FERPA / Confidentiality of Student Records
Your Records, Your Rights
The Family Educational Rights and Privacy Act (FERPA) of 1974 is a federal law that protects the privacy of student education records. UNC Asheville complies fully with FERPA. Education records are maintained by the Office of the Registrar, and your official academic transcript is permanently retained.
The university does not release education records without your written consent except as required by law. Use the sections below to learn about your rights, how to grant access to others, and what faculty and staff are required to do.
⚠ Want to restrict ALL information about you?
You may submit a Restriction of Directory Information formt o the Academic Success Center at any time. Once filed, the university cannot release any information about you — including your name in Dean’s List publications, graduation programs, or athletic rosters. The restriction stays in place until you notify the Office of the Registrar in writing to remove it. Photo ID is required.
Release of Student Directory Information
Directory information may be released to the public without the student's consent unless the student has filed a restriction. Non-directory information requires written authorization.
The following is considered directory information at UNC Asheville and may be released without student consent unless a restriction is on file:
- Name (including preferred first name)
- Major field of study
- Class (junior, senior, etc.)
- Enrollment status (full-time, part-time, etc.)
- Dates of attendance at UNC Asheville
- Degrees and awards received (including Dean’s List, Chancellor’s List, and scholarships)
- Participation in select activities and sports
- Height, hometown, and high school of members of athletic teams
Limited Use Directory Information
Photographs, videos, and University-issued student email addresses are designated as limited use directory information. Disclosure is restricted to:
(1) official University publications and University-hosted websites or social media;
(2) University officials with a legitimate educational interest; and
(3) external parties contractually affiliated with the University where sharing is required by that affiliation.
The university does not permit access to or release of non-directory education records without the student’s written authorization, except in the following circumstances:
- To UNC Asheville officials, including faculty, who require the records in the proper performance of their duties
- In connection with the student’s application for or receipt of financial aid or Veterans Administration benefits
- To organizations conducting studies for educational or governmental agencies, where individual students are neither identified nor identifiable
- To U.S. government agencies as listed in Public Law 93-380
- To parents of a dependent student as defined in the Internal Revenue Code of 1954
- To accrediting agencies
- To comply with a judicial order or lawfully issued subpoena
- To appropriate persons in an emergency where the information is necessary to protect the health or safety of a student or others
- To other UNC system institutions if the student applies or is accepted for transfer
The Office of the Registrar ensures the security of student records through the following practices:
In the Registrar’s Office
- Files are secured in the Student Records Vault with access limited to authorized personnel only
- Access to electronic student records is restricted to those needing it for essential job functions
- Spaces where records are used and stored are kept locked
- Social security number display is limited to those who require it for essential job functions
- All staff, including student workers, sign confidentiality agreements
- Photo ID is required before releasing non-directory information to any party
- Screen protectors are used on monitors to prevent unauthorized viewing during business hours
- Workstations are password-protected to prevent unauthorized after-hours access
Campus-Wide
- Password-protected databases and limited password access
- File cabinets and drawers with student records are kept locked
- Student information is not re-released to third parties beyond its approved use
- Offices where records are used and stored are kept locked
- Appropriate documents are shredded as required
Access to the Banner Student database is restricted to the smallest number of users possible. All access requests are reviewed and approved by the Registrar. Annual re-authorization reviews are required. Employees granted access must sign an agreement affirming they understand and will uphold applicable federal statutes. For more information see UNC Asheville’s Data Management Policy.
Student Rights Under FERPA
FERPA guarantees you specific rights regarding your education records at UNC Asheville.
- The right to inspect and review your education records
- The right to seek amendment of education records you believe are inaccurate or misleading
- The right to have some control over the disclosure of information from your education records
Education records are records in any medium (handwritten, print, tape, email, fax, etc.) that contain information directly related to you and are maintained by UNC Asheville or a party acting on its behalf.
The following are NOT education records:
- Sole possession notes kept by a university employee that are not shared with others
- Law enforcement records maintained by Campus Police
- Employment records, as long as employment is not contingent on student status
- Medical/treatment records made and maintained by a recognized health professional for treatment purposes only
- Alumni records created after you are no longer a student that do not relate to your time as a student
- Submit a written request to the Office of the Registrar specifying which record(s) you wish to inspect.
