told her that “next to professional organizations, ‘colleagues’ was the next resource most
utilized for FERPA guidance and information” (p. 95). She goes on to state that the study
“participants’ most common use of ‘colleagues’ was in the area of policy and procedure
development, which involved seeing what other campuses were doing before taking
action on their own campus or seeking guidance on particular situations they were
facing” (p. 95).
Another factor that should be considered as policies are reviewed is the change in
the populations that universities serve. Parents of present day university students are very
involved in their children’s university careers. They are also better educated than
parents of prior generations (Daniel, Evans, & Scott, 2001). Sells (2002) states,
A growing consumer orientation is fueled by the rising costs of higher education.
Through an explosion of college guides and Web sites, parents of today have
become privy to much more information about their students' college experience.
They have a growing awareness of the potential for their students to experience
problems with everything from credit card debt to substance abuse to suicide.
Instantaneous reporting of campus tragedies alerts parents to crises happening on
campuses throughout the country, raising their concerns that similar events could
7
happen elsewhere, even to their sons or daughters. Together, these factors
position parents to challenge policies and practices that do not meet their
expectations. (p. 30)
Parents are now requesting access to increasing amounts and varieties of
information. Universities are reporting that students want, and expect, their parents to be
very involved in their lives while they are in college. What students in the 1970s and
1980s would have considered intrusive and controlling, today’s students see as natural
and supportive (O’Brient, 2003). According to O’Brient, many students do not make a
decision without calling home on their cell phone, and give their parents their university
personal identification number so their parents can take care of things like registering for
classes and checking grades. Parents are questioning the legitimacy of universities
keeping information from them because of FERPA. Frank LoMonte, executive director
of Student Press Law Center states,
To the extent that the department (of education) has heard from parents or
members of the public at all (about FERPA) it has been from people who feel
aggrieved about inadequate privacy. It’s from people who feel their privacy had
been compromised, and that has impacted the direction the department has chosen
to take. Now what we’re seeing is ordinary citizens and parents suffering
wrongful denials of their legitimate requests based on FERPA. Once you have
parents being aggrieved, that’s what changes the debate. (as cited in Stripling,
2009, p. 3)
After the April 2007 shootings at the Virginia Polytechnic Institute and State
University (Virginia Tech), many universities looked at their own policies and procedures
8
in an effort to determine if they were doing all they could to keep an event like that from
occurring on their campuses. The Midwestern Higher Education Compact (MHEC)
conducted a survey in 2008 to assess how universities had responded to the incident at
Virginia Tech. An online survey was sent to chief student life officers and directors of
campus security at all institutions included in the Higher Education Directory. There
were 331 responses. The part of the MHEC report which pertains to FERPA states,
56% of respondents indicated that their college or university had reviewed its
responsibilities and obligations under FERPA in response to the events at Virginia
Tech.... In one quarter of cases the FERPA review brought about changes in
policies or procedures related to communication of student information, either
internally (e.g., among campus offices) or externally (such as with
parents/guardians or law enforcement agencies. (p. 13)
Decisions not to disclose have generally been based on the philosophy that
universities are in the business of educating and part of that mission is teaching students
how to be responsible for themselves (Palmer, et al., 2001). Universities want the
students to make the decisions about disclosure of their own information. This
philosophical stance should lead to consistency in permissive disclosure policies within a
university. However, many universities that inform parents of alcohol and drug
violations would not consider disclosing grades to parents of dependent children. A
study conducted by the National Center on Addiction and Substance Abuse at Columbia
University "found that in 2001 there were more than 1,700 deaths from unintentional
alcohol-related injuries among college students, up 6% since 1998. Also in 2001, 97,000
students were victims of alcohol-related date rape or sexual assault, and almost 700,000
9
students were assaulted by a student who had been binge drinking" (Bernstein, 2007).
Administrators can easily see how not informing parents of an alcohol problem could
lead to a lawsuit, especially if the student is eventually injured or dies. It is more difficult
to imagine being sued because a parent does not know a student’s grades. In addition, as
resources continue to shrink, decisions may be made based on what is easiest and
cheapest, and takes the least amount of staff time. In 1994, it was estimated that the cost
of staying in compliance with FERPA was between 1 and 4 percent of a university’s
operating budget (Gehring, 1994).
A study conducted in 1995 found that student affairs professionals were giving
more consideration to legal issues when making decisions in their work than they had in
the past (Cooper & Lancaster, 1995). "Increasingly, we find our professional lives in a
struggle to define the proper balance between accountability to legal policies and our
professional belief in developmental/ethical issues. There is a perceived danger that we
will address our relationship with students by resorting to the relative safety of
proceduralism and legalities" (p. 7). The researchers attempted to ascertain if the student
affairs practitioners made decisions with risk management, liability reduction, and
adherence to policy in mind (“legal/rational” response) or if they made decisions with
concern for the affective outcomes for the students (“traditional/developmental”
response). The results indicate that there was an increase in consideration of both legal
and developmental considerations in decision-making, but the increase in legal
consideration was greater. This may be because, "Practically speaking, the days of wide
college immunity are gone (if they ever truly existed). Courts are increasingly willing to
apply traditional tort law notions of duty to the university" (Bickel & Lake, 1997, p. 755).
10
Learning what universities do when given the option to disclose and the rationale
for their decisions regarding the disclosure policies would be invaluable to a university
undertaking a review of their own permissive disclosure policies. A review of what other
universities are doing and why would be helpful in policy development.
Purpose of the Study
The purpose of this study is to determine the extent to which colleges and
universities disclose student information without student consent, as allowed under the
permissive disclosure clauses of FERPA. This study attempted to ascertain how many
institutions in the sample disclose information under each of the permissive disclosure
situations. It also tried to determine why universities have chosen to disclose or not
disclose, and if the concept of risk management plays a part in the decisions. For the
purpose of this study, both colleges and universities are referred to as “universities.”
The research questions guiding this study are:
1. To what extent have universities made decisions about the permissive
disclosure clauses of FERPA?
2. To what extent do universities disclose student information under the
permissive disclosure clauses of FERPA?
3. What reasons do universities give for either disclosing or not disclosing
information under the permissive disclosure clauses of FERPA?
4. Has the issue of risk to the university played a part in the decisions about the
permissive disclosure clauses of FERPA?
5. Does institutional type, location, size of the student body, or size of the on-
campus population relate to whether universities disclose or do not disclose
11
under the permissive disclosure clauses of FERPA? To what extent do these
factors influence a university's use of risk management in the decision to
disclose or not disclose?
Conceptual Framework
FERPA requires universities to make decisions about each permissive disclosure
clause, and to publish such decisions. As this is done, each university must take many
things into consideration, including many “risk” factors. Noncompliance with FERPA
may result in what The National Association of College and Business Officers
(NACUBO) calls compliance risk because it deals with regulations and laws (Cassidy et
al., 2000). It may also result in financial and reputational risks if a university is found,
for example, to have withheld information that may have saved a life in a health or safety
emergency situation. The management of these risks is becoming increasingly important
in higher education.
While many authors state that risk management should not just be concerned with
avoiding litigation (Hoye, 2006; Lake, 2005; Shackelford, 2007), the reality is that legal
implications of decisions are being considered more and more by universities (Cooper &
Lancaster, 1995). Parents are more involved in the college educations of their children
and they expect to be given information that may be restricted by FERPA. The
permissive disclosure clauses have always allowed universities to give parents
information under certain conditions, but universities have hesitated to do so because of
FERPA compliance issues. The Higher Education Opportunity Act of 2008 has eased the
fears of universities in some respects. This act clarified that, in a safety situation, a
university that discloses information within the FERPA guidelines will not be held liable
12
(Department of Education, 2008, p. 336). This has caused the concern to change from
wondering what the risk is if a disclosure should be made, to wondering what the risk is if
a disclosure is not made.
My study was conducted using the lens of risk management because decisions
regarding the permissive disclosure clauses of FERPA should consider the risk involved.
Every university is required to make decisions about the permissive disclosure clauses of
FERPA. They must decide if they will disclose or not disclose in each area in which they
are given discretion. Universities must take the possible outcomes of these decisions into
account. There are many factors to be considered. Risk management may prove to be
helpful in making these decisions.
University administrators are being urged to consider risk management concepts
when making decisions about educational issues (Hoye, 2006; Lake, 2005; Shackelford,
2007; Sokolow, n.d.; Ward & Tribbensee, 2003). Hoye sees risk management efforts as
proactive. He states that it is important to
identify, assess and mitigate unnecessary risk on our own campuses, in order to
help better protect our students, faculty, staff, alumni and guests. If recent history
is any guide, the courts are likely to continue to have increasingly higher
expectations of colleges and universities in areas such as the protection of
students, faculty, staff and guests from foreseeable harm by third parties.... The
best institutional tool against litigation is improved risk assessment and pro-active
management of risk on campus. (p. 37)
Ward and Tribbensee (2003) also note the importance of risk management strategies
being put into effect proactively in order to "manage the risks associated with important
13
campus functions" (p. 18).
The University Risk Management and Insurance Association (URMIA) states that
risk management should be part of the decision-making process in higher education.
“Thus it is not a distinct product, but rather it seeks to enhance judgment and decision-
making throughout the organization, in such a way as to beg the question ‘have you
thought of…?’ when making decisions about any aspect of the enterprise…” (URMIA,
2007, p. 18). The report goes on to state that risk assessment should be done before any
decisions are made.
Methods
This is a relational study and utilized quantitative methods. Anastas (1999)
defines relational research as research “designed to describe regularities or patterns in
how a predefined phenomenon relates to other predefined phenomena” (p. 148). In this
study the phenomenon of disclosure under the permissive disclosure clauses of FERPA
was looked at in relation to type of institution and use of risk management strategies.
The chief student life officers at 1,975 post-secondary, baccalaureate degree granting,
institutions in the United States were invited to complete an author-created web-based
survey. They were asked if their university discloses information under specific
circumstances and why they choose to disclose or not disclose. The data shows how
many universities in the sample disclose, what types of universities disclose, and why
they do or do not disclose. The data were analyzed to determine who discloses under the
permissive disclosure clauses of FERPA and what factors influence their decisions.
Statistical analyses were used to determine if different types of universities handle
permissive disclosure differently.
14
Delimitations and Limitations
Generalizations from this study are limited to chief student life officers at
baccalaureate degree granting universities in the United States who have email addresses
listed in the Digital Higher Education Directory.
One limitation is as FERPA is a legal issue, administrators may not be inclined to
tell the truth if they know, or think they know, they are in violation of FERPA. Likewise,
they may know the law and answer as they think they should, rather than based on their
university’s policy. It is hoped that the guarantee of anonymity has minimized this
limitation.
Another limitation of the study is that the individuals answering the survey may
not have been at the university when decisions were made or been involved in making the
decisions regarding the permissive disclosure clauses of FERPA. They may not know,
therefore, why the decisions were made.
Chapter 1 Summary
The Family Educational Rights and Privacy Act (FERPA) was passed in 1974 as
a way to protect the privacy of educational records. It has been revised nine times since it
was passed. These revisions have given universities permission to disclose personally
identifiable information in certain situations without the permission of the student.
Universities can make their own decisions about these permissive disclosure clauses. The
purpose of this study is to determine the extent to which universities disclose when given
the option and why these decisions were reached. The study used the lens of risk
management practices in higher education to frame the research. The results of this
research will be useful to universities that are reviewing or developing FERPA policies as
15
it will provide information on prevailing practices in higher education.
The following chapter is a review of the literature on FERPA and permissive
disclosure. The history of FERPA will be presented and the amendments to FERPA
delineated. The permissive disclosure clauses of FERPA will be explained in detail.
Prior research studies on FERPA and risk management will be presented.
16
CHAPTER 2: REVIEW OF THE LITERATURE
This study focused on the response of universities to the permissive disclosure
clauses of the Family Educational Rights and Privacy Act (FERPA). The purpose of this
study is to determine how prevalent disclosure is under the permissive disclosure clauses
of FERPA. This will inform administrators of trends in disclosure and provide data
universities can use when formulating or revising policy. This literature review chapter
focuses on an explanation of FERPA, prior research concerning FERPA, especially
research concerning the permissive disclosure clauses, and research concerning risk
management and decision making in higher education.
The Family Educational Rights and Privacy Act
Senator William Buckley of New York asked his staff to investigate the issue of
privacy and student records after he read an article in Parade Magazine (Schuerman,
1980) entitled “How Secret Records Can Haunt Your Child.” Buckley introduced his
legislation and it was passed by a voice vote as an amendment to the Elementary and
Secondary Education Aid Bill in May 1974. It was a modest beginning for a piece of
legislation that would have a huge effect on institutions of higher education.
The Family Educational Rights and Privacy Act (FERPA), also known as the
Buckley Amendment, is a regulation designed to protect the privacy of educational
records. It is codified as 20 U.S.C. § 1232g and went into effect on November 19, 1974.
It gives parents of K-12 students specific rights concerning their child’s records, and
gives university students specific rights concerning their own records. Educational
institutions must protect three primary rights: the right to access educational records, the
right to seek to have the records amended, and the right to control the release of
17
personally identifiable records. In addition, universities must notify students of their
rights under FERPA, guarantee that third parties who receive information do not
redisclose it, and keep records of requests for records and disclosure of student records.
Universities may disclose “directory information” without the written consent of
students, including name, local and permanent addresses, email address, telephone
number, date and place of birth, major field of study, photograph, degrees and awards
received, dates of attendance, grade level, participation in officially recognized activities
and sports, weight and height of members of athletic teams, and the most recent previous
educational agency or institution attended (Weeks, 2003). Students must be informed of
what a university considers “directory information” and they must be given a reasonable
amount of time at the beginning of each academic year to decline release of this
information without their consent (U.S. Dept. of Education, Legislative History, 2010).
Universities must follow the regulations of FERPA and they must communicate
their policies concerning it to students on a yearly basis. “Schools must notify parents
and eligible students annually of their rights under FERPA. The actual means of
notification (special letter, inclusion in a PTA bulletin, student handbook, or newspaper
article) is left to the discretion of each school” (U.S. Dept. of Education, FERPA, 2010,
paragraph 3). In addition, they have some discretionary power in certain areas, but their
decisions regarding these areas must also be communicated (Ramirez, 2004).
FERPA only applies to educational records. “An educational record is any
material that contains information directly related to a student and is maintained by an
educational agency or institution or someone acting on its behalf” (Weeks, 2003, p. 104).
It must be recorded in some way. Other than directory information, a university may not
18
give out information that can personally identify a student. Written notes that are for
personal use and are not kept in official files or shared with anyone, and oral
communication, are not considered educational records.
Individuals who feel that their rights under FERPA have been violated can file a
complaint with the Family Policy Compliance Office (FPCO) of the Department of
Education. The complaint will be investigated and the parties will be notified of the
findings. Hearings are not conducted. If it is determined that a violation has occurred,
the university is given notice of what needs to be changed in order to be in compliance.
If the changes are not made or there is a pattern of continued violations, the Department
of Education can begin proceedings to cease all federal funding of that university. This
has never occurred (Daggett & Huefner, 2001).
Amendments to FERPA
Amendments to FERPA occurred in 1974, 1979, 1979, 1990, 1992, 1994, 1998,
2000, and 2001 (Ramirez, 2004). Many of these changes are considered permissive
disclosure clauses. Permissive disclosure means that, in certain situations and under
certain guidelines, information may be released without the student’s permission.
Universities are given the power to make decisions about permissive disclosure. They, of
course, must abide by any state laws concerning disclosure. Beyond this, universities
may make the decisions as to how much information to disclose and to whom they will
disclose (Gehring, 1994). Each amendment is briefly reviewed in the following
paragraphs.
Public Law 93-568, the Buckley/Pell Amendment, was the first amendment to
FERPA. It was passed on December 31, 1974 and was retroactive to the date of the
19
passage of FERPA. Senators Buckley and Pell reacted to public outcry from parents and
this amendment allows universities to release information to parents of dependent
children without the permission of the students, with dependency determined by the
Internal Revenue Service. Thus, the parent’s income tax return may be used as proof of
dependency and universities may give eligible parents information about their students,
i.e., grades, bills, conduct issues. Universities do not widely use this “loophole” to
inform parents, and many universities do not tell parents that this is even an option
(Weeks, 2001).
Also included in the 1974 amendment is the option to release certain health and
safety information to persons the university considers have a need to know. Weeks
(2001) notes “the college must consider such factors as the seriousness of the health or
safety threat, the need for the information to meet the emergency, whether the person to
whom the information is released is able to treat the emergency, and the extent to which
time is crucial” (p. 46). Parents are certainly considered in this disclosure, but others who
may need to know could include roommates, significant others, entire residence halls in
the case of contagious disease, and public health officials. One problem with this
amendment is that “emergency” is not clearly defined (Baker, 2005).
One type of health and safety emergency that is increasingly dealt with by
university administrators is attempted suicide. There have been five recent, high-profile
court cases in which parents sued universities over their response to threats of suicide
(Baker, 2005). In each case, parents of students who killed themselves sued the
institutions for not informing them of suicidal risk. Although none of the universities
were held responsible, there is currently much debate about whether parental notification
20
of suicidal risk will help students. One author states that “administrators would certainly
benefit from family-based research on the types of self-destructive behavior that warrant
emergency notification, (and) the impact of parental notice on the students…” (Baker,
2005, p. 529).
Public Law 96-46, Amendments to Education Amendments of 1978, was passed
on August 6, 1979. This amendment allowed state auditors access to education records to
audit and evaluate state or federally supported education programs. It also permitted
disclosure of information to employees of the university with a legitimate educational
interest, and disclosure of student information to accrediting agencies and organizations
conducting research for educational agencies.
Public Law 96-88, Establishment of Department of Education, was passed on
October 17, 1979. This act declared that the Department of Education is responsible for
the enforcement of FERPA.
The next several amendments to FERPA address student disciplinary and
behavioral issues. Public Law 101-542, Campus Security Act, also known as the Clery
Act, was passed on November 8, 1990. Universities are required to publish their crime
statistics every year and to inform students and employees of their security policies.
They are also required to provide warnings to students and employees when there is a
threat of crime. The permissive disclosure part of the Campus Security Act of 1990
allows universities to tell the victim of a violent crime the results of the disciplinary case
against the accused student. This can be done regardless of the outcome of the
disciplinary proceeding (Weeks, 2001). This means that a university may tell a victim if
the student accepts responsibility, or is found responsible or not responsible by a judicial
21
board, and the nature of any penalty imposed. The violent crimes on the list are arson,
assault offenses, burglary, criminal homicide, destruction/damage/vandalism of property,
kidnapping/abduction, robbery, and forcible sex offenses (DOE, 34 CFR 99.39).
Public Law 102-324, Higher Education Amendments of 1992, was passed on July
23, 1992. Also known as the Ramstad Act, this amendment requires universities to
adhere to a bill of rights for sexual assault victims. This includes the following five
provisions:
The accuser and the accused are entitled to have other individuals present
at a campus disciplinary proceeding.
The accuser and the accused shall be informed of the outcome of any
disciplinary proceeding.
The victim shall be informed of the options to notify law enforcement,
including on-campus and local police, and of the option to be assisted by
campus authorities in notifying such authorities.
The students shall be advised about available on- and off-campus
counseling services, mental health services, and other student services for
victims of sex offenses.
The students shall be notified about options for changing academic and
living situations, if reasonably available. (Ramirez, 2004, p. 21)
This amendment also stipulated that records maintained by a university police department
are not education records and may be released without the consent of the students named
in the records.
Public Law 103-382, Improving America’s Schools Act, was passed on October
22
20, 1994. This act permitted subpoenas to be used to access education records. It
required universities to notify students of their rights under FERPA by an annual
notification of rights. It also permitted universities to include disciplinary records in
education records if a student’s conduct is a risk to the community.
Public Law 105-244, Higher Education Amendments of 1998, was passed on
October 7, 1998. This amendment added “nonforcible sex offenses” (statutory rape and
incest) to the list of violent crimes that are permitted to be disclosed under the Foley
Amendment. The Foley Amendment, which is part of the 1998 amendments, permits the
disclosure of the final results of disciplinary proceeding against a student accused of a
violent crime to the general public, if the student is found responsible for the crime and
the offense is a violation of the university’s rules. Parents of both the victim and the
perpetrator may also be informed of the final results. University police departments are
also required to post daily crime logs and crime statistics.
The Warner Amendment was also part of the 1998 amendments. This
amendment permits universities to inform a parent or legal guardian if a student violates
any law or university policy governing the possession or use of alcohol or controlled
substances. The student must be under 21 years of age and the university must have
determined that the student violated a university policy. When Senator John Warner of
Virginia introduced the legislation, he stated: “There is a presumption of dependency by
colleges and universities for all students who are under the age of 21 for the purposes of
this notification to parents. This would ensure that parents are informed when their sons
and daughters had the misfortune of violating state alcohol law or drug laws” (Weeks,
2001, p. 48). Burd (2000) notes that universities may contact parents about their children
23
drinking or using illegal drugs without a disciplinary hearing being conducted. The
timing of the notification is up to the university.
When the Warner Amendment was passed, universities were faced with a big
decision. The University of Delaware was one of the first universities to institute a
parental notification policy. They reported a huge drop in repeat offenders during the
first year of notification. “More than half of the 600 first-time offenders of alcohol
policies in 1996-97 were caught a second time. But in 1997-98, the first year of the
notification policy, fewer than a quarter of the 630 students cited for alcohol violations
were caught again” (Reisberg, 1998, p. A39). While this seemed to be good news for
administrators, they were concerned about whether having the ability to inform parents
increased the legal risks for them. “For example, if a college decided not to tell parents
about a student’s alcohol violations, and the student was later killed or injured in an
alcohol related incident, would the college face a greater liability if the parents sued?”
(Reisberg, p. A39)
Public Law 106-386, Campus Sex Crime Prevention Act, was passed on October
28, 2000. This amendment permits campus security departments to notify the university
community of registered sex offenders on campus.
Public Law 107-56, USA PATRIOT (Uniting and Strengthening America by
Providing Appropriate Tools Required to Intercept and Obstruct Terrorism) Act of 2001,
was passed on October 26, 2001. This amendment was a reaction to the events of
September 11, 2001 and increased the government’s power to order the disclosure of
information regarding students. It also provides immunity to the university regarding the
release of information to the government.
24
The E-Sign Rule was enacted on April 21, 2004. This rule permits universities to
accept the required signed and dated written consent needed for release of information in
electronic format.
Public Law 110 - 315, the Higher Education Opportunity Act of 2008, did not
amend FERPA but rather provided guidance concerning disclosures for safety reasons. It
is specifically concerned with notification to a third party when a student is considered to
be a risk to self or others. The act clarified that "an institution of higher education that, in
good faith, discloses education records or other information in accordance with the
requirements of this Act and (FERPA) shall not be liable to any person for that
disclosure" (Department of Education, HEOA, p. 336).
Many of these amendments include permissive disclosure clauses, which permit,
but do not require, universities to disclose information without student permission in
certain situations. It is clear that while FERPA does allow disclosure of personally
identifiable information under specific circumstances without student approval,
universities are not required to do so. Yet many universities have not developed clear
policies concerning the permissive disclosure allowances of FERPA. As stated
previously, learning what universities do in these situations and the rationale for their
decisions regarding the policies would be invaluable to a university undertaking a review
of their own permissive disclosure policies. My research therefore asks what universities
are disclosing under the FERPA guidelines and why they decided to disclose or not
disclose.
25
Prior FERPA Studies
There have been many research studies written concerning various aspects of
FERPA. Some focused on knowledge of FERPA by students, faculty, and administrators
and the effect of FERPA on references, and are described in this section. Studies more
directly relating to the permissive disclosure clauses of FERPA will then be presented.
Knowledge of FERPA
Dominici (1979) researched the effect of FERPA on student privacy rights at
community colleges in California. She found that few students understood their privacy
rights under FERPA but that community colleges were following the FERPA guidelines.
Dobbins (1987) studied how knowledgeable administrators and students at Kent
State University were about FERPA. He concluded that administrators were more
knowledgeable about FERPA than were students, and that non-academic administrators
were more knowledgeable than academic administrators. Students and administrators all
agreed the privacy of student records was important.
Clay (2001) undertook a study to determine the level of understanding of FERPA
by students, faculty and staff at St. Petersburg College, a community college with a full-
time enrollment of 18,000 students. He found that while students placed more
importance on the privacy of student records than did faculty or administrators, students
did not understand FERPA as well as administrators. Administrators had the most
correct answers regarding FERPA, followed by faculty and then students, yet the average
of correct answers for administrators was only 58%. Clay concluded that "from its
inception in 1974 to the present, the Buckley Amendment has not been well understood
by those who it impacts and those who apply it on a regular basis. While nearly everyone
26
agrees that safeguarding student information is important, a sufficient effort to train and
educate those who need to understand privacy law the most has not been undertaken” (p.
91).
Maycunich (2002) studied faculty understanding of FERPA at three land-grant
universities. She learned that faculty violate FERPA frequently and recommended
training for all faculty and administrators.
Turnage (2007) researched whether FERPA training impacted the level of
knowledge of faculty and staff members at the University of Southern Mississippi.
Turnage found that completion of an on-line tutorial increased the level of knowledge
regarding FERPA as measured by pre- and post-tests.
Jones (2004) looked at whether administrators at Southeast Missouri State
University use discretion when implementing FERPA policy. He concluded that FERPA
was not widely understood and that using individual discretion in making decisions
regarding FERPA could have negative consequences for the university.
Hall (2003) examined the knowledge and perceptions of students concerning the
Clemson University parental notification policy for drug and alcohol violations. He
surveyed 183 currently enrolled students and found that students did not want the
university to notify parents of alcohol and drug offences.
Effect of FERPA on References
Calihan (1983) researched how FERPA affected students' rights to review their
own reference letters at seven universities. He found that while faculty and students
supported the students' right to see their reference letters, students were concerned that
the credibility of the letters would be diminished if they reviewed them.
27
Holder (1990) studied the effect of FERPA on admissions applications. He found
that the usefulness of subjective comments on college applications from high school
personnel decreased after the passage of FERPA, but that subjective comments on
graduate school applications from college professors did not.
Prior FERPA Research Relevant to this Study
There have been several studies that reported to some extent on issues of
university compliance with FERPA and disclosure under the permissive disclosure
clauses, which is the subject of this current study. This research falls into the following
categories: existence of written FERPA policies, disclosure to individuals with a
legitimate educational interest, release of information to parents of dependent students,
and parental notification of alcohol and drug violations. They will be described in detail
here, moving from the earliest to the most recent studies in each subsection.
FERPA Policies
Schuerman (1980) surveyed 100 universities and had a 100% return rate.
Eighteen percent of the universities did not have written FERPA policies at that point.
None of the written policies were in complete compliance; 65% contained less than 75%
of the requirements. He found that private universities complied with FERPA to a lesser
extent than state universities.
Steinberg (2003) surveyed registrars at 400 universities concerning FERPA
policies, procedures, training, and enforcement, with a response rate of 61%. The
purpose of the study was to determine if there were differences among universities in the
four Carnegie Classifications and there was a response rate of 61%. One set of questions
concerned instituting FERPA policy changes in light of the many amendments to
28
FERPA. Six percent of respondents stated that there had not been any legislative changes
to FERPA. Seven percent responded that their institutions did not update their FERPA
policies and procedures when the law was amended. Eighty-one percent stated that
legislative changes to FERPA caused their universities to implement new FERPA
policies and procedures.
Sayer (2005) surveyed all four-year public, all two-year public, and several
private institutions of higher education in Nebraska about FERPA compliance and
implementation. A total of 16 institutions were included in the study. Fewer than half of
the participants had developed policies to address all aspects of FERPA. Sayer
concluded that universities would be "better prepared to handle FERPA issues if there
were at least some policies in writing. The overall theme that emerged was one of
undocumented procedures related to policies that create difficulties when others on
campus need to be aware of what other departments are doing" (p. 182).
Legitimate Educational Interest
Turner-Dickerson (1997) surveyed the registrars at the 56 member institutions of
the Association of American Universities. There was a 75% return rate. The registrars
were asked many questions about their knowledge and practices concerning FERPA, two
of them pertaining to permissive disclosure clauses. Ninety-eight percent of the
respondents stated that information from students' education records would be released to
university personnel who had a legitimate educational interest.
Fry (1999) researched faculty requests for information about students and how
universities determine if a faculty member has a legitimate educational interest in that
information. Four hundred registrars were surveyed, with a 31% return rate. Forty-seven
29
percent indicated faculty had "controlled access" to student records; that is, faculty had
unlimited access to only their advisees' records or to student records if the faculty
member was conducting official research for the university. Simply having a student in
class did not constitute a legitimate educational interest. Forty-one percent of
respondents, however, indicated that faculty at their universities had unlimited access to
student records.
Release to Parents of Dependents
Turner-Dickerson (1997) asked the registrars in the study described above if they
disclosed information to parents of dependent students. Twenty-eight percent released
information to parents of dependent students by using the information from income tax
records.
Parental Notification of Alcohol and Drug Violations
There have been several research studies that looked at the factors that influenced
university decisions about parental notification. A study by Palmer, et al. (2001)
determined that the greatest influences on whether universities had parental notification
policies were the changes to FERPA which allowed notification and the universities’
concerns about alcohol use by students.
Watts (2003) surveyed 1,175 universities about the adoption of parental
notification policies concerning alcohol and drug violations after FERPA was amended
by the Higher Education Reauthorization Act (HERA) of 1998 to permit such disclosure.
Out of the 229 respondents, 156 (69%) had a parental notification policy. Sixty-seven
percent of those that had a policy had instituted it only after the passage of the 1998
HERA and 58% of those did so simply because HERA allowed them to do so. Other
30
reasons given for adopting a parental notification policy included: institutional concerns
about student alcohol use (97% said this was somewhat important, important or very
important in their decision); a desire to curb underage drinking (72%); interest in
involving parents in the solution to the problem of underage drinking (92%); effort to
control the misuse of alcohol by college students (97%); and belief that parents should
know about alcohol and drug violations (83%). Watts found that a concern over possible
lawsuits was considered important by 64% of respondents and not important at all by
31%. Of the 71 universities that had not implemented parental notification for alcohol
and drug violations, 35 (56%) said they had considered instituting a policy while 28
(44%) had not considered it (eight respondents did not answer this question). Watts
asked the universities that had considered instituting the policy to say why they had
decided not to do so. Seventy-one percent felt that "telling on" students would not
promote responsibility for their actions; 58% said that it would interfere with a student's
right to independence; 55% said that it could hurt the relationship between the student
and the university; and 68% said that other programs on campus are more effective in
reducing alcohol use. Of those 28 universities that did not consider a parental
notification policy, 50% said they had not because of the demographic make-up of the
student population; 52% stated that it went against the philosophical stance of the
university regarding relationships with its students; 50% said that state laws prohibited
disclosure.
Henning (2004) developed a study to determine why universities did or did not
implement parental notification policies concerning drug and alcohol violations after the
1998 amendment allowed it and if there were any predictors of a university adopting a
31
policy. It looked at the relationships between students, parents and universities and
questioned how these relationships influence the decision regarding parental notification.
