In compliance with the Family Educational Rights and Privacy Act of 1974 (FERPA), The University of Alabama sends an annual notification of a student’s rights under FERPA to the crimson email address for all currently enrolled students each fall semester. These rights include:

  1. The right to inspect and review their education records within 45 days of receipt of written request for access
  2. The right to request the amendment of their education records that the student believes are inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA.
  3. The right to provide written consent before the University discloses personally identifiable information from the student’s education records, except to the extent that FERPA authorizes disclosure without consent
  4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA.

I. The Right to inspect and review their education records within 45 days of receipt of written request for access.

Students should submit written requests that identify the record(s) they wish to inspect to the Office of the University Registrar, 206 Student Services Center, The University of Alabama, Box 870134, Tuscaloosa, AL 35487. The University Registrar or designee will make arrangements for access and will notify the student of the time and place where records may be inspected. If the University official to whom the request was submitted does not maintain the records, that official will advise the student of the correct official to whom the request should be addressed.

The right of inspection and review does not entitle a student to review (1) financial statements of the student’s parents; (2) confidential letters and statements of recommendation to which a student has waived his/her right to inspect and review; or (3) portions of records that contain information about more than one student (in which case the University must first redact personally identifiable information about the other student(s)).

II. The Right to Have Some Control over the Disclosure of Information from Their Educational Record

The student should write the University official responsible for the record; clearly identify the part of the record they want changed; and specify why the record is inaccurate or misleading. If the University decides not to amend the record as requested, the student will be notified in writing of the decision and of the student’s right to a hearing regarding the request for amendment. After a student examines his or her records, it is possible for the student to challenge entries and add factual, explanatory information to the records. This request may not include amendments to the accuracy/fairness of grades in courses or any other assessment of academic performance. If the University does not agree to amend a record as requested, the student will be notified and informed of the right to a hearing. Results of hearings will be given in writing to eligible students according to procedures, which shall include:

  • Hearings will be conducted within a reasonable time frame;
  • Eligible students will be given notice of date, place, and time of hearing;
  • The hearing will be conducted by an official of the institution, named by the Provost/Vice President of Academic Affairs, who does not have a direct interest in the outcome of the hearing;
  • Eligible students can present evidence relevant to the issue and may be represented by individuals including attorneys; and

Decisions will be given in writing in a reasonable period of time and will be based solely on evidence presented at the hearing.

III. The right to provide written consent before the University discloses personally identifiable information from the student’s education records, except to the extent that FERPA authorizes disclosure without consent.

FERPA allows for the disclosure of certain information defined as “directory information” to third parties without the student’s permission. The following information from a student’s education record is defined by the University of Alabama as “directory information,” which may be disclosed under FERPA without the student’s permission. Asterisked items are available in the on-line directory.

  • Name*
  • Preferred Name
  • Date of Birth (for Census purposes only)
  • Class/Level
  • Local Address
  • UA School/College(s)
  • Local Phone Number
  • Major(s)/Degree Program(s)
  • Permanent Address
  • Degree(s) Earned and Date(s)
  • Permanent Phone Number
  • Academic Awards and Honors
  • UA email address*
  • Prior Postsecondary Institution(s) Attended
  • Dates of Attendance
  • Full-/Part-Time Enrollment Status
  • Participation or membership in officially recognized activities, social or Greek organizations, and sports (or in intercollegiate athletic teams)
  • Weight and height of members of intercollegiate athletic teams

Steps Required to Prevent Disclosure of Directory Information

The University of Alabama assumes that a student’s failure to specifically request the blocking of access to any element of “directory information” constitutes approval for disclosure. To prevent the University from disclosing any “directory information” to third parties, students must notify this office by submitting a confidentiality hold request through myBama ( On the Student tab, go to the “Update Directory Information/Confidentiality Hold” page located in the Banner Self-Service channel, under Student Services and then Student Records. Select “Yes” and then submit. Such requests may be filed at the time of the annual FERPA notification to students or at any other time during an academic year.

The request to prevent disclosure of “directory information” will remain in effect permanently, including after departure from the University, unless subsequently changed by the student. At the time of graduation, students will be given another opportunity to release such “information hold.”