2. You will be contacted at your official UNC Asheville email address to schedule an appointment. Access must be provided within 45 days of receiving your request.
3. Review takes place in the presence of a Registrar staff member. No copies may be taken from the record.
The university reserves the right to refuse inspection of the following, even with written consent:
- Financial statements of the student’s parents
- Letters or statements of recommendation for which the student has waived the right of access
- Records excluded from the FERPA definition of education records that are not otherwise publicly accessible
The university may also deny copies of records in any of the following situations:
- The student or qualifying parent lives within commuting distance of the university (generally assumed to be within 100 miles)
- The student has unresolved financial obligations to the university
- There are unresolved disciplinary actions against the student
Under FERPA, UNC Asheville may disclose education records to parents of dependent students without the student’s consent. If the student is claimed as a dependent on either parent’s most recent federal income tax return, either parent may be granted access under this provision — regardless of the student’s age. The university may ask the parent to provide a copy of the relevant tax return to establish dependency.
Parent Rights Under FERPA
Once a student turns 18 or enrolls in a postsecondary institution, FERPA rights transfer from parents to the student. There are, however, specific circumstances where the university may share information with parents.
When a student turns 18 or enrolls in a postsecondary institution at any age, FERPA rights transfer from the parents to the student. At that point the student is referred to as an “eligible student” under the law. While parents lose automatic access rights, FERPA provides several ways the institution can still share records with parents.
- Dependent student: If the student is listed as a dependent on either parent’s most recent federal income tax return, either parent may be given access to the student’s records regardless of age.
- Health or safety emergency: The university may disclose information if there is a genuine risk to the health or safety of the student or others.
- Alcohol or drug violations: The university may — but is not required to — notify parents if a student under 21 violates the institution’s drug or alcohol policies.
- Proxy access granted by student: Students may voluntarily grant parents access to specific portions of their record through OnePort. See the Proxy Access section below.
Proxy Access (Online FERPA Release)
You can authorize a parent, guardian, or anyone else to view portions of your academic record online — without filling out any paper forms. The entire process is managed through OnePort.
You can grant a proxy view access to any combination of the following:
- Unofficial academic transcript, including grades
- Schedule of classes
- Account summary for charges
- Financial aid information
Once set up, your proxy receives email instructions for logging into a separate, secure online portal. They must log in to view the information — it is not sent directly to them. You can modify or revoke access at any time through OnePort.
Your proxy only needs a valid email address. As you complete the steps below, they will be receiving setup emails simultaneously — so complete all steps in one sitting to avoid issues.
- Log in to OnePort with your UNC Asheville credentials.
2. Click Self Service Banner in the left-side menu.
3. Click General, then Proxy Management.
4. Click Add New to add a proxy user.
5. Enter your proxy’s name and their email address — not your own. This address receives the emails they need to finalize setup.
6. Click Add Proxy, then define your relationship with the proxy. Set a Passphrase (minimum 8 characters — letters, numbers, or both). The proxy will need this passphrase when calling the university by phone to verify their identity. Keep it private between you and your proxy.
7.Set a start and end date for the proxy’s access. The end date can be as far into the future as you’d like. Access automatically deactivates when the end date is reached.
8. Choose which areas of your record the proxy can view, then save.
Faculty & Staff Responsibilities
All university employees are considered school officials under FERPA and are legally required to protect the confidentiality of student records.
All university faculty and staff — including student workers — are required by law to maintain the confidentiality of student records. Any employee who maintains specific records is considered a record custodian. The Office of the Registrar is the official custodian of academic records.
Releasing any non-directory information about a student — including course grades, letters of recommendation, or GPA — to anyone outside the university community, or to university personnel without a legitimate educational interest, violates federal and state law and university regulations.
Access requires a legitimate educational interest — a “need to know” within the scope of one’s role. At UNC Asheville:
- Faculty advisors may search for and access student academic records via OnePort.
- Faculty who do not serve in an advisor role may not access student academic records.
