Family Educational Rights and Privacy Act – FERPA Compliance

In today’s digital age, a large amount of information that is stored, processed and retrieved is in the digital format. Student records which were previously paper-based documents are now stored digitally. Web-based systems are being used to process applications for enrollment and also for loans and grants. Sensitive bursar information and social security numbers are stored on numerous occasions without proper information security policies in place. With these changes and the convenience they have brought along, have also come regulations that mandate compliance and due diligence in the form of information security policies, information security audits, etc. Educational institutions are required by law to protect confidential student information and the Family Education Rights and Privacy Act (FERPA) is one of the major governing regulations to make sure the information is secured.

The Family Educational Rights and Privacy Act is one of the most important regulations affecting educational institutions. It requires them to protect confidential student information from being disclosed. It also requires that educational institutions demonstrate responsibility and due diligence by taking proactive security measures to identify the risks faced by confidential student information and to employ countermeasures that are commensurate with the amount of risk identified.

Enterprise Risk Management works with a large client base of educational institutions to help them comply with the information security requirements set forth by the Family Educational Rights and Privacy Act and other applicable regulations. Enterprise Risk Management’s team of experts combines technical expertise with regulatory knowledge to help client organizations achieve both robust information security and regulatory compliance as a by-product. Our experts help comply with the FERPA by ensuring that sensitive information is accessed only by those authorized to do so, assessing the security of information systems and also helping draft adequate security policies to govern the storage, processing and retrieval of confidential information.