Faculty-Student Interaction in a Risk Management and Insurance Studies Program: Compliance and Regulatory Considerations

Abstract

Programs that are perceived as being specialized in a specific industry such as real estate or insurance typically require a great deal of attention to survive and thrive. Not only is there increasing competition for students and funding, but the move toward a society increasingly reliant on information combined with constantly-changing technology can cause roles to blur and increase opportunities for miscommunication and errors. In addition, most Risk Management and Insurance (RMI) programs are dependent to various degrees on support from the industries they serve. Some smaller, newer programs must struggle with frequent political battles with administrators just for survival. With many RMI faculty members holding multiple roles of faculty member, job/internship facilitator and general promoter of an RMI studies program, the ability to comply with regulations can be challenging. This paper provides a general overview of certain key regulations and updates of these regulations, especially as they relate to student and employer interaction. We also point out some areas that would generally fall under the purview of a typical RMI faculty member or center director, and discuss the potential ethical or regulatory pitfalls that RMI faculty should be cognizant of during this process.

2

Introduction

Distinct from many areas of study at universities, including some business disciplines, are

programs that are perceived as being specialized in a specific industry such as real estate or

insurance. Such programs typically require a great deal of attention to survive and thrive. Not

only is there increasing competition for students and funding, but the move toward a society

increasingly reliant on information combined with constantly-changing technology can cause

roles to blur and increase opportunities for miscommunication and errors. In addition, most Risk

Management and Insurance (RMI) programs are dependent to various degrees on support from

the industries they serve. Some smaller, newer programs must struggle with frequent political

battles with administrators just for survival. The list of universities that have discontinued RMI

programs at some point in their history over the last 40 years is noteworthy.1

With many RMI faculty members holding multiple roles of faculty member,

job/internship facilitator and general promoter of an RMI studies program, the ability to stay on

top of regulations can be challenging. Recent high-profile cases of identity theft have heightened

the awareness of school officials’ responsibility to insure that student data is only used for

authorized and intended purposes. The purpose of this paper is to provide a general overview of

certain key regulations and updates of these regulations, especially as they relate to student and

employer interaction. We also point out some areas that would generally fall under the purview

of a typical RMI faculty member or center director, and discuss the potential ethical or regulatory

pitfalls that RMI faculty should be cognizant of during this process.1 According to ARIA historian Dr. Richard Corbett, these schools include Notre Dame, Cal State - Chico, Texas Christian University Louisiana State University, University of Florida, Virginia Tech, University of Miami, Ohio State University, Oregon State University, University of Southern California, Indiana University, University of Wyoming, University of Washington, University of North Carolina, University of Arizona, University of Oregon, and Arizona State University.

3

The Family Educational Rights & Privacy Act of 1974

The Family Educational Rights & Privacy Act of 1974 (FERPA), also known as the

“Buckley Amendment” is a law that essentially protects the privacy of student educational

records and allows the students the right to refuse to permit educational institutions from

releasing or disclosing any information about them. Basically the purpose of FERPA is to

identify the rights afforded to students pertaining to their educational records. Three

fundamental rights that students have under FERPA are: (1) the right to review and inspect

education records, (2) the right to request to amend education records, and (3) the right to limit

disclosure of “personally identifiable information” contained in education records. FERPA

applies to the education records of persons who attend a postsecondary school (regardless of age)

and all educational agencies or institutions receiving funds under any program administered by

the Secretary of Education. Generally, a student’s FERPA rights begin on the first day of class

(FPCO, 2010).

Directory Information is any information contained in the student record that is

considered public information. This information may be released without the student’s written

permission. However, if student opts to have Directory Information suppressed, no information

about the student may be released to anyone. Schools must tell parents and eligible students

about directory information and allow parents and eligible students a reasonable amount of time

to request that the school not disclose directory information about them. Schools must notify

parents and eligible students annually of their rights under FERPA. Confidential items such as

those in the right-hand column of Table 1 below should never be released.

