Compliance Corner

Guidance: BPM 66 Sec 3.3.1 Regarding Posting of Grades

Posted: February 15, 2007

[ Note: June 20, 2008 :: BPM 66 is now referred as UTS166 ]

The Office of Corporate Compliance has received notice from the Social Security Number (SSN) Coordinator that in a recent meeting of the Chief Information Security Officers, BPM 66, Section 3.3.1, regarding posting of grades was discussed. BPM 66, Section 3.3.1, states "Grades may not be publicly posted or displayed in a manner in which all or any portion of either the SSN or the unique identifier identifies the individual associated with the information."

If a faculty member is posting student grades for “public” viewing (outside the office door, etc.) using a unique identifier, he/she should read the following guidelines from Barbara Holthaus of the Office of General Counsel:

Section 3.3.1 in BPM 66 is not a policy that UT System or an institution is free to reinterpret or amend. The provision is a reiteration and codification of what the Family Educational Rights and Privacy Act (1974) (FERPA) requires. This portion of the BPM merely reflects what all UT System institutions are required to do by law. As you know, FERPA is federal law designed to protect the privacy of education records and is enforced by the Family Policy Compliance Office of the U.S. Department of Education (FPCO). Failure to comply with FERPA can result in the loss of federal funding.

The Family Policy Compliance Office issued rulings even before BPM 66 was drafted, clarifying that FERPA prohibits any institution of higher education from using an identifiable number or any portion thereof for posting student grades. This includes school-issued identifier numbers, SSNs, or any portion of SSNs. It is federal law (FERPA), not BPM 66, that prohibits the use of a school-assigned student id numbers or SSNs for grade posting. Incidentally, it is also why faculty cannot mail a student his/her grades on a postcard. Below is a link to one such ruling issued by FPCO:

http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/hunter.html

FERPA permits a professor to post a grade using a codeword or password agreed upon by the student and/or professor. Below are websites containing alternative methods of grade posting utilized by other universities. These sites demonstrate that the requirements are not merely regulations fabricated by UT System – these requirements are the law, and although the requirements may inconvenience professors, the inconvenience is far better than having professors and the institution respond to a FERPA complaint, becoming subject to an investigation by the federal government.

http://academicleadership.rutgers.edu/GradePosting-10-11-05_001.pdf

http://www.wccnet.edu/staff/facultyinfo/gradeposting.php

http://www.registrar.ufl.edu/ferpafaculty.html

http://www.uc.edu/registrar/documents/FERPA_Faculty_Reference_Sheet.pdf

If you have questions or need further information, please do not hesitate to contact Doug Arney, AVPBA/Compliance/SSN Coordinator at 882-7318.

Thank you