An online survey was sent to Chief Student Affairs officers at 318 baccalaureate degree
granting institutions; there was a 60% participation rate. Henning found that universities
consider three things when deciding on a parental notification policy: “parents’ right to
be involved in their student’s life, students’ benefit of parental notification policies, and
IHE’s (institutions of higher education) legal responsibility to protect students” (Henning,
p. 127). Using logistic regression, Henning found four variables that were predictors of
having a parental notification policy concerning alcohol and drug violations: (1) being
located in the northeast; (2) believing that students benefit from parental notification; (3)
believing that alcohol is a problem on campus; and (4) being a private school. Henning
concluded that universities may not have a logical reason for implementing parental
notification for alcohol and drug violations. He recommended further research into
additional variables that may explain adoption of parental notification policies.
Research conducted by Lowery, Palmer, and Gehring (2005) asked 665
universities about parental notification. With a 53% return rate to the on-line survey, less
than half (49%) reported having a formal parental notification policy for alcohol and drug
violations. Of these universities, 44% reported that the most important factor in
developing a policy was institutional concern about student alcohol use.
Prior Permissive Disclosure Research Summary
Overall, to date research has only been conducted on the permissive disclosure
clauses that address legitimate educational interest, parental notification for alcohol and
drug violations, and release of information to parents of dependent children. One of the
32
legitimate educational interest studies surveyed 400 registrars (Fry, 1999) and the other
went to 56 registrars (Turner-Dickerson, 1997). One survey concerning parental
notification went to 1,175 institutions (Watts, 2003) and the other went to 318 (Henning,
2004). The survey concerning release to parents of dependent children was sent to 56
registrars (Turner-Dickerson, 1997). Yet, research needs to be conducted on the other
permissive disclosure clauses. A larger sample of chief student life officers, with a high
response rate, would allow the results to be generalized to the entire population of chief
student life officers in the United States. The results of my research will therefore be
useful to universities that are reviewing or developing FERPA policies concerning the
permissive disclosure clauses as it will provide information on prevailing practices in
higher education.
Risk Management
Among those writing about risk management in higher education, many
emphasize that risk management on college campuses should not be about thwarting
litigation. Hoye (2006) clearly states that "contrary to popular belief, the primary
purpose of risk assessment is not to avoid lawsuits and legal liability." Lake (2005)
agrees that risk management should not have reduction of litigation as the primary goal.
"Risk management must be based upon a genuine concern for student safety; only then
does it seem to have the required effect" (Lake, 2005, p. 655). Shackelford (2007)
concurs by stating that "college administrators and legal counsel should not make
student-related decisions driven by bureaucratic processes or perceived legal risks.
Instead, they must always make decisions based on the best interests of students and their
institutions" (p. 687). Eick (2003) determined through her research that
33
higher education administrators have recognized that effective risk management is
important for implementing the strategic initiatives of their university as well as
for protecting the assets of the university….Effective risk management protects
the resources of the university so that more resources can be directed towards
meeting the mission of the university and the chance of unforeseen losses
distracting the university away from its goals is reduced. (p. 80)
Farrell (2001) noted,
With litigation escalating and insurance premiums skyrocketing in higher
education, the need to prevent losses is greater than ever.... Unfortunately, a lot of
people see colleges and universities as places with deep pockets, and there's this
greater sense of entitlement because education is being viewed as a product, so
when students and parents don't get what they pay for, they want to be
compensated. (p. 29)
Peard, of Advanced Educational Solutions, states universities "have started to realize that
they can save a lot of money by working on preventative (sic) risk management" (as cited
in Farrell, 2001, p. 31).
Thomas (2000) described risk theory in regard to individuals' willingness to be
involved in new educational projects. He postulates that the characteristics of individuals
affect whether they feel at risk by being involved in new initiatives. He defines risk as
"the likelihood that undesirable consequences will result from an action--that the person
will suffer some sort of loss" (p. 5). Characteristics that affect an individual's willingness
to take on risk include "people's needs, their perceptions of reality, salient features of
educational-development efforts, the influence of consequences, psychological
34
identification, the decision-making process, and individual differences in such
characteristics" (p. 4). If this thinking is transferred to an organization, such as a
university, the organization's needs, perception of reality, influence of prior consequences
of similar initiatives, identity, and decision making procedures would influence how the
university approaches assessing situations for risk and how likely the institution is to deal
with risk in an effective manner.
Strategies of Risk Management
Risk management strategies may be helpful in making decisions about disclosure
of information under the permissive disclosure clauses of FERPA. University
administrators must think about risk management—we must consider liability, what will
show due diligence, and what will show we did what we considered to be in the best
interest of students, their parents, and the institution.
Dickson (1978) states that once risk is identified in the organization, the
organization must evaluate it in terms of possible frequency and the severity of the risk.
Muffee (2007) defines risk management as “the planning, arranging and controlling of
operations and resources in order to minimize the impact of uncertain events” (p. 25).
Muffee goes on to delineate four risk management strategies. The first, risk
retention, is a strategy used when a company decides to continue to take the risk and will
pay for the cost of the risk from their profits. Risk avoidance involves an organization
deciding to stop the activity that causes the risk. In risk reduction, an organization takes
action to reduce the actual risk or the severity of the loss possible from the risk. Risk
transfer is when an organization buys insurance, thus transferring the risk to another
entity. Bodine, Pugliese, and Walker (2001) state that there are five steps to effective risk
35
management that organizations should follow: establish a risk management context;
identify potential risks; analyze and assess the risks; design strategies for managing risks;
and implement risk management processes.
Risk Management and Decision-Making
Culcleasure (2005) states that risk management is the framework that exists to
guide better decision-making throughout an organization. He states that
the organization should include risk as a fundamental consideration in its choices
and decision-making. It should also determine how much risk it is willing to take
and apply appropriate risk tolerance for each situation and the possible effect on
the organization’s portfolio. (p. 35)
He views risk management as a process consisting of “identifying, measuring, selecting,
implementing, and monitoring risks” (p. 44). Rescher (1983) asserts that risk assessment
is subjective; it depends on the context of the situation and the background and
experiences of the person or persons doing the assessment and making the decisions.
According to Head and Horn (1991), risk management is “the process of making
and carrying out decisions that will minimize the adverse effects of accidental losses
upon an organization” (p. 6). Whitfield (2003) determined through his research that the
corporate sector’s risk management framework is “transferable to higher education
institutions” (p. 79).
NACUBO addressed the issue of risk management in a 2000 report. The report
stated that in the past,
risk was generally viewed in terms that reflected primarily negative outcomes.
Risk Management meant making sure that an organization was adequately
36
protected in the event of a catastrophe. Increasingly in today’s environment, risk
is being more broadly defined as any issue that affects an organization’s ability to
meet its objectives. In this light, risk management encompasses all of the
operational, financial, compliance and strategic issues that an organization might
encounter in its attempt to achieve its objectives. (Cassidy et al., 2000, p. 3)
The authors define the five types of risk with which higher education should be
concerned. Strategic risk affects a university’s ability to achieve its goals. Financial risk
may cause a loss of assets. Operational risk affects management processes. Compliance
risk is that associated with externally imposed regulations and laws. According to
Culcleasure (2005), universities must comply with more than 200 federal regulations.
Reputational risk affects a university’s reputation or brand.
Strategic Risk Management/Enterprise Risk Management
Strategic risk management, also known as enterprise risk management (ERM), is
a new development in risk management practices. Chapman (2001) describes it as a
“method for managing risks more strategically. By holistically looking at all risks the
organization faces and considering how they affect the overall accomplishment of goals,
ERM helps organizations better handle their risks to achieve the greatest gains at the
lowest cost” (Chapman, 2001, p. 1). According to Whitfield (2003), different
frameworks for ERM have been developed.
These frameworks focus on the organization’s strategy and assist with the
assessment of risks and the likelihood of occurrence and significance of impact.
The most effective models begin with establishing an oversight structure, creating
a common language about risk management, identifying a risk champion to lead
37
the implementation and engaging the entire organization in assessing risks that
accompany business strategies planned or in progress. (p. 18)
Kinman (2001) states a “successful ERM program builds a competency throughout the
organization for identifying and understanding risks and provides a methodology for
assessing those risks” (as cited in Chapman, 2001, p. 4). A recent Association of
Governing Boards (AGB) of Universities and Colleges/National Association of College
and University Business Officers (NACUBO) report on risk management in higher
education concludes by quoting the Committee of Sponsoring Organizations: “Enterprise
risk management helps an entity get to where it wants to go and avoid pitfalls and
surprises along the way” (AGB/NACUBO, 2007, p. 14).
ERM creates a mindset at an institution, whether a business or a university, that
causes risk to be considered in all decisions that are made. It provides a basis to make
decisions that is used by everyone at the institution. This should result in consistency of
decisions because it is based on what is acceptable and important to the university. ERM
could provide an effective framework for individuals to use when making decisions
regarding the permissive disclosure clauses of FERPA.
Prior Studies on Risk Management in Education
Risk management in higher education has not been researched until recently.
Such research as there is has mainly looked at the possibility of using risk management
concepts from the world of business in the realm of higher education, and what would be
necessary for a risk management framework to be successful in colleges and universities.
A review of these studies follows.
Whitfield (2003) conducted a qualitative study with the goal of transferring an
38
institution-wide risk management framework from the for-profit sector to universities.
He conducted interviews at two corporations and two universities. He concluded that this
is possible but there is not one model which will work for every institution. He states,
“recognizing change is constant, setting a ‘risk conscious’ tone at the top and identifying
a risk management champion are critical success factors for implementation of an
institution-wide risk management framework” (p. 87).
Harwell (2003) performed a qualitative study to find effective risk management
skills in higher education. The sample was 20 universities and three insurance
consultants who specialize in risk management in higher education, and there was an
83% participation rate. Harwell found each risk management program was unique and
that there is a set of skills effective risk managers possess. The most important skills are
influencing others, developing a network on campus, technical abilities, and knowledge
of “risk finance strategies.” “The most effective risk managers were proactive versus
reactive” (p. 63).
Eick (2003) used a mixed methods approach and surveyed 171 universities, with a
return rate of 42%, and interviewed five university risk managers. Her work revealed
risk manager competencies and organizational factors that foster risk management
effectiveness at universities, including the visibility of the risk manager on campus,
supportive leadership, and resources available to the risk manager.
Culcleasure (2005) researched best practices of risk management at the 36 private
colleges and universities in North Carolina, with a return rate of 33%, in light of the
September 11 attacks. He also identified factors that “drive risk decisions” (p. 70).
Resources, regulatory compliance, and management commitment to risk management
39
were the top three factors driving the use of risk management techniques.
The AGB/NACUBO study (2009) surveyed college presidents and boards to
determine the “attitudes, practices, and policies regarding enterprise risk management
among American colleges and universities” (p. 15). There was a 15.3% return rate.
Forty-one percent of respondents “mostly agreed” their institution considered risk
management to be a priority. Forty-seven percent “mostly agreed” that the risk tolerance
of their institution is understood by decision makers. Forty-four percent “mostly agreed”
that their risk tolerance guides decision-making. Among the report’s recommendation
are that “an institution’s appetite and tolerance for risk needs to be understood and part of
the institution’s decision-making culture” and “an institution’s risk tolerance ought to
guide strategic and operational decisions” (p. 24).
Of these previous studies, the AGB/NACUBO study is the only research found to
focus on the use of risk management in higher education decision-making. More
research therefore needs to be done in this area to determine if enterprise risk
management is having an impact on decision-making in higher education, and if risk is
something that decision-makers take into account when making important decisions.
How My Research Differs
My research differs from prior studies in two fundamental ways: it looked at all
of the permissive disclosure clauses of FERPA and it used the lens of risk management.
This is significant because it will be useful to universities that are reviewing or
developing FERPA policies in that it will provide information on current practices in
higher education.
Currently, the only research specific to the permissive disclosure clauses concerns
40
parental notification for alcohol and drug violations, disclosure to parents of dependent
students, and disclosure to university personnel with a legitimate educational interest.
My research looked at all nine of the permissive disclosure clauses. Chief Student
Affairs Officers were asked if their university has made decisions about each of the
clauses, what their policy is on each of the clauses, and what factors, including risk
management, were considered when making the decision.
Eick (2003) states, “There is very little written about university risk management”
(p. 33). My study adds to the literature by focusing on whether university administrators
are concerned with risk issues when making decisions about FERPA, and if they use a
risk management approach when making these decisions. My research differs from the
few risk management research projects previously described in that my study is looking
at a specific federal mandate and asking if concerns about possible risk to the university
had anything to do with the decisions made about how the university will deal with the
permissive disclosure clauses. Culcleasure (2005) found that regulatory compliance was
one of the drivers of risk management techniques at the private colleges and universities
in North Carolina. My research will add to the findings by determining if universities
considered the risks involved to the institution when making decisions about how they
will comply with FERPA.
Chapter 2 Summary
Universities have been dealing with the requirements of FERPA since 1974.
While some requirements are clear, there are clauses in FERPA that allow universities to
disclose personally identifiable information without the permission of the student. Policy
decisions must be made concerning these permissive disclosure statements. Prior
41
FERPA-related research has been conducted on the prevalence of parental disclosure for
alcohol and drug violations, disclosure to parents of dependent students, and disclosure to
university personnel with a legitimate educational interest. That research included
information on why universities made the decision to disclose or not disclose. My
research project builds on prior research and attempts to inform university administrators
about disclosure practices in other circumstances permitted under FERPA. It uses the
lens of risk management and attempts to determine if possible risk to the university was a
factor in decisions made about the permissive disclosure clauses of FERPA.
The following chapter will describe the proposed methodology for this study.
Research questions are listed, and the research design, sampling plan, data collection
procedures and data analysis procedures are explained.
42
CHAPTER 3: METHODOLOGY
A relational study using a quantitative design was conducted to determine to
what extent universities disclose under the permissive disclosure clauses of FERPA, what
factors, such as risk management elements, are taken into consideration when making
decisions about permissive disclosure, and if FERPA-related policy and decisions are
dependent on type of institution. Anastas (1999) defines relational research as research
“designed to describe regularities or patterns in how a predefined phenomenon relates to
other predefined phenomena” (p. 148). In this study the phenomenon of disclosure under
the permissive disclosure clauses of FERPA was looked at in relation to type of
university and use of risk management strategies. Data were collected via a web survey
to answer the following research questions.
Research Questions
1. To what extent have universities made decisions about the permissive
disclosure clauses of FERPA?
2. To what extent do universities disclose student information under the
permissive disclosure clauses of FERPA?
3. What reasons do universities give for either disclosing or not disclosing
information under the permissive disclosure clauses of FERPA?
4. Has the issue of risk to the university played a part in the decisions about the
permissive disclosure clauses of FERPA?
5. Does institutional type, location, size of the student body, or size of the on-
campus population relate to whether universities disclose or do not disclose
under the permissive disclosure clauses of FERPA? To what extent do these
43
factors influence an institution's use of risk management in the decision to
disclose or not disclose?
Research Design
This research used a quantitative research design and collected data using a cross-
sectional survey that describes the patterns of disclosure under FERPA. Quantitative
research is appropriate for this study as knowledge concerning the permissive disclosure
clauses was gathered and possible influencing factors were studied (Creswell, 2003).
Surveys are used for data collection in quantitative research and the information gathered
may be used to generalize from the sample surveyed to a larger population (Creswell,
2003). A “one-shot survey for the purpose of describing the characteristics of a sample at
one point in time” (Mertens, 2005, p. 172) was developed.
Study Participants
The study participants were chief student life officers at the institutions included
in the Digital Higher Education Directory. The institutions included in the directory are
baccalaureate degree granting and are accredited by the Council of Higher Education
Accreditation (CHEA) or an accrediting agency authorized by the United States Secretary
of Education. At the time of the study there were 1,977 chief student life officers listed
in the directory with email addresses. Two people were removed from the list because
they participated in the development of the instrument. Therefore, a total of 1,975
surveys were distributed via email. Chief student life officers were selected because they
usually supervise the offices that deal most often with the permissive disclosure clauses
of FERPA. If we assume there is one chief student life officer at each baccalaureate
degree granting institution in this country, the population size is approximately 2,727
44
(Higher Education Publications 2009). This method of sampling is single stage; there is
direct access to a sample of the population (Creswell, 2003). If the response rate is high
enough, it will be possible to generalize the results to the entire population of chief
student life officers in the United States.
Measures
A survey was developed to gather information to answer the research questions.
There are eight demographic questions to begin the survey. All participants then see a
question concerning published policy decisions for all permissive disclosure clauses of
FERPA. The categorical responses for this question are: Yes and it is a published policy,
Yes but it is only a “working” unpublished policy, No, Don’t know. The next question
for all participants asks to what extent risk management issues were taken into account
when making disclosure decisions. The Likert-type scale for this question is: Not at all,
Limited extent, Moderate extent, Great extent, Don’t know. Participants are then asked if
they disclose information in each of the circumstances permitted in the permissive
disclosure clauses of FERPA. These are answered on the following Likert-type scale:
Always (we disclose every time, no exceptions); Usually (we disclose unless there is a
good reason not to do so); Sometimes (we do not disclose unless there is a good reason to
do so); Never (we never disclose, no exceptions); Don’t know (I don’t know if we do or
do not disclose). Each of these questions is followed by a question asking to what extent
certain factors contributed to the decision to disclose or not disclose. The Likert scale for
these questions is Not at all, Limited extent, Moderate extent, Great extent, and Don’t
know. This section has a total of 27 questions, but not everyone answers every question;
the survey branches depending on answering each question pertaining to the permissive
45
disclosure clauses with always, usually, sometimes, never, or don’t know. Participants
who answer Don’t know to the disclosure questions are taken to an open-ended question
which asks if there are specific factors which caused them to not know if their institution
discloses under the permissive disclosure clauses of FERPA.
There are four open-ended questions at the end of the survey that everyone is
asked to answer. The first asks for a description of the decision-making process used for
the permissive disclosure clauses and what factors are given the greatest weight. The
next questions ask for a description of the role risk management plays in the decisions
and the role “student development considerations” play in the decision. The final
question asks if there are other factors that play a role in decisions to disclose information
allowed by FERPA.
Some factors used in making decisions regarding FERPA were taken from the
survey developed by Watts (2003), in which she researched the permissive disclosure
clause concerning parental notification for alcohol and drug violations. Some definitions
used in this survey come from the Cooper and Lancaster Decision Perspective Survey
(1995).
In order to establish content validity, a small group of FERPA experts evaluated
the survey questions. These people were asked if the questions relate to the objectives of
the research proposed and if they will produce the information needed (Thomas, 2004).
A group of student life professionals, including two chief student life officers, a
registrar, a conduct program director, a director of an academic advising office, and a
vice president for institutional research, was invited to determine whether the survey
questions were clear and answerable. The participants were selected because of their
46
experience with FERPA issues and/or their familiarity with research methods. Salant and
Dillman (1994) describe the purpose of a pilot study to be "to learn whether it works to
your satisfaction or has big problems. Not only must you check all the individual parts,
but the total effect must be evaluated as well" (p. 120). Rea and Parker (2005) describe a
pilot study as "a small-scale implementation of the draft questionnaire that assesses such
critical factors as the following: questionnaire clarity...questionnaire
comprehensiveness...questionnaire acceptability..." (pp. 31 - 32). The pilot study
participants offered suggestions for changes to the survey but reported overall that the
questions were understandable and covered key content, and that the estimated length of
time needed to complete the survey was accurate.
Data Collection and Analysis Procedures
Self-reported data were collected using a web-based survey. The initial email
included an invitation to complete the survey and a link to the web address for the survey.
An email follow-up was sent one week after the initial email. A second email follow-up
was sent two weeks after the first follow-up email. These follow-ups were done in order
to help increase the response rate (Fowler, 2002). The first email resulted in 115
responses; the second email brought in an additional 75 responses; the final email added
42 responses.
The data collected were analyzed using SPSS 18.0. The analyses used to report
the results for research question 1 through 4 (the extent to which universities have made
decisions about the permissive disclosure clauses of FERPA; the extent to which
universities disclose student information under the permissive disclosure clauses of
FERPA; ways the issue of risk to the university has played a part in the decisions about
47
the permissive disclosure clauses of FERPA; reasons universities give for either
disclosing or not disclosing information under the permissive disclosure clauses of
FERPA) are descriptive statistics. These include frequencies, means, and standard
deviation.
The analyses used to report the results for research question 5 (whether
institutional type, location, size of the student body, or size of the on-campus population
relate to whether universities disclose or do not disclose under the permissive disclosure
clauses of FERPA, and influence a university’s use of risk management in the decision to
disclose or not disclose) are frequency, chi-square, and discriminant function analysis.
The open-ended questions in the survey were analyzed using the method
described by Marshall and Rossman (1995). The answers were put into categories that
emerged from reading the responses. Patterns and themes were then identified, and such
categories, patterns and themes were coded to make analysis possible.
The following table shows the research questions, which survey questions relate
to the research questions, and the analysis that was conducted for each question.
Table 1
Statistical Analysis for Research Questions
Research Question Survey Question Analysis
To what extent have
universities made decisions
about the permissive
disclosure clauses of FERPA?
To what extent do universities
disclose student information
under the permissive
disclosure clauses of FERPA?
Has your university made
a policy decision for each
of the permissive disclosure
clauses of FERPA?
My institution discloses
information…
--In health emergencies.
--In safety emergencies.
Frequency—how
many of each type
of institution have
same answers?
Frequency—how
many of each type
of institution have
same answers?
48
Research Question Survey Question Analysis
Has the issue of risk to the
university played a part in the
decisions regarding disclosure
under FERPA?
--When students under 21 violate
alcohol and drug regulations.
--To parents of dependent
children.
--To victims of violent crimes.
--To parents of victims of violent
crimes.
--To parents of perpetrators of a
violent crime.
--To the general public about
violent crimes.
--To university employees with a
legitimate educational interest
To what extent do the following
factors contribute to the decision
to disclose information to
appropriate parties?
o Legal risk o Best interest of students o Best interest of the
university community
To what extent do the following
factors contribute to the decision
to not disclose information to
appropriate parties?
o Legal risk o Students’ privacy rights o Student development
considerations.
To what extent are the following
factors considered by your
institution when making policy
decisions about FERPA?
o Potential risk to institution
o Potential risk to students o Best interests of students o Best interests of
institution
Frequency—how
many of each type
of institution have
same answers?
Table 1 - Continued
49
Research Question Survey Question Analysis
What reasons do universities
give for either disclosing or not
disclosing information under
the permissive disclosure
clauses of FERPA?
o Minimization of risk to students
o Minimization of risk to institution
o Consideration of risk management
o Consideration of student development
Overall, describe to what extent
“risk management” plays a role
in any decisions to disclose or
not disclose.
To what extent do the following
factors contribute to the decision
to disclose information to
appropriate parties?
o Legal risk o Best interest of students o Best interest of the
university community
To what extent do the following
factors contribute to the decision
to not disclose information to
appropriate parties?
o Legal risk o Students’ privacy rights o Student development
considerations
--Overall, when making
decisions to disclose or not
disclose, describe the process for
making such decisions (including
who is involved), and what
factors are usually given the
greatest weight.
--Overall, describe to what extent
“risk management” plays a role
in any decisions to disclose or
categories, patterns,
trends
Frequency—how
many of each type
of institution have
same answers?
categories, patterns,
trends
Table 1 - Continued
50
Research Question Survey Question Analysis
Does institutional type,
location, size of the student
body, or size of the on-campus
population impact whether
universities disclose or do not
disclose under the permissive
disclosure clauses of FERPA?
To what extent do these factors
influence an institution’s use
of risk management in the
decision to disclose or not
disclose?
not disclose.
--Overall, describe to what extent
“student development
considerations” play a role in any
decisions to disclose or not
disclose.
--Are there other factors that play
a role in any decisions to disclose
or not disclose?
--Institutional type
--Highest degree offered
--In what state or territory is
institution located?
--How many undergraduate
students enrolled full-time?
--How many undergraduate
students enrolled part-time?
--How many students live on
campus?
--Does your institution accept
any form of federal funding?
Frequency—how
many of each type
of institution have
same answers?
chi-square—is there
a relationship
between variables
(e.g., is there a
relationship between
being a public
university and
disclosure?)?
discriminant
function analysis—
which variables best
predict disclosure?
________________________________________________________________________
Limitations of Study
As Mertens (2005) states, “surveys rely on individuals’ self-reports of their
knowledge, attitudes, or behaviors. Thus, the validity of the information is contingent on
the honesty of the respondent” (p. 167). As FERPA is a legal issue, administrators may
not be inclined to tell the truth if they know, or think they know, they are in violation of
FERPA. Or they may know the law and answer as they think they should, rather than
based on their university’s policy. It is hoped that the guarantee of confidentiality
Table 1 - Continued
51
minimizes this limitation.
Another limitation of the study is that the individuals answering the survey may
not have been at the university when decisions were made or been involved in making the
decisions regarding the permissive disclosure clauses of FERPA. They may not know,
therefore, why the decisions were made.
Response rate may be another limitation of the study. If there are not significant
returns, the power of the analysis will be too low to generalize findings.
Chapter 3 Summary
This research project is a relational study using a quantitative design. The web-
based survey was sent to 1,975 chief student life officers listed with email addresses in
the Digital Higher Education Directory (code 32, cslo). The statistical analyses were
presented that were used to determine who discloses under the permissive disclosure
clauses of FERPA and what factors influence their decisions.
The next chapter will present the results of the study and the statistical analysis
for each research question.
52
CHAPTER 4: RESULTS
The results of the survey concerning the permissive disclosure clauses of the
Family Educational Rights and Privacy Act (FERPA) are presented in this chapter. First,
data considerations and response rates will be discussed. Then, general information on
demographic data will be presented. This will be followed by the introduction of data to
answer each research question. Following this will be a chapter summary of the findings.
Data Considerations
A total of 283 survey responses were received from 1,975 invitations, for a
response rate of 14.33%. There were 28 surveys (9.89%) with incomplete demographic
information. Of these, two did not answer the question regarding receiving federal funds.
Two did not answer the question regarding the highest degree their institution awards.
Three did not give any demographic information at all. The rest, 21 respondents, failed
to answer one or more of the questions regarding the number of students enrolled full-
time or part-time or the number of students who live on campus. I decided not to exclude
responses from surveys with incomplete demographic information because participants
could complete the survey without answering the demographic questions. I allowed this
because I did not want respondents to worry about being identified since FERPA
compliance is a legal issue and noncompliance may result in investigation and sanctions.
Surveys that were blank or did not have at least the first question answered
concerning disclosure under FERPA were removed from the data set. There were 51
survey responses removed for this reason.
A power analysis was conducted prior to distribution of the survey. Using a
confidence interval of 1.2, a general population of 2,727, and a confidence level of 95%,
53
the sample size needed is 1,936. A total of 1,975 surveys were distributed. Using 95%
confidence level, 5% error, and a population of 1,975, it is necessary to have a response
size of 239 in order to be able to generalize the findings to the larger population. There
were 232 usable responses to the survey, and this is 2.9% lower than the required
response. Yet, given the sample size, this number of responses falls within the 90%
confidence level with 5.1% margin of error; 95% confidence level with 6% margin of
error; 99% confidence level with 7.9% margin of error. Generalization of the findings to
the larger population should, therefore, be done with caution.
The statistical significance level used for all tests was .05. A level of .05 or
smaller shows significance. This indicates that the results could only have been a result
of chance 5% of the time. A level greater than .05 indicates that the difference in factors
is not significant.
Sample Description
The people responding to the survey used the following titles: 49.6% Vice
President for Student Affairs, 27.6% Dean of Students, 9.6% Registrar, and 13.2% Other.
Seven of the titles that respondents typed in after designating “other” were some form of
Vice President of Student Affairs, or Associate or Assistant Vice Presidents. Six titles
were Associate or Assistant Dean of Students. Three titles were Associate Registrars. A
total of 1.7% did not designate their titles.
54
Table 2
Responses by Titles of Respondents
Titles of respondents N Percentage
______________________________________________________________________________
Vice President of Student Affairs 113 48.7
Dean of Students 63 27.2
Registrar 22 9.5
Other 30 12.9
No response 4 1.7
Public and private universities were both represented. Public universities
comprise 31.9% of the respondents and 66.8% were private universities. Three
respondents, 1.3%, did not stipulate type of university. Universities were further
delineated by highest degree offered. Doctorate degree granting universities made up
39.2% of the group, master’s degree granting universities were 41.8%, and baccalaureate
degree granting universities were 17.7%. A total of 5 respondents, 2.2%, did not
designate the highest degree offered. The percentages for the public and private
demographic category are very similar to the percentages of universities as a whole in the
United States. Carnegie reports show 36.8% of the universities in the country are public
and 63.2% are private. The respondents to this survey were 31.9% public and 66.8%
private. The percentages of respondents by highest degree offered, however, were not
similar to the Carnegie classifications. The Carnegie classification lists 44%
baccalaureate, 39% master’s, and 16% doctoral. The results for this survey were 17.7%
baccalaureate, 41.8% master’s, and 39.2% doctoral.
55
Table 3
Responses by Public or Private University
______________________________________________________________________________
Type of Institution N Percentage
______________________________________________________________________________
Public 74 31.9
Private 155 66.8
No response 3 1.3
Table 4
Responses by Highest Degree Offered by the Institution
______________________________________________________________________________
Highest degree offered N Percentage
______________________________________________________________________________
Doctoral degree 89 38.4
Master’s 97 41.8
Baccalaureate 41 17.7
No response 5 2.2
The United States was divided into regions for the purpose of this study.
Respondents were asked to list the state in which they are located, but these responses are
reported by region. The regions used by the National Association of Student Personnel
Administrators (NASPA) were used in this study. These regions were chosen because
student affairs administrators identify with the universities in their regions and hold
regional meetings and conferences. They would be interested in knowing what
universities in their region are doing regarding FERPA, as well as knowing what
universities in general are doing. The percentages of respondents to this survey by region
are similar to the percentages of member institutions of NASPA for each region. Region
II is slightly over-represented by 3.9% and region IV-W is slightly under-represented by
2.9%.
56
Table 5
Responses per Region of the United States
Region N Percentage NASPA %
______________________________________________________________________________
I: Connecticut, Maine, Massachusetts, 24 10.5 10.9
New Hampshire, Rhode Island, Vermont
II: New York, Pennsylvania, West Virginia, 57 25.0 21.1
Delaware (no responses), New Jersey, Maryland,
District of Columbia (no responses), Puerto Rico,
Virgin Islands (no responses)
III: Alabama, Florida, Georgia, Kentucky, 59 25.8 23.6
Louisiana, Mississippi, North Carolina,
South Carolina, Tennessee, Texas, Virginia
IV-E: Illinois, Indiana, Iowa, Michigan, Minnesota, 45 19.7 18.5
Ohio, Wisconsin
IV-W: New Mexico (no responses), Colorado, 18 7.9 10.8
Wyoming (no responses), North Dakota
(no responses), South Dakota, Nebraska, Kansas,
Oklahoma, Missouri, Arkansas
V: Utah, Alaska, Idaho, Oregon, Nevada 11 4.8 6.5
(no responses), Montana, Washington
VI: California, Arizona, Hawaii (no responses), 14 6.1 8.3
American Samoa (no responses), Micronesia
(no responses), Guam (no responses), Marshall
Islands (no responses), Northern Marianas
(no responses), Palau (no responses)
______________________________________________________________________________
Four respondents did not designate a state or territory. Overall, the percentages for this
demographic category are very similar to the percentages of universities listed per region
by NASPA.