Persons and Entities Entitled to Review a Student’s Education Records Without the Student’s Consent

Notwithstanding the general rule that a student must provide written consent to the release of personally identifiable information from his/her records, FERPA permits (but does not require) limited disclosure to the individuals/entities identified as:

  • School officials with a legitimate educational interest. A “school official” may include:
    • a person employed by the University in an administrative, supervisory, academic, research or support staff position, including but not limited to law enforcement unit personnel, health staff and in-house attorneys;
    • contractors, consultants, volunteers or other outside parties with whom the University has contracted or delegated certain educationally-related functions to provide service under retainer or agreement; including but not limited to collection agency, outsourced service company, agent, attorney, auditor, etc.;
    • a person serving on the Board of Trustees;
    • a student serving on an official committee, such as a disciplinary or grievance committee, or assisting another school official in performing his/her tasks.
  • “Legitimate educational interest” is defined as any authorized interest or activity undertaken in the name of the University for which access to an education record is necessary or appropriate to the proper performance of the undertaking. A school official has a legitimate educational interest if, in the judgment of the individual/office responsible for requested information, the official needs to review an education record in order to fulfill his or her professional responsibility. The information sought and provided must be pertinent to and used within the context of official University business and not for a purpose extraneous to the official’s area of responsibility.
  • Release of a student’s education record to a school official having legitimate educational interest does not constitute institutional authorization to transmit, share, or disclose any or all of the information to a third party, within or outside the University. An unauthorized disclosure of personally identifiable information from the education records of the student is prohibited.
  • Parents of a student who is claimed as a dependent, as defined by Section 152 of the Internal Revenue Code of 1986. A student is a dependent if the parent claims the student as a dependent for the current tax reporting year.
    • A “parent” includes a natural parent, a guardian, or someone acting as a student’s parent in the absence of a parent or guardian.
    • All students will be presumed to be non-dependents unless (1) the student verifies that he/she is a dependent student, or (2) the parent(s) provide their most recent filed IRS tax return with evidence to the contrary.
    • Divorced or separated parents of dependent students may be provided equal access to records, unless the University is provided with evidence of a court order, state law, or legally binding document that specifically revokes those rights, or unless the University, in the exercise of its discretion, deems such disclosure ill-advised.
    • Information may be disclosed to parents and legal guardians of students under the age of 21, without the student’s consent, regarding the student’s violation of any federal, state or local law, or any rule or policy of the institution governing the use, possession, or distribution of alcohol, narcotics, or other controlled substances.
  • Officials of another school in which a student seeks or intends to enroll or is enrolled so long as disclosure is for purposes related to student’s enrollment or transfer.
  • Authorized representatives of the Comptroller General and of the Attorney General of the United States, the Secretary of the Department of Education, or state and local educational authorities in connection with the audit or evaluation of federal- and state- supported programs, or for enforcement of or compliance with legal requirements applicable to federally-supported education programs.
  • Veterans Administration officials not covered by FERPA but specified under Title 38, section 3690 (c), United States Code.
  • Persons or organizations providing financial aid to students, or determining financial aid decisions, but only to the extent necessary to determine eligibility, or the amount or condition of such aid, or to enforce the terms of said aid.
  • Appropriate persons, including parents, in connection with an emergency, if knowledge of the information is necessary to protect the health or safety of the student or other individuals. The totality of the circumstances pertaining to a threat to the health or safety of a student or other individuals will be taken into account, and the University will disclose only if there is an articulable and significant threat. The threat and the parties to whom the University discloses information will be recorded.
  • Organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, and administer predictive tests, to administer student aid programs, or to improve instruction, but only if personal identification of the student is not made to individuals outside the organization and the information is destroyed when no longer needed for their projects.
  • Accrediting organizations carrying out their accrediting functions.
  • Persons in compliance with a judicial order or a lawfully issued subpoena, provided that the institution makes a reasonable attempt to notify the student in advance of compliance. The student bears the responsibility for keeping an up-to-date address on file in the Office of the University Registrar. Certain law enforcement-related subpoenas, however, can mandate the release of information without notification to the student of either the subpoena or the information released.
  • An alleged victim of any crime of violence or of a non-forcible sex offense, but only of the final results of any institutional disciplinary proceeding against the perpetrator of that crime with respect to the crime, and regardless of the outcome of the proceeding. Also, if the University determines through its disciplinary proceeding that a student has committed a violation of the University’s rules or policies with respect to an alleged crime of violence or non-forcible sex offense, the University may reveal to anyone the “final results,” which are limited by FERPA to include only the name of the student being disciplined, a description of the violation committed, and any sanction imposed by the University on that student. Final results of disciplinary proceedings reached prior to October 7, 1998 may not be released.
  • University officials in defense of a claim. If a parent or eligible student initiates a legal claim or otherwise takes any adversarial position in writing against the University, the University may disclose to the court or other entity that has authority to take specific action against the University, the student’s education records that are necessary for the University to defend itself.
  • Information about registered sex offender. Information provided to the University under a community notification program concerning a student required to register as a sex offender.
  • Return of record to creator. If the University has created any record, it may disclose that information to teachers and other school officials with legitimate educational interests, such as persons who need to verify the accuracy or authenticity of the information. Likewise, the University may return a record to its identified source to be able to verify its authenticity.