Table 1

4

Directory Information NOT Directory Information

Student’s name Social security number

Local address Grade point average (GPA)

Local or contact telephone number Academic standing

College and major Grades

Class Gender

Dates of attendance Race

University email address Ethnicity

Place of birth Nationality

Degrees and awards received

Most recent previous educational agency or institution attended

Participation in officially recognized activities and sports

Weight, height, and date of birth of members of athletic teams

FERPA’s privacy protections apply to education records that are kept in various formats,

including: paper, digital image, video, electronic, film, and audio tape -- even after the student is

no longer enrolled. However, records not directly related to the individual’s attendance as a

student, such as alumni records, are not considered education records. In addition, universities

are increasingly limiting email communications involving academic issues between faculty and

students to their official university email address. An example of a response to an email from a

student’s non-university email address can been seen in Appendix A.

5

Some selected FERPA-related issues are gradually making their way through the legal

system. In Owasso Independent School District v. Falvo, 534 U.S. 426, (2002), Kristja J. Falvo

originally sued her son's Oklahoma school district in 1998, claiming the disclosure of his quiz

grades when students swapped and graded work during class was a violation of FERPA. A

federal appeals court sided with Falvo in October 2000. The Owasso school district then

appealed to the Supreme Court, which constituted the first time the nation's highest court heard a

case involving FERPA.

In a unanimous decision, the nation’s highest Court ruled that classroom peer grading

does not constitute an "education record," and does not violate the federal Family Educational

Rights and Privacy Act (FERPA) -- at least not until after the grades are recorded in a teacher's

grade book. Furthermore, the Court said that when quiz grades are read aloud by students in

class, they are not "maintained" by the school district, a stipulation required for records that are

protected under FERPA. The Court chose not to address the broader question of whether student

assignment grades are protected under FERPA once they are turned in to teachers.

Because professors compile evaluative information about students, they are obligated to

protect the student rights and safeguard against unwarranted publication of this type of

information. In the event of a conversation over lunch between a recruiter and a professor about

a student, there could conceivably be a response to a recruiter’s inquiries wherein the professor

may advertently or inadvertently divulge private and proprietary information. This can give rise

to FERPA violations regardless of the good faith or well-meaning motivation on behalf of the

professor. Clearly, it is always paramount to maintain student confidentiality when talking,

writing, or emailing to any third party – including parents of the student.

6

In a survey of hundreds of faculty at three four-year public universities in the Mountain

West, Midwest, and Great Lakes areas, Gilley and Gilley (2006) find that demographic factors

such as faculty member teaching rank and tenure status do not significantly impact faculty

member knowledge of FERPA; in addition, many faculty members do not appreciate the

importance of FERPA; their results posit that current providers of FERPA information do not

significantly influence faculty members’ familiarity of applicable laws related to educational

privacy. Specifically, they find that 41.8 percent of responding faculty members at the surveyed

universities lack comprehension of FERPA, and 29.4 percent indicate a slight familiarity with

the law. Doctoral students are rigorously trained for the research element of an academic career.

Gilley and Gilley contend, however, that many Ph.D. programs spend little time on situations

that arise based on the interpersonal relationships of faculty and their students.

Consequences of FERPA Violations

Technically, the consequences for violating FERPA are serious and may include possible

prosecution under criminal codes, dismissal or termination, or loss of Federal funding to the

educational institution. It should be noted that, a single instance of divulging protected

information is not a “policy or practice” by the university which is the requirement for a FERPA

violation to be found. See: U.S.C. Section 123g (1) (A) (2006). Isolated incidents of divulging

student “education records” to a third party carry no sanctions. Even when there might be a

showing of a “policy or practice” of an alleged privacy violation, the only remedy available

under the Act, is for the government to stop federal funding in the event of the finding of a

FERPA violation.

7

To date, there has been no public school or university that has had its funding withdrawn.

See: Lynn M. Daggett, “FERPA in the Twenty-First Century: Failure to Effectively Regulate

Privacy for All Students, 58 Cath. U.L. Rev. 59 (2008). Clearly, from an enforcement

perspective, FERPA is silent as to any potential civil remedy that exists to ensure compliance.