Respondents were asked to write in the number of students enrolled at their
university this year, and then further delineate by the number of full-time students
enrolled at their university this year, the number of part-time students enrolled at their
university this year, and the number of students who lived on campus this year. Carnegie
57
categories were used to designate size of student bodies. The percentages for this
demographic category are very similar to the percentages of universities as a whole in the
United States. The Carnegie enrollment figures are 25.2% less than 1,000; 35.5% 1,000
– 2,999; 24.8% 3,000 – 9,999; 14.4% over 10,000. The respondents to this survey were
21.4% less than 1,000; 39.7% 1,000 – 2,999; 24.1% 3,000 – 9,999; 14.7% over 10,000.
The percentages of total enrollment, full-time enrollment, part-time enrollment and on-
campus population are reported in Table 6.
Table 6
Response by Size of Enrollment and On-campus Population
Total enrollment FT enrollment PT enrollment On-campus population
%/N %/N %/N %/N
______________________________________________________________________________
Fewer than 1,000 21.4/50 19.9/48 71.2/167 43.2/103
1,000 – 2,999 39.7/92 37.5/88 8.5/20 28.0/65
3,000 - 9,999 24.1/56 25.9/61 1.2/3 9.3/22
10,000 or more 14.7/34 8.4/20 .4/1 .4/1
No response 0/0 6.5/15 17.7/41 17.7/41
_____________________________________________________________________________
The relatively high percentage of respondents who did not respond to the question
asking how many students are enrolled part-time and live on-campus at their universities
may indicate they do not have part-time or on-campus populations. I did not offer “does
not apply” as an option; it was an open response question (I did not give these categories
as possible responses), however, so they could have responded “0” in the box. This may
have been confusing. Universities that accept any form of federal funding must abide by
FERPA. Out of the 232 respondents, 225, or 97%, reported accepting federal funding.
No respondents reported they do not accept federal funding. There were 7 respondents,
3%, who did not answer this question.
58
This concludes a description of my respondents. Now let us turn to an analysis of
my research questions.
Research Questions
The survey was designed to answer the following research questions.
1. To what extent have universities made decisions about the permissive
disclosure clauses of FERPA?
2. To what extent do universities disclose student information under the
permissive disclosure clauses of FERPA?
3. What reasons do universities give for either disclosing or not disclosing
information under the permissive disclosure clauses of FERPA?
4. Has the issue of risk to the university played a part in the decisions about the
permissive disclosure clauses of FERPA?
5. Does institutional type, location, size of the student body, or size of the on-
campus population relate to whether universities disclose or do not disclose
under the permissive disclosure clauses of FERPA? To what extent do these
factors influence an institution's use of risk management in the decision to
disclose or not disclose?
Each question will be answered using the data collected.
Research Question 1: To What Extent Have Universities Made Decisions About the
Permissive Disclosure Clauses of FERPA?
The survey respondents were asked if their university had made policy decisions
about each of the permissive disclosure clauses of FERPA. The possible responses were:
Yes, and it is a published policy; Yes, but it is only a “working” unpublished policy; No;
59
Don’t know. Results are presented in Tables 7 and 8 and discussed below.
The permissive disclosure clause that the most institutions have made published
policy decisions on, as required by FERPA, is disclosure of information to university
employees with a legitimate educational interest (67.9%). The rest, in order of highest to
lowest percentages are: to parents about alcohol and drug violations if the student is
under 21 years of age (66.5%), results of hearings to victims of violent crimes (62.3%),
safety emergencies (55.1%), health emergencies (51.8%), to parents of dependent
children (51.6%), results of hearings to parents of perpetrators of violent crimes (27.2%),
results of hearings to parents of victims of violent crimes (26.5%), and results of hearings
concerning violent crimes to the general public (24.0%).
Table 7
Has Your Institution Made a Policy Decision for Each of the Following Permissive
Disclosure Clauses of FERPA?
Yes, Published Yes, Unpublished No Don’t Know
(%) (%) (%) (%)
Disclosure Clause
______________________________________________________________________________
Health emergencies 51.8 39.3 5.4 3.6
Safety emergencies 55.1 37.8 4.0 3.1
Alcohol/drug violations 66.5 16.5 14.7 2.2
Parents of dependent 51.6 16.1 29.6 2.7
children
Results of hearings to victims 62.3 22.0 12.6 3.1
Results of hearings to parents 26.5 22.9 44.8 5.8
of victims
Results of hearings to parents 27.2 25.0 43.3 4.5
of perpetrators
Results of hearings to public 24.0 15.6 53.8 6.7
Employees with legitimate 67.9 27.7 4.0 4.0
educational interest
______________________________________________________________________________
60
If you look at yes, published and yes, unpublished as “yes,” it is clear that the
majority of schools have made policy decisions about the permissive disclosure clauses
of FERPA. The only clause that has a higher percentage of “no” is releasing the results
of disciplinary hearings concerning violent crimes to the general public (39.6% have
made decisions, 53.8% have not). The next closest ones also concern the results of
disciplinary hearings—results to parents of victims (49.4% have made decisions, 44.8%
have not) and results to parents of perpetrators (52.2% have made decisions, 43.3% have
not).
Table 8
Has Your Institution Made a Policy Decision for Each of the Following Permissive
Disclosure Clauses of FERPA? (combined yes, published with yes, unpublished and
compared to no)
Disclosure Clause Yes, Published or Unpublished No
(%) (%)
______________________________________________________________________________
Health emergencies 91.1 5.4
Safety emergencies 92.9 4.0
Alcohol/drug violations 83.0 14.7
Parents of dependent 67.7 29.6
children
Results of hearings to victims 84.3 12.6
Results of hearings to parents 49.4 44.8
of victims
Results of hearings to parents 52.2 43.3
of perpetrators
Results of hearings to public 39.6 53.8
Employees with legitimate 95.6 4.0
educational interest
______________________________________________________________________________
Research Question 2: To What Extent do Universities Disclose Student Information
Under the Permissive Disclosure Clauses of FERPA?
The respondents were asked to designate if they always (we disclose every time,
no exceptions), usually (we disclose unless there is a good reason not to do so),
61
sometimes (we do not disclose unless there is a good reason to do so), or never (we never
disclose, no exceptions) disclose information under the permissive disclosure clauses.
They could also respond that they do not know if their university discloses. Results are
presented in Table 9 and discussed in this section.
The top three disclosure clauses under which institutions always disclose are
results of hearings to victims of violent crimes (38.9%), safety emergencies (32.6%), and
to parents of students with alcohol or other drug violations if the students is under 21
years of age (21.4%). The top three disclosure clauses under which institutions usually
disclose are to employees with a legitimate educational interest (67.1%), health
emergencies (61.3%), and safety emergencies (52.0%). The top three disclosure clauses
under which institutions sometimes disclose are to parents of dependent children
(46.7%), results of hearing to parents of perpetrators of violent crimes (41.5%), and
results of hearings to parents of victims of violent crimes (41.1%). The top three
disclosure clauses under which institutions never disclose are results of hearing regarding
violent crimes to the general public (54.8%), results of hearings to parents of victims of
violent crimes (29.5%), and to parents of dependent children (20.8%), and results of
hearings to parents of perpetrators of violent crimes (20.8%). The top three disclosure
clauses that respondents did not know if their institution disclosed or did not disclose all
concerned hearings: results of hearing to parents of victims (12.1%), results of hearings
to parents of perpetrators (10.1%), and results of hearings to the general public (9.6%).
Disclosure of results of hearings to the general public had both the lowest
percentage for always discloses (1.9%) and the lowest percentage for usually discloses
(4.3%). Disclosure in safety emergencies had both the lowest percentage for sometimes
62
discloses (13.6%) and the lowest percentage for never discloses (0%); in other words, no
respondents reported that they never disclose in safety emergencies.
Table 9
The Extent to Which Universities Disclose Student Information Under the Permissive
Disclosure Clauses of FERPA
Always Usually Sometimes Never Don’t Know
(%) (%) (%) (%) (%)
Disclosure Clause
________________________________________________________________________
Health emergencies 14.0 61.3 21.2 1.4 2.3
Safety emergencies 32.6 52.0 13.6 0.0 1.8
Alcohol/Drugs 21.4 30.7 36.7 5.6 5.6
Parents of dependent
children 9.4 18.4 46.7 20.8 4.7
Results of hearings to victims 38.9 26.1 9.0 7.6 8.5
Results of hearings to parents
of victims 4.8 12.6 41.1 29.5 12.1
Results of hearings to parents
of perpetrators 8.2 19.3 41.5 20.8 10.1
Results of hearings to public 1.9 4.3 29.3 54.8 9.6
Employees with legitimate 13.8 67.1 17.1 .5 1.4
educational interest
________________________________________________________________________
Research Question 3: What Reasons do Universities Give for Either Disclosing or
Not Disclosing Information Under the Permissive Disclosure Clauses of FERPA?
Participants were asked what factors they consider when making policy decisions
regarding FERPA. The responses provide a view into what universities consider to be
the important factors guiding whether they will disclose or not disclose student
information. The results are presented in Table 10 and discussed in this section.
The factors that are considered to the greatest extent are the best interest of
students (89.8%), potential risk to students (87.5%), the importance of student privacy
63
rights (75.0%), and minimization of risks to students (71.6%). These all scored higher
than the institutional issues. The factors that are considered highest in the moderate
extent are minimization of risk to the institution (41.5%), student development
considerations (34.2%), potential risk to the institution (32.9%), and the best interest of
the institution (28.9%).
Table 10
The Extent to Which the Following Factors are Considered When Making Policy
Decisions About FERPA
Not at all Limited Moderate Great Don’t
(%) extent (%) extent (%) extent (%) know (%)
Factors
________________________________________________________________________
Potential risk to
the institution .9 7.7 32.9 58.1 .5
Potential risk to
students 0 2.2 9.8 87.5 .4
Best interests of
students .4 .9 8.0 89.8 .9
Minimization of
risk to students .5 3.2 23.0 71.6 1.8
Minimization of
risk to institution .9 12.5 41.5 43.8 1.3
Best interest of
institution 3.1 8.4 28.9 58.7 .9
Importance of student
privacy rights 0 3.6 21.4 75.0 0
Student development
considerations 2.7 9.9 34.2 52.7 .5
________________________________________________________________________
In looking at the means of these answers (see Table 11), the responses went from
1 (not at all) to 4 (greatest extent). The average response for all factors was between
moderate extent and great extent; however, the standard deviations for the responses
indicate that responses were quite varied, as seen in the frequency Table 10. Again, the
means show that universities consider student factors to a greater extent than institutional
64
factors; “student development considerations” is the exception to this, as it is second to
last on the list. The factors, in order of considered to a great extent (4) to not considered
at all (1) are: best interests of students (M=3.90), potential risk to students (M=3.86),
importance of student privacy rights (M=3.71), minimization of risk to students
(M=3.71), potential risk to the institution (M=3.50), best interest of the institution
(M=3.46), student development considerations (M=3.38), and minimization of risk to the
institution (M=3.32). All factors are between moderate extent (3) and great extent (4),
showing that these considerations are all considered to be important when making policy
decisions regarding FERPA.
Table 11
The Extent to Which the Following Factors are Considered When Making Policy
Decisions About FERPA; Means and Standard Deviations
Factors M SD
______________________________________________________________________________
Best interests of students 3.90 .393
Potential risk to students 3.86 .417
Minimization of risk to students 3.71 .577
Importance of student privacy rights 3.71 .526
Best interest of the institution 3.46 .790
Potential risk to the institution 3.50 .684
Student development considerations 3.38 .780
Minimization of risk to the institution 3.32 .742
______________________________________________________________________________
Note: 1-not at all, 4-great extent
Factors for those who disclose. Respondents who stated that they always,
usually, or sometimes disclose information under each permissive disclosure clause (see
Table 9) were then asked what factors were important in their decisions to disclose. The
factors are: whether it would put the institution at legal risk not to disclose, whether it is
65
in the best interests of students to disclose, and whether it is in the best interest of the
university community to disclose.
When comparing these three factors (see Table 12), it is clear that the best interest
of students is considered to a greater extent when making policy decisions to disclose,
followed by the best interest of the university community and then legal risk to the
institution. The range of percentages of considering the factors to a great extent is: the
best interest of students (71.6% - 88.6%), the best interest of the university community
(52.7% - 76.9%), and legal risk to the institution (22.6% - 52.8%). The range for legal
risk is lower, indicating the universities do not consider it to the same extent as the other
two factors. The range of percentages of not considering the factor at all is: the best
interest of students (0% - 4.0%), the best interest of the university community (.5% -
4.8%), and legal risk to the institution (2.8% - 25.3%). Here, the range for legal risk is
higher, indicating a lack of consideration in making the policy decisions.
Factors considered for each clause by those who disclose. For universities that
disclose, under eight of the nine clauses they considered the factors to the same extent
when looking at percentages, and for six of the nine clauses they considered the factors to
the same extent when looking at the means. The results are presented in Table 12 and
discussed in this section.
In making policy decisions regarding disclosure, those universities that disclose
information consider the best interest of students to the greatest extent (81.0% - 88.6%
range), followed by the best interest of the university community (47.8% - 77.7% range)
and legal risk to the institution (22.6% - 51.2% range) under eight of the nine permissive
disclosure clauses (health emergencies, safety emergencies, alcohol/drug violations,
66
parents of dependent children, results of hearings to victims, results of hearings to parents
of victims, results of hearings to parents of perpetrators, employees with legitimate
educational interest). When making policy decisions to disclose the results of hearings
concerning violent crimes to the general public, universities consider the best interest of
the university community to the greatest extent (74.3%), followed by the best interest of
students (71.6%) and legal risk to the institution (52.8%). This is the only clause where
the university community is considered to a greater extent than the other two factors.
Under all clauses, universities consider legal risk to the institution to a lesser degree than
the best interest of students and the university community.
The clauses that had the highest percentages of universities not considering the
best interests of student at all are: results of hearings to victims (4.0%), alcohol and drug
violations (2.1%), and results of hearings to parents of perpetrators (2.1%). These
percentages for “not at all” are low, showing that the best interest of students is
considered by universities when making decisions to disclose. The clauses that had the
highest percentages of universities not considering the best interests of the university
community at all are: alcohol and drug violations (4.8%), results of hearings to victims
(4.6%), and parents of dependent children (4.5%). These percentages are low, indicating
that the best interest of the university community is considered by most universities. The
clauses that had the highest percentages of universities not considering legal risk at all
when deciding to disclose are: alcohol and drug violations (25.3%), parents of dependent
children (13.3%), and employees with a legitimate educational interest (13.1%).
When the percentages for great extent are examined for each factor, it is clear that
the percentages are higher for the best interest of students, followed by the best interest of
67
the university community, and then legal risk to the university. Legal risk is clearly
considered the least. The mean scores indicate that universities consider the three factors
in the moderate to great extent range when making policy decisions about six of the nine
permissive disclosure clauses in this category (health emergencies, safety emergencies,
results of hearings to victims, results of hearings to parents of victims, results of hearings
to parents of perpetrators, results of hearings to the general public). In making policy
decisions regarding alcohol and drug violations, disclosure of information to parents of
dependent children, and disclosure to employees with a legitimate educational interest the
best interest of students and the best interest of the university community are considered
in the moderate to great range, while legal risk to the institution is considered in the
limited to moderate range.
Table 12
The Extent to Which Factors are Considered by Universities that Make Policy Decisions
to Disclose Under Each Permissive Disclosure Clause of FERPA
Always Usually Sometimes Never Don’t M/SD
(%) (%) (%) (%) Know (%)
Disclosure Clause
________________________________________________________________________ Health emergency (N=214)
Legal risk to univ. 4.3 19.4 34.1 40.8 1.4 3.16/.899
Best interest of student .5 .9 9.5 88.6 .5 3.88/.407
Best interest of comm. 1.0 6.2 25.8 67.0 0 3.59/.653
Safety emergency (N=217)
Legal risk to univ. 2.8 13.3 31.3 51.2 1.4 3.33/.816
Best interest of student 0 .9 10.8 87.7 .5 3.87/.362
Best interest of comm. .5 2.4 19.2 76.9 1.0 3.74/.520
Alcohol/drugs (N=191)
Legal risk to univ. 25.3 26.3 25.8 22.6 0 2.46/1.101
Best interest of student 2.1 1.6 10.2 85.6 .5 3.80/.568
Best interest of comm. 4.8 12.4 30.1 52.7 0 3.31/.868
68
Table 12 – Continued
Always Usually Sometimes Never Don’t M/SD
(%) (%) (%) (%) Know(%)
Disclosure Clause
________________________________________________________________________
Parents of depen-
dent children (N=158)
Legal risk to univ. 13.3 25.9 31.0 29.7 0 2.77/1.021
Best interest of student 1.3 4.4 13.3 81.0 0 3.74/.599
Best interest of comm. 4.5 17.8 29.9 47.8 0 3.21/.892
Hearing results to
Victims (N=177)
Legal risk to univ. 8.5 20.5 27.8 43.2 0 3.06/.990
Best interest of student 4.0 1.7 11.9 82.4 0 3.73/.688
Best interest of comm. 4.6 8.1 22.5 64.2 0 3.48/.839
Hearing results to
parents of victims (N=121)
Legal risk to univ. 4.2 28.8 24.6 41.5 .8 3.06/.954
Best interest of student .8 2.5 14.2 81.7 .8 3.79/.533
Best interest of comm. 3.3 12.4 28.1 55.4 .8 3.38/.839
Hearing results to
parents of perps. (N=143) Legal risk to univ. 7.7 24.5 29.4 37.1 1.4 3.00/.993
Best interest of student 2.1 2.1 10.5 84.6 .7 3.80/.588
Best interest of comm. 3.5 5.7 30.5 58.9 1.4 3.49/.780
Hearing results to
Public (N=74)
Legal risk to univ. 4.2 12.5 30.6 52.8 0 3.32/.853
Best interest of student 1.4 8.1 18.9 71.6 0 3.61/.699
Best interest of comm. 1.4 5.4 18.9 74.3 0 3.66/.647
Employees with
legit. ed. interest (N=206)
Legal risk to univ. 13.1 24.3 24.3 7.4 0 2.87/1.068
Best interest of student 2.0 3.9 8.3 85.9 0 3.78/.607
Best interest of comm. 2.5 3.0 21.2 73.4 0 3.66/.660
Factors for those who never disclose. Respondents who indicated that they
never disclose under a permissive disclosure clause of FERPA were asked what factors
were important in making that policy decision. The number of “never” responses was
69
294 across all of the permissive disclosure clauses. There are nine disclosure clauses
with five possible answers for each (always, usually, sometimes, never, don’t know).
Given the number of respondents who answered the survey, 294 “never” responses is
only 2.8% of the possible responses. The factors considered when making a policy
decision to not disclose are: whether it would put the institution at legal risk to disclose,
whether it would violate students’ privacy rights to disclose, whether it is contrary to
student development considerations to disclose. The results are presented in Table 13
and discussed in this section.
When comparing these three factors, it is clear that for those universities making
policy decisions not to disclose under the permissive disclosure clauses of FERPA the
privacy rights of students are considered to a greater extent than student development
considerations and legal risk to the institution. The range of percentages of considering
the factors to a great extent is: student privacy rights (30.0% - 100.0% [N=1]), legal risk
to the institution (20.0% - 100.0% [N=1]), and student development considerations (0% -
100% [N=1]). The range of percentages of not considering the factor at all is: student
privacy rights (0% - 50.0%), legal risk to the institution (0% - 80.0%), and student
development considerations (0% - 40.0%). Here, the range for legal risk is higher,
indicating a lack of consideration in making the policy decisions.
The clauses that had the highest percentages of universities not considering legal
risk at all when deciding not to disclose are: alcohol and drug violations (80.0%), results
of hearings to parents of perpetrators (30.8%), and results of hearings to parents of
victims (26.7%). The clauses that had the highest percentages of universities not
considering student privacy rights at all when deciding not to disclose are: alcohol and
70
drug violations (50.0%), results of hearings to parents of perpetrators (15.0%), disclosure
to parents of dependent children (14.3%), and results of hearings to parents of victims
(13.3%). The clauses that had the highest percentages of universities not considering
student development considerations at all when deciding not to disclose are: alcohol and
drug violations (40.0%), results of hearings to parents of perpetrators (30.8%), disclosure
to parents of victims (28.3%), and disclosure to parents of dependent children (21.4%).
The mean scores indicate that universities consider student privacy rights in the
moderate to great extent range for seven out of the eight clauses (M=3.33 to M=4.0
[N=1]). No one said they never disclose in safety emergencies so that clause is not
included here. When making policy decisions to not disclose alcohol and drug violations,
universities consider student privacy rights in the limited to moderate range (M=2.20).
Student development considerations are considered in the limited to moderate extent
range for six out of the eight clauses (M=2.30 to M=2.97). When making policy
decisions to not disclose to parents of dependent children and employees with a
legitimate educational interest, universities consider student development considerations
in the moderate to great extent range (M=3.05 to M=4.00 [N=1]). Legal risk to the
university is considered in the moderate to great extent range for four out of the eight
clauses (hearing results to the general public, health emergencies, hearing results to
victims, employees with a legitimate educational interest; M=3.17 to M=4.00 [N=1]), in
the limited to moderate extent range for three out of the eight clauses (hearing results of
parents of victims, hearing results of parents of perpetrators, parents of dependent
children; M=2.73 to M=2.74), and in the not at all to limited extent range for one of the
clauses (alcohol and drug violations; M=1.60).
71
Table 13
The Extent to Which Factors are Considered by Universities that Make Policy Decisions
to Not Disclose Under Each Permissive Disclosure Clause of FERPA (N=294)
________________________________________________________________________
Not at Limited Moderate Great Don’t M/SD
all (%) extent (%) extent (%) extent (%) know (%)
Factor
______________________________________________________________________________
Health emergency (N=3)
Legal risk to univ. 0 0 66.7 33.3 0 3.33/.577
Student privacy rights 0 0 66.7 33.3 0 3.33/.577
Student development 0 33.3 66.7 0 0 2.67/.577
Safety emergency (N=0)
Alcohol/drugs (N=12)
Legal risk to univ. 80.0 0 0 20.0 0 1.60/1.265
Student privacy rights 50.0 10.0 10.0 30.0 0 2.20/1.398
Student development 40.0 20.0 10.0 30.0 0 2.30/1.337
Parents of depen-
dent children (N=44)
Legal risk to univ. 23.8 19.0 19.0 35.7 2.4 2.74/1.251
Student privacy rights 14.3 4.8 16.7 61.9 2.4 3.33/1.119
Student development 21.4 9.5 14.3 52.4 2.4 3.05/1.268
Hearing results to
victims (N=16)
Legal risk to univ. 7.1 7.1 35.7 50.0 0 3.29/.914
Student privacy rights 0 7.1 0 92.9 0 3.86/.535
Student development 7.1 35.7 14.3 42.9 0 2.93/1.072
Hearing results to
parents of victims (N=61)
Legal risk to univ. 26.7 18.3 16.7 31.7 6.7 2.73/1.339
Student privacy rights 13.3 3.3 8.3 71.7 3.3 3.48/1.097
Student development 28.3 23.3 11.7 35.0 1.7 2.58/1.279
Hearing results to
parents of
perpetrators (N=43)
Legal risk to univ. 30.8 10.3 15.4 41.0 2.6 2.74/1.352
Student privacy rights 15.0 5.0 5.0 72.5 2.5 3.43/1.152
Student development 30.8 10.3 12.8 43.6 2.6 2.77/1.366
Hearing results to
public (N=114)
Legal risk to univ. 14.5 13.6 13.6 56.4 1.8 3.17/1.156
Student privacy rights 6.3 .9 5.4 86.6 .9 3.75/.777
Student development 20.5 12.5 17.9 47.3 1.8 2.97/1.226
72
Table 13 – Continued
______________________________________________________________________________
Not at Limited Moderate Great Don’t M/SD
all (%) extent (%) extent (%) extent (%) know (%)
Factor
______________________________________________________________________________
Employees with
legitimate educational
interest (N=1)
Legal risk to univ. 0 0 0 100.0 0 4.00/----
Student privacy rights 0 0 0 100.0 0 4.00/----
Student development 0 0 0 100.0 0 4.00/----
______________________________________________________________________________
Note: 1-not at all, 4-great extent
Open-ended question about how disclosure decisions are made. Respondents
were asked to answer this open-ended question: Overall, when making decisions to
disclose or not disclose, describe the process for making such decisions and what factors
are usually given the greatest weight. There were 101 responses to this question. Ninety-
seven responses were put into the following categories: committee, department, student
affairs, attorney, registrar, president, campus police, risk manager. The other four
responses did not answer the question. The results are presented in Table 14 and
discussed in this section.
The most frequently noted process used to make decisions regarding disclosure
was use of a committee. This was noted 32 times. The make-up of the committees
varied. Student affairs staff were included in all but three committees; even those three
may include student affairs staff but it was not clearly evident (“president and executive
council;” “registrar and public information director;” “administrative council”). Ten
respondents indicated that the department involved in the request makes the decision; it
73
could be the health center, an academic department, the registrar’s office, or student
affairs.
Eight respondents designated that the Chief Student Affairs Officer makes the
decision regarding disclosure. Eight respondents indicated that the Dean of Students
makes the decision. Four respondents specifically mentioned conduct administrators
being involved in their process.
Eleven respondents indicated that an attorney is consulted every time a decision is
made regarding disclosure of student information. Eight respondents said that an attorney
is sometimes consulted, in unusual circumstances, by the committee or staff member
making the decision.
In nine instances, the Registrar is involved in the decision-making process; in
three of these responses, the Registrar and the Dean of Students were involved. Five
respondents stated that the president is involved in their process. Three respondents
mentioned the involvement of the campus police in the decision process. Only two
respondents stated that the risk manager for the university was involved in the decision-
making process on their campus.
The process used to make decisions regarding disclosure under the permissive
disclosure clauses varies. It is clear, however, that at the majority of universities that
responded to this question, someone from Student Affairs is involved in the decision.
The fact that attorneys are always involved at 11 institutions and sometimes consulted at
eight others, and that the president is involved at five universities seems to speak to the
importance that is placed on making appropriate decisions regarding disclosure.
74
Table 14
Responses to Open-ended Question Regarding the Process Used to Make Decisions
About Disclosure Under FERPA
Decision Maker Number Subsets Number
______________________________________________________________________________
Committee 32
Student affairs staff included 29
President and executive council 1
Registrar and PR director 1
Administrative council 1
Department with info 10
Student Affairs 20
Chief Student Affairs Officer 8
Dean of Students 8
Conduct Admin. involved 4
Attorney involved 19
Always consulted 11
Sometimes consulted 8
Registrar involved 9
Registrar only 6
Registrar and Dean of Students 3
President involved 5
Campus police involved 3
Risk Manager involved 2
______________________________________________________________________________
Open-ended question regarding factors given greatest weight in decision-
making. The second part of this question concerned the factors given the greatest weight
when making decisions regarding the permissive disclosure clauses of FERPA. The
categories discovered in the answers are: best interest of students, best interest of the
university community, “need to know,” the law, legal liability, student safety,
institutional FERPA policy, signed waivers, benefit to student, parents, and student
privacy. These results are presented in Table 15 and discussed in this section.
The responses to the free response question concerning factors given weight in
making decisions regarding disclosure show respondents give the best interest of students
75
and the best interest of the university community great weight when making decisions.
The majority of the factors cited have to do with students—their best interest,
safety, privacy.
Twenty-two respondents noted the best interest of the student to be the most
important factor in these decisions. Eighteen respondents mentioned that the best interest
of the university community was important in the decisions. However, only three of
these listed the best interest of the university community only; fifteen of these
respondents combined student and community best interest. Thirteen respondents stated
that the “need to know” is the most important factor for them in making decisions; that is,
they will disclose information if there is a legitimate need to access the FERPA
information for some reason.
Nine respondents noted that the law carries great weight in their decisions; only
one person said that the law carries the greatest weight. Nine respondents also noted that
legal liability is heavily considered but that it is not given the greatest weight; five of
these stated that legal liability is secondary to the best interest of students. One
respondent said that the institution does not consider disclosure to carry any legal liability
as they consider all students to be dependents.
There were also nine respondents who noted that the safety of their students is a
very important factor in decisions regarding disclosure. Eight respondents noted that
following their institutional FERPA policy is an important consideration when making
disclosure decisions. Six respondents noted that whether they have a signed waiver from
the student is an important factor in their decision.
76
Five respondents specifically noted the importance of considering if disclosure
will benefit the student in any way: will it get the student to seek help or will it help
provide support for the student? One of these respondents noted that they consider
whether informing parents or guardians will actually cause harm to the student. Three
respondents stated that they consider the parents when making decisions about disclosing.
Two respondents noted that student privacy is given the greatest weight in their decisions.
Table 15
Responses to Open-ended Question Regarding Factors Given the Greatest Weight When
Making Decisions About Disclosure
Factor Categories Number Subsets Number
______________________________________________________________________________
Best interest of students 22
Best interest of university community 18
Community only 3
Community and student 15
Legitimate “need to know” 13
The law 9
Legal liability 9
Heavily considered but
not greatest weight 9
Secondary to students (5 of the 9)
Student safety 9
University FERPA policy 8
Signed waiver 6
Benefit to students? 5
Parents 3
Student privacy 2
Open-ended question regarding student development. Respondents were
asked to answer the following open-ended question: Overall, describe to what extent
“student development considerations” play a role in any decisions to disclose or not
disclose. There were 101 responses to this question. Eighty-six responses were
77
categorized; fifteen respondents did not answer the question adequately or at all. The
categories that developed are: weighed heavily, always considered, moderate role,
sometimes considered, not significant, not considered. The results are presented in Table
16 and discussed in this section.
The responses to this question show that student development considerations are
considered by most universities. The issue is whether “telling on” students by disclosing
information about them works against promoting a sense of responsibility for their own
actions and their growing independence. Only 17 out of the 86 respondents stated that
this issue is not significant or not considered at all.
Forty-two respondents noted that student development considerations are weighed
heavily in disclosure decisions. Four of these respondents considered it to be the most
important factor. Two respondents noted that student development considerations are
very important if safety is not concerned. Fourteen respondents said that student
development issues are always considered, but four of these considered the best interest
of the student to be more important and one considered institutional considerations to be
more important.
Eight people stated that student development considerations only play a moderate
role in making decisions regarding FERPA; some comments made include, “not always
at the top of the list,” “plays a role, but not the highest role;” “always a factor but not the
deciding factor;” “considered but takes a back seat to FERPA compliance and other legal
considerations.”
Five people said that student development considerations are sometimes
considered. Twelve people said that they are not a significant factor in their decision-
78
making. Five respondents said that they do not consider student development issues at
all.