IV. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the University to comply with the requirements of FERPA. The name and address of the office that administers FERPA is:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-5920

The Family Educational Rights and Privacy Act (FERPA) of 1974, as amended, is a federal law that protects the privacy and confidentiality of personally identifiable information contained within student education records. The University of Alabama complies with FERPA’s confidentiality protections and adheres to procedures dealing with student education records and directory information recommended by the American Association of Collegiate Registrars and Admissions Officers (AACRAO).

  • A “student” must be enrolled and “in attendance” at the University for his/her records to be protected by this policy. A student is defined as “in attendance” when a person has been enrolled for at least the first day of classes for any term. This includes all persons taking courses on campus, by correspondence, by distance, as well as the period when a person is working under a work study program at the University. This may be full-time or part-time pursuing undergraduate, graduate or professional studies.
  • “Education records” of a student that are covered by this privacy rights law are defined by FERPA to include any records, files, documents, or other materials that contain personally identifiable information directly related to the student and that are maintained by the University of Alabama or by officials acting for the University. The definition of “personally identifiable information” is any information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. Personally identifiable information includes the student’s name, family member’s names, address of student or family, social security number, CWID, and indirect identifiers such as date of birth, Mother’s maiden name, biometric records, etc. The term “biometric record” is defined, as a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual. Examples include fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting. By definition, the University is prohibited from disclosing information, even in redacted form, that is requested by a party if the school reasonably believes the party knows the identity of the student to whom the record relates.
  • Personal observations and conversations with students are not considered as “education records” under FERPA. Peer-graded papers not yet collected and recorded by a teacher are also not covered. Additional records that are not covered by this law include:
    • Records of institutional, supervisory, and administrative personnel which are in the sole possession of the maker and which are not accessible to any other person except a substitute;
    • Records maintained by the University’s Department of Public Safety that are maintained solely for law enforcement officials and which are not made available to persons other than law enforcement officials of the same jurisdiction;
    • Employment records of University employees (unless the employee is primarily a student and happens to work for the University);
    • Health records of students covered by HIPAA (such as health records at University Medical Center) and student’s records that have been made and/or maintained by physicians, psychiatrists, psychologists, or other recognized professionals or paraprofessionals and which are made, maintained or used only in connection with the provision of treatment to the student and are not available to anyone other than persons for the purpose of providing treatment; and
    • Alumni/former student records containing information about a student no longer in attendance and not directly relating to the individual’s attendance as a student.
  • It stands for the Family Educational Rights and Privacy Act of 1974
  • Also known as the Buckley Amendment
  • FERPA sets forth requirements regarding the privacy of student records
  • FERPA is enforced by the Family Policy Compliance Office of the U.S. Department of Education
  • It’s the Law & University of Alabama policy
  • Failure to comply could result in the withholding of Federal Funds including Student Financial Aid
  • Lawsuits caused by violations cost time and $$$
  • As an employee of the University you may be disciplined for intentional violations
  • The right to inspect and review their own education records
  • The right to seek to have those records amended
  • The right to provide written consent before the University discloses personally identifiable information from the student’s education records, except to the extent that FERPA authorizes disclosure without consent
  • The right to file a complaint to the U.S. Department of Education concerning alleged failures by the University to comply with FERPA
  • Students who are or have been in attendance at a postsecondary institution are covered under FERPA
  • Applicants who are denied admission or who never attend are not covered under FERPA [Note: some information that applicants submit in an application (like test scores, grades, social security numbers, etc.) should remain protected from disclosure]
  • When the student is “in attendance” as defined by the institution. At The University of Alabama this is defined as being enrolled on at least the first day of classes for any term.
  • If the institution does not define “in attendance” as the point when a student registers for class
  • All records from which a student can be personally identified and are maintained by an institution
  • These records can be in any media form: handwritten, print, type, film, electronic, etc.
  • Registration and advising forms
  • Grades & Transcripts
  • Student information displayed on your computer screen (do not leave your desk with student information on display)
  • Student schedules
  • Class assignments
  • Class rosters
  • Any electronic or paper document with the student’s ID or grade(s) on it
  • Personal Notes – kept by a faculty/staff member if kept in the sole possession of the one who made the record
  • Department of Public Safety Records – maintained solely for law enforcement purposes & revealed only to law enforcement agencies
  • Employment Records – of those whose employment is not contingent upon being a student
  • Student Medical Records – created by a health care professional and disclosed only to other healthcare professional for the medical/health treatment of the student
  • Alumni Records – containing information about a student no longer in attendance
  • Directory Information
  • Information that the student has given written consent to release, including reference letter from faculty and/or staff
  • Information needed by UA employees who have a legitimate educational interest
  • Information needed by certain government agencies
  • Information that can be released without the student’s written consent, unless the student opts out of disclosure
  • Each institution, to some extent, can determine what information is classified as directory information

