Safeguarding FERPA Information when Using Cloud-based Resources in a Course Environment

The Information Security Office acknowledges the value of use of cloud based solutions in courses. This article provided guidance on how to stay within FERPA requirements when using solutions non-university solutions that contain data or require access by students.

 

Detailed Information

Cloud-based Resources available through the Internet, such as social media sites, can be powerful tools to engage students and/or form a sense of community.

1. Some existing cloud-based solutions have agreed to the university safeguarding standards, and are on a list of protected and restricted systems.
2. For new fee-based solutions being acquired, a technology review by the Information Security Office is required. 
3. For no-cost cloud-based resources, faculty are required to protect student information from exposure as describe in this document. 

Dos and Don'ts

• Do understand the terms and conditions of the social media site. For example, does the site collect data on users? 
• Do inform students at the beginning of the course that cloud-based resource use will be assigned so they have the option to voice their concerns, use alternative means if possible, or withdraw if they wish. Some students may have higher privacy risks than others. If possible, include the dependency on social media in the course syllabus and descriptions. 
• Do inform students that their social media content may be viewed by others and advise them not to post private information about themselves or other students. 
• Do NOT require students to place personal information on social media. Students should be given the option (and possibly encouraged) to create an alias for social media use. 
• Do NOT post class lists or associate a course identifier with the students participating on a public site, and do not comment on grades or student course work on a public site. 
• Do NOT record information about students on sites that may be publicly viewed. Some interactive sites can be recorded and do subject the material to become an educational record covered under FERPA.

Publicly-Shared Information

In some instances, it may serve the interest of the students to post information online regarding the students in a course, or to publicly share classroom activity such as a video recording which identifies students. In such instances obtain consent from the student prior to placing such information on a web site accessible to the public.

Environment

• Cloud-based services, Social Media, Software-as-a-Service, AI or other platforms when service is at no cost and used for a course or program.