[ARCHIVED] FERPA and Notifications

[heidi1]

Have any of you dealt with questions from faculty concerned about grades going out via email, text, twitter, etc. and the possibility that this violates some aspect of FERPA?

Heidi

[kona]

Yes, but not faculty, as much as higher level administration. What helped everyone be ok with this is that Canvas has a Admin setting, "Students can opt-in to receiving scores in email notifications" that ensures students are made aware of potential issues and are ok with it.  See the following guide for (a little) more information - What are the Canvas settings at the account level?

There's also this pop-up notification you can use - How do I display the account one-time popup warning on the Notifications page?

Overall since students are the ones setting up where their information is sent and we have some of these opt-in and popup warnings in place, everyone has been ok with it on our campus (we've been using Canvas since 2012).

[kmeeusen]

Heidi:

Kona's response is correct. FERPA requires opt-in permission (rather than opt-out) from students to share sensitive information. Because Canvas notifications are user specific, and the students make the determination of what is sent where, this meets FERPA privacy standards.

We strengthen this by including clear information on Notifications and what those settings mean in our Student Canvas training.

And, as Kona also pointed out, very little concern from our faculty, some small initial concern from administration and almost none from our students. We also have been using Canvas since 2012.

[kedmison]

Our student information data steward and our IT security office are very conservative.

We have opted to turn this feature off. The issue that we see is that we can't guarantee that the student is going to use a university-issued email address to receive their grades. If we could, then it would be no problem, as we have a contract with our email provider. But the view here is that because we would be sending FERPA protected info via a third party (the student's email service), regardless of if the student opted in or not, that could be viewed as a data exposure. We can't guarantee the student's info is secure on the mail server, or that copies of the emails are not being archived.

[kmeeusen]

Bob:

Yep, seen that level of conservatism before, and since I worked as a hospital Compliance Officer for 20 years, I can also understand it to a certain degree.

You can set your Canvas account so that students cannot delete their school provided email address, but you cannot prevent students from adding additional email addresses and making them the default, so that feature is almost useless. What is needed in more granular settings for this feature so that you can also prohibit additional emails.

Still, the notifications are opt-in, You have a built-in alert message for students, and control of info is theirs.

I see the pedagogical value of notifications to be very high and it is one of the features I really like in Canvas. It provides students with information they need to stay on top of and engaged in their online courses.

May not help, but have you sought an opinion from your system's AAG?

[kona]

kedmison​, when a question like this was posed, I reminder our upper level admins that students can already forward their Institutional email to any email address they want, so this really isn't all that different. That seemed to help quiet some fears.

[kedmison]

The difference for us is that if a student forwards an email, it's clearly on the student. If we send the email, even if the student has blessed it, there is still a perception that we are on the hook if the student, or mom/dad, complains.

It's hair-splitting, but that's where we are.

[kmeeusen]

I truly get that, Bob!

[Robbie_Grant]

 @heidi1 ,

We are giving the Canvas Admins area a little bit of love (especially questions that are really, really old) and just want to check in with you.  This will also bring this question new attention. 

Were you able to find an answer to your question? I am going to go ahead and mark this question as answered because there hasn't been any more activity in a while so I assume that you have the information that you need. If you still have a question about this or if you have information that you would like to share with the community, by all means, please do come back and leave a comment.  Also, if this question has been answered by one of the previous replies, please feel free to mark that answer as correct.

Robbie