Asterisked items are printed in the University telephone directory unless a Request to Prevent Disclosure of Directory Information is filed within the first two weeks of Fall Semester.

  • Name*
  • Preferred Name
  • Local Address & Permanent Address
  • Local Phone Number & Permanent Phone Number
  • UA E-mail Address*
  • Full-/Part-time Enrollment Status
  • Class Level
  • UA School/College(s)
  • Major(s)/Degree Program(s)
  • Degree(s) Earned and Date(s)
  • Academic Awards and Honors
  • Prior Postsecondary Institution(s) Attended
  • Dates of Attendance
  • Participation or membership in officially recognized activities, social or greek organizations, and sports (or in intercollegiate athletic teams)
  • Weight and height of members of intercollegiate athletic teams
  • UA Employees who have a legitimate educational interest
    • Legitimate Education Interest is defined as a school officials’ need to review student education information to fulfill a responsibility as part of his or her job responsibilities.
  • Others who are performing a function on institution’s behalf who have a legitimate educational interest
  • Financial Aid Lenders
  • Parties to a law suit when UA has been issued a subpoena or court order
  • Certain State & Federal Agencies.
  • Appropriate individuals in an emergency in order to protect the health & safety of the student or other persons
  • Under the Solomon Amendment – military recruiters
  • Parents’ Ability to Access Student Information (not a “right”)
  • Parents may obtain directory information
  • Parents may obtain non-directory information by obtaining a signed consent from their child
  • Existence of a signed consent does not constitute a “power of attorney” empowering parents to act on behalf of the student
  • Access to Student information via Banner or other computer software does not authorize unrestricted use of that information
  • Curiosity is not a valid reason to view student information
  • Parenthood is not a valid reason to view student information on one’s son or daughter
  • Records should only be used in the context of official business
  • When in doubt – don’t give it out
  • Requests for student academic information should be referred to the Office of the University Registrar
  • Information on a computer should be treated with the same confidentiality as a paper copy
  • Do not leave confidential information displayed on an unattended computer
  • Cover or put away papers that contain confidential information if you are going to step away from your desk
  • Records containing SSNs/Student IDs/Names and/or grades should always be shredded when the need arises to discard such items, not just thrown in the garbage

They should not:

  • Use the Student ID/Student Names to post grades
  • Leave graded tests [electronically or in print] for students to sort through
  • Circulate electronically or in print, class list with the Student Name and Student ID
  • Provide anyone with student schedules
  • Provide anyone with lists of students enrolled in your classes
  • Include confidential information (i.e., grades, #of credits) in a commendation letter without the written consent of the student [Note: If a student provides you a resume with the information, you may disclose whatever is in the resume.]

Students now have the option of designating access to their academic record to parents and/or guardians via their myBama account. This FERPA release will allow faculty and staff at the University of Alabama to speak with the designated person about the student’s educational record. The ‘Record Release to Parent/Guardian’ link resides under the Student Services folder located on the Student Tab of myBama. Students may designate access only to individuals that are listed as an emergency contact, which they may also enter through their myBama account. To deactivate a previously assigned release, students must submit this request in writing to the Office of the University Registrar.

