Examples of Violations of the Confidentiality Policy
Policies and Procedures | Human Resources

It is very important that all faculty and staff members at the University are aware of the importance of respecting an individual’s right to privacy. Whether it is a student’s academic file or an employee’s human resources file, University faculty and staff must be very careful to maintain the confidentiality of all print and electronic data. Here are examples of how well-meaning, conscientious individuals violate the University’s confidentiality policy.

Student Records

1. A professor asks for phone numbers of a few students from last semester’s class. He has heard of a local company with several jobs open in their field of study. Is it okay to give this professor that information?

No. Refer this call to the University registrar. The registrar is the only individual with the authority to provide confidential student information.

2. A parent calls the University, stating that he is on his way to the school to pick up his son, a student at the University, because of a family emergency. The parent wants to know the location of his son’s classes for the afternoon. Can an employee provide this information?

No. University staff cannot share a student’s schedule with anyone except the student. The employee can refer this call to the University registrar. Providing this information is a violation of FERPA law, but more importantly, may put the student in danger.

3. On the phone, a parent angrily asks how he can possibly pay his son’s tuition bill if the school will not let him see an itemized bill. Can the employee provide this information?

No. It may seem odd, but FERPA regulations prohibit the release of financial information to anyone other than the student. The employee can refer the call to the University registrar, who can ask the parent to have their child sign a waiver, granting him these rights.

4. Can a work-study student check out the grade point averages of fellow students?

No. Even though a work-study student works in the Registrar’s Office, he or she does not have legitimate access to the academic records of fellow students. In fact, it is poor policy to assign a work-study student to such a position.

5. Can a Roosevelt faculty member provide information about a student’s progress in class to the student’s parents?

No. University faculty and staff must assume that the student is an adult who is entitled to privacy, even from parents. FERPA recognizes students in higher education as adults, regardless of age.

6. A person comes to the office with a letter containing a signature that gives consent to release the transcript of a student. Can the employee release that information?

No. Official transcripts are available only through the Office of the Registrar. University staff should never give records to a third party.

7. An employee receives a phone call from the local police department indicating they are trying to determine whether a particular student attended on a specific day. Can an employee provide this information?

No. University staff should direct the caller to the University registrar. If the police require more information, a subpoena may be required. Additionally, FERPA requires that we notify the student, unless the subpoena specifically states, that the student must not be notified.

8. A professor leaves papers and graded tests outside the office door for students to pick up. Is this acceptable?

No. It is inappropriate for students to have access to other student’s information. One should never leave personally identifiable materials in a public place.

Employee Records

9. Can an employee give the home address of a co-worker, who is out on medical leave of absence, to other staff members when they inquire about her health?

No. It seems harmless to provide address information to co-workers, but it is clearly a violation of the policy that prohibits any employee of the University from providing personal information about another employee. An individual’s privacy is protected by HIPPA regulations.

10. Several times a day, concerned employees and students ask about a co-worker who has been out ill. Can employees from that area acknowledge that the employee is ill and out of the office, and give some basic information about the status of that employee?

No. Without permission from the employee, faculty and staff should not provide any information. However, the department supervisor can call the employee and ask him or her specifically how to respond. The supervisor should then ask the employee to give written permission to share the approved information.

11. A human resource employee frequently uses the phone to discuss sensitive disability information about employees to our insurance carrier. She worries that individuals walking through the office for other reasons may overhear the conversation. Does she have a legitimate concern?

Yes. Human resource employees have a responsibility to ensure that all employee health information be kept confidential from everyone.

Donors, Prospective Donors and Alumni Records

12. The Chicago Tribune plans to run an article on RU alumni and donor, Jane Doe. She recently donated money for the renovation of several classrooms. When a reporter calls for the information, the employee is careful to avoid giving confidential information. Instead, he talks briefly about Jane as a student at the school, her awarded degrees and her amazing 4.0 grade point average. Is that okay?

No. Before providing any information about Jane, the department supervisor can contact her directly. Jane must put her approval in writing before any information is given. And, another point, while student activities and awarded degrees are directory information, grade point average is not.

Documents and Data

13. A supervisor sends a staff member an e-mail to highlight the importance of improving her attendance. The benefit of using e-mail for this message is to document the fact that the supervisor notified the employee. Is this acceptable?

No. According to University policy, sensitive information about an employee should never be transmitted via electronic mail. From a management point-of-view, a conversation such as this should take place face-to-face, and document in writing as necessary.

14. An administrator gives a work-study student his Banner password so he can continue his work. The password allows him access to the student’s academic records, which he needs to get his work done. The password also allows access to student financial records. Is this a problem?

Yes. Every employee has a duty to protect students’ information from those who do not have a legitimate reason to see it. It is irresponsible to give anyone a password.

15. A friend is trying to contract with Roosevelt University to use his new office cleaning business. An employee in the Business Office can easily find out what we pay our current provider, and pass the information along to the friend. Is this wrong?

Yes. Any time we release confidential information, we may violate FERPA, HIPPA or the Gramm, Leach, Bliley Act, as well as University policy. Such violations put the University at risk and could lead to employee discipline up to and including termination.

16. An unauthorized person retrieves information from a computer screen that was left unattended. Under FERPA, is the University responsible?

Yes. Information on a computer screen should be treated the same as printed information.

Human Resources | Policies and Procedures | Confidentiality Policy