Table 16
Responses to Open-ended Question Regarding the Extent Student Development
Considerations Play a Role in Decisions About Disclosure ______________________________________________________________________________
Categories Number Subsets Number
Weighed heavily 42
Most important factor 4
Very important if safety
is not a concern 2
Always considered 14
Best interest of students
is more important 4
Univ. considerations more
important 1
Moderate role 8
Sometimes considered 5
Not significant 12
Not considered 5
Open-ended question regarding other factors considered. Respondents were
asked the following open-ended question: Are there other factors that play a role in any
decisions to disclose or not disclose? There were 101 responses to this question. Ninety-
eight responses were usable to develop categories. Three respondents did not answer the
question. These results are presented in Table 17 and discussed in this section.
The categories developed are: no other factors, state laws, type of institution, best
interest of students, safety issues, federal laws, culture of the institution, student
characteristics, state university system policies, institutional policies, signed waivers,
relationships, context, legal advice, impact. This list of responses shows the depth of
issues involved in making decisions regarding disclosing information covered by
FERPA. Institutional type will be considered in the data relating to research question 5.
79
Some of these other factors may be worth further research, and will be discussed in
chapter 5.
Twenty-seven respondents said that there are no other factors considered at their
institution. Seventeen people said that state laws play into their decisions. Fourteen
respondents noted that the type of institution is important in the decision. They
mentioned private schools, religiously-affiliated schools, and small institutions as being
more likely to disclose. One person from a graduate-only school noted that they are less
likely to disclose because of the age of their students.
Eight respondents said that the best interest of students is an important factor for
them. This was part of the survey, however. Seven people note that safety issues and
concerns are important considerations.
Five respondents cited federal laws (e.g., HIPAA, FERPA, Patriot Act) as playing
a role. Four respondents noted that the culture of their institution plays a role in
decisions. Four people noted that student characteristics are important: financial
independence, age, graduate student status, mental health. Three people noted that being
part of a state university system and having to follow those policies is a large factor.
Three respondents said that following institutional policies plays a role in their decisions.
Three people noted that having signed waivers plays a part in decision-making.
Three respondents noted that they are careful about the relationship between the
student and the parent; that is, are the parents abusive or are the parents the reason the
student is having difficulties? Two people said that they might disclose if they felt that
certain people could shed light on the student’s situation that would help the institution
help the student. Two respondents said that legal advice played a role. Two respondents
80
said that they consider the impact of disclosure or nondisclosure on the student and the
campus community.
Table 17
Responses to Open-ended Question Regarding Other Factors that Play a Role in
Decisions About Disclosure
Categories Number
______________________________________________________________________________
No other factors 27
State laws 17
Type of institution 14
(private schools, religiously-affiliated schools, small schools, graduate-only schools)
Best interest of students 8
Safety issues 7
Federal laws 5
(HIPAA, FERPA, Patriot Act)
Institutional culture 4
Student characteristics 4
(financial independence, age, graduate student status, mental health)
State university system policies 3
Institutional policies 3
Signed waivers 3
Relationship between student and parent 3
Context—if people could shed light on the situation 2
Legal advice 2
Impact on student and campus community 2
______________________________________________________________________________
Research Question 4: Has the Issue of Risk to the University Played a Part in the
Decisions Regarding Disclosure Under FERPA?
The risk management factors on the list are potential risk to the institution,
potential risk to students, minimization of risk to students, and minimization of risk to the
institution. The potential risk to students (87.5%) and the minimization of risks to
students (71.6%) were considered to a greater extent than potential risk to the institution
(58.1%) and minimization of risk to the institution (43.8%). When the areas of not
considering a factor at all or considering a factor to a limited extent are examined, the
81
percentages are very low, indicating that risk factors are considered to a moderate or
great extent when making decisions regarding the disclosure clauses.
The mean scores for the risk factors are all between moderate to great extent.
This further supports the idea that universities do consider risk when making decisions
regarding the permissive disclosure clauses of FERPA. Potential risk to students is
considered to the greatest extent, followed by minimization of risk to students, potential
risk to the institution, and minimization of risk to the institution. Again, the means
indicate that student factors are considered to a greater extent than university factors.
Table 18
The Extent to Which the Following Risk Factors are Considered When Making Policy
Decisions About Disclosure
Not at Limited Moderate Great Don’t M/SD
all (%) extent (%) extent (%) extent (%) know (%)
Factors
______________________________________________________________________________
Potential risk to
the institution .9 7.7 32.9 58.1 .5 3.86/.417
Potential risk to
students 0 2.2 9.8 87.5 .4 3.71/.577
Minimization of
risk to students .5 3.2 23.0 71.6 1.8 3.50/.684
Minimization of
risk to institution .9 12.5 41.5 43.8 1.3 3.32/.742
______________________________________________________________________________
Note: 1-not at all, 4-great extent
Respondents were asked what factors they consider when making policy decisions
to disclose or not disclose under each of the permissive disclosure clauses of FERPA.
There were two factors that concern risk: if the university discloses, do they consider the
legal risk of not disclosing; if they do not disclose, do they consider the legal risk of
disclosing. Results are presented in Tables 19 and 20 and discussed below.
82
When looking at the means (with 1 being legal risk not considered at all and 4
being legal risk considered to a great extent), universities that disclose considered the
legal risk of not disclosing at a low of M=2.46 (alcohol/drug violations) to a high of
M=3.33 (safety emergencies). All but three clauses (alcohol/drug violations, parents of
dependent children, and employees with legitimate educational interest) were at or above
moderate extent. Universities that do not disclose considered the legal risk of disclosing
at a low of M=1.60 (alcohol/drug violations) to a high of M=4.0 (employees with
legitimate educational interest; N=1). Four clauses were between moderate and great
extent (health emergencies, results of hearing to victims of violent crimes, results of
hearing to the public, and employees with legitimate educational interest [N=1]) and four
were below moderate extent (alcohol/drug violations, parents of dependent children,
results of hearings to parents of victims, and results of hearings to parents of
perpetrators). No one reported never disclosing in safety emergencies.
When making policy decisions regarding disclosure under the following
disclosure clauses, universities that disclose and who do not disclose consider legal risk
between moderate and great extent: health emergencies, safety emergencies, hearing
results to victims of violent crimes, and hearing results concerning violent crimes to the
general public. The percentages of institutions that report not considering legal risk at all
were low in these categories (0% - 14.5%).
When making policy decisions regarding disclosure to parents of dependent
children, universities consider legal risk between limited and moderate extent, whether
they disclose (M=2.77) or do not disclose (M=2.74). Universities that disclose
information to employees with a legitimate educational interest also consider legal risk to
83
the institution to a limited to moderate extent (M=2.87). Only one respondent indicated
that they do not disclose to employees with a legitimate educational interest. That
university considers legal risk to a great extent in making that decision.
When making policy decisions regarding disclosure for alcohol and other drug
violations, universities that disclose information consider the legal risk of not disclosing
between limited and moderate extent (M=2.46). However, universities that decide not to
disclose alcohol and other drug violations consider the legal risk of disclosing from not at
all to limited extent (M=1.60). This area had the highest percentage of respondents who
reported not considering the legal risk of disclosing. Of those who disclose, 25.3%
reported not considering the legal risk of not disclosing in that decision. The next closest
percentages in this category were parents of dependent children (13.3%) and employees
with legitimate educational interest (13.1%). Of those who do not disclose alcohol and
drug violations, 80.0% reported not considering the legal risk of disclosing in that
decision. The next closest percentages were hearing results to parents of perpetrators of
violent crimes (30.8%), hearing results to parents of victims of violent crimes (26.7%),
and disclosure to parents of dependent children (23.8%).
Universities consider legal risk when making policy decisions regarding
disclosure to parents of both victims and perpetrators of violent crimes. Universities that
disclose in these situations consider the legal risk of not disclosing to a moderate extent
(M=3.06 for parents of victims; M=3.00 for parents of perpetrators). Universities that do
not disclose in these situations consider the legal risk of disclosing between limited and
moderate extent (M=2.73 for parents of victims; M=2.74 for parents of perpetrators).
84
Table 19
The Extent to Which Legal Risk is Considered When Universities Make Policy Decisions
to Disclose Under the Permissive Disclosure Clauses of FERPA
________________________________________________________________________ Whether it would put institution at legal risk not to disclose
N Not at Limited Moderate Great Don’t M/SD
all (%) extent (%) extent (%) extent (%) know (%)
Disclosure
Clause
______________________________________________________________________________
Health emergencies 229 4.3 19.4 34.1 40.8 1.4 3.16/.899
Safety emergencies 232 2.8 13.3 31.3 51.2 1.4 3.33/.816
Alcohol/drug
violations 220 25.3 26.3 25.8 22.6 0 2.46/1.101
Parents of dependent
children 188 13.3 25.9 31.0 29.7 0 2.77/1.021
Results of hearings
to victims 216 8.5 20.5 27.8 43.2 0 3.06/.990
Results of hearings
to parents of
victims 171 4.2 28.8 24.6 41.5 .8 3.06/.954
Results of hearings
to parents of
perpetrators 189 7.7 24.5 29.4 37.1 1.4 3.00/.993
Results of hearings
to public 118 4.2 12.5 30.6 52.8 0 3.32/.853
Employees with
legitimate
educational interest 231 13.1 24.3 24.3 37.4 1.0 2.87/1.068
______________________________________________________________________________
Note: 1-not at all, 4-great extent
85
Table 20
The Extent to Which Legal Risk is Considered When Universities Make Policy Decisions
Not to Disclose Under the Permissive Disclosure Clauses of FERPA
Whether it would put institution at legal risk to disclose
N Not at Limited Moderate Great Don’t M/SD
all (%) extent (%) extent (%) extent (%) know (%)
Disclosure
Clause
______________________________________________________________________________
Health emergencies 3 0 0 66.7 33.3 0 3.33/.577
Safety emergencies 0 0 0 0 0 0 ----/----
Alcohol/drug
violations 12 80.0 0 0 20.0 0 1.60/1.265
Parents of dependent
children 44 23.8 19.0 19.0 35.7 2.4 2.74/1.251
Results of hearings
to victims 16 7.1 7.1 35.7 50.0 0 3.29/.914
Results of hearings
to parents of
victims 61 26.7 18.3 16.7 31.7 6.7 2.73/1.339
Results of hearings to
to parents of
perpetrators 43 30.8 10.3 15.4 41.0 2.6 2.74/1.352
Results of hearings
to public 114 14.5 13.6 13.6 56.4 1.8 3.17/1.156
Employees with
legitimate
educational interest 1 0 0 0 100.0 0 4.00/----
______________________________________________________________________________
Note: 1-not at all, 4-great extent
Open-ended question regarding risk. Respondents were asked to respond to the
following open-ended question: Overall, describe to what extent “risk management”
plays a role in any decisions to disclose or not disclose. There were 101 responses to this
question; 80 could be categorized under the themes of no to minimal role (34/42.5%),
always considered to some extent (30/37.5%), or major role (16/20%). The other 21
respondents did not answer the question clearly or at all. Results are presented in Table
21 and discussed in this section.
86
Three respondents stated that risk management does not play any role at their
university in making policy decisions about disclosure. Four respondents said that they
are aware of risk management but that they are more concerned with doing the right thing
in the situation at hand. The comments made include: “if we do the right thing it will be
defensible;” “would rather justify a FERPA violation to a judge than an act of
negligence;” “would rather defend doing the right thing than playing it safe;” “would
rather get sued for doing the right thing than for protecting information that could cause
harm to individuals.” This was followed by 27 respondents who said that risk
management was only considered to a minimal or small extent.
Thirty respondents stated that risk management is always considered when
making a policy decision regarding disclosure. Twenty-one of these 30 further stated that
while risk management is always considered, it is secondary to other factors when
making decisions. Eleven of those 21 cited the best interest or welfare of students to be
more important, three cited the best interest of the university community to be more
important, and two cited the health and safety of students, faculty, and staff to be more
important than risk management issues. Comments made by respondents include: “Risk
management is a constant factor in decisions, although secondary to the welfare of
students involved, the best interests of the campus community, and institutional
integrity.” “We are mindful of legal exposure but the principal factor in deciding is what
is in the best interest of the parties involved and the university.”
Sixteen respondents indicated that risk management plays a large or major role in
their decision-making regarding FERPA. Further comments in this group include: “every
87
decision is based on the liability issue;” and “primary motivation for our decisions and
actions.”
Only 20% of those who responded to this free response question consider risk
management to play a major role in their decision to disclose under FERPA. When
combined with those who consider risk management to some extent, however, the
percentage of universities that consider risk management rises to 57.5%. When
compared to the 42.5% who stated that risk management plays little or no role in their
decisions, it is clear that the majority of universities at least consider risk management to
some extent.
Table 21
Responses to Open-ended Question Concerning Consideration of Risk Management in
Decisions to Disclose or Not Disclose (N=80)
Extent Total Number Comment Number making
comment
______________________________________________________________________________
No to minimal role 34
No role at all 3
Aware, but more concerned
with doing the right thing 4
Minimal to small extent 27
Always considered
to some extent 30
Risk is secondary to other
factors 21
--best interest and welfare of
students 11
--best interest of univ.
community 3
--health and safety of students 2
Major role 16
______________________________________________________________________________
88
Research Question 5: Does Institutional Type, Location, Size of the Student Body,
or Size of the On-campus Population Impact Whether Universities Disclose or Do
Not Disclose Under the Permissive Disclosure Clauses of FERPA? To What Extent
Do These Factors Influence an Institution’s Use of Risk Management in the Decision
to Disclose or Not Disclose?
Each of the following characteristics will be examined: public or private, highest
degree offered, location, size of the institution, full-time enrollment, part-time
enrollment, and on-campus residency size. The data presented are whether or not
universities have made policy decisions for each disclosure clause, the factors taken into
consideration when making policy decisions to disclose or not disclose, whether risk
management factors were taken into account, and to what extent the respondent’s
universities disclose (always, usually, sometimes, never) under each clause. Only those
results that are statistically significant are presented here in Tables 22 to 40 and discussed
in this section.
Many Chi-square tests reported had at least one cell count of less than five. These
are reported below each chart. It was not possible to combine cells as most of the small
cells involved either “not at all,” “never” or “don’t know” answers. The responses in
these categories are important to note. There were also some small categories of
universities, e.g., universities with over 10,000 on-campus residents, which caused small
cell counts.
Public or private. Whether the institution is public or private does not make a
significant difference in whether or not policy decisions have been made about the
permissive disclosure clauses of FERPA. There was a significant difference in the extent
to which one of the listed factors is considered when making the policy decisions: the
best interest of the institution (p=.030). This is presented in Table 22. Private
89
universities consider the best interest of the institution to a greater extent than public
universities at all levels.
Table 22
Significant Differences Regarding the Extent Factors are Considered by Public and
Private Institutions When Making Policy Decisions About FERPA
N Not at Limited Moderate Great Don’t
all (%) extent (%) extent (%) extent (%) know (%)
Best interest
of institution
Public 74 8.6 5.7 27.1 57.1 1.4
Private 155 .7 9.2 30.3 59.2 .7
______________________________________________________________________________
p= .030
Note: 5 cells have count less than 5.
In looking at the four factors that involve risk management, potential risk to the
institution, potential risk to students, minimization of risk to students, and minimization
of risk to the institution, none show significant differences between public and private
universities. When looking at the results for public and private universities for disclosing
or not disclosing under each permissive disclosure clause of FERPA, two out of the nine
clauses show significance. The difference is significant for disclosing the results of
hearings to parents of victims of violent crimes (p=.018) and results of hearings to
parents of perpetrators of violent crimes (p=.001). In both of these clauses, private
universities always disclose and usually disclose at a higher rate than public universities.
Private universities usually disclose at 16.5% and public universities usually disclose at
3.1%. They are virtually the same for sometimes disclosing (private at 41.7% and public
at 41.5%). There is also a large difference in the never disclose category. Public
universities never disclose the results of hearings to parents of victims at 41.5% while
private universities never disclose at a rate of only 23.7%. These results indicate that
90
private universities disclose the results of disciplinary hearings to parents of victims of
violent crimes more than public universities. Public universities are more inclined to
never disclose.
The results for disclosing hearing results to parents of perpetrators of violent
crimes are similar. Private universities always disclose results of hearing to parents of
perpetrators at 10.0% and public universities always disclose at 4.7%. Private
universities usually disclose at 25.0% and public universities usually disclose at 7.8%.
They are similar in the sometimes disclose category: private universities disclose at
40.7% and public at 42.2%. There is a large difference in the never disclose category.
Public universities never disclose the results of hearings to parents of perpetrators at
35.9% while private universities never disclose at a rate of only 14.3%. These results
indicate that private universities disclose the results of disciplinary hearings to parents of
perpetrators significantly more than public universities. Public universities are more
inclined to never disclose.
Table 23
Significant Differences Regarding Whether Public and Private Universities Disclose or
Do Not Disclose the Results of Hearings to Parents of Victims and Parents of
Perpetrators ______________________________________________________________________________
N Always Usually Sometimes Never Don’t Know
(%) (%) (%) (%) (%)
Clause
______________________________________________________________________________
Hearing results to
parents of victims
Public 74 4.6 3.1 41.5 41.5 9.2
Private 155 5.0 16.5 41.7 23.7 12.9
Hearing results to
parents of perps.
Public 74 4.7 7.8 42.2 35.9 9.4
Private 155 10.0 25.0 40.7 14.3 10.0
______________________________________________________________________________
91
p ≤ 0.05
Highest degree offered. The highest degree offered by a university shows a
significant difference in whether or not policy decisions have been made about one of the
permissive disclosure clauses of FERPA. The difference is significant for alcohol and
drug violations (p=.032). Master’s and baccalaureate universities are similar in having
made and published a policy decision about telling parents about alcohol and drug
violations if the student is under 21 years of age (74% and 74.4%). Only 56.0% of
doctoral universities have made and published a policy decision about this clause. More
doctoral universities have an unpublished decision, however. That percentage is 26.2%,
as opposed to 10.4% for master’s universities and 7.7% for baccalaureate. If “yes,
published” and “yes, unpublished” are combined into “yes,” however, the results are very
similar: 82.2% for doctoral, 84.4% for master’s, and 82.1% for baccalaureate. Doctoral
universities have a higher percentage of not having made a policy decision at all about
informing parents of alcohol and drug violations. Only 12.8% of baccalaureate
universities and 13.5% of master’s universities have not made a policy decision, while
16.7% of doctoral universities have not made a policy decision. This indicates that
doctorate degree granting universities are more out of compliance with FERPA
requirements than are master’s degree granting and baccalaureate degree granting
universities, as doctorate degree granting universities have both the lowest percentage for
having a published policy for informing parents of alcohol and drug violations and the
highest percentage for not having made a policy decision about this.
92
Table 24
Significant Differences Regarding Whether Institutions Have Made a Policy Decision to
Disclose Alcohol and Drug Violations to Parents (Highest Degree Offered) ______________________________________________________________________________
N Yes, Published (%) Yes, Unpublished (%) No (%) Don’t know (%)
Alcohol and drug
violations
Doctoral 89 56.0 26.2 16.7 1.2
Master’s 97 74.0 10.4 13.5 2.1
Baccalaureate 41 74.4 7.7 12.8 5.1
p=.032
Note: 4 cells have count less than 5.
There was one significant difference in the extent to which the listed factors are
considered when making policy decisions. The difference is significant for the
importance of student privacy rights (p=.033). Doctoral and master’s universities are
similar in the extent to which they consider the importance of privacy rights when
making disclosure policy decisions. Doctoral universities consider privacy rights to a
great extent at 78.8% and master’s universities at 76.6%. Only 60.0% of baccalaureate
universities consider privacy rights to a great extent. If the percentages for considering
privacy rights to a moderate and great extent are combined, however, the results are very
similar: 98.8% for doctorate, 93.6% for master’s, and 97.5% for baccalaureate. This
indicates that student privacy rights are certainly considered by the majority of all types
of universities. No university reported not considering student privacy rights at all.
93
Table 25
Significant Differences Regarding the Extent to Which the Importance of Student Privacy
Rights is Considered When Making Policy Decisions About FERPA (Highest Degree
Offered)
N Not at Limited Moderate Great Don’t
all (%) extent (%) extent (%) extent (%) know (%)
Importance of
student privacy
rights
Doctoral 89 0 1.2 20.0 78.8 0
Master’s 97 0 6.4 17.0 76.6 0
Baccalaureate 41 0 2.5 37.5 60.0 0
______________________________________________________________________________
p=.033
Note: 8 cells have count less than 5.
In looking at the four factors that involve risk management, potential risk to the
institution, potential risk to students, minimization of risk to students, and minimization
of risk to the institution, none show significant differences when looking at highest
degree offered. There were no significant differences when looking at the results for
highest degree offered by universities for disclosing or not disclosing under each
permissive disclosure clause of FERPA.
Location. The location of the institution regionally does not result in a significant
difference in whether or not policy decisions have been made about any of the permissive
disclosure clauses of FERPA. There were, however, significant differences in the extent
to which some of the factors are considered when making the policy decisions. The
regions used are those designated by the National Association of Student Personnel
Administrators:
Region I: Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont
94
Region II: New York, Pennsylvania, West Virginia, Delaware (N=0), New Jersey,
Maryland, District of Columbia (N=0), Puerto Rico, Virgin Islands (N=0)
Region III: Alabama, Florida, Georgia, Kentucky, Louisiana, Mississippi, North
Carolina, South Carolina, Tennessee, Texas, Virginia
Region IV-E: Illinois, Indiana, Iowa, Michigan, Minnesota, Ohio, Wisconsin
Region IV-W: New Mexico (N=0), Colorado, Wyoming (N=0), North Dakota (N=0),
South Dakota, Nebraska, Kansas, Oklahoma, Missouri, Arkansas
Region V: California, Arizona, Hawaii (N=0), American Samoa (N=0), Micronesia
(N=0), Guam (N=0), Marshall Islands (N=0), Northern Marianas (N=0), Palau (N=0)
The extent to which the following factors are considered in different regions are
significant: potential risk to the institution (p=.008), potential risk to students (p=.044),
the best interests of students (p=.003), minimization of risk to students (p=.018),
minimization of risk to the institution (p=.001), and student development considerations
(p=.018). These results are discussed in this section and presented in Table 26. Best
interest of the institution and importance of student privacy rights did not show
significant differences among the regions.
The extent to which potential risk to the institution is considered when making
policy decisions to disclose is significantly different among regions of the country
(p=.008). The percentage of schools that consider this risk to a great extent varied widely
by region. Region V had the highest percentage of respondents who only consider
potential risk to the institution to a limited extent (18.2%). All other regions were
between 5.6% and 8.7% for limited extent. Region I is the only region that has
95
universities that do not consider the potential risk to the institution at all (8.7%). These
results indicate that universities in region V consider potential legal risk to the institution
to the greatest extent. Even though there are significant statistical differences in the
categories of the extent the factor is considered, however, the majority of universities in
all regions of the country consider legal risk to the institution to a moderate or great
extent when making policy decisions about FERPA.
The extent to which potential risk to students is considered when making policy
decisions to disclose is significantly different among regions of the country (p=.044).
Region V had the highest percentage of respondents who only consider potential risk to
students to a limited extent (9.1%). The two other regions that had percentages for
limited extent are region VI at 7.1% and region II at 5.5%. No regions reported not
considering the potential risk to student at all. These results indicate that even though
there are significant statistical differences in the specific categories of extent the factor is
considered, the majority of universities in all regions of the country consider the potential
risk to students to a great extent when making policy decisions about FERPA.
The extent to which the best interest of students is considered when making
policy decisions to disclose is significantly different among regions of the country
(p=.003). Region I had the only percentage of respondents who consider the best interest
of students to a limited extent (4.3%). Only region V has universities that reported not
considering the best interest of students at all (9.1%). These results indicate that although
there are significant statistical differences in the categories of extent, the majority of
universities in all regions consider the best interest of students to a great extent when
making policy decisions about FERPA.
96
The extent to which the minimization of risk to students is considered when
making policy decisions to disclose is significantly different among regions of the
country (p=.018). Region V had the highest percentage of respondents who consider
minimization of risk to students to a limited extent (9.1%). The other regions that had
percentages for limited extent are region II at 5.6%, region III at 3.8%, and region IV-E at
2.3%. Only region VI had universities that reported not considering the minimization of
risk to students at all (7.1%). These data indicate that universities in region V consider
minimization of risk to students to the greatest extent. Even though there is a significant
statistical difference in the categories of the extent this factor is considered, the majority
of universities in all regions consider the minimization of risk to students to a great extent
when making policy decisions about FERPA. Region VI had the smallest percentage
(50.0%) of considering this factor to a great extent.
The extent to which the minimization of risk to the institution is considered when
making policy decisions to disclose is significantly different among regions of the
country (p=.001). Region V had the highest percentage of respondents who consider
minimization of risk to the institution to a limited extent (27.3%). Only regions VI and I
have universities that reported not considering the minimization of risk to the institution
at all (7.1% and 4.3%). These results indicate that universities in region V consider
minimization of risk to the institution to the greatest extent. Although there are
statistically significant differences in the extent to which this factor is considered, the
majority of universities in all regions of the county consider the minimization of risk to
the institution to a moderate or great extent.
97
The extent to which student development considerations are considered when
making policy decisions to disclose is significantly different among regions of the
country (p=.018). Region VI had the highest percentage of respondents who consider
student development considerations to a limited extent (28.6%). These data indicate that
even though there is a statistically significant difference in the extent this factor is
considered among the regions, the majority of universities in all regions consider student
development considerations to a moderate or great extent when making policy decisions
about FERPA. Regions VI and I had rather high percentages of universities that consider
this factor to a limited extent or not at all (35.7% and 34.8%).
Table 26
Significant Differences Regarding the Extent to Which These Factors are Considered
When Making Policy Decisions About FERPA (Location) ______________________________________________________________________________
N Not at Limited Moderate Great Don’t
all (%) extent (%) extent (%) extent (%) know (%)
Clause
Potential risk to
institution
I 24 8.7 8.7 39.1 43.5 0
II 57 0 7.3 30.9 61.8 0
III 59 0 7.8 41.2 51.0 0
IV-E 45 0 6.8 38.6 54.5 0
IV-W 18 0 5.6 22.2 72.2 0
V 11 0 18.2 0 81.8 0
VI 14 0 7.7 23.1 61.5 7.7
Potential risk to
students
I 0 0 4.3 95.7 0
II 0 5.5 7.3 87.3 0
III 0 0 13.5 86.5 0
IV-E 0 0 15.9 84.1 0
IV-W 0 0 5.6 94.4 0
V 0 9.1 0 90.9 0
VI 0 7.1 14.3 71.4 7.1
98
Table 26 – Continued
______________________________________________________________________________
N Not at Limited Moderate Great Don’t
all (%) extent (%) extent (%) extent (%) know (%)
Clause
Best interest of
students
I 0 4.3 0 95.7 0
II 0 0 7.1 92.9 0
III 0 0 13.5 86.5 0
IV-E 0 0 6.8 93.2 0
IV-W 0 0 0 94.4 5.6
V 9.1 0 18.2 72.7 0
VI 0 0 14.3 78.6 7.1
Minimization of
risk to students
I 0 0 17.4 82.6 0
II 0 5.6 20.4 70.4 3.7
III 0 3.8 30.8 65.4 0
IV-E 0 2.3 23.3 74.4 0
IV-W 0 0 27.8 72.2 0
V 0 9.1 0 90.9 0
VI 7.1 0 28.6 50.0 14.3
Minimization of
risk to
institution
I 4.3 21.7 30.4 43.5 0
II 0 10.9 36.4 50.9 1.8
III 0 15.4 55.8 28.8 0
IV-E 0 9.1 47.7 43.2 0
IV-W 0 5.6 38.9 55.6 0
V 0 27.3 0 72.7 0
VI 7.1 0 57.1 21.4 14.3
Student develop-
ment considera-
tions
I 8.7 26.1 39.1 26.1 0
II 1.8 7.3 32.7 58.2 0
III 0 8.0 38.0 52.0 2.0
IV-E 0 4.5 31.8 63.6 0
IV-W 0 0 50.0 50.0 0
V 9.1 9.1 45.5 36.4 0
VI 7.1 28.6 0 64.3 0
p ≤ 0.05
In looking at the four factors that involve risk management, potential risk to the
institution, potential risk to students, minimization of risk to students, and minimization
99
of risk to the institution, all show significant differences among regions (see analysis
above). When looking at the results per region for disclosing or not disclosing under
each permissive disclosure clause of FERPA, only one clause shows significance. The
difference is significant under disclosing the results of hearings to victims of violent
crimes (p=.012).
Region VI had the highest percentage of respondents who always disclose hearing
result to victims of violent (64.3%). Region IV-W also has a much higher percentage
than the other regions for sometimes disclosing (43.8%). There is a smaller range in the
never disclose category. These results indicate that in six out of the seven regions
universities are inclined to disclose results of hearings to victims of violent crimes.
Universities in region IV-W are more likely to not disclose.
Table 27
Significant Differences Regarding Whether Institutions Do or Do Not Disclose the
Results of Hearings to Victims of Violent Crimes (Location) ______________________________________________________________________________
N Always Usually Sometimes Never Don’t Know
(%) (%) (%) (%) (%)
Region
Hearing results
to victims
I 24 26.3 42.1 10.5 15.8 5.3
II 57 44.2 26.9 21.2 0 7.7
III 59 38.8 18.4 20.4 8.2 14.3
IV-E 45 40.5 31.0 11.9 14.3 2.4
IV-W 18 31.3 12.5 43.8 6.3 6.3
V 11 18.2 54.5 27.3 0 0
VI 14 64.3 7.1 0 7.1 21.4
______________________________________________________________________________
p=.012
Note: 18 cells have count less than 5.
Size of institution. The size of the institution results in a significant difference in
whether or not policy decisions have been made about three of the permissive disclosure
100
clauses of FERPA. The differences are significant for the following clauses: alcohol and
drug violations (p=.011), results of disciplinary hearings to victims of violent crimes
(p=.002), and employees with a legitimate educational interest (p=.002). These results
are discussed in this section and presented in Table 28.
The Chi-square results indicate that universities with 1,000 – 2,999 are most
likely to be in compliance with FERPA concerning parental notification of alcohol and
drug violations because they have made and published policy decisions. Universities
with 10,000 or more students are the most likely to have made published or unpublished
policy decisions about parental notification of alcohol and drug violations. Universities
with less than 1,000 students are the least likely to have made published or unpublished
policy decisions and, therefore, the most likely to have not made a policy decision at all.
Universities with 3,000 – 9,999 students have the highest percentage of having
made and published a decision regarding disclosing hearing results to victims of violent
crimes (74.5%). Next is 1,000 – 2,999 at 67.4%, 10,000 or more at 51.5%, and under
1,000 is at 45.7%.
These data indicate that universities with 3,000 – 9,999 students are the most
likely to be in compliance with FERPA requirements because they have made and
published policy decisions about disclosing hearing results to victims of violent crimes.
Universities with 3,000 – 9,999 students are also the most likely to have made a
published or unpublished policy decision about disclosing hearing results to victims.
Universities with under 1,000 students are again the least likely to have made a policy
decision and, therefore, the most likely to have not made a policy decision at all.
101
Universities with 1,000 – 2,999 and 3,000 – 9,999 students have the highest and
very similar percentages of having made and published a decision regarding disclosing to
employees with a legitimate educational interest (73.9% and 73.2%). Next are 10,000 or
more at 71.9%, and under 1,000 at 47.9%.