  • Directory information on individual students may be made available publicly by the appropriate educational record custodian.
  • Information from a student’s educational record may be shared among University officials who have legitimate educational interests.
  • Access to a student’s educational records by school officials is restricted to that portion of the record necessary for the discharge of assigned duties.
  • The release of non-directory information to parties outside of the University is restricted to the appropriate educational record custodian and only if the custodian has a signed and dated authorization to release statement from the student.
  • FERPA rights cease upon death. However, it is the policy of the University of Alabama that no records of deceased students be released to third parties after the date of death, unless specifically authorized by the executor of the deceased’s estate or by the next of kin.
  • The University does not provide mailing lists to any third party for either commercial use or for solicitation of any product or service.
  • Good practice by faculty and staff members requires that they maintain, use, and report student data in compliance with the requirements of FERPA and the University’s Policy. The following statements provide practical guidelines to follow:
    • Do refer requests for student record information to the proper educational record custodian.
    • Do keep only those individual student records necessary for the fulfillment of your teaching or advising responsibilities.
    • Do keep any personal records relating to individual students separate from their educational records. Private notes of a professor/staff member concerning a student that are intended for professor’s/staff member’s own use are not part of the student’s educational record.
    • Do insure privacy when asking for student UA CWID. When on the telephone, be aware that the student may not be in a private environment.
    • Do ask for only the last four digits of the UA CWID on exams and other documents, when needed, to identify different students with the same name.
    • Do properly dispose of all papers and documents that contain the UA CWID.
    • Do not include the UA CWID in the subject line of an e-mail message.
    • Do not include the complete UA CWID in the body of e-mail messages and attached documents.
    • Do not include the UA CWID on any document mailed by surface mail where the UA CWID is visible on the document or in a window envelope.
    • Do not display student scores or grades publicly in association with the student name, CWID, social security number, or other personal identifier. Scores or grades may be posted using a code known only to you and the student.
    • Do not put papers or lab reports containing student names and grades in publicly accessible places. Students are not to have access to the scores and grades of others in the class.
    • Do not request information from the educational record custodian without a legitimate educational interest and the appropriate authority to do so.
    • Do not share student educational record information with other faculty or staff members of the University unless their official responsibilities provide for a legitimate educational interest.
    • Do not ask for the CWID on any document that will be viewed by anyone other than a University employee with an educational need to know. Examples:
      • On exams, homework assignments and attendance rosters – if other students may view these documents.
      • On questionnaires, surveys and other documents soliciting additional personal information.
      • On checks payable to the University or to the student.
      • On non-academic documents such as an appointment sign-in sheet.

The Student Information option or the Student Advising Profile under the Faculty and Advisors folder located in the Faculty tab of myBama will indicate if a student designated a FERPA release. A student may only grant a release to an individual listed as a student’s emergency contact.

FERPA release codes may also be found on form SGASADD (student attribute block) in Internet Native Banner (INB).

Values are:

DDR             Release to Parents

DFR             Release to Father

DMR             Release to Mother

DGR             Release to Guardian

On the General Person SPAIDEN form in the Emergency Contact tab, the student must have specified an individual(s) with appropriate contact information.  Note that the Emergency Contact relationship (mother, father, parent, guardian) equates to relationship on the FERPA release.

If you are unable to determine the individual to whom a student has granted a FERPA release, you may contact the Office of the University Registrar at 205-348-2020 or

  • Questions related to FERPA, students’ privacy rights, and The University of Alabama’s compliance procedures should be directed to the Office of the University Registrar, 206 Student Services Center, Box 870134, Tuscaloosa, Alabama 35487, or via e-mail addressed to
  • Any student covered by FERPA who has reason to believe that the university is not complying with the Act or this policy should inform the University Registrar via e-mail addressed to Upon receipt the University Registrar shall promptly review all such allegations and take appropriate action.
  • A student covered by FERPA also has a right to file a complaint with the U.S. Department of Education if he or she believes the University has failed to comply with the requirements of FERPA. A complainant must be an eligible student affected by an alleged violation. The name and address of the office that administers FERPA is: Family Policy Compliance Office; U. S. Department of Education; 400 Maryland Avenue, SW; Washington, DC 20202-4605; Telephone: (202) 260-3887 ;Fax: (202) 260-9001.