Most commentaries believe that the sanction of removing federal funding is so punitive as to

make it a hollow threat. Moreover, under FERPA there is not presently any cause of action for

private lawsuits. Therefore, no person can sue the university for monetary damages and recover

a monetary award against the university or an individual professor under the Act. See the United

States Supreme Court decision of Gonzaga University v. Doe, 122 S. Ct. 2268 (2002).

It is important to note that there is the possibility that states could legislate a state remedy

to allow students to sue and recover in private lawsuits for privacy breaches of their education

records by public schools or universities. Of course, most state courts already recognize personal

injury claims based upon general tort law of invasion of Right to Privacy.

Other Privacy Issues

The consent to disclosure of records is an area that appears to cause the most violations

by faculty and administrators. According to a study by Rainsberger (1998), examples of

behaviors that would be considered in violation include posting of grades via social security

number (which is considered identification, similar to a name), leaving graded student work in a

public place such as stacked outside a faculty member’s office, sharing student information with

third parties without the student’s consent, using listservs to provide students with feedback,

discussing grades or individual student performance with colleagues possessing “no legitimate

8

need to know,” and passing stacks of graded assignments around a classroom for students to sort

through.2

In general terms, if the information is such that, either single-handedly or in combination,

can be linked or is linkable to a specific student and would enable a rational person in the

university community, who does not have personal knowledge of the germane circumstances, to

accurately identify the student with reasonable conviction, then privacy constraints apply. There

are certain exceptions to the privacy restrictions, such as the disclosure is to parents of a

dependent student, as defined in section 152 of the IRS Code; the disclosure is in connection

with a health or safety emergency (discussed in more detail later in this section); the disclosure is

to a parent of a student at a postsecondary institution regarding the student’s violation of any

Federal, State, or local law, or of any rule or policy of the institution, governing the use or

possession of alcohol or a controlled substance, if the school determines that a student under the

age of 21 has committed a disciplinary violation with respect to that use or possession; and in

connection with financial aid for which the student has applied or which the student has received,

if the information is necessary for such purposes as to determine (1) eligibility for the aid, (2)

determine the amount of the aid, (3) determine the conditions of the aid; or (4) enforce the terms

and conditions of the aid (FERPA, 2010).

It is not unusual for RMI courses to include students that are members of university

athletic teams. Academic Support Programs in Athletic Departments tend to be generally well-

versed in privacy regulations and compliance issues in general (such as NCAA regulations). For 2 There are several options that obviate the possible FERPA violation while allowing professors the convenience of using the “hallway distribution system.” These include assigning each student a confidential pseudonym to put on their papers; only show notes/corrections/comments on the paper and disclose the actual grade through the university’s learning management system; include a notice in your syllabus that you intend to return graded assignments through a pick-up box in the hallway outside the faculty member’s office, and specifically state that students who wish to opt-out may advise the professor in writing that they do not wish to have their assignments distributed in this manner.

9

those members of RMI classes that are student athletes, requests for academic progress reports

should be accompanied by a statement that all student-athletes have signed a FERPA waiver

allowing the solicitation of academic information.

While most RMI faculty have little or no direct involvement in the risk management

operations at the university where they are employed,3 for those teaching classes in areas such as

contingency plans and emergency planning it is constructive to discuss privacy implications

during an emergency. In some situations, a school may determine that it is necessary to disclose

non-directory information to appropriate parties in order to address a disaster or other health or

safety emergency. FERPA permits school officials to disclose, without consent, education

records, or personally identifiable information from education records, to appropriate parties in

connection with an emergency, if knowledge of that information is necessary to protect the

health or safety of the student or other individuals.