- Staff must be employed in an administrative office that requires access to student records to perform essential job functions. Otherwise, access is not granted.
When in doubt about whether access is permissible, contact the Office of the Registrar before accessing or sharing any student information.
All faculty should instruct students to check their grades via OnePort. Grades display once an official grade roll has been processed by the Office of the Registrar; rolls are performed regularly throughout the day during active grading periods.
Graded work must be returned personally to each student. Do not leave a stack of graded papers for students to pick up themselves — this violates each student’s right to privacy.
Parents lose their FERPA rights when their child turns 18 or starts attending college — whichever comes first. If a parent contacts you by any means:
1. First verify with the Office of the Registrar whether the student has set up proxy access through OnePort and what information, if any, the proxy is authorized to receive.
2. If the student is present during the conversation, you may discuss information with the parent, but always ask to see the student’s photo ID if you do not recognize them.
3. If a parent claims to have a written consent form from the student, do not accept it unless you witnessed the student signing it or have written confirmation directly from the student. The consent must clearly state what information may be released and must bear the student’s signature.
4. Once you have confirmed that releasing information is permissible, always verify the identity of the person you are speaking with — especially if the student is not present. Ask for photo ID.
- Never share, disclose, or loan your personal username or password. Everyone must obtain their own individual login.
- Remote access, retrieval, and transmission of student record information must use a secure, encrypted connection.
- Restrict unauthorized persons from viewing screens or documents containing student information.
- Log out of any system containing student data before leaving your workstation unattended.
- Do not discuss student information in public spaces where others may overhear.
- Report any suspected breach of student record confidentiality to the Office of the Registrar immediately.
FERPA violations may result in the loss of federal funding for the university. Any breach of confidentiality can lead to disciplinary action, up to and including termination of employment.
Frequently Asked Questions
Personally identifiable information (PII) is information about a student that cannot be disclosed without consideration of FERPA. Information does not need to include a student’s name to qualify as PII — it qualifies if it is part of an education record and is easily traceable to a specific student. PII includes but is not limited to:
- Student’s name
- Name of the student’s parent or family member
- Student’s or family’s address
- A personal identifier such as Social Security Number or student ID number
- Any list of personal characteristics that would make the student’s identity easily traceable
Not fully. FERPA rights attach upon enrollment, not application. However, the university is required to protect records it receives on behalf of an applicant — such as transcripts from a prior institution — and may not redisclose that information except in accordance with FERPA.
Once enrolled, if a student later seeks to transfer, FERPA permits the university to disclose education records, including disciplinary records, to any institution the student seeks to attend. Student consent is not required for transfer disclosures, though the student should be notified.
A school official is a university employee or contracted third party who:
- Performs a service or function the institution would otherwise use its own employees to perform
- Has a legitimate educational interest in the information
- Operates under the institution’s direct control with respect to the use and maintenance of education records
Outside vendors and contractors may qualify as school officials if they meet all three criteria.
Yes. Directory information may not be disclosed if it is linked to non-directory information — for example, a student’s financial aid status. Additionally, if a request involves students who have applied for or received financial aid, the institution is prohibited from disclosing directory information about those students without prior written consent.
Submit a Directory Restriction form to the Office of the Registrar. Once filed, the university cannot release any information about you — directory or otherwise. This includes:
- Confirmation of your enrollment
- Your name in Dean’s List or Chancellor’s List publications
- Your name in the list of graduates or in the graduation program
If you later want information released, you must come to the Office of the Registrar and revoke the restriction in writing. Photo ID is required. No information can be released until the restriction is formally removed.
Generally, no — not without your permission. Parents lose FERPA rights when you turn 18 or enroll in college. There are two ways a faculty or staff member may discuss your records with a parent:
- You have set up proxy access through OnePort authorizing that parent to receive specific information
- You are present in the conversation and the faculty/staff member has verified your identity
If you are a dependent student (claimed on a parent’s federal tax return), the university may also release information to that parent without your consent. The parent may need to provide documentation of dependency.
Contact the Office of the Registrar
Schedule an appointment or stop by during office hours. Drop-ins are welcome and we’re happy to assist with any records, registration, or enrollment questions.