These results indicate that universities with 1,000 – 2,999 students and 3,000 –
9,999 students are more likely to be in compliance with FERPA requirements as they
have the highest percentage of having made and published policy decisions regarding
disclosing information to employees with a legitimate educational interest. Universities
with 1,000 - 10,000 or more students are more likely to have made both published and
unpublished policy decisions about giving information to employees than universities
with less than 1,000 students. Universities with less than 1,000 students are the least
likely to have made published or unpublished policy decisions and, therefore, the most
likely to have not made a policy decision at all.
Table 28
Significant Differences Regarding Whether the Institution Has Made Policy Decisions
About Disclosure (Size of Institution) ______________________________________________________________________________
N Yes, Published Yes, Unpublished No Don’t know
(%) (%) (%) (%)
Clause
______________________________________________________________________________
Alcohol/Drugs
Under 1,000 50 48.9 14.9 31.9 4.3
1,000 – 2,999 92 75.3 13.5 9.0 2.2
3,000 – 9,999 56 69.1 16.4 14.5 0
10,000 or more 34 63.6 27.3 6.1 3.0
Hearing results
to victims
Under 1,000 45.7 17.4 30.4 6.5
1,000 – 2,999 67.4 24.7 6.7 1.1
3,000 – 9,999 74.5 18.2 5.5 1.8
10,000 or more 51.5 27.3 15.2 6.1
102
Table 28 – Continued
______________________________________________________________________________
N Yes, Published Yes, Unpublished No Don’t know
(%) (%) (%) (%)
Clause
______________________________________________________________________________
Employees with
legit. ed. int.
Under 1,000 47.9 35.4 14.6 2.1
1,000 – 2,999 73.9 25.0 1.1 0
3,000 – 9,999 73.2 25.0 1.8 0
10,000 or more 71.9 28.1 0 0
______________________________________________________________________________
p ≤ 0.05
For these three permissive disclosure clauses, alcohol/drugs, hearing results to
victims, and disclosure to employees with a legitimate educational interest, the size of the
university’s student body results in statistically significant differences in whether policy
decisions have been made and published. These differences are presented in Table 29.
Table 29
Size of Institution Influences Whether Policy Decisions are Made Under These Clauses
________________________________________________________________________
Most likely to have Most likely to have Most likely to
made and published made published or not have policy
policy unpublished policy
Clause
______________________________________________________________________________
Alcohol/drugs 1,000 – 2,999 10,000 or more less than 1,000
Victims of violent
crimes 3,000 – 9,999 3,000 – 9,999 less than 1,000
Employees with
leg. ed. int. 1,000 – 9,999 1,000 – 10,000 or more less than 1,000
______________________________________________________________________________
There were no significant differences in the extent to which the listed factors are
considered when making the decisions. In looking at the four factors that involve risk
management, potential risk to the institution, potential risk to students, and minimization
103
of risk to students and minimization of risk to the institution, none show significant
differences among institutions of different sizes. When looking at the results for each
institutional size category for disclosing or not disclosing under each permissive
disclosure clause of FERPA, five clauses shows significance. The difference is
significant under safety emergencies (p=.000), alcohol and drug violations (p=.000),
results of hearings to victims of violent crimes (p=.013), results of hearings to parents of
victims of violent crimes (p=.002), and results of hearings to parents of perpetrators of
violent crimes (p=.000). These results are discussed in this section and presented in
Table 30.
The results for disclosing in safety emergencies are significantly different among
institutions with different sized student bodies (p=.000). Universities with 3,000 – 9,999
students had the highest percentage of respondents who always disclose in safety
emergencies (48.1%). Universities with under 1,000 students had a much higher
percentage than the other sizes for sometimes disclosing (32.6%). No university reported
never disclosing in safety emergencies. These data indicate that universities with 3,000 –
9,999 are the most likely to disclose information in safety emergencies. Universities with
under 1,000 students are the least likely to disclose.
The results for disclosing to parents of students under 21 years of age who violate
alcohol and drug regulations are significantly different among institutions with different
sized student bodies (p=.000). Universities with 10,000 or more students had the highest
percentage of respondents who always (30.3%) and usually (34.6%) disclose alcohol and
drug violations to parents. Universities with student bodies under 1,000 had the highest
percentage of never disclosing alcohol and drug violations (16.3%). These results
104
indicate that universities with 10,000 or more students are most likely to disclose alcohol
and drug violations to parents. Universities with 3,000 – 9,999 students are most likely
not to disclose to parents.
The results for disclosing hearing results to victims of violent crimes are
significantly different among institutions with different sized student bodies (p=.013).
Universities with 3,000 – 9,999 students had the highest percentage of respondents who
always (50.0%) and usually (38.8%) disclose hearing results to victims. Universities
with 10,000 or more students had the highest percentage for sometimes disclosing
(22.6%). Universities with student bodies under 1,000 had the highest percentage of
never disclosing hearing results to victims (16.3%). These data indicate that universities
with 3,000 – 9,999 students are the most likely to disclose hearing results to victims of
violent crimes. Universities with under 1,000 students are the least likely to disclose.
The results for disclosing hearing results to parents of victims of violent crimes
are significantly different among institutions with different sized student bodies (p=002).
Universities with 3,000 – 9,999 students had the highest percentage of respondents who
always disclose hearing results to parents of victims (9.8%). Universities with under
1,000 students had the highest percentage of usually disclosing (19.0%). Universities
with 1,000 – 2,999 students had the highest percentage for sometimes disclosing (46.4%).
Universities with student bodies of 10,000 or more had the highest percentage of never
disclosing hearing results to parents of victims (46.7%). These results indicate that
universities with student bodies of 1,000 - 9,999 are most likely to disclose the results of
hearings to parents of victims of violent crimes, although these numbers are low (15.8%).
105
Most universities do not disclose in these situations, with universities with 10,000 or
more students being the least likely to disclose.
The results for disclosing hearing results to parents of perpetrators of violent
crimes are significantly different among institutions with different sized student bodies
(p=.000). Universities with 10,000 or more students had the highest percentage of
respondents who always disclose hearing results to parents of perpetrators (13.3%).
Universities with under 1,000 students had the highest percentage of usually disclosing
(27.9%). Universities with 3,000 – 9,999 students had the highest percentage for
sometimes disclosing (54.9%). Universities with student bodies of 10,000 or more had
the highest percentage of never disclosing hearing results to parents of perpetrators
(36.7%). These results indicate that universities with 1,000 – 2,999 students are mostly
likely to disclose hearing results to parents of perpetrators of violent crimes. Universities
with 3,000 or more students are the least likely to disclose this information.
Table 30
Significant Differences Regarding Whether Institutions Do or Do Not Disclose Under the
Permissive Disclosure Clauses (Size of Institution) ______________________________________________________________________________
N Always Usually Sometimes Never Don’t Know
(%) (%) (%) (%) (%)
Clause
______________________________________________________________________________
Safety emergency
Under 1,000 50 21.7 41.3 32.6 0 4.3
1,000 – 2,999 92 25.3 63.2 9.2 0 2.3
3,000 – 9,999 56 48.1 48.1 3.7 0 0
10,000 or more 34 41.2 44.1 14.7 0 0
Alcohol/drugs
Under 1,000 7.0 27.9 30.2 16.3 18.6
1,000 – 2,999 20.9 33.7 38.4 2.3 4.7
3,000 – 9,999 28.3 24.5 43.4 3.8 0
10,000 or more 30.3 36.4 30.3 3.0 0
106
Table 30 – Continued
______________________________________________________________________________
N Always Usually Sometimes Never Don’t Know
(%) (%) (%) (%) (%)
Clause
______________________________________________________________________________
Hearing results
to victims
Under 1,000 25.6 18.6 18.6 16.3 20.9
1,000 – 2,999 38.8 29.4 20.0 7.1 4.7
3,000 – 9,999 50.0 30.8 15.4 0 3.8
10,000 or more 38.7 19.4 22.6 9.7 9.7
Hearing results to
parents of victims
Under 1,000 0 19.0 28.6 23.8 28.6
1,000 – 2,999 6.0 13.1 46.4 22.6 11.9
3,000 – 9,999 9.8 7.8 45.1 35.3 2.0
10,000 or more 0 10.0 36.7 46.7 6.7
Hearing results to
parents of perps.
Under 1,000 2.3 27.9 30.2 16.3 23.3
1,000 – 2,999 10.8 25.3 38.6 14.5 10.8
3,000 – 9,999 5.9 13.7 54.9 25.5 0
10,000 or more 13.3 0 43.3 6.7 6.7
______________________________________________________________________________
p ≤ 0.05
For these five permissive disclosure clauses, safety emergencies, alcohol/drugs,
hearing results to victims, hearing results to parents of victims, and hearing results to
parents of perpetrators, the size of the university’s student body results in statistically
significant differences in whether universities disclose. These differences are presented
in Table 31.
107
Table 31
Size of Institution Influences Whether Universities Disclose Under These Clauses
______________________________________________________________________________
Most likely to disclose Most likely to not disclose
Clause
______________________________________________________________________________
Safety emergencies 3,000 – 9,999 less than 1,000
Alcohol/drug 10,000 or more 3,000 – 9,999
Victims of violent
crimes 3,000 – 9,999 less than 1,000
Parents of victims up to 2,999 10,000 or more
Parents of perpetrators 1,000 – 2,999 3,000 – 9,999
______________________________________________________________________________
Full-time enrollment. The number of full-time students shows a significant
difference in whether or not policy decisions have been made about four of the
permissive disclosure clauses of FERPA. The differences are significant for the
following clauses: alcohol and drug violations (p=.027), results of disciplinary hearings
to victims of violent crimes (p=.001), results of disciplinary hearings concerning violent
crimes to the general public (p=.050), and employees with a legitimate educational
interest (p=.003). These results are discussed in this section and presented in Table 32.
The Chi-Square analysis indicates that universities with 1,000 – 2,999 full-time
students are most likely to be in compliance with FERPA regulations as they have the
highest percentage of having made and published policy decisions about informing
parents of alcohol and drug violations. Universities with 10,000 or more full-time
students are most likely to have made both published and unpublished policy decisions
about informing parents. Universities with less than 1,000 full-time students are the least
likely to have made published or unpublished policy decisions and, therefore, the most
likely to have not made a policy decision at all.
108
Universities with 3,000 – 9,999 full-time students are more likely to be in
compliance with FERPA requirements as they have the highest percentage of having
made and published policy decisions regarding disclosing hearing results to victims of
violent crimes. Universities with 3,000 – 9,999 full-time students are also most likely to
have made both published and unpublished policy decisions about giving hearing results
to victims. Universities with less than 1,000 students are the least likely to have made
published or unpublished policy decisions and, therefore, the most likely to have not
made a policy decision at all.
Universities with 3,000 – 9,999 full-time students are more likely to be in
compliance with FERPA requirements as they have the highest percentage of having
made and published policy decisions regarding disclosing hearing results concerning
violent crimes to the general public. Universities with 3,000 – 9,999 full-time students
are also the most likely to have made both published and unpublished policy decisions
about giving hearing results to the general public. Universities with 10,000 or more full-
time students are the most likely to have not made a policy decision at all. Universities
with 3,000 – 9,999 full-time students are the only category that has a higher percentage of
having made a published or unpublished policy decision than not having made a policy
decision.
Universities with 10,000 or more full-time students are more likely to be in
compliance with FERPA requirements as they have the highest percentage of having
made and published policy decisions regarding disclosing information to employees with
a legitimate educational interest. Universities with 10,000 or more full-time students are
also most likely to have made both published and unpublished policy decisions about
109
giving information to employees. Universities with less than 1,000 full-time students are
the least likely to have made published or unpublished policy decisions and, therefore,
the most likely to have not made a policy decision at all.
Table 32
Significant Differences Regarding Whether the Institution Has Made Policy Decisions
About Disclosure (Full-time Enrollment) ______________________________________________________________________________
N Yes, Published Yes, Unpublished No Don’t know
(%) (%) (%) (%)
Clause
Alcohol/drugs
Under 1,000 48 48.9 14.9 31.9 4.3
1,000 – 2,999 88 75.3 13.5 9.0 2.2
3,000 – 9,999 61 69.1 16.4 14.5 0
10,000 or more 20 72.2 22.2 5.6 0
Hearing results
to victims
Under 1,000 45.7 17.4 30.4 6.5
1,000 – 2,999 67.4 24.7 6.7 1.1
3,000 – 9,999 74.5 18.2 5.5 1.8
10,000 or more 44.4 38.9 16.7 0
Hearing results
to public
Under 1,000 14.9 14.9 59.6 10.6
1,000 – 2,999 25.8 10.1 57.3 6.7
3,000 – 9,999 33.9 23.2 41.1 1.8
10,000 or more 11.1 22.2 66.7 0
Employees with
legit. ed. int.
Under 1,000 47.9 35.4 14.6 2.1
1,000 – 2,999 73.9 25.0 1.1 0
3,000 – 9,999 73.2 5.0 1.8 0
10,000 or more 83.3 16.7 0 0
______________________________________________________________________________
p ≤ 0.05
For these four permissive disclosure clauses, alcohol/drugs, hearing results to
victims, hearing results to the general public, and disclosure to employees with a
legitimate educational interest, the number of full-time students results in statistically
110
significant differences in whether policy decisions have been made and published. These
differences are presented in Table 33.
Table 33
Number of Full-time Students Influences Whether Policy Decisions are Made Under
These Clauses
________________________________________________________________________ Most likely to have Most likely to have Most likely to
made and published made published or not have
policy unpublished policy policy
Clause
______________________________________________________________________________
Alcohol/drugs 1,000 – 2,999 10,000 or more less than 1,000
Victims of violent
crimes 3,000 – 9,999 3,000 – 9,999 less than 1,000
Hearing results to
general public 3,000 – 9,999 3,000 – 9,999 10,000 or more
Employees with
leg. ed. int. 10,000 or more 10,000 or more less than 1,000
______________________________________________________________________________
In looking at the four factors that involve risk management, potential risk to the
institution, potential risk to students, minimization of risk to students, and minimization
of risk to the institution, none show significant differences among full-time population
sizes. When looking at the results for full-time population ranges for disclosing or not
disclosing under each permissive disclosure clause of FERPA, seven out of the nine
clauses show significance. The difference is significant under health emergencies
(p=.030), safety emergencies (p=.000), alcohol and drug violations (p=.000), parents of
dependent children (p=.034), disclosing the results of hearings to victims of violent
crimes (p=.007), results of hearings to parents of victims of violent crimes (p=.002), and
results of hearings to parents of perpetrators of violent crimes (p=.000). These results are
discussed in this section and presented in Table 34.
111
Universities with 1,000 – 2,999 full-time students are most likely to disclose
information in a health emergency. Universities with under 1,000 full-time students are
most likely not to disclose in health emergencies, although the percentage is small
(4.3%).
Universities with 3,000 – 9,999 full-time students are most likely to disclose
information in safety emergencies. Universities with under 1,000 full-time students are
most likely to only sometimes disclose in safety emergencies. No universities reported
that they never disclose in safety emergencies.
Universities with 10,000 or more full-time students are most likely to disclose
alcohol and drug violations to parents. Universities with 1,000 – 2,999 full-time students
are most likely not to disclose to parents.
Universities with under 1,000 full-time students are most likely to disclose
information to parents of dependent children. These percentages are low, however,
which means that the majority of universities tend not to disclose in this situation.
Universities with 1,000 – 2,999 full-time students are most likely not to disclose to
parents of dependent children.
Universities with 3,000 – 9,999 full-time students are most likely to disclose
hearing results to victims of violent crimes. Universities with 10,000 or more full-time
students are most likely not to disclose hearing results to victims.
Universities with up to 2,999 full-time students are most likely to disclose hearing
results to parents of victims of violent crimes. These percentages are low, however,
indicating that most universities do not disclose to parents of victims. Universities with
10,000 or more full-time students are most likely not to disclose to parents of victims.
112
Universities with 1,000 – 2,999 full-time students are most likely to disclose
results of disciplinary hearings to parents of perpetrators of violent crimes. No
universities with 10,000 or more full-time students reported always or usually disclosing
in this situation. Universities with 10,000 or more full-time students are most likely not
to disclose to parents of perpetrators.
Table 34
Significant Differences Regarding Whether Institutions Do or Do Not Disclose Under the
Permissive Disclosure Clauses (Full-time Enrollment) ______________________________________________________________________________
N Always Usually Sometimes Never Don’t Know
(%) (%) (%) (%) (%)
Clause
______________________________________________________________________________
Health emergencies Under 1,000 48 8.5 51.1 34.0 4.3 2.1
1,000 – 2,999 88 14.8 68.2 13.6 1.1 2.3
3,000 – 9,999 61 13.0 68.5 18.5 0 0
10,000 or more 20 22.2 38.9 27.8 0 11.1
Safety emergencies
Under 1,000 21.7 41.3 32.6 0 4.3
1,000 – 2,999 25.3 63.2 9.2 0 2.3
3,000 – 9,999 48.1 48.1 3.7 0 0
10,000 or more 44.4 38.9 16.7 0 0
Alcohol/drugs
Under 1,000 7.0 27.9 30.2 16.3 18.6
1,000 – 2,999 20.9 33.7 38.4 2.3 4.7
3,000 – 9,999 28.3 24.5 43.4 3.8 0
10,000 or more 33.3 33.3 27.8 5.6 0
Parents of depen-
dent children
Under 1,000 7.1 26.2 28.6 23.8 14.3
1,000 – 2,999 9.3 16.3 52.3 19.8 2.3
3,000 – 9,999 11.3 18.9 52.8 17.0 0
10,000 or more 17.6 11.8 29.4 29.4 11.8
Hearing results
to victims
Under 1,000 25.6 18.6 18.6 16.3 20.9
1,000 – 2,999 38.8 29.4 20.0 7.1 4.7
3,000 – 9,999 50.0 30.8 15.4 0 3.8
10,000 or more 41.2 17.6 17.6 17.6 5.9
113
Table 34 – Continued
______________________________________________________________________________ N Always Usually Sometimes Never Don’t Know
(%) (%) (%) (%) (%)
Clause
______________________________________________________________________________
Hearing results to
parents of victims
Under 1,000 0 19.0 28.6 23.8 28.6
1,000 – 2,999 6.0 13.1 46.4 22.6 11.9
3,000 – 9,999 9.8 7.8 45.1 35.3 2.0
10,000 or more 0 6.3 31.3 56.3 6.3
Hearing results to
parents of perps.
Under 1,000 2.3 27.9 30.2 16.3 23.3
1,000 – 2,999 10.8 25.3 38.6 14.5 10.8
3,000 – 9,999 5.9 13.7 54.9 25.5 0
10,000 or more 0 0 43.8 50.0 6.3
______________________________________________________________________________
p ≤ 0.05
For these seven permissive disclosure clauses, health emergencies, safety
emergencies, alcohol/drugs, parents of dependent children, hearing results to victims,
hearing results to parents of victims, and hearing results to parents of perpetrators, the
number of full-time students results in statistically significant differences in whether
universities disclose. These differences are presented in Table 35.
Table 35
Number of Full-time Students Influences Whether Universities Disclose Under These
Clauses
________________________________________________________________________
Most likely to disclose Most likely to not disclose
Clause
______________________________________________________________________________
Health emergencies 1,000 – 2,999 less than 1,000
Safety emergencies 3,000 – 9,999 less than 1,000
Alcohol/drugs 10,000 or more 1,000 – 2,999
Parents of dependents less than 1,000 1,000 – 2,999
Victims of violent
crimes 3,000 – 9,999 10,000 or more
Parents of victims up to 2,999 10,000 or more
Parents of perpetrators 1,000 – 2,999 10,000 or more
______________________________________________________________________________
114
Part-time enrollment. The number of part-time students does not show a
significant difference in whether or not policy decisions have been made about the
permissive disclosure clauses of FERPA. There also were no significant differences in
the extent to which the listed factors are considered when making the policy decisions. In
looking at the four factors that involve risk management, potential risk to the institution,
potential risk to students, minimization of risk to students, and minimization of risk to the
institution, none show significant differences among part-time population sizes. When
looking at the results for the part-time population ranges for disclosing or not disclosing
under each permissive disclosure clause of FERPA, no clauses show significance.
On-campus residents. The size of the on-campus population results in a
significant difference in whether or not policy decisions have been made about two of the
permissive disclosure clauses of FERPA. The differences are significant for the
following clauses: results of disciplinary hearings to victims of violent crimes (p=.043)
and results of hearings to the general public (p=.045). These results are discussed in this
section and presented in Table 36.
Universities with 10,000 or more on-campus residents are more likely to be in
compliance with FERPA requirements as they have the highest percentage of having
made and published policy decisions regarding disclosing results of disciplinary hearings
to victims of violent crimes. There was only one response in this size category, however.
The next most likely size is universities with 1,000 – 2,999 on-campus residents.
Universities with 10,000 or more on-campus residents are also most likely to have made
both published and unpublished policy decisions about disclosing hearing results to
victims. As there was only one response in this category, it is also important to know that
115
the next most likely size is universities with 1,000 – 2,999 on-campus residents.
Universities with less than 1,000 students are the least likely to have made published or
unpublished policy decisions and, therefore, the most likely to have not made a policy
decision at all. Most universities have made policy decisions for this clause.
Universities with 10,000 or more on-campus residents are more likely to be in
compliance with FERPA requirements as they have the highest percentage of having
made and published policy decisions regarding disclosing hearing results to the general
public. There was only one response in this size category, so it is important to report that
universities with 1,000 – 2,999 on-campus residents are the next most likely to be in
compliance. The results are the same for having made both published and unpublished
policy decisions about disclosing results to the general public. Universities with 3,000 –
9,999 on-campus residents are the most likely to have not made a policy decision at all.
Table 36
Significant Differences Regarding Whether Institutions Have Made Policy Decisions
About Disclosure (On-campus Residents) ______________________________________________________________________________ N Yes, Published Yes, Unpublished No Don’t know
(%) (%) (%) (%)
Clause
______________________________________________________________________________
Hearing results to
victims
Under 1,000 103 55.6 19.4 19.4 5.6
1,000 – 2,999 65 72.6 23.3 4.1 0
3,000 – 9,999 22 59.3 29.6 11.1 0
10,000 or more 1 100.0 0 0 0
Hearing results to
public
Under 1,000 22.9 12.8 55.0 9.2
1,000 – 2,999 31.1 16.2 50.0 2.7
3,000 – 9,999 7.4 29.6 63.0 0
10,000 or more 100.0 0 0 0
______________________________________________________________________________
p ≤ 0.05
116
For these two permissive disclosure clauses, hearing results to victims and hearing
results to the general public, the size of the university’s student body results in
statistically significant differences in whether policy decisions have been made and
published. These differences are presented in Table 37.
Table 37
Size of On-campus Population Influences Whether Policy Decisions are Made Under
These Clauses ______________________________________________________________________________
Most likely to have Most likely to have Most likely to
made and published made published or not have policy
policy unpublished policy
Clause
______________________________________________________________________________
Victims of violent
crimes 10,000 or more (N=1) 10,000 or more (N=1) less than 1,000
(1,000 – 2,999) (1,000 – 2,999)
Hearing results to
general public 10,000 or more (N=1) 10,000 or more (N=1) 3,000 – 9,999
(1,000 – 2,999) (1,000 – 2,999)
______________________________________________________________________________
There was a significant difference in the extent to which one of the factors is
considered when making the decisions. It is also one of the four factors that involve risk
management. The extent to which minimization of risk to the institution is considered in
different on-campus population sizes is significant (p=.022).
Universities with 10,000 or more on-campus residents and universities with under
1,000 on-campus residents are the most likely to consider minimization of risk to the
institution. Although there is a statistically significant difference in the extent this factor
is considered among sizes of on-campus residents, the majority of universities in all sizes
consider minimization of risk to the institution to a moderate or great extent when making
policy decisions about FERPA. Universities with 3,000 – 9,999 on-campus residents had
117
a rather high percentage of universities that consider this factor to a limited extent
(22.2%).
Table 38
Significant Differences Regarding the Extent to Which Minimization of Risk to the
Institution is Considered When Making Policy Decisions About FERPA (On-campus
Residents)
N Not at Limited Moderate Great Don’t
all (%) extent (%) extent (%) extent (%) know (%)
On-campus
residents
Minimization of
risk to inst.
Under 1,000 103 0 9.2 36.7 53.2 .9
1,000 – 2,999 65 2.7 13.7 50.7 32.9 0
3,000 – 9,999 22 0 22.2 40.7 29.6 7.4
10,000 or more 1 0 0 0 100.0 0
______________________________________________________________________________
p=.022
Note: 7 cells have count less than 5.
When looking at the results per on-campus population size for disclosing or not
disclosing under each permissive disclosure clause of FERPA, four clauses show
significance. The difference is significant under alcohol and drug violations (p=.000),
results of hearings to victims of violent crimes (p=.024), results of hearings to parents of
victims of violent crimes (p=.009), and results of hearings to parents of perpetrators of
violent crimes (p=.000). The results are discussed in this section and presented in Table
39.
Universities with 1,000 – 2,999 on-campus residents are most likely to disclose
alcohol and drug violations to parents. Universities with 10,000 or more on-campus
residents are most likely not to disclose alcohol and drug violations. There is only one
118
university in this category, however, so it is important to report that the next most likely
not to disclose are universities with under 1,000 on-campus residents.
Universities with 10,000 or more on-campus residents are most likely to disclose
hearing results to victims of violent crimes. There is only one university in this category,
however, so it is important to report that the next most likely are universities with 1,000 –
2,999 on-campus residents. Universities with under 1,000 on-campus residents are most
likely not to disclose hearing results to victims.
Universities with 1,000 – 2,999 on-campus residents are most likely to disclose
hearing results to parents of victims of violent crimes. The percentages are low in the
always and usually disclose categories, indicating that most universities do not disclose
hearing results to parents of victims. Universities with 10,000 or more on-campus
residents are most likely not to disclose hearing results to parents of victims. There is
only one university in this category, however, so it is important to report that the next
most likely not to disclose are universities with 3,000 – 9,999 on-campus residents.
Universities with 1,000 – 2,999 on-campus residents are most likely to disclose
hearing results or parents of perpetrators of violent crimes. Universities with 10,000 or
more on-campus residents are most likely not to disclose hearing results to parents of
perpetrators. There is only one university in this category, however, so it is important to
report that the next most likely not to disclose are universities with 3,000 – 9,999 on-
campus residents.
119
Table 39
Significant Differences Regarding Whether Institutions Do or Do Not Disclose Under the
Permissive Disclosure Clauses (On-campus Residents) ______________________________________________________________________________ N Always Usually Sometimes Never Don’t
(%) (%) (%) (%) know (%)
Clause
______________________________________________________________________________
Alcohol/drugs Under 1,000 103 11.8 28.4 39.2 8.8 11.8
1,000 – 2,999 65 33.8 29.6 33.8 2.8 0
3,000 – 9,999 22 22.2 40.7 37.0 0 0
10,000 or more 1 0 0 0 100.0 0
Hearing results to
victims
Under 1,000 29.7 24.8 18.8 10.9 15.8
1,000 – 2,999 49.3 30.4 17.4 2.9 0
3,000 – 9,999 46.2 26.9 11.5 11.5 3.8
10,000 or more 100.0 0 0 0 0
Hearing results to
parents of victims
Under 1,000 3.0 13.1 33.3 30.3 20.2
1,000 – 2,999 8.7 11.6 55.1 20.3 4.3
3,000 – 9,999 4.2 8.3 29.2 54.2 4.2
10,000 or more 0 0 100.0 0 0
Hearing results to
parents of perps.
Under 1,000 2.0 23.0 35.0 22.0 18.0
1,000 – 2,999 17.9 23.9 44.8 11.9 1.5
3,000 – 9,999 4.0 4.0 44.0 44.0 4.0
10,000 or more 0 0 100.0 0 0
______________________________________________________________________________
p ≤ 0.05
For these four permissive disclosure clauses, alcohol/drugs, hearing results to
victims, hearing results to parents of victims, and hearing results to parents of
perpetrators, the size of the university’s student body results in statistically significant
differences in whether universities disclose. These differences are presented in Table 40.
120
Table 40
Size of On-Campus Population Influences Whether Universities Disclose Under These
Clauses
________________________________________________________________________
Most likely to disclose Most likely to not disclose
Clause
________________________________________________________________________
Alcohol/drug 1,000 – 2,999 10,000 or more (N=1)
(less than 1,000)
Victims of violent
crimes 10,000 or more (N=1) less than 1,000
(1,000 – 2,999)
Parents of victims 1,000 - 2,999 10,000 or more (N=1)
(3,000 – 9,999)
Parents of perpetrators 1,000 – 2,999 10,000 or more (N=1)
(3,000 – 9,999)
________________________________________________________________________
Predictors? Discriminant function analysis was performed on the data to
determine which variables best predicted disclosure. The analysis did not result in any
significant predictors (p=.137 to p=.922). This lack of statistically significant analyses
indicates that I cannot predict whether a university discloses or chooses not to disclose
based on the variables identified. The inability to find predictors of disclosure is most
likely due to the low response rate for this survey.
Open-ended question for those who answered “don’t know.” Respondents
who answered “don’t know” to any question were taken to question 38 at the end of their
survey. They were asked if the survey should have been sent to a different person at their
institution or if there was another reason why they didn’t know the answer to the
question(s). There were 27 responses to this question. The results are presented in Table
41 and discussed below.
121
Nine people said they could not answer the question(s) because they have never
dealt with some of the issues involved, such as violent crimes. Six respondents stated
that a different person would have been able to answer the questions. The positions or
offices listed were financial aid, business office, dean of students, judicial affairs, health
center and registrar. Three people noted that no one person at their university would have
been able to answer all the questions.
Three respondents said that they were too new to their positions or had not
attended training concerning FERPA yet. Two people noted that they answered “don’t
know” because they approach the issues on a case by case basis. Two people said that
the situations don’t apply at their graduate institution. Two respondents noted that they
do not have policies in any or all of the FERPA areas.
Table 41
Responses to Open-ended Question Concerning Why Respondents Answered “Don’t
Know” to Any Question in the Survey
Reason Number
______________________________________________________________________________
Never dealt with some issues listed 9
Respondent was wrong person to answer 6
No one person could have answered all questions 3
Too new to position 3
Always decided case by case 2
Situations don’t apply at graduate institution 2
No policies for all areas of FERPA 2
The free responses indicate that those who answered “don’t know” for questions
on the survey did so for two main reasons. Either they have never dealt with some areas
of FERPA or the survey was not completed by the person at their university who had the
most knowledge of FERPA.
122
Chapter 4 Summary of Findings
The survey on disclosure of information under the permissive disclosure clauses
of FERPA generated 232 usable responses. This number falls within the 90% confidence
level with 5.1% margin of error. Most respondents were chief student affairs officers
(49.6%). The majority of respondents came from private universities (66.8%), master’s
level universities (41.8%), from region II of the country (25.8%; New York,
Pennsylvania, West Virginia, New Jersey, Maryland, and Puerto Rico), with 1,000 –
2,999 full-time students (37.5%), fewer than 1,000 enrolled only part-time, and fewer
than 1,000 living on-campus (43.2%). Ninety-seven percent of respondents reported
accepting federal funding.