This exception to FERPA’s general consent requirement is temporally limited to the

period of the emergency and generally does not allow for a blanket release of personally

identifiable information from the student’s education records. Under this health or safety

emergency provision, an educational agency or institution is responsible for making a

determination whether to make a disclosure of personally identifiable information on a case by

case basis, taking into account the totality of the circumstances pertaining to a threat to the health

or safety of the student or others. If the school determines that there is an articulable and

significant threat to the health or safety of the student or other individuals and that a party needs

personally identifiable information from education records to protect the health or safety of the

3 The author was intensely involved in a major revision of the Emergency Response Manual at a previous university. Other faculty may be involved in consulting for university risk management departments on an ad hoc basis.

10

student or other individuals, it may disclose that information to such appropriate party without

consent. This is a flexible standard under which the spirit of FERPA intentions defers to school

administrators so that they may bring appropriate resources to bear on the situation, provided that

there is a rational basis for the educational agency’s or institution’s decisions about the nature of

the emergency and the appropriate parties to whom information should be disclosed. Within a

practical period of time after a disclosure is made under this exception, a college or university

must document in the student’s education records the articulable and significant circumstances

that formed the basis for the disclosure as well as the parties to whom information was divulged.

Even within the context of these exceptions, universities can find themselves in situations

that trigger legal confrontation. If the campus Student Health Center is operated by the

University rather than by a private health facility, its medical records are subject to FERPA as

"education records" (medical record disclosures of students from campus health centers would

also likely constitute a HIPPA violation). As previously noted, student medical record disclosure

violations under FERPA are recognized UNLESS there is an "exception" in case of an

emergency, or when exceptional circumstances exist that are specific to a particular situation that

presents a substantial risk to the student, other students, or members of the community. And,

even in the face of these exceptional circumstances, it is always advisable to divulge protected

information only after there have been efforts to obtain permission to contact the parents.

As noted by Blanchard (2014), collegiate administrators would be imprudent to employ

trepidation of FERPA-related litigation as an excuse not to act prudently when a credible threat

exists that a student is at risk for committing suicide. In fact, FERPA is the most frequently cited

explanation by campuses as to why parents are not notified of suicidal threats and, thus,

frustrates legislative intent to allow for such exceptions (Farrell, 2002).

11

A secondary issue has arisen due to the increasing usage and development of technology.

Colleges and universities as well as providers of services to educational institutions need to

consider state laws that limit an educational institution from demanding students disclose user

names and passwords for their social media accounts. According to Krasnow (2013), as of

August 2013 there were nine states that had such laws. These state laws restrict the ability of

educational institutions to request or require students to disclose any social media account user

names and passwords. Prohibitions are also in place to disallow universities from penalizing

students for failing or refusing to divulge this information. The law in California also requires

private nonprofit or for-profit postsecondary educational institutions to post their privacy policies

applicable to social media on their Internet websites. As an example, the statute for California is

listed in Appendix B.

RMI Student Recruitment and Placement

One of the most effective ways to recruit students into an RMI program is to build a high

level of career and internship placement, and to publicize those impressive numbers. Due to a

close relationship with the risk management and insurance industry, RMI faculty may arguably

be more involved with connecting students to potential employers than many other disciplines.

The National Association of Colleges and Employers (NACE) is the leading source of

information on the employment of the college educated, and it provides a set of ethical standards

for guiding the job-search process. In the publication “A Faculty Guide to Ethical and Legal

Standards in Student Hiring,” it is acknowledged that colleges and employers share the common

goal of achieving the best match between the individual student and the employing organization

(NACE, 2012). Some of the essential precepts that promote this goal are:

12

1. All Candidates should have equal access to the opportunity for open and free selection of employment opportunities consistent with their personal objectives and optimum use of talents.

2. All aspects of the recruiting process should be fair and equitable to candidates and employing organizations.

3. Career services professionals and faculty involved in recruiting should provide generally comparable services to all employers, regardless of whether the employers contribute services, gifts, or financial support to the college, department, or program, and regardless of the level of such support.

4. As required by the Family Educational Rights and Privacy Act (FERPA), any disclosure of student information outside of the educational institution will be with prior consent of the student unless health and/or safety considerations necessitate the dissemination of such information. Both career services professionals and faculty will exercise sound judgment and fairness in maintaining the confidentiality of student information, regardless of the source, including written records, reports, and computer data bases.

