Disclaimer: The information provided on this page and throughout this website does not, and is not intended to, constitute legal advice. The information is provided for informational purposes only and may not constitute the most up-to-date legal or other information. We recommend that you contact an attorney to seek legal advice with respect to all legal matters.
For certain verification requests, you may be required to collect and possibly provide the signed and dated written consent of the individual whose information you are seeking to verify. Consent is always required if you submit a Social Security number (SSN) as part of your request. Consent may also be required for other reasons, such as if the individual has placed a block on their directory information with their academic institution or if the institution has chosen to require consent for all verifications. Consent must be obtained for all high school diploma requests.
The Family Educational Rights and Privacy Act (FERPA), a U.S. federal law, is designed to protect the privacy of student education records. For a consent to be valid, it must meet the requirements of a FERPA-compliant consent.
Here is what a verification requestor needs to understand about securing proper consent under FERPA.
Key Components of FERPA-Compliant Consent
To ensure that the consents you collect comply with FERPA, they must meet several specific criteria (see 34 CFR § 99.30 for more information). Here’s a breakdown of these requirements:
- Signed and Dated Written Consent: Consent must be provided in writing and include the date the consent was provided. This can be in the form of a physical document or an electronic record. An electronic signature must be in a form that authenticates the person as the source of the consent and indicates that person’s approval of the information contained in the consent.
- Specification of Records: The consent form must identify the education records that are to be disclosed.
- Purpose of Disclosure: The consent must state the purpose of the disclosure. The individual providing consent should understand why their information is being disclosed.
- Identification of Recipients: The consent must name the party or class of parties to whom the records will be disclosed. You should identify each recipient by name or describe the category of recipients in a way that makes it clear who will receive the data.
Best Practices for Verification Requestors
Develop clear consent forms:
- Create templates for consent forms that include all the required elements.
- Use plain language to ensure that individuals understand what they are consenting to.
- Because of the sensitivity of Social Security numbers (SSNs), be transparent about how and when you will use SSNs in the verification (e.g., “your SSN may be used to identify your education records”).
Educate your team:
- Train your staff on all compliance requirements, including FERPA requirements, and the importance of securing compliant consent.
- This knowledge will help prevent unauthorized disclosures and ensure proper handling of education records.
Audit and review:
- Regularly audit your consent processes and forms to ensure ongoing compliance with FERPA in addition to other compliance obligations.
- Stay updated on any changes to FERPA regulations that may affect your consent practices.