Research Question 1
The first research question asked if universities have made decisions about each
of the permissive disclosure clauses of FERPA. While the question specifically asked if
the policy decision was made and was published or made and not published because of
FERPA requirements to publish the policy decisions, it is clear when those two categories
are combined, the majority of universities have made policy decisions about all but two
clauses. The exceptions are the disclosure of results of disciplinary hearings concerning
violent crimes to the general public (39.6% have made decisions, 53.8% have not) and
the disclosure of hearing results to parents of victims (49.4% have made decisions, 44.8%
have not). The next closest one also concerns the results of disciplinary hearings—results
to parents of perpetrators (52.2% have made decisions, 43.3% have not). The permissive
disclosure clause that the most institutions have made published decisions on, as required
by FERPA, is disclosure of information to university employees with a legitimate
123
educational interest. The rest in order of highest to lowest percentages are: to parents
about alcohol and drug violations if the student is under 21 years of age, results of
hearings to victims of violent crimes, safety emergencies, health emergencies, to parents
of dependent children, results of hearings to parents of perpetrators of violent crimes,
results of hearings to parents of victims of violent crimes, and results of hearings
concerning violent crimes to the general public. The significant number of institutions
that have made but not published decisions will be discussed in chapter 5.
Research Question 2
The second research question asked to what extent universities disclose
information. The data indicate universities always or usually (defined as disclosing
unless there is a compelling reason not to disclose) disclose in the following order: safety
emergencies (84.6%), employees with a legitimate educational interest (80.9%), health
emergencies (75.3%), results of hearings to victims of violent crimes (65.0%), alcohol
and drug violations to parents of students under 21 years of age (52.1%), parents of
dependent children (27.8%), results of hearings to parents of perpetrators of violent
crimes (27.5%), results of hearings to parents of victims of violent crimes (17.4%), and
results of hearings concerning violent crimes to the general public (6.2%). If we look at
the flip-side of this, the universities that tend not to disclose, the data indicate universities
sometimes (defined as not disclosing unless there is a compelling reason to disclose) and
never disclose in the following order: result of hearing to the general public (84.1%),
results of hearing to parents of victims (70.6%), parents of dependent children (67.5%),
results of hearings to parents of perpetrators (62.3%), alcohol and drug violations
(42.3%), results of hearings to victims (26.6%), health emergencies (22.6%), employees
124
with a legitimate educational interest (17.6%), and safety emergencies (13.6%).
The majority of universities always or usually disclose in safety emergencies, to
employees with a legitimate educational interest, in health emergencies, results of
hearings to victims of violent crimes, and alcohol and drug violations to parents. The
majority of universities only sometimes or never disclose hearing results concerning
violent crimes to the general public, hearing results to parents of victims of violent
crimes, information to parents of dependent children, and hearing results to parents of
perpetrators of violent crimes. These results will be discussed in chapter 5 in light of the
way the law defines institutions’ responsibilities to disclose or not disclose.
Research Question 3
The third research question asked what reasons universities give for either
disclosing or not disclosing under FERPA. When comparing factors for institutions who
disclose under FERPA, it is clear that the best interest of students is considered to a
greater extent when deciding to disclose, followed by the best interest of the university
community and then legal risk to the institution. The range of percentages of considering
the factors to a great extent is: the best interest of students (71.6% - 88.6%), the best
interest of the university community (52.7% - 76.9%), and legal risk to the institution
(22.6% - 52.8%). The range for legal risk is lower, indicating the universities do not
consider it to the same extent as the other two factors. The range of percentages of not
considering the factor at all is: the best interest of students (0% - 4.0%), the best interest
of the university community (.5% - 4.8%), and legal risk to the institution (2.8% -
25.3%). Here, the range for legal risk is higher, indicating a lack of consideration in
making the decisions.
125
When comparing the factors for universities that do not disclose, it is clear that
the percentages are higher overall for considering student privacy rights to a great extent
(30.0% - 92.9%) than for legal risk to the university (20.0% - 56.4%) and student
development considerations (0% - 52.4%). The range of percentages of not considering
the factor at all is: legal risk to the institution (0% - 80.0%), student privacy rights (0% -
50.0%), and student development considerations (0% - 40.0%). The range for legal risk
is again higher, indicating a lack of consideration in making decisions.
Research Question 4
The fourth research question asked if the issue of risk is considered by
universities when making decisions regarding disclosure under FERPA. The risk
management factors concerning students were considered to a greater extent than the risk
management factors concerning the university. When the data for not considering a
factor at all or considering a factor to a limited extent are examined, the percentages are
very low, indicating that risk factors are certainly considered by universities when
making decisions regarding the disclosure clauses.
The mean scores for the risk factors are all between moderate to great extent.
This further supports the idea that universities do consider risk when making decisions
regarding the permissive disclosure clauses of FERPA. Potential risk to students is
considered to the greatest extent, followed by minimization of risk to students, potential
risk to the institution, and minimization of risk to the institution.
Only 20% of those who responded to this free response question consider risk
management to play a major role in their decision to disclose under FERPA. When
combined with those who consider risk management to some extent, however, the
126
percentage of universities that consider risk management rises to 57.5%. When
compared to the 42.5% who stated that risk management plays little or no role in their
decisions, it is clear that the majority of universities at least consider risk management to
some extent.
Research Question 5
The fifth research question asked if institutional type, location, size of the student
body, or size of the on-campus population impacts whether universities disclose or do not
disclose under FERPA and to what extent these characteristics influence an institution’s
use of risk management in the decision to disclose or not to disclose. The statistically
significant results were discussed.
The following characteristics do not influence whether or not universities have
made policy decisions for each disclosure clause: public or private, location, and number
of part-time students. The highest degree offered has an impact on whether a decision is
made for disclosing alcohol and drug violations. The size of the student body has an
impact on whether decisions are made for three disclosure clauses: alcohol and drug
violations, results of disciplinary hearing to victims of violent crimes, and employees
with a legitimate educational interest. The number of full-time students influences
whether a decision is made about disclosure in four clauses: alcohol and drug violations,
results of hearings to victims of violent crimes, results of hearings to the general public,
and employees with a legitimate educational interest. The size of the on-campus
population has an impact on whether a decision is made for two disclosure clauses:
results of disciplinary hearings to victims of violent crimes and results of hearings to the
general public.
127
The size of the institution, the number of full-time students and the number of
part-time students do not influence the extent to which the listed factors are considered
when making decisions about disclosure. There is a significant difference in the extent
the best interest of the institution is considered when making decisions by public and
private universities. There is a difference in the extent that the importance of student
privacy rights is considered by universities with different highest degree levels. The
location of the institution influences the extent the following factors are considered:
potential risk to the institution, potential risk to students, the best interests of students,
minimization of risk to students, minimization of risk to the institution, and student
development considerations. The size of the on-campus population influences the extent
that minimization of risk to the institution is considered.
The only characteristics that influence the extent that risk management factors are
considered when making disclosure decisions are location of the institution (potential risk
to the institution, potential risk to students, minimization of risk to students, minimization
of risk to the institution), and size of the on-campus population (minimization of risk to
the institution). Even though there are significant statistical differences in the categories
of the extent that legal risk to the institution and minimization of risk to the institution is
considered, the majority of universities in all regions of the country consider legal risk
and minimization of risk to the institution to a moderate or great extent when making
policy decisions about FERPA. Likewise, the majority of universities in all regions of
the country consider the potential risk to students, the best interest of students,
minimization of risk to students, and student development considerations to a great extent
when making policy decisions about FERPA. The size of the on-campus population
128
influenced the extent that the minimization of risk to the institution is considered when
making decisions to disclose. Even though there is a statistically significant difference in
the extent this factor is considered among sizes of on-campus residents, the majority of
universities in all sizes consider minimization of risk to the institution to a moderate or
great extent when making policy decisions about FERPA.
The only characteristics that did not influence whether an institution discloses
under the permissive disclosure clauses of FERPA are highest degree offered and number
of part-time students. Being public or private influences disclosing results of hearings to
parents of victims of violent crimes and results of hearings to parents of perpetrators of
violent crimes. The location of the institution influences whether a university discloses
the results of hearings to victims of violent crimes. Institutional size influences
disclosure under the following clauses: safety emergencies, alcohol and drug violations,
results of hearings to victims, results of hearings to parents of victims, and results of
hearing to parents of perpetrators of violent crimes.
The number of full-time students influences disclosure under seven of the nine
clauses: health emergencies, safety emergencies, alcohol and drug violations, parents of
dependent children, results of hearings to victims, results of hearings to parents of
victims, and results of hearings to parents of perpetrators. The size of the on-campus
population influences disclosure under the following clauses: alcohol and drug
violations, result of hearings to victims, results of hearings to parents of victims, and
results of hearings to parents of perpetrators.
129
In the next chapter, I will further discuss the findings of this study and the
implications of the findings. Limitations of the study, implications for practice, and
implications for future research will be discussed.
130
CHAPTER 5: DISCUSSION
In this chapter, the findings of my study and the implications of the findings will
be discussed. A review of the basis of the study is presented, followed by a discussion of
limitations of the study, the findings related to the literature, implications for practice,
and recommendations for future research.
Restatement of the Problem
The Family Educational Rights and Privacy Act has been revised nine times since
its passage in 1974. These revisions included permissive disclosure clauses that allow, in
certain situations and under certain guidelines, information to be released without a
student’s permission. Within certain guidelines, universities may disclose information in
the following situations: health emergencies; safety emergencies; to parents of students
under the age of 21 who violate alcohol or drug regulations; to parents of dependent
children as defined by the Internal Revenue Service; results of disciplinary hearings to
victims of violent crimes; results of disciplinary hearings to parents of victims of violent
crimes if the accused student is found responsible; results of disciplinary hearings to
parents of perpetrators of violent crimes if the accused student is found responsible;
results of disciplinary hearings concerning violent crimes to the general public if the
accused student is found responsible; to university employees with a legitimate
educational interest.
Universities are required to make and publish decisions about every permissive
disclosure clause. As these decisions are required by law, it is important for universities
to periodically review each FERPA permissive disclosure clause. When considering
131
policy development or reviews regarding FERPA, it would be helpful for administrators
to know how other universities handle the permissive disclosure clauses.
Review of Methodology
My study was conducted using the lens of risk management. Culcleasure (2005)
states that risk management is the framework that exists to guide better decision-making
throughout an organization. University administrators are being urged to consider risk
management concepts when making decisions about educational issues (Hoye, 2006;
Lake, 2005; Shackelford, 2007; Sokolow, n.d.; Ward & Tribbensee, 2003). Hoye (2006)
sees risk management efforts as proactive. He states that it is important to “identify,
assess and mitigate unnecessary risk on our own campuses, in order to help better protect
our students, faculty, staff, alumni and guests” (p. 37).
A quantitative relational study was designed to examine to what extent
universities disclose under the permissive disclosure clauses of FERPA, what factors,
such as risk management elements, are taken into consideration when making decisions
about permissive disclosure, and if FERPA-related policy and decisions are dependent on
type of institution. Data were collected via a web survey developed using Qualtrics and
emailed to 1,975 chief student affairs officers. Surveys were completed in part or in
whole by 232 respondents. Data were downloaded directly from Qualtrics into SPSS
18.0 and were analyzed for each research question.
The statistical analyses used to report the results for research questions 1 through
4 (the extent to which universities have made decisions about the permissive disclosure
clauses of FERPA; the extent to which universities disclose student information under the
permissive disclosure clauses of FERPA; ways the issue of risk to the university has
132
played a part in the decisions about the permissive disclosure clauses of FERPA; reasons
universities give for either disclosing or not disclosing information under the permissive
disclosure clauses of FERPA) employ descriptive statistics. These include frequencies,
means, and standard deviations. Frequencies and chi-squares were used to report the
results for research question 5 (whether institutional type, location, size of the student
body, or size of the on-campus population relate to whether universities disclose or do
not disclose under the permissive disclosure clauses of FERPA, and influence a
university’s use of risk management in the decision to disclose or not disclose).
The open-ended questions in the survey were analyzed using the method
described by Marshall and Rossman (1995). The answers were put into categories that
emerge from reading the responses. Patterns and themes were then identified. The
categories, patterns, and themes were coded to make analysis possible.
Key Findings
A summary of the answers to each research question is presented at the end of
Chapter 4 of this document. The results that are the most interesting and have the most to
say about current practice under FERPA are presented here and summarized in Table 42.
FERPA requires that universities make and publish decisions for each of the
permissive disclosure clauses. This research shows that the highest percentage of
published policies is for employees with a legitimate educational interest, and that is only
67.9%. The average of universities with published policies for the permissive disclosure
clauses is only 48.1%. Overall then, fewer than 50% of universities are in compliance
with FERPA in this regard.
There are many universities that reported they have unpublished policies
133
regarding the permissive disclosure clauses of FERPA. The percentages ranged from
15.6% for disclosing hearing results to the general public to 39.3% for disclosing in
health emergencies. The reasons for this could range from simply not knowing that the
policies must be published, not wanting to be tied down to a written policy, or wanting to
have flexibility when dealing with making decisions about disclosing in specific
situations involving students. In addition to the problem of being out of compliance with
FERPA, this presents issues that do not square with risk management (Cassidy et al.,
2000).
Three of the clauses, results of hearings to parents of victims, results of hearings
to parents of perpetrators, and results of hearings to the general public, show published
policies only in the 24.0% to 27.2% range. This may be because universities are unclear
about their ability to make such disclosures. Many university administrators would be
surprised to know that they are able to disclose hearing results concerning crimes of
violence. While crime reporting is required by federal statute and must be done in order
to avoid fines and loss of federal funding, the idea of informing people about specific
hearing outcomes is often not considered a possibility. I do not believe that the low
percentages in these areas are a result of the lack of violent crime on some campuses; I
believe they result from not knowing universities are able to disclose. This is backed up
by the fact that these three clauses have the highest percentages of respondents who did
not know if their universities disclose or do not disclose under them.
For those universities that have made decisions about the permissive disclosure
clauses, the same three clauses, plus disclosing to parents of dependent children, are the
clauses with the highest percentages of never disclosing. Is this a result of universities
134
again not knowing that they can disclose in these instances or being hesitant to “tell on”
students to their parents? From the time that FERPA was enacted, higher education
administrators have believed that it restricted us in what we could tell parents and
guardians of enrolled students. While this restriction has eased over time with the
passage of new acts, it seems that our interpretation of it has not.
The top three disclosure clauses under which universities always disclose are
results of hearings to victims of violent crimes, safety emergencies, and to parents of
students with alcohol and other drug violations who are under the age of 21. These
results are not surprising given events that have occurred. In 2004, a Department of
Education ruling against Georgetown University stated that victims may be given hearing
results about violent crimes and do not have to sign a confidentiality agreement about
those results (Bhatia, 2004). It stated that FERPA does not restrict this information. The
incident at Virginia Tech changed the way we treat information during safety
emergencies and resulted in an environment where the interpretation of the federal law is
much more relaxed and supportive of universities that disclose information in order to
keep people safe. Indicative of the aftermath of this tragedy is the fact that no
respondents to this survey stated that they never disclose in safety emergencies. This is
the only clause where this happened. The number of student deaths due to alcohol and
drug overdoses and the subsequent lawsuits from some parents who questioned why they
were not told about prior violations, with the implication that if they had known they may
have been able to prevent their child’s death, has led many institutions to inform parents
of these violations. These situations made big news in the higher education community;
administrators did not have to read revisions in order to learn about new interpretations of
135
the law in these areas.
When looking at the factors that universities consider when making decisions to
disclose or not to disclose, it is evident that concern for students overrides concern for the
university. For those universities who disclose, they consider the best interest of students
to the greatest extent, followed by the best interest of the university community, and then
legal risk to the institution when making the policy decision to disclose. For those
universities that have made the policy decision to not disclose under one or more of the
permissive disclosure clauses, they consider student privacy rights to the greatest extent,
followed by legal risk to the institution and, close behind, student development
considerations.
Concern over legal risk to the university is not the most important factor when
making policy decisions regarding disclosure of information about students under
FERPA. Universities are more concerned about doing what is right for students than
keeping the university safe from legal action. The responses to the open-ended questions
reinforce this: legal liability is not the most important factor considered; student affairs
administrators are involved in making these disclosures at a higher rate than legal
counsel; student development considerations are weighed heavily in decisions. Were
respondents being honest in their responses? Are these results indicative of the
respondents being chief student affairs officers and, thus, being of a certain mindset? I
believe that the student affairs respondents were being honest—in my experience as a
Dean of Students, concern for students is considered to a greater extent than legal issues.
While we consider possible legal issues surrounding our decisions, the prevalent feeling
is that we want to make the decision that is right for students; we would rather defend
136
that decision than a decision to do what is right for the university (e.g., protecting its
reputation).
It is interesting to compare Table 12 (Extent factors are considered by universities
that make policy decisions TO disclose under each permissive disclosure clause of
FERPA) and Table 13 (Extent factors are considered by universities that make policy
decisions TO NOT disclose under each permissive disclosure clause of FERPA). The
percentages are much higher in the “not at all” category for those universities that do not
disclose than for those that do disclose. The universities that do not disclose, “do not
consider” the factors at a higher percentage. Most of their “not at all” numbers are higher
and most of their “great extent” numbers are lower. Could this mean that the decision to
not disclose is easier to make than the decision to disclose? Is it easier to blindly follow
FERPA’s prohibitions than to make informed decisions about each permissive disclosure
clause? The factors are different, so a straight comparison could not be done.
When looking at risk factors only, it is clear that they are considered from a
moderate to great extent when making permissive disclosure policy decisions. The
responses to the open-ended question regarding risk management, however, only showed
57.5% of respondents considered risk management to some extent; only 20% of those
said it played a major role in decision-making. Comments made clearly show that
respondents consider risk but it is secondary to what is best for students. There is room
for improvement in this area as we are being tasked to use risk management techniques in
decision-making in higher education. One of the problems is that we see discussion of
risk to primarily mean legal risk, when in reality we should be looking at risk as anything
that can impact the organizational objectives of the university negatively. Will this
137
decision affect our reputation? Will it affect recruitment? Will it affect retention? Will
we be out of compliance with FERPA? Have we thought of everything? What is the risk
if a disclosure is made? What is the risk if a disclosure is not made? How much risk can
we accept?
Discriminant function analysis was performed on the data but did not result in any
predictive variables. Certain characteristics, however, did impact disclosure in a
statistically significant way: highest degree offered, size of the student body, number of
full-time students, and number of on-campus residents. Doctoral institutions are the most
out-of-compliance with FERPA concerning notification of alcohol and drug violations in
that they are less likely than baccalaureate and master’s level institutions to have made
and published a decision regarding this clause. Interesting patterns developed when
looking at different student populations.
Universities with 1,000 – 2,999 students and universities with 1,000 – 2,999 full-
time students are the most likely to have made and published a policy decision about
disclosure of alcohol and drug violations. Universities with 1,000 – 2,999 on-campus
residents are most likely to have made and published a policy decision about disclosure
of hearing results to victims and to the general public. Universities with 3,000 – 9,999
students and universities with 3,000 – 9,999 full-time students are the most likely to have
made and published policy decisions about disclosure to victims. When looking at the
statistically significant differences in this area, these results indicate that small and
medium schools are more in compliance with the FERPA requirement to make and
publish policy decisions about the permissive disclosure clauses.
138
Universities with fewer than 1,000 students and universities with fewer than 1,000
full-time students are the least likely to have made and published policy decisions
regarding disclosure of alcohol and drug violations, hearing results to victims of violent
crimes, and disclosure of information to employees with a legitimate educational interest.
Universities with fewer than 1,000 on-campus residents are also the least likely to have
made and published a policy decision regarding disclosure of hearing results to victims.
These results indicate that very small schools are less in compliance with the requirement
to make and publish decisions about the permissive disclosure clauses.
Private institutions are more likely to disclose hearing results to parents of victims
and parents of perpetrators than are public institutions. This may indicate a difference in
relationships with parents and a difference in expectations of parents whose children go
to private institutions. There were several comments regarding this in the responses to
the open-ended question concerning other factors that are considered when making
decisions about FERPA. Private universities reported having a partnership with parents
regarding their students and this sometimes makes private universities more willing to
inform parents. Parents of students at private universities were also described as having
an expectation to be given information in order to stay connected with their students.
Universities with 3,000 – 9,999 students and universities with 3,000 – 9,999 full-
time students are most likely to disclose in safety emergencies and to victims of violent
crimes. Universities with 10,000 or more students and universities with 10,000 or more
full-time students are most likely to disclose alcohol and drug violations. Universities
with up to 2,999 students and universities with up to 2,999 full-time students are most
likely to disclose to parents of victims. Universities with 1,000 – 2,999 students,
139
universities with 1,000 – 2,999 full-time students, and universities with 1,000 – 2,999 on-
campus residents are most likely to disclose to parents of perpetrators.
Universities with fewer than 1,000 students and universities with fewer than 1,000
full-time students are least likely to disclose in safety emergencies. Universities with
1,000 – 2,999 full-time students are least likely to disclose alcohol and drug violations
and to parents of dependents. Universities with 10,000 or more full-time students are
least likely to disclose to victims, parents of victims, and parents of perpetrators.
This allows for clear comparisons for some of the permissive disclosure clauses.
The data indicate that small and medium universities are most likely to disclose in safety
emergencies while very small universities are the least likely to disclose in safety
emergencies. Small and medium universities are the most likely to disclose to victims of
violent crimes and to parents of both victims and perpetrators of violent crimes while
large universities are the least likely to disclose under these clauses. Large universities
are most likely to disclose alcohol and drug violations to parents while small universities
are the least likely to disclose alcohol and drug violations.
The key findings discussed above are presented in Table 42. This is not an
exhaustive list of the findings of my study; the findings presented here are the most
interesting and relevant to the current practice in higher education concerning disclosure
under FERPA.
140
Table 42
Key Findings that Are the Most Interesting and the Most Relevant to Current Practice
Regarding FERPA
Only 48.1% of universities have published policies for the permissive disclosure clauses of FERPA; thus, fewer than 50% are in compliance with FERPA.
Disclosure of hearing results to parents of victims, to parents of perpetrators, and to the general public show published policies in only the 24.0% to 27.2% range.
The clauses concerning disclosure of hearing results to parents of victims, to parents of perpetrators, and to the general public, plus the clause concerning disclosure to parents of
dependent children, are the clauses with the highest percentages of never disclosing.
The top three clauses under which universities always disclose are results of hearings to victims of violent crimes, safety emergencies, and to parents of students with alcohol and
drug violations.
Concern for students overrides concern for the university when making policy decisions to disclose or not disclose.
Risk factors are considered from a moderate to great extent when making permissive disclosure policy decisions. Only 57.5% of respondents to the open-ended question
consider risk management to some extent; only 20% said it played a major role in
decision-making.
Doctoral institutions are the most out-of-compliance with FERPA regarding notification of alcohol and drug violations.
Small and medium universities are more in overall compliance with the FERPA requirement to make and publish policies.
Very small universities are less in overall compliance with the requirement to make and publish policies.
Private institutions are more likely to disclose hearing results to parents of victims of violent crimes and to parents of perpetrators of violent crimes than are public institutions.
Small and medium universities are most likely to disclose in safety emergencies; very small universities are least likely to disclose in safety emergencies.
Small and medium universities are most likely to disclose to victims of violent crimes and to parents of both victims and perpetrators of violent crimes; large universities are
least likely to disclose under these clauses.
Large universities are most likely to disclose alcohol and drug violation to parents; small universities are least likely to disclose alcohol and drug violations.
______________________________________________________________________________
141
Implications of the Research
A discussion of the results of my research in relation to the findings of prior
research concerning FERPA policies, legitimate educational interest, disclosure to
parents of dependent children, disclosure to parents of alcohol and drug violations, and
risk management follows and is presented in Table 43. This section also includes
recommendations for practice and a discussion of the limitations of my study.
Discussions of the Findings Related to the Literature
My research is related to several prior research studies. These studies fall under
the categories of FERPA policies, disclosure to university employees with a legitimate
educational interest, disclosure to parents of dependent children, disclosure to parents of
children under the age of 21 who violate alcohol and drug policies, and risk management.
FERPA policies. Schuerman (1980) found that only 18% of the 100 universities
he surveyed did not have written FERPA policies at that point. He also found that private
universities complied with FERPA to a lesser extent than state universities. While my
study did not ask about a general FERPA policy, it found the percentages of those who
have no written FERPA policies for individual permissive disclosure clauses is actually
much higher than 18%. My data range from a low of 32.1% for not having a written
policy about releasing information to employees with a legitimate educational interest to
a high of 76.0% for not having a written policy about releasing results of hearings
concerning violent crimes to the general public. While my results were not statistically
significant for having a written policy for permissive disclosure clauses when comparing
public and private universities, there were some differences that support Schuerman’s
findings. Public universities had higher percentages than private universities for having
142
written policies for seven out of the nine clauses. The two clauses for which the
percentages for private universities were higher were health emergencies (private-52.3%,
public-51.5%) and alcohol and drug violations (private-69.7%, public-60.9%).
Sayer (2005) surveyed 16 institutions in Nebraska and concluded that fewer than
half of them had developed policies to address all aspects of FERPA. My study found
that more than half of the respondents had published policies for six out of the nine
disclosure clauses: employees with a legitimate educational interest (67.9%), alcohol and
drug violations (66.5%), results of hearings to victims of violent crimes (62.3%), safety
emergencies (55.1%), health emergencies (51.8%), and parents of dependent children
(51.6%). The three that fewer than half have published policies for all have to do with
hearing results: results of hearings to parents of perpetrators (27.2%), results of hearings
to parents of victims (26.5%), and results of hearings to the general public (24.0%).
Legitimate educational interest and parents of dependent children. Turner-
Dickerson (1997) surveyed registrars at 56 institutions. Ninety-eight percent of the
respondents stated that information from students’ education records would be released to
university personnel with a legitimate educational interest and that 28% released
information to parents of dependent children. My study found that 13.8% always release
to employees with a legitimate educational interest and 67.1% usually release (release
unless there is a good reason not to), for a total of 80.9%. This result is lower than the
Turner-Dickerson result. Only 0.5% never release to employees with a legitimate
educational interest. My study also found that only 9.4% always release information to
parents of dependent children and 18.4% usually release, for a total of 27.8%. This is
comparable to the Turner-Dickerson study. The percentage of respondents who never
143
release to parents of dependent children is 20.8%.
Parental notification of alcohol and drug violations. Watts (2003) surveyed
1,175 universities about the adoption of parental notification policies concerning alcohol
and drug violations. She found that 69% had a policy. She did not differentiate between
published and unpublished policies. Sixty-four percent of the respondents considered the
risk of lawsuits to be an important consideration in their policies. Of the universities that
did not have a policy, 58% said they were concerned that notifying parents would
interfere with a student’s right to independence and 71% felt that “telling on” students
would not promote responsibility for their actions. My study found that 66.5% of
respondents have a published policy about notifying parents of alcohol and drug
violations. The percentage with policies that are unpublished is 16.5%. So the total of
universities with policies is 83.0%; 14.7% reported not having a policy at all.
My study found that for those who disclose alcohol and drug violations, only
25.3% said they do not consider legal risk when making the decision to disclose; 74.7%
consider legal risk to some extent, but only 22.6% to a great extent. For those who do not
disclose alcohol and drug violations, only 20.0% said they consider legal risk to a great
extent when making the decision to not disclose. Of those who do not disclose alcohol
and drug violations, 30.0% consider student development considerations (defined in the
survey as “telling on students may work against promoting a sense of responsibility for
their own actions and growing independence”) to a great extent, 10.0% to a moderate
extent, 20.0% to a limited extent, and 40.0% do not consider them at all. This is much
lower than in the Watts (2003) study. This difference could be a result of two current
trends: a rise in parental expectations of continued involvement in the lives of their
144
children and the increased pressure to keep students safe from alcohol poisoning. We,
college administrators, ask ourselves the following questions quite frequently: how can
we not tell parents that their child is involved in risky behavior concerning alcohol and
drugs? If the behavior continues and something happens to that student, how could we
justify not having told the parents what we knew?
Henning (2004) surveyed chief student affairs officers at 318 universities. That
study found that being located in the northeast and being a private institution were
predictors of disclosure of alcohol and drug violations. My study found that 25.0% of
public institutions always disclose, while only 20.1% of private institutions always
disclose; 25.0% of public institutions usually disclose, while 31.9% of private institutions
usually disclose. The results for never disclosing alcohol and drug violations are 4.4%
for public universities and 6.3% for private universities. These data were not statistically
significantly different but do show that private universities are not more likely to disclose
than public ones.
Region I in this study encompasses the northeast part of the country. The Chi-
square analysis for disclosure of alcohol and drug violations was not statistically
significant, but there are differences. Region I has the highest percentage for always
disclosing (36.8%) and the second highest for usually disclosing (31.6%); when those
two categories are combined, Region I has the highest percentage for disclosing (68.4%).
This supports Henning’s (2004) findings.
Lowery, Palmer, and Gehring (2005) surveyed 665 universities about alcohol and
drug violations disclosure and found that 49% reported having a formal parental
notification policy for alcohol and drug violations. My study found that 66.5% of
145
respondents have a published policy about notifying parents of alcohol and drug
violations.
Risk management. The University Risk Management and Insurance Association
(URMIA) states that risk management should be part of the decision-making process in
higher education and risk assessment should be done before any decisions are made. The
AGB/NACUBO study (2009) surveyed college presidents and boards about risk
management. Forty-one percent of respondents “mostly agreed” their institution
considered risk management to be a priority. My study asked respondents to what extent
they consider risk factors when making policy decisions about FERPA. The risk factors
considered were potential risk to the institution, potential risk to students, minimization
of risk to students, and minimization of risk to the institution. When the items not
considering a factor at all or considering a factor to a limited extent are examined, the
percentages are very low (0% - 12.5%), indicating that risk factors are considered to a
moderate or great extent when making decisions regarding the disclosure clauses. The
mean scores for the risk factors are all considered between moderate to great extent.
A study conducted in 1995 found that student affairs professionals were giving
more consideration to legal issues when making decisions in their work than they had in
the past (Cooper & Lancaster, 1995). The researchers attempted to ascertain if the
student affairs practitioners made decisions with risk management, liability reduction,
and adherence to policy in mind (“legal/rational” response) or if they made decisions
with concern for the affective outcomes for the students (“traditional/developmental”
response). Their results indicated there was an increase in consideration of both legal and
developmental considerations in decision-making, but the increase in legal consideration
146
was greater. My research shows that student concerns are considered to a greater extent
than legal concerns when making policy decisions concerning the permissive disclosure
clauses of FERPA.
The following table provides a summary of the comparison of my study to prior
research. It does not contain all results of my research, only those that pertain to previous
research studies about FERPA and risk management.
Table 43
Comparison of Greer (2012) Research with Previous Research Involving Disclosure
Under FERPA and Risk Management
Greer (2012) Research Previous Research
FERPA Policies
32.1% - 76.0% did not have written Dissimilar to Schuerman (1980): 82% did
policies concerning some disclosure not have written policies
clauses
Public universities had higher Similar to Schuerman (1980): public
percentages than private universities for universities are more likely to be in
having policies for 7 out of 9 clauses compliance than private universities
More than half of respondents had Dissimilar to Sayer (2005): fewer than half
policies for 6 out of 9 disclosure clauses of institutions had policies addressing all
aspects of FERPA
Legitimate Educational Interest and Dependent Children
80.9% release information to employees Dissimilar to Dickerson (1997): 98%
with a legitimate educational interest release information to employees with a
legitimate educational interest
27.8% release information to parents Similar to Dickerson (1997): 28% release
of dependent children information to parents of dependent children
Parental Notification of Alcohol and Drug Violations
66.5% have a published policy and Similar to Watts (2003): 69% have a policy
16.5% have an unpublished policy on on alcohol and drug violations
alcohol and drug violations
147
Table 43 – Continued
Greer (2012) Research Previous Research
74.7% consider legal risk to play a role Similar to Watts (2003): 64% consider legal
in the policy decision risk to be an important factor in their policy
decision
60% consider student development Similar to Watts (2003): 58% were
factors to some extent; only 30% concerned that notifying parents would
consider them to a great extent interfere with student’s independence; 71%
felt “telling on” students would not promote
responsibility
Private institutions are not more likely Dissimilar to Henning (2004): being
to disclose alcohol and drug violations private is a predictor of disclosure of alcohol
and drug violations
Institutions in the northeast are more Similar to Henning (2004): being located in
likely to disclose alcohol and drug the northeast is a predictor of disclosure of
violations alcohol and drug violations
66.5% have a published policy about Dissimilar to Lowery, Palmer, Gehring
notifying parents about alcohol and (2005): 49% had a formal notification policy
drug violations for alcohol and drug violations
Risk Management
87.5% - 100% consider risk Dissimilar to AGB/NACUBO (2009):
management to moderate or great extent 41% “mostly agreed” they consider risk
when making policy decisions regarding management to be a priority
FERPA
Student issues are considered to a Dissimilar to Cooper & Lancaster (1995):
greater extent than legal issues when increase in consideration of legal issues
making policy decisions about FERPA (includes risk management) over student
development issues in decision-making
________________________________________________________________________
Recommendations for Practice
Universities are required by law to make and publish decisions about each of the
permissive disclosure clauses of FERPA. There are growing liability issues concerning
health and safety on campus. It is important for universities to address each permissive
disclosure clause and make a disclosure decision about each of them. As universities
148
consider policy development or reviews, it would be helpful for administrators to know
how other universities handle the permissive disclosure sections of FERPA. Decisions to
revise could then be made in light of prevailing practices.
The results of my research provide administrators with an idea of how universities
are addressing the permissive disclosure clauses. While only 48.1% of respondents are in
compliance with the FERPA requirement to make and publish policy decisions for each
of the permissive disclosure clauses, this is an improvement since the Schuerman study.
Schuerman (1980) found that only 18% of universities in his study had FERPA policies.
There has also been an improvement in the area of alcohol and drug notification.
Lowery, Palmer, and Gehring (2005) found that only 49% had a formal policy regarding
notification of alcohol and drug violations; this study found that 66.5% had published
policies. There is still a large percentage of universities that have not made and published
decisions about the permissive disclosure clauses of FERPA as required by law. Those
universities that have not made decisions for each disclosure clause should start the
process to do so.
A committee made up of the chief student affairs officer, dean of students,
conduct administrator, registrar, and financial aid director might be an appropriate group
to consider and draft policies. The initial work could take some time as the committee
sorts through the issues, considers the risks of disclosing and not disclosing, and makes
the decision about each clause that is right for their institution. These decisions should
then be reviewed yearly to make sure they are still appropriate for the university and the
students.
149
There is also a large percentage of universities that have made decisions but have
not published those decisions. Thirty-nine percent of respondents have made decisions
about disclosing in health emergencies but have not published them. This is followed by
37.8% that have unpublished policies for disclosing in safety emergencies. Those
universities that have made decisions but have not published them should put those
decisions in writing and communicate those decisions to the university community.
My study shows that risk management issues are taken into consideration when
making permissive disclosure clause decisions. When the results of not considering a
risk factor at all are examined, the percentages are very low, indicating that risk factors
are considered to a moderate or great extent when making decisions regarding the
disclosure clauses. The responses to the open-ended question concerning risk
management indicate that more universities consider risk management (57.5%) than do
not consider it (42.5%).
Risk management should be used by universities when making decisions about
the permissive disclosure clauses. The University Risk Management and Insurance
Association (URMIA) states simply that risk management “seeks to enhance judgment
and decision-making throughout the organization, in such a way as to beg the question
‘have you thought of…?’ when making decisions about any aspect of the enterprise…”
(URMIA, 2007, p. 18). Bickel and Lake noted in 1997 that, “practically speaking, the
days of wide college immunity are gone (if they ever truly existed). Courts are
increasingly willing to apply traditional tort law notions of duty to the university” (p.
755). The Higher Education Opportunity Act of 2008 has eased the fears of universities
by clarifying that in a safety situation, a university that discloses information within the
150
FERPA guidelines will not be held liable (Department of Education, 2008, p. 336). Now
universities are concerned about the legal risk of not disclosing. Enterprise Risk
Management (ERM) could provide a framework for identifying the risks of disclosing or
not disclosing under the permissive disclosure clauses and for making appropriate
decisions for the university. Adoption of ERM would create an environment where risk
is always considered when making decisions and the decisions are based on what is
acceptable and important to the university.
Limitations of the Study
The response rate for my survey was only 14.33%, and a power analysis
conducted prior to distribution of the survey revealed that the number of responses
needed to confidently generalize to the population was 239. Although my response rate
fell short by only 7 responses, or 2.9%, this means that any generalizations must still be
offered with caution.
My survey was sent to chief student affairs officers at baccalaureate degree (or
higher) granting universities in the United States who have email addresses listed in the
Digital Higher Education Directory. While chief student affairs officers certainly
supervise staff members who are intimately involved in FERPA issues, the chief officers
may not be fully aware of the policies at their institutions. From the variety of titles of
the respondents, however, it does seem that some of the chief student affairs officers
forwarded the survey to staff they considered to be more appropriate. The percentages of
“don’t know” responses were very low in most areas, so this limitation may not be a great
concern.
Another limitation of the study is that the individuals answering the survey may
151
not have been at the university when decisions were made or may not have been involved
in making the decisions regarding the permissive disclosure clauses of FERPA. They
may not know, therefore, why the decisions were made. The percentages of “don’t
know” responses concerning consideration of factors in decision-making were, again,
very low, so this limitation may not be a great concern.
The fact that FERPA is a legal issue may result in another limitation of the study.
Administrators may not be inclined to tell the truth if they know, or think they know, they
are in violation of FERPA. Or they may know the law and answer as they think they
should, rather than based on their university’s policy. It is hoped that the guarantee of
anonymity minimized this limitation.
One possible reason for the low response rate may be that respondents may have
been concerned about the anonymity of the survey. Indeed, one well-known chief
student affairs officer told me he would not answer the survey because I would have been
able to identify which survey was his by the demographic data requested.
Comfort level with web-based surveys may also have influenced response rate.
While the pilot study participants assured me that the survey was easy to take, there are
certainly college administrators who are not experienced with web-based surveys and,
therefore, may not attempt to complete them.
Many chi-square tests reported had at least one cell count less than five. It was
not possible to combine cells as most of the small cells involved either “not at all,”
“never” or “don’t know” answers. Removing these categories would have removed
interesting data and would not have resulted in a full range of information. There were
also some small categories of universities, e.g., universities with over 10,000 on-campus
152
residents, which caused small cell counts. The low cell counts violate one of the
assumptions of chi-square, that the minimum expected cell frequency should be five.
This may indicate that the chi-square test is unreliable and the analysis may be suspect.
Finally, my study was not able to discover predictors for disclosing or not
disclosing under the permissive disclosure clauses. The statistical analyses for this were
not significant.
Recommendations for Further Research
My study looked at all of the permissive disclosure clauses of FERPA. It is
possible that one reason the response rate was lower is because the survey was long, and
therefore it may be more effective to study each clause separately. This would allow for
more in-depth questions about the clauses and why universities do or do not disclose. I
chose to look at all of the permissive disclosure clauses in this study because there as
only been limited research done on three clauses: parental notification of alcohol and
drug violations, disclosure to parents of dependent students, and disclosure to university
personnel with a legitimate educational interest. Future research could study each clause
separately but in a consistent manner.
My study found that certain characteristics (i.e., public/private, location, size,
number of full-time students, and on-campus population size) differentiated whether or
not a university discloses under the permissive clauses. Another research study that looks
at why this is, could be helpful to complete this body of knowledge.
My study did not address the reasons that universities have or have not made
decisions about the permissive disclosure clauses. Less than 50% of universities are in
compliance with FERPA regarding published policy decisions. Why are they not in
153
compliance? Are they aware of the FERPA requirements? If they are, why haven’t they
made a policy decision? Have they made decisions about some but not all of the
disclosure clauses? Why is there a difference among clauses? Are they making decisions
on a case by case basis? Why do they consider this better than making a policy decision?
Are they concerned about inconsistency and possible legal issues resulting from this?
Delving into this phenomenon may provide interesting information about why some
institutions are not abiding by federal regulations.
Also, it would be interesting to know the reasons why the clauses that have the
highest percentages of decisions made (employees with a legitimate educational interest,
alcohol and drug violations, results of hearings to victims of violent crimes, safety
emergencies, health emergencies, to parents of dependents) are the highest and why the
remaining three clauses (results of hearings to parents of perpetrators of violent crimes,
results of hearings to parents of victims of violent crimes, results of hearings concerning
violent crimes to the general public) are so much lower. The reasons for this could be
very complicated and institution-specific. As large universities are the least likely to
disclose to parents of victims and perpetrators, I do not think the low figures are simply a
result of low crime rates.
In addition, learning why there is always disclosure at some universities under
some clauses (i.e. hearing results of victims of violent crimes, safety emergencies, drug
and alcohol violations) but never disclosure under others (i.e., hearing results to the
general public, hearing results to victims, hearing results to parents of perpetrators,
information to parents of dependent children) would be interesting. The number of
“sometimes” and “usually” responses indicates that universities may be making some
154
disclosure decisions on a case by case basis. It is also possible that institutions make
policy decisions but do not follow them strictly. Questions of consistency and fairness
result. This may lend itself more to qualitative research in order to really get to the
reasons driving universities to make these decisions.
It would be interesting to combine some variables in this study to determine if
there is any predictive value. For instance, are small, private universities in the south
more likely to disclose than small, public universities in the northeast? There are many
combinations that could be explored. This was not a research question of this study, but a
secondary analysis of the data could be done.
For someone interested in the risk management aspect of this study, a more
generalized look at how student affairs professionals use the concepts of ERM in making
decisions about other aspects of their responsibilities would be a good next step.
Decisions about conduct would be an especially interesting area to look at through the
lens of risk management. Qualitative research that collects data through observation
would be advisable in order to follow decision-makers over a period of time and allow
for discussions of their decision-making process. It would then be possible to see if their
espoused use of risk management techniques matches their actual use.
My study showed that location and size of the on-campus population were the
only characteristics that resulted in a statistical difference in the extent that risk
management factors are considered when making decisions about the permissive
disclosure clauses. Region V considered risk to the institution and minimization of risk
to the institution and students to the greatest extent. Region I considered risk to students
to the greatest extent. Universities with on-campus populations of 10,000 or more (N=1)
155
and under 1,000 considered the minimization of risk to the institution to the greatest
extent. Perhaps a study of why this is would be worthwhile.
Another interesting look at risk management could be to interview different staff
members at the same institution to see if risk is more of a factor in different areas of
responsibility. One could investigate, for instance, conduct, housing, student activities,
and athletics, as to what extent they consider risk factors when making decisions about
their areas of operation , and this could lead to important information about which areas
of institutions are moving toward decision-making based on risk rather than student
concerns only.
Closing
The purpose of my study was to determine the extent to which universities
disclose student information without student consent, as allowed under the permissive
disclosure clauses of FERPA, and if any characteristics of institutions can predict
disclosure. It attempted to ascertain if universities have published policies regarding
disclosure as required by FERPA. It also tried to determine why universities have chosen
to disclose or not disclose, and if the concept of risk management plays a part in the
decision.
Overall, the majority of universities always or usually disclose in safety
emergencies, to employees with a legitimate educational interest, in health emergencies,
results of hearings to victims of violent crimes, and alcohol and drug violations to
parents. The majority of universities only sometimes or never disclose hearing results
concerning violent crimes to the general public, hearing results to parents of victims of
violent crimes, information to parents of dependent children, and hearing results to
156
parents of perpetrators of violent crimes.
When looking at the reasons for disclosing or not disclosing, it is clear that
universities consider the best interest of students to be more important than legal risk to
the institution. Risk management is considered to some extent by institutions when
making decisions regarding disclosure; the risk to students is considered to be more
important than risk to the institution.
Statistical analysis did not reveal any predictors of disclosure. Some
characteristics did, however, show significance in whether or not institutions have made
policy decisions, the extent to which factors are considered in those decisions, and
whether an institution discloses or does not disclose under certain permissive disclosure
clauses.
FERPA is clear: it permits release in certain situations and it requires universities
to make decisions about the permissive disclosure clauses and publish these decisions so
as to inform students of them. Yet, my study clearly shows the majority of universities
are not in compliance with FERPA because they do not have published policies.
Universities should make the effort to be in compliance by making and publishing
decisions on each permissive disclosure clause. The results of my research could provide
helpful information for universities in the decision-making process.
157
REFERENCES
American Association of Collegiate Registrars and Admissions Officers (2010).
Practical online guide to the Family Educational Rights and Privacy Act.
Retrieved on April 25, 2010 from
http://www.aacrao.org/federal_relations/ferpa/index.cfm
Anastas, J. W. (1999). Research design for social work and the human services (2 nd
ed.).
New York: Columbia University Press.
Association of Governing Boards of Universities and College (2009). The state of
enterprise risk management at colleges and universities today. Retrieved on July
1, 2009 from http://www.agb.org/user-assets/documents/AGBUE_FINAL.pdf.
Association of Governing Boards of Universities and Colleges/National Association of
College and University Business Officers (2007). Meeting the challenges of
enterprise risk management in higher education. Retrieved on July 14, 2009 from
http://www.nacubo.org/documents/business_topics/NACUBOriskmgmtWeb.pdf.
Baker, T. R. (2005). Notifying parents following a college student suicide attempt: A
review of case law and FERPA, and recommendations for practice. NASPA
Journal, 42(4), 513 – 533.
Bernstein, E. (2007, December 6). Colleges move boldly on student drinking. The Wall
Street Journal On-line. Retrieved November 21, 2007 from
http://online.wsj.com/public/article_print/SB119690910535115405.html
Bhatia, J. (2004, September 7). Georgetown Ruling Breaks Silence on Campus Rape.
WeNews. Retrieved December 20, 2011 from http://www.womensenews.org/story/rape/040907/georgetown-ruling-breaks-silence-
campus-rape
Bickel, R., & Lake, P. (1997). The emergence of new paradigms in student-university
relations: From in loco parentis to bystander to facilitator. The Journal of College
and University Law, 23(4), 755 - 795.
Bodine, S., Pugliese, A., & Walker, P. (2001). A road map to risk management. Journal
of Accountancy, 192(6), 65 – 70.
Burd, S. (2000, July 14). Colleges allowed to tell parents about alcohol use. The
Chronicle of Higher Education, p. A31.
Callihan, D. S. (1983). Conditions of compliance: A case study of the Buckley
Amendment (reference letters). (Doctoral dissertation, Miami University, 1983).
Proquest Information and Learning Company.
158
Carnegie Foundation for the Advancement of Teaching (2011). Classification
Description. Retrieved August 15, 2011, from
http://classifications.carnegiefoundation.org/descriptions/size_setting.php.
Cassidy, D., Goldstein, L., Johnson, S., Mattie, J., & Morley, J. (2000). Developing a
strategy to manage enterprisewide risk in higher education. Washington, DC:
NACUBO.
Chapman, C. (2001, June). The big picture--enterprise risk management services.
Internal Auditor. Retrieved February 13, 2009 from
http://findarticles.com/p/articles/mi_m4153/is_3_58/ai_77151366.
Clay, M. R. (2001). Student, faculty, and administrator knowledge and perceptions of the
Buckley Amendment at St. Petersburg College: An assessment 27 years after
implementation. (Doctoral dissertation, University of Missouri – Columbia,
2001). Proquest Information and Learning Company.
Cooper, D., & Lancaster, J. (1995). The legal and developmental perspectives: A
question of balance. College Student Affairs Journal, 15(1), 5 – 15.
Culcleasure, F. (2005). Risk management: A study of current practices at North
Carolina’s private colleges and universities. (Doctoral dissertation, Capella
University, 2005). Proquest Information and Learning Company, 114.
Creswell, J. W. (2003). Research design: Qualitative, quantitative, and mixed methods
approaches (2 nd
ed.). Thousand Oaks, CA: Sage Publications.
Daggett, L. M., & Huefner, D. S. (2001). Recognizing schools’ legitimate educational
interests: Rethinking FERPA’s approach to the confidentiality of student
discipline and classroom records. American University Law Review, 51, 1 – 48.
Daniel, B. V., Evans, S. G., & Scott, B. R. (2001). Understanding family involvement in
the college experience. New directions for student services, Consumers,
adversaries, and partners: working with the families of undergraduates (No. 94,
pp. 3 – 13). San Francisco: Jossey-Bass, Inc.
Dickson, G. C. A. (1978). Decision theory in risk management. London: Keith Shipton
Developments Limited.
Digital Higher Education Directory (2010). Reston, VA: Higher Education Publications,
Inc.
Dobbins, K. W. (1987). Student and administrator knowledge and perceptions of the
Buckley Amendment at Kent State University. (Doctoral dissertation, Kent State
University, 1987). Proquest Information and Learning Company.
Dominici, M. L. (1979). Privacy rights of California community college students and the
159
Buckley Amendment. (Doctoral dissertation, University of Southern California,
1979). Proquest Information and Learning Company.
Eick, C. (2003). Factors that promote effective risk management at universities classified
by the Carnegie system as doctoral/research universities – extensive. (Doctoral
dissertation, Auburn University, 2003). Proquest Information and Learning
Company, 114.
Farrell, E. F. (November 16, 2001). Colleges' risk managers face a rising tide of
litigation. Chronicle of Higher Education, 48(12), A29 - A31.
Fowler, F. J. (2002). Survey research methods (3rd ed.). Thousand Oaks, CA: Sage
Publications.
Fry, B. G. (1999). An academic dilemma: Student records, faculty access, and the
Family Educational Rights and Privacy Act. (Doctoral dissertation, Texas Tech
University, 1999). Proquest Information and Learning Company.
Gehring, D. D. (1994). The federal university. In M. D. Coomes & D. D. Gehring
(Vol. eds.), New directions for student service, Student services in a changing
federal climate (No. 68, pp. 93 – 110). San Francisco: Jossey-Bass, Inc.
Gehring, D. D. (1994). Protective policy laws. In M. D. Coomes & D. D. Gehring (Vol.
eds.), New directions for student services, Student services in a changing federal
climate (No. 68, pp. 67 – 82). San Francisco: Jossey-Bass, Inc.
Hall, R. C. (2003). An analysis of student perceptions of Clemson University’s parental
notification policy. (Doctoral dissertation, Clemson University, 2003). Proquest
Information and Learning Company, 105.
Harwell, R. D. (2003). A study of effective risk management practices in higher
education. (Doctoral dissertation, Baylor University, 2003). Proquest
Information and Learning Company, 133.
Head, G., & Horn, S. (1991). Essentials of risk management, VI. Malvern, PA:
Insurance Institute of America.
Henning, G. W. (2004). Predictors of parental notification policies for alcohol-related
violations at colleges and universities. (Doctoral dissertation, University of New
Hampshire, 2004). Proquest Information and Learning Company, 158.
Higher Education Publications, Inc. (2009). Statistics 2007. Retrieved March 6, 2009
from http://www.hepinc.com/pdfs/18Hedstats.pdf
Holder, H. (1990). Buckley Amendment--help or hindrance for postsecondary institution
admissions officers? (Doctoral dissertation, The George Washington University,
160
1990). Proquest Information and Learning Company.
Hoye, W. P. (2006). In pursuit of excellence: integrating pro-active risk management
into the campus culture. Phoenix, AZ: Arizona State University.
Jones, C. (2004). An analysis of administrative discretion and its use to implement
FERPA policy at Southeast Missouri State University. (Doctoral dissertation,
University of Missouri - Columbia, 2004). Proquest Information and Learning
Company.
Lake, P. F. (2005). Private law continues to come to campus: Rights and responsibilities
revisited. The Journal of College and University Law, 31(3), 53 - 92.
Lowery, J. W. (2005). Legal issues regarding partnering with parents: Misunderstood
federal laws and potential sources of institutional liability. In K. Keppler, R. H.
Mullendore, and A. Carey (Eds.), Partnering with the parents of today’s college
students (pp. 43 – 51). USA: NASPA—Student Affairs Administrators in Higher
Education.
Lowery, J. W., Palmer, C. J., & Gehring, D. D. (2005). Policies and practices of parental
notification for student alcohol violations. NASPA Journal, 42(4), 415 – 429.
Marshall, C., Rossman, G. B. (1995). Designing Qualitative Research (2 nd
ed.).
Thousand Oaks, CA: Sage Publications, Inc.
Maycunich, A. M. (2002). FERPA: An investigation of faculty knowledge levels and
organization practices at three land-grant universities. (Doctoral dissertation,
Iowa State University, 2002). Proquest Information and Learning Company.
Mertens, D. M. (2005). Research and evaluation in education and psychology:
Integrating diversity with quantitative, qualitative, and mixed methods (2 nd
ed.).
Thousand Oaks, CA: Sage Publications, Inc.
Midwestern Higher Education Compact (2008). The ripple effect of Virginia Tech:
Assessing the nationwide impact on campus safety and security policy and
practice. Retrieved on November 21, 2008 from
http://www.mhec.org/policyresearch/052308mhecsafetyrpt_hr.pdf
Muffee, V. W. (2007). Risk management: Theory and practice. New York: Nova
Science Publishers, Inc.
O’Briant, D. (2003). The millenials arrive at college with life plans and respect for their
parents. Retrieved November 27, 2005, from
http://www.studentleadership.net/ci/articles/students.htm.
Palmer, C. J., Lohman, G., Gehring, D. D., Carlson, S., & Garrett, O. (2001). Parental
161
notification: A new strategy to reduce alcohol abuse on campus. NASPA Journal,
38(3), 372 – 385.
Ramirez, C. (2004). The FERPA transition: Helping parents adjust to higher education
records laws. Horsham, PA: LRP Publications.
Rea, L., & Parker, R. (2005). Designing and conducting survey research: A
comprehensive guide (3rd ed.). San Francisco, CA: Jossey-Bass.
Reisberg, L. (1998, December 4). When student drinks illegally, should colleges call
mom and dad? The Chronicle of Higher Education, p. A39 – 40.
Rescher, N. (1983). Risk: A philosophical introduction to the theory of risk evaluation
and management. Washington, DC: University Press of America, Inc.
Salant, P., & Dillman, D. (1994). How to conduct your own survey. New York: John
Wiley & Sons, Inc.
Sayer, E. M. (2005). Understanding the Family Educational Rights and Privacy Act
(FERPA): An analysis of FERPA compliance, implementation, and related issues
at Nebraska colleges and universities (Doctoral dissertation, University of
Nebraska-Lincoln, 2005). Proquest Information and Learning Company, 158.
Schuerman, W. C. (1980). A model institutional policy on the privacy of student records
in compliance with the Family Educational Rights and Privacy Act of 1974 as
amended (Doctoral dissertation, The American University, 1980). Proquest
Information and Learning Company, 221.
Sells, D. (2002). Parents and campus safety. New Directions for Student Services, 99, 25
- 35.
Shackelford, A. L. (2007). Conduct a risk-management assessment before tragedy strikes
your campus. Dean & Provost, 8(9) 1, 4 - 5.
Sokolow, B. A. (n.d.). Risk management in the college setting. Retrieved October 10,
2008, from
http://www.ncherm.org/pdfs/RISK_MANAGEMENT_COLLEGE.pdf.
Steinberg, M. B. (2003). A comparative study of the policies, procedures, training and
enforcement of the Family Educational Rights and Privacy Act (FERPA) at public
and private colleges and university in four Carnegie classifications of institutions
of higher education in the United States. (Doctoral dissertation, University of
Louisville, 2003). Proquest Information and Learning Company, 230.
Stripling, J. (2009, June 26). Right to remain silent. Inside Higher Ed. Retrieved June
26, 2009, from
162
http://www.insidehighered.com/layout/set/print/news/2009/06/26/ferpa.
Thomas, R. M. (2000). Applying risk theory to educational development. Santa Barbara,
CA: University of California, Santa Barbara.
Thomas, S. (2004). Using web and paper questionnaires for data-based decision
making: From design to interpretation of the results. Thousand Oaks, CA:
Corwin Press.
Turnage, C. C. (2007). School officials’ knowledge of the Family Educational Rights
and Privacy Act of 1974 at the University of Southern Mississippi. (Doctoral
dissertation, University of Southern Mississippi, 2007). Proquest Information
and Learning Company.
Turner-Dickerson, M. E. (1997). The Family Educational Rights and Privacy Act:
Knowledge, practices, and perceptions. (Doctoral dissertation, University of
Pittsburgh, 1997). Proquest Information and Learning Company.
U.S. Department of Education. (n.d.). Family Educational Rights and Privacy Act
(FERPA). Retrieved April 18, 2010, from http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html
U.S. Department of Education. (n.d.). Legislative history of major FERPA provisions.
Retrieved April 18, 2010, from
http://www2.ed.gov/policy/gen/guid/fpco/ferpa/leg-history.html.
U.S. Department of Education. (n.d.). Higher Education Opportunity Act (August 14,
2008). Retrieved November 14, 2008, from
http://www.ed.gov/policy/highered/leg/hea08/index.html.
University Risk Management and Insurance Association (2007). ERM in higher
education. Retrieved on July 14, 2009 from
http://www.urmia.org/library/docs/reports/URMIA_ERM_White_Paper.pdf.
Ward, P., & Tribbensee, N. (2003). Preventive law on campus. Change, 35(3), 16 - 20.
Watts, L. A. (2003). The use of parental notification and alcohol policies of National
Association of Student Personnel Administrators (NASPA) member institutions
(Doctoral dissertation, State University of New York at Buffalo, 2003). Proquest
Information and Learning Company, 166.
Weeks, K. M. (1985). The Buckley Amendment and college students’ parents:
Limitations and allowances. In R. D. Cohen (Vol. ed.), New directions for
student services, Working with the parents of college students (No. 32, pp. 15 –
26). San Francisco: Jossey-Bass, Inc.
163
Weeks, K. M. (2001). Family-friendly FERPA policies: affirming parental partnerships.
New directions for student services, Consumers, adversaries, and partners:
Working with the families of undergraduates (No. 94, pp. 39 – 50). San
Francisco: Jossey-Bass, Inc.
Weeks, K. M. (2003). Complying with federal law, a reference manual for college
decision makers. Nashville, TN: College Legal Information, Inc.
Whitfield, R. (2003). Managing institutional risks – a framework (Doctoral dissertation,
University of Pennsylvania, 2003). Proquest Information and Learning
Company, 104.
164
Appendix A
Survey Instrument
165
Q1 Permissive Disclosure Clauses of FERPA Survey
Q2 Institutional Type
Public (1)
Private (2)
Q3 Highest Degree Offered by Your Institution
Doctorate (1)
Master's (2)
Baccalaureate (3)
166
Q4 In what state or territory is your institution located?
Alabama (1)
Alaska (2)
American Samoa (52)
Arizona (3)
Arkansas (4)
California (5)
Colorado (6)
Connecticut (7)
Delaware (8)
District of Columbia (48)
Federated State of Micronesia (53)
Florida (9)
Georgia (10)
Guam (54)
Hawaii (11)
Idaho (12)
Illinois (13)
Indiana (14)
Iowa (15)
Kansas (16)
Kentucky (17)
Louisiana (18)
Maine (19)
Marshall Islands (55)
Maryland (20)
Massachusetts (21)
Michigan (22)
Minnesota (23)
Mississippi (24)
Missouri (25)
Montana (26)
Nebraska (27)
Nevada (28)
New Hampshire (29)
New Jersey (30)
New Mexico (31)
New York (32)
North Carolina (33)
North Dakota (34)
Northern Marianas (56)
167
Ohio (35)
Oklahoma (36)
Oregon (37)
Palau (57)
Pennsylvania (38)
Puerto Rico (58)
Rhode Island (39)
South Carolina (40)
South Dakota (41)
Tennessee (42)
Texas (43)
Utah (44)
Vermont (45)
Virgin Islands (59)
Virginia (46)
Washington (47)
West Virginia (49)
Wisconsin (50)
Wyoming (51)
Q5 About how many undergraduate students are enrolled full-time this year at your institution?
Q6 About how many undergraduate students are enrolled part-time this year at your
institution?
Q7 About how many students live on campus this year?
Q8 Does your institution accept any form of federal funding (i.e., financial aid, grants, etc.)?
Yes (1)
No (2)
If No Is Selected, Then Skip To End of Survey
168
Q9 Title of person completing survey
Vice President for Student Affairs (1)
Dean of Students (2)
Registrar (3)
Other (4) ____________________
169
Q10 Has your institution made a policy decision for each of the following permissive disclosure
clauses of FERPA?
Yes, and it is a published policy
(1)
Yes, but it is only a "working" unpublished
policy (2)
No (3) Don't know (4)
Disclosure in
health
emergencies (1)
Disclosure in
safety
emergencies (2)
Disclosure to
parents about
alcohol and drug
violations if the
student is under
21 years of age
(3)
Disclosure of
educational
records to
parents of
dependent
children without
permission from
the student (4)
Disclosure of
results of
disciplinary
hearings to
victims of violent
crimes (5)
Disclosure of
results of
disciplinary
170
hearings to
parents of victims
of violent crimes
if accused
student is found
responsible (6)
Disclosure of
results of
disciplinary
hearings to
parents of
perpetrators of
violent crimes if
accused student
is found
responsible (7)
Disclosure of
results of
disciplinary
hearings
concerning
violent crimes to
the general
public if accused
student is found
responsible (8)
Disclosure of
information
concerning
students to
university
employees with a
legitimate
educational
interest (9)
171
Q11 To what extent are the following factors considered by your institution when making policy
decisions concerning the permissive disclosure clauses of FERPA?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Potential risk
to the
institution (1)
Potential risk
to students (2)
The best
interests of
students (5)
Minimization
of risk to
students (6)
Minimization
of risk to the
institution (7)
The best
interest of the
institution (8)
Importance of
student
privacy rights
(9)
Student
developmental
considerations
(i.e promoting
a sense of
responsibility
172
for their own
actions and
growing
independence)
(10)
173
Q12 In health emergencies, my institution discloses information allowed by FERPA to
appropriate parties--which could include faculty, staff, students, parents, or outside agencies--if
such information is necessary to protect the health of the student or other persons.
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If In health emergencies, my institution discloses informati... ALWAYS: We disclose
every time, no exceptions. Is Selected Or In health emergencies, my institution discloses
informati... USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or In
health emergencies, my institution discloses informati... SOMETIMES: We do not disclose unless
there is a good reason to do so. Is Selected
Q13 To what extent do the following factors contribute to the decision to disclose health
emergency information to appropriate parties?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it would
put the
institution at
legal risk not to
disclose. (2)
Whether it is in
the best interest
of the
college/university
community.
(5)
Whether it is in
the best interest
of students.
(9)
174
Answer If In health emergencies, my institution discloses informati... NEVER: We never disclose,
no exceptions. Is Selected
Q14 To what extent do the following factors contribute to the decision to not disclose health
emergency information to appropriate parties?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
Whether it
would violate
students'
privacy rights.
(5)
175
Q15 In safety emergencies, my institution discloses information allowed by FERPA to
appropriate parties--which could include faculty, staff, students, parents, or outside agencies--if
such information is necessary to protect the safety of the student or other persons.
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If In safety emergencies, my institution discloses informati... ALWAYS: We disclose
every time, no exceptions. Is Selected Or In safety emergencies, my institution discloses
informati... USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or In
safety emergencies, my institution discloses informati... SOMETIMES: We do not disclose unless
there is a good reason to do so. Is Selected
Q16 To what extent do the following factors contribute to the decision to disclose safety
emergency information to appropriate parties?
Not at all (1) Limited extent (2)
Moderate extent (3)
Whether it would
put the
institution at
legal risk not to
disclose. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(7)
176
Answer If In safety emergencies, my institution discloses informati... NEVER: We never disclose,
no exceptions. Is Selected
Q17 To what extent do the following factors contribute to the decision to not disclose safety
emergency information to appropriate parties?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
177
Q18 My institution notifies parents of students under 21 years of age who violate alcohol and
drug regulations. This notification may be made by the institution or required of the student.
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If My institution notifies parents of students under 21 year... ALWAYS: We disclose
every time, no exceptions. Is Selected Or My institution notifies parents of students under 21
year... USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or My
institution notifies parents of students under 21 year... SOMETIMES: We do not disclose unless
there is a good reason to do so. Is Selected
Q19 To what extent do the following factors contribute to the decision to notify parents of
underage students who violate alcohol and drug regulations?
Not at all (1) Limited extent (2)
Moderate extent (3)
Whether it would
put the
institution at
legal risk not to
do so. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(7)
178
Answer If My institution notifies parents of students under 21 year... NEVER: We never disclose,
no exceptions. Is Selected
Q20 To what extent do the following factors contribute to the decision to not notify parents of
underage students who violate alcohol and drug regulations?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
179
Q21 My institution discloses educational records as allowed by FERPA to parents of dependent
children (as determined by tax information) without permission of the students.
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If My institution discloses educational records as allowed b... ALWAYS: We disclose
every time, no exceptions. Is Selected Or My institution discloses educational records as
allowed b... USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or My
institution discloses educational records as allowed b... SOMETIMES: We do not disclose unless
there is a good reason to do so. Is Selected
Q22 To what extent do the following factors contribute to the decision to disclose
information to parents of dependent children (as determined by tax information) without
permission of the students?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it would
put the
institution at
legal risk not to
do so. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(4)
180
Answer If My institution discloses educational records as allowed b... NEVER: We never disclose,
no exceptions. Is Selected
Q23 To what extent do the following factors contribute to the decision to not disclose
information to parents of dependent children (as determined by tax information) without
permission of the students?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
181
Q24 My institution discloses the results of disciplinary hearings (i.e., name of accused student,
violation, penalty) to victims of violent crimes.
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If My institution discloses the results of disciplinary hear... ALWAYS: We disclose every
time, no exceptions. Is Selected Or My institution discloses the results of disciplinary hear...
USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or My institution
discloses the results of disciplinary hear... SOMETIMES: We do not disclose unless there is a
good reason to do so. Is Selected
Q25 To what extent do the following factors contribute to the decision to disclose the results of
disciplinary hearings (i.e., name of accused student, violation, penalty) to victims of violent
crimes?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it would
put the
institution at
legal risk not to
do so. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(4)
182
Answer If My institution discloses the results of disciplinary hear... NEVER: We never disclose,
no exceptions. Is Selected
Q26 To what extent do the following factors contribute to the decision to not disclose the
results of disciplinary hearing (i.e., name of accused student, violation, penalty) to victims of
violent crimes?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
the accused
students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is,
"telling on"
students may
work against
promoting a
sense of
responsibility
for their own
actions and
growing
independence.
(4)
183
Q27 My institution discloses the results of disciplinary hearings (i.e., name of accused student,
violation, penalty) to the parents of victims of violent crimes if the accused student is found
responsible.
ALWAYS: We disclose very time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If My institution discloses the results of disciplinary hear... ALWAYS: We disclose very
time, no exceptions. Is Selected Or My institution discloses the results of disciplinary hear...
USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or My institution
discloses the results of disciplinary hear... SOMETIMES: We do not disclose unless there is a
good reason to do so. Is Selected
Q28 To what extent do the following factors contribute to the decision to disclose the results of
disciplinary hearings (i.e., name of accused student, violation, penalty) to the parents of victims
of violent crimes if the accused student is found responsible?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it would
put the
institution at
legal risk not to
do so. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(4)
184
Answer If My institution discloses the results of disciplinary hear... NEVER: We never disclose,
no exceptions. Is Selected
Q29 To what extent do the following factors contribute to the decision to not disclose the
results of disciplinary hearings (i.e., name of accused student, violation, penalty) to the parents
of victims of violent crimes if the accused student is found responsible?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
the students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
185
186
Q30 My institution discloses the results of disciplinary hearings (i.e., violation, penalty) to the
parents of students found responsible for a violent crime.
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If My institution discloses the results of disciplinary hear... ALWAYS: We disclose every
time, no exceptions. Is Selected Or My institution discloses the results of disciplinary hear...
USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or My institution
discloses the results of disciplinary hear... SOMETIMES: We do not disclose unless there is a
good reason to do so. Is Selected
Q31 To what extent do the following factors contribute to the decision to disclose the results of
disciplinary hearings (i.e., violation, penalty) to the parents of students found responsible for a
violent crime?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it would
put the
institution at
legal risk not to
do so. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(4)
187
Answer If My institution discloses the results of disciplinary hear... NEVER: We never disclose,
no exceptions. Is Selected
Q32 To what extent do the following factors contribute to the decision to not disclose the
results of disciplinary hearings (i.e., violation, penalty) to the parents of students found
responsible for a violent crime?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
the accused
students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
188
Q33 My institution discloses the results of disciplinary hearings (i.e. name accused student,
violation, penalty) concerning violent crimes to the general public if the accused student is
found responsible. (This disclosure to the public does not include Clery reporting.)
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If My institution discloses the results of disciplinary hear... ALWAYS: We disclose every
time, no exceptions. Is Selected Or My institution discloses the results of disciplinary hear...
USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or My institution
discloses the results of disciplinary hear... SOMETIMES: We do not disclose unless there is a
good reason to do so. Is Selected
Q34 To what extent do the following factors contribute to the decision to disclose the results of
disciplinary hearings (i.e., name of accused student, violation, penalty) concerning violent crimes
to the general public if the accused student is found responsible?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it would
put the
institution at
legal risk not to
do so. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(4)
189
Answer If My institution discloses the results of disciplinary hear... NEVER: We never disclose,
no exceptions. Is Selected
Q35 To what extent do the following factors contribute to the decision to not disclose the
results of disciplinary hearings (i.e., name of accused student, violation, penalty) concerning
violent crimes to the general public if the accused student is found responsible?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
the students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
190
191
Q36 My institution discloses information concerning students as allowed by FERPA to employees
with a legitimate educational interest.
ALWAYS: We disclose every time, no exceptions. (1)
USUALLY: We disclose unless there is a good reason not to do so. (2)
SOMETIMES: We do not disclose unless there is a good reason to do so. (3)
NEVER: We never disclose, no exceptions. (4)
DON'T KNOW: I don't know if we do or do not disclose. (5)
Answer If My institution discloses information concerning students ... ALWAYS: We disclose
every time, no exceptions. Is Selected Or My institution discloses information concerning
students ... USUALLY: We disclose unless there is a good reason not to do so. Is Selected Or My
institution discloses information concerning students ... SOMETIMES: We do not disclose unless
there is a good reason to do so. Is Selected
Q37 To what extent do the following factors contribute to the decision to disclose information
concerning students to employees with a legitimate educational interest?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don’t know (5)
Whether it would
put the
institution at
legal risk not to
do so. (2)
Whether it is in
the best interest
of students.
(3)
Whether it is in
the best interest
of the
college/university
community.
(7)
192
Answer If My institution discloses information concerning students ... NEVER: We never
disclose, no exceptions. Is Selected
Q38 To what extent do the following factors contribute to the decision to not disclose
information concerning students to employees with a legitimate educational interest?
Not at all (1) Limited extent (2)
Moderate extent (3)
Great extent (4)
Don't know (5)
Whether it
would put the
institution at
legal risk to do
so. (2)
Whether it
would violate
students'
privacy rights.
(3)
Whether it is
contrary to
student
development
considerations
(that is, "telling
on" students
may work
against
promoting a
sense of
responsibility
for their own
actions and
growing
independence).
(4)
193
Answer If In health emergencies, my institution discloses informati... DON'T KNOW: I don't
know if we do or do not disclose. Is Selected Or In safety emergencies, my institution discloses
informati... DON'T KNOW: I don't know if we do or do not disclose. Is Selected Or My institution
notifies parents of students under 21 year... DON'T KNOW: I don't know if we do or do not
disclose. Is Selected Or My institution discloses educational records as allowed b... DON'T
KNOW: I don't know if we do or do not disclose. Is Selected Or My institution discloses the
results of disciplinary hear... DON'T KNOW: I don't know if we do or do not disclose. Is Selected
Or My institution discloses the results of disciplinary hear... DON'T KNOW: I don't know if
we do or do not disclose. Is Selected Or My institution discloses the results of disciplinary hear...
DON'T KNOW: I don't know if we do or do not disclose. Is Selected Or My institution discloses
the results of disciplinary hear... DON'T KNOW: I don't know if we do or do not disclose. Is
Selected Or My institution discloses information concerning students ... DON'T KNOW: I don't
know if we do or do not disclose. Is Selected
Q39 You answered "don't know" to one or more questions regarding whether
your institution discloses or does not disclose in situations permitted by FERPA. Should this
survey have been sent to another person at your institution? If so, please list the title of the
person who could have better answered the survey. Are you the correct person, but there are
specific factors that cause you to answer "don't know?" If so, please describe
below.
Q40 Overall, when making decisions to disclose or not disclose information allowed by FERPA,
describe the process for making such decisions (including who is involved), and what factors are
usually given the greatest weight.
Q41 Overall, describe to what extent "risk management" (e.g. liability reduction) plays a role in
any decisions to disclose or not disclose information allowed by FERPA.
Q42 Overall, describe to what extent "student development considerations" (e.g. helping
students take responsibility for themselves) play a role in any decisions to disclose or not
disclose information allowed by FERPA.
Q43 Are there other factors that play a role in any decisions to disclose or not disclose
information allowed by FERPA (e.g. state laws, type of institution)?
194
195
Appendix B
Western Michigan University
Human Subjects Institutional Review Board Application
196
The Family Educational Rights and Privacy Act and Permissive Disclosure: What
Information Are Post-Secondary Institutions Disclosing and Why?
Principal Investigator: Andrea Beach
Student Investigator: Christine Greer
Abstract
This study will focus on the response of universities to the permissive disclosure
clauses of the Family Educational Rights and Privacy Act (FERPA). FERPA was passed
in 1974 and has been amended nine times. Some of these amendments permit
universities to disclose personally identifiable information without the permission of
students.
The purpose of this study is to determine how prevalent disclosure is under the
permissive disclosure clauses of FERPA and if universities use the concept of risk
management to make decisions regarding disclosure. This will inform administrators of
trends in disclosure and provide data universities can use when formulating or revising
policy.
This is a relational study and will utilize quantitative methods. The chief student
life officers at 1,983 baccalaureate degree granting institutions in the United States will
be invited to complete a web-based survey. This number is based on the number of chief
student life officers listed in the Digital Higher Education Directory with email addresses.
They will be asked if their university discloses information under specific circumstances
and why they choose to disclose or not disclose. The data will show how many
197
universities in the sample disclose, what types of universities disclose, and why they do
or do not disclose. The results will also show whether risk management issues are taken
into consideration when making disclosure decisions. Statistical analyses will be run to
determine if different types of universities handle permissive disclosure differently.
Purpose/Background Information
The Family Educational Rights and Privacy Act (FERPA) was enacted by the
federal government in 1974. It is a regulation designed to protect the privacy of
educational records. It gives parents of K-12 students specific rights concerning their
child’s records, whereby they can access their child’s educational records, seek to have
the records amended, and request that directory information not be released to the public.
These rights transfer to the student when he or she enrolls in a school beyond high
school. This effectively means that parents are not granted access to any educational
records of their child once he or she is enrolled in college, unless the student grants them
access or the institution chooses to do so under one of the permissive disclosure clauses.
Institutions of higher education that receive any form of federal funding must follow the
stipulations of FERPA. All public institutions and any private institutions that use federal
money for grant programs, research or financial aid are required to abide by FERPA.
FERPA has been revised nine times since it was signed into law. Some of these
revisions included permissive disclosure clauses which made it possible to disclose more
information from students’ records to parents and the general public. Permissive
disclosure means that, in certain situations and under certain guidelines, information may
be released without the student’s permission. Post-secondary institutions are given the
power to make decisions about permissive disclosure, and their administrators may make
198
the decisions as to how much information to disclose and to whom they will disclose
(Gehring, 1994). “Campus offices may respond to parents’ inquiries in different ways
based on their particular philosophy or their interpretation of the Buckley Amendment
requirements” (Weeks, 2001, p. 42). This creates inconsistencies among institutions and
sometimes within the same institution (Daniel, Evans, & Scott, 2001).
Many of the amendments to FERPA allow universities to disclose information to
the following groups without the written consent of the student:
1) other officials within the institution who have a legitimate educational interest;
2) organizations conducting studies for educational agencies;
3) accrediting organizations for use in accrediting functions;
4) parents of dependent students as defined in the Internal Revenue Code;
5) persons in an emergency situation, if the knowledge is necessary to protect
students or other persons;
6) victims of a violent crime, the results of pertinent disciplinary hearings;
7) the general public, results of disciplinary hearings for a crime of violence, if the
student is found responsible for the offense;
8) parents of a student under the age of 21, accused of violating alcohol or drug
policies (Department of Education, 2005).
Universities are not required to give out information in these situations; however, they are
permitted to do so. The institution is permitted to make the decisions regarding these
issues.
The purpose of this study is to determine the extent to which colleges and
199
universities disclose student information without consent as allowed under the permissive
disclosure clauses of FERPA. This study will attempt to ascertain how many institutions
in the sample disclose information under each of the permissive disclosure situations. It
will also try to determine why universities have chosen to disclose or not disclose, and if
the concept of risk management plays a part in the decisions. For the purpose of this
study, both colleges and universities will be referred to as “universities.”
Research Questions
To what extent have universities made decisions about the permissive disclosure
clauses of FERPA?
To what extent do universities disclose student information under the permissive
disclosure clauses of FERPA?
Has the issue of risk to the university played a part in the decisions about the
permissive disclosure clauses of FERPA?
What reasons do universities give for either disclosing or not disclosing
information under the permissive disclosure clauses of FERPA?
Does institutional type, location, size of the student body, or size of the on-
campus population relate to whether universities disclose or do not disclose under the
permissive disclosure clauses of FERPA? To what extent do these factors influence a
university’s use of risk management in the decision to disclose or not disclose?
How my research differs
My research will differ from prior FERPA and risk management research because
200
it will look at all of the permissive disclosure clauses of FERPA and it will use the lens of
risk management. Currently, the only research specific to the permissive disclosure
clauses concerns parental notification for alcohol and drug violations, disclosure to
parents of dependent students, and disclosure to university personnel with a legitimate
educational interest. My research will look at all eight of the permissive disclosure
clauses. Chief Student Affairs Officers will be asked if their university has made
decisions about each of the clauses, what their policy is on each of the clauses, and what
factors, including risk management, were considered when making the decision.
Eick (2003) states, “There is very little written about university risk management”
(p. 33). My study will add to the literature by focusing on whether university
administrators are concerned with risk issues when making decisions about FERPA and if
they use a risk management approach when making these decisions. My research will
differ from the few reported risk management research projects in that my study is
looking at a specific federal mandate and asking if concerns about possible risk to the
university had anything to do with the decisions made about how the university will deal
with the permissive disclosure clauses. Culcleasure (2005) found that regulatory
compliance was one of the drivers of risk management techniques at the private colleges
and universities in North Carolina. My research will add to the findings by determining
if universities considered the risks involved to the institution when making decisions
about how they will comply with FERPA.
Subject Recruitment
The study participants will be chief student life officers at the institutions included
in the Digital Higher Education Directory. The institutions included in the directory are
201
baccalaureate degree granting and are accredited by the Council of Higher Education
Accreditation (CHEA) or an accrediting agency authorized by the United States Secretary
of Education. There are 1,983 chief student life officers listed in the directory with email
addresses. Chief student life officers were selected as they usually supervise the offices
that deal most often with the permissive disclosure clauses of FERPA. The participants
will be recruited by an email sent to their listed email address in the Digital Higher
Education Directory.
Informed Consent Process
A link in the email invitation will take participants to the survey. The email
invitation states that the survey is voluntary, that responses will be kept confidential, and
that no personal identifiers will be collected. Completion of the web survey will indicate
informed consent. There are no repercussions for not participating in the survey.
Participants can stop and abort the survey at any time.
Research Procedures
Method of Data Collection
Each participant completes the web-based survey and submits it.
Instrumentation
A web-based survey was developed using the Qualtrics.com survey tool to gather
information to answer the research questions. There are eight demographic questions to
begin the survey. These are multiple choice and open-ended questions. All participants
then see a question concerning published policy decisions for all permissive disclosure
clauses of FERPA. The categorical responses for this question are: Yes and it is a
published policy, Yes but it is only a “working” unpublished policy, No, Don’t know.
202
The next question for all participants asks to what extent risk management issues were
taken into account when making disclosure decisions. The Likert-type scale for this
question is: Not at all, Limited extent, Moderate extent, Great extent, Don’t know.
Participants are then asked if they disclose information in each of the circumstances
permitted in the permissive disclosure clauses of FERPA. These are answered on the
following Likert-type scale: Always (we disclose every time, no exceptions); Usually (we
disclose unless there is a good reason not to do so); Sometimes (we do not disclose unless
there is a good reason to do so); Never (we never disclose, no exceptions); Don’t know (I
don’t know if we do or do not disclose). Each of these questions is followed by a
question asking to what extent certain factors contributed to the decision to disclose or
not disclose. The Likert scale for these questions is Not at all, Limited extent, Moderate
extent, Great extent, and Don’t know. This section has a total of 27 questions, but not
everyone answers every question; the survey branches depending on answering each
question pertaining to the permissive disclosure clauses with always, usually, sometimes,
never, or don’t know. Participants who answer Don’t know to the disclosure questions
are taken to an open-ended question which asks if there are specific factors which caused
them to not know if their institution discloses under the permissive disclosure clauses of
FERPA. There are four open-ended questions at the end of the survey that everyone is
asked to answer. The first asks for a description of the decision-making process used for
the permissive disclosure clauses and what factors are given the greatest weight. The
next questions ask for a description of the role risk management plays in the decisions
and the role “student development considerations” play in the decision. The final
question asks if there are other factors that play a role in decisions to disclose information
203
allowed by FERPA.
Location of Data Collection
The data will be collected via a web-based survey housed on the Qualtrics server.
The software was purchased by Northern Michigan University. The data will be stored
on the Qualtrics server while the survey is active. The survey will remain open for
approximately four weeks. When the survey is closed, all data will be downloaded to my
personal computer and then deleted from the Qualtrics server. Following analysis, the
data will be transferred to the principal researcher for storage.
Duration of the Study
Completion of the survey will take approximately 20 minutes. Requested length
of the study is 12/1/10 to 12/1/11.
Methodology
A relational study using a quantitative design will be conducted to determine to
what extent universities disclose under the permissive disclosure clauses of FERPA, what
factors, such as risk management elements, are taken into consideration when making
decisions about permissive disclosure, and if FERPA-related policy and decisions are
dependent on type of institution. Data will be collected via a web survey.
Research Design
This proposed research will use a quantitative research design and collect data
using a cross-sectional survey that describes the patterns of disclosure under FERPA.
Quantitative research is appropriate for this study as knowledge concerning the
204
permissive disclosure clauses will be gathered and possible influencing factors will be
studied (Creswell, 2003). A “one-shot survey for the purpose of describing the
characteristics of a sample at one point in time” (Mertens, 2005, p. 172) was developed.
In order to establish content validity, a small group of FERPA experts evaluated
the survey questions. These people were asked if the questions relate to the objectives of
the research proposed and if they will produce the information needed (Thomas, 2004).
A group of student life professionals, including two chief student life officers, a
registrar, a conduct program director, a director of an academic advising office, and a
vice president for institutional research, was invited to determine whether the survey
questions were clear and answerable. The participants were selected because of their
experience with FERPA issues and/or their familiarity with research methods. They
offered suggestions for changes to the survey but reported overall that the survey
questions were understandable and covered key content and that the estimated length of
time needed to complete the survey was accurate.
Data Collection Procedures
Self-reported data will be collected using a web-based survey. The initial email
will include an invitation to complete the survey and a link to the web address for the
survey. An email follow-up will be sent one week after the initial email. A second email
follow-up will be sent two weeks after the first follow-up email. This follow-up will be
done in order to help increase the response rate (Fowler, 2002).
Analysis
The data collected will be analyzed using SPSS 18.0. The analyses used to report
205
the results for research question 1 through 4 (the extent to which universities have made
decisions about the permissive disclosure clauses of FERPA; the extent to which
universities disclose student information under the permissive disclosure clauses of
FERPA; ways the issue of risk to the university has played a part in the decisions about
the permissive disclosure clauses of FERPA; reasons universities give for either
disclosing or not disclosing information under the permissive disclosure clauses of
FERPA) will be descriptive statistics. These will include frequencies, means, and
standard deviation. The analyses used to report the results for research question 5
(whether institutional type, location, size of the student body, or size of the on-campus
population relate to whether universities disclose or do not disclose under the permissive
disclosure clauses of FERPA, and influence a university’s use of risk management in the
decision to disclose or not disclose) will be frequency, multiple regression, chi-square,
discriminant function analysis, t-test, ANOVA, and post-hoc comparisons.
Dissemination
The results of this study will be disseminated through a dissertation and possibly journal
articles.
Risks and Cost to and Protections for Subjects
There are minimal risks to subjects. The identity of the participants and their
institutions will be confidential. The survey does not ask participant name or institution.
All data will be reported in the aggregate. The only cost is in the participant’s time.
Benefits of Research
It is clear that while FERPA does allow disclosure of personally identifiable
206
information under specific circumstances without student approval, universities are not
required to do so. The Family Educational Rights and Privacy Act (FERPA) was passed
in 1974 as a way to protect the privacy of educational records. It has been revised nine
times since it was passed. These revisions have given universities permission to disclose
personally identifiable information in certain situations without the permission of the
student. Universities can make their own decisions about these permissive disclosure
clauses. Many institutions have not developed clear policies concerning the permissive
disclosure allowances of FERPA. This study will focus on the response of universities to
the permissive disclosure clauses of the Family Educational Rights and Privacy Act
(FERPA). The study will use the lens of risk management practices in higher education
to frame the research. This study will assess if institutions consider risk when making
decisions about FERPA permissive disclosure issues. The purpose of this study is to
determine how prevalent disclosure is under the permissive disclosure clauses of FERPA.
Learning what universities do in these situations and the rationale for their decisions
regarding the policies would be invaluable to an institution undertaking a review of their
own permissive disclosure policies. This will inform administrators of trends in
disclosure and provide data universities can use when formulating or revising policy.
Confidentiality of Data
The data collected will be stored on the Qualtrics, Inc. server. The researcher
will only receive the data from the surveys and the results will not be attached to any
identifying information. Participants may email the researcher for a results summary. At
the conclusion of the survey, all data will be deleted from the Qualtrics server. Copies of
the data and SPSS analysis will be stored on CD for three years by the principal
207
investigator and the student investigator in locked offices.
208
References
Culcleasure, F. (2005). Risk management: A study of current practices at North
Carolina’s private colleges and universities. (Doctoral dissertation, Capella
University, 2005). Proquest Information and Learning Company, 114.
Creswell, J. W. (2003). Research design: Qualitative, quantitative, and mixed methods
approaches (2 nd
ed.). Thousand Oaks, CA: Sage Publications.
Daniel, B. V., Evans, S. G., & Scott, B. R. (2001). Understanding family involvement in
the college experience. New directions for student services, Consumers,
adversaries, and partners: working with the families of undergraduates (No. 94,
pp. 3 – 13). San Francisco: Jossey-Bass, Inc.
Digital Higher Education Directory (2010). Reston, VA: Higher Education Publications,
Inc.
Eick, C. (2003). Factors that promote effective risk management at universities classified
by the Carnegie system as doctoral/research universities – extensive. (Doctoral
dissertation, Auburn University, 2003). Proquest Information and Learning
Company, 114.
Fowler, F. J. (2002). Survey research methods (3rd ed.). Thousand Oaks, CA: Sage
Publications.
Gehring, D. D. (1994). Protective policy laws. In M. D. Coomes & D. D. Gehring (Vol.
eds.), New directions for student services, Student services in a changing federal
climate (No. 68, pp. 67 – 82). San Francisco: Jossey-Bass, Inc.
Mertens, D. M. (2005). Research and evaluation in education and psychology:
Integrating diversity with quantitative, qualitative, and mixed methods (2 nd
ed.).
Thousand Oaks, CA: Sage Publications, Inc.
Thomas, S. (2004). Using web and paper questionnaires for data-based decision
making: From design to interpretation of the results. Thousand Oaks, CA:
Corwin Press.
U.S. Department of Education. (n.d.). Legislative history of major FERPA provisions.
Retrieved April 18, 2010, from
http://www2.ed.gov/policy/gen/guid/fpco/ferpa/leg-history.html.
Weeks, K. M. (2001). Family-friendly FERPA policies: affirming parental partnerships.
New directions for student services, Consumers, adversaries, and partners:
Working with the families of undergraduates (No. 94, pp. 39 – 50). San
209
Francisco: Jossey-Bass, Inc.
210
Western Michigan University
Department of Educational Leadership, Research, and Technology
Principal Investigator: Andrea Beach
Student Investigator: Christine Greer
Title of Study: The Family Educational Rights and Privacy Act and Permissive
Disclosure: What Information Are Post-Secondary Institutions Disclosing and Why?
Dear Colleague:
You are invited to participate in a research study designed to determine the extent
to which colleges and universities disclose student information without consent when
given the option under FERPA. This study will attempt to ascertain how many
institutions in the sample disclose information under each of the permissive disclosure
situations. It will also try to determine why schools have chosen to disclose or not
disclose and if the concept of risk management plays a part in the decision. The results of
this survey will be used in my dissertation. The results will also be useful for college
administrators by providing information regarding trends in disclosure under FERPA and
data that can be used when formulating or revising policies.
This study utilizes an online survey that will take approximately 20 minutes to
complete. You may forward this request to another administrator if that individual has
more experience with FERPA decisions and would be better able to complete the survey.
For participants volunteering to take this survey, I guarantee responses will be
confidential and not connected to the corresponding institution in the data analysis or
result sections of the study. Since the survey was sent via an embedded URL, your email
address will not be connected in any manner with your survey responses. Data may be
shared with other researchers and educators in the form of presentations and/or
publications. Your identity will not be revealed.
When you begin the survey, you are consenting to participate in the study. If you
do not consent, you can simply choose not to continue at this time. If you decide after
beginning the survey that you do not wish to continue, you may abort at any time. You
also may choose not to respond to a particular question for any reason. There are no
repercussions for electing not to participate in this study.
211
This consent document has been approved for use for one year on _______ by the
Western Michigan University Human Subjects Institutional Review Board (HSIRB). Do
not participate in this study if it is one year past that date.
If you have any questions or concerns at any time about completing the survey,
you can contact the primary investigator, Andrea Beach, at 269-387-1725 or
[email protected], or the student investigator, Christine Greer, at 906-227-1703
or [email protected]. You may also contact the Chair, Human Subjects Institutional
Review Board at 269-387-8293 or the Vice President for Research at 269-387-8298 if
questions arise during the course of the study.
Please email me at [email protected] if you would like a copy of the results.
The survey will be available until ________________. Click here to consent and
enter the survey. [link address]
Thank you for participating in this important research.
Christine Greer, Doctoral Student
212
Western Michigan University
Department of Educational Leadership, Research, and Technology
Principal Investigator: Andrea Beach
Student Investigator: Christine Greer
Title of Study: The Family Educational Rights and Privacy Act and Permissive
Disclosure: What Information Are Post-Secondary Institutions Disclosing and Why?
Dear Colleague:
This is a reminder and invitation to those of you who have not participated in the
survey regarding the permissive disclosure clauses of FERPA. You still have an
opportunity to participate. The survey will take up to 20 minutes to complete. Your
responses will be confidential and you may choose not to answer any question.
Your participation will benefit the profession by providing information regarding
trends in disclosure under FERPA that can be used by college administrators when
formulating or revising policies concerning disclosure of information about students. A
summary of the findings and conclusions of this study will be used in my dissertation and
shared with anyone who requests the results.
If you have any questions or concerns, please call me at 906-227-1703 or e-mail
me at [email protected], or contact my dissertation chair, Andrea Beach, at Western
Michigan University, 269-387-1725, or [email protected].
The survey will be available until _______________. Click here to consent and
enter the survey. [link address]
Thank you for participating in this important research.
Christine Greer, Doctoral Student
213
Appendix C
Letter From the Human Subjects Institutional Review Board
214
Date: January 3, 2011
To: Andrea Beach, Principal Investigator Christine Greer, Student Investigator for dissertation
From: Amy Naugle, Ph.D., Chair
Re: Approval not needed for HSIRB Protocol 10-12-18
This letter will serve as confirmation that your project “The Family Educational Rights
and Privacy Act and Permissive Disclosure: What information are Post-Secondary
Institutions Disclosing and Why?” has been reviewed by the Human Subjects
Institutional Review Board (HSIRB). Based on that review, the HSIRB has determined
that approval is not required for you to conduct this project because you are studying
institutional policies and procedures and are not gathering private information about
individuals. Thank you for your concerns about protecting the rights and welfare of
human subjects.
A copy of your protocol and a copy of this letter will be maintained in the HSIRB files.
- Western Michigan University
- ScholarWorks at WMU
- 4-2012
- The Family Educational Rights and Privacy Act and Permissive Disclosure: What Information are Post-Secondary Institutions Disclosing and Why?
- Christine Glah Greer
- Recommended Citation
- tmp.1346086298.pdf.fImxt