It is not unusual to come into contact with employers who seek a diverse work force. A

number of insurance organizations have formalized their diversity and affirmative objectives and

some even have Chief Diversity Officers. Even though it is lawful and ethical to support

employers with their outreach efforts to minority groups via targeted information sessions or

career fairs, it is still considered inappropriate to knowingly recognize only those individuals

who are members of a specific group or classification. Basically, all students should have access

to information about internships and career opportunities. According to the NACE, if an RMI

faculty member receives a request for qualified minority candidates, the professor can make

announcements in class, post signs around the department, and notify minority student

organizations. However, NACE recommends that the employer’s request be forwarded to the

career center of the college so that an open posting can be accessed by all qualified candidates in

order to protect the faculty member and the university. On a practical basis, this would also

allow the career center to build a relationship with that employer and expand future prospects. If

13

the college has a minority student advisory office, they may be permitted to provide a complete

list of members of a specific population.

In summary, adhering to these principles does not inevitably mean unfair treatment for

students who are not minorities. The effectiveness in which the potential employer, faculty and

the career services office work together is an important factor. For example, if a 100% Native

American owned and operated insurance provider in Indian Country is seeking risk management

candidates, they can be directed to student organizations such as the Native American Business

Student Association in an effort to spread the word about the opportunity. Career services

offices also make this sort of effort with certain traditionally "underserved" student groups.

However, notifying only Native American students about a company’s visit would be

inappropriate, as would minority-only recruiting schedules. Career services professionals are

also expected to provide services to international students consistent with U.S. immigration laws;

inform those students about such laws; characterize the reality of the existing job market in the

United States; encourage pursuit of only those employment opportunities in the United States

that meet the individual's work authorization; and encourage pursuit of eligible international

employment opportunities."

RMI faculty are often contacted by employers to request the names of students who

would be good candidates for job opportunities. If such an employer has hired a number of your

students in the past, or has provided significant financial support to the RMI program, it may be

tempting to provide the names of your best students only. However, according to the NACE, if

you receive a lead from an employer and choose to only refer selected individuals without

circulating the position to all qualified students, you are failing to uphold an equitable and

evenhanded recruiting process. If you are routinely identifying individuals for employment as a

14

regular practice, you may even be considered an “employment agency” for purposes of equal

employment opportunity (EEO) laws and potentially be exposed to charges of discrimination.

NACE recommends that if a faculty member receives a request for student referrals, students

who have articulated an interest in such career opportunities can be informed and encouraged to

apply. The position can also be publicized in RMI and related classes and distributed via a

listserv.

The third area linking RMI faculty and employers involves providing a written or

telephonic reference for a student. Reference letters and forms provided by professors on behalf

of students continue to play an influential role in hiring decisions. However, such letters can

expose faculty to legal redress under laws pertaining to defamation and privacy. Many

professors devote considerable time writing letters of reference that may have the potential for

significant legal consequences. With demand for these references by students remaining

vigorous, it is in the interests of the prospective employer and the student that these letters be

constructed to provide as much pertinent information as possible, while safeguarding against

resultant liability. Generally, faculty members have the responsibility of providing a sincere,

relevant and truthful representation of facts pertaining to the credentials of a reference seeker.

This can be accomplished without negative legal consequences if carried out within the

parameters that the law allows (Compton and Albinsson, 2013).

FERPA prohibits the disclosure of a student’s protected information to a third party,

thereby prohibiting the disclosure of educational information to potential employers without the

prior approval of the student or parent. Regarding reference letters, the critical inquiry is whether

these records include or incorporate the student’s “educational information” (i.e., GPA, grades,

social security numbers, and so forth). If a reference letter contains “protected” educational

15

information, the information cannot be disclosed without satisfying FERPA’s predisclosure

requirements. A referral source must obtain the signed, written consent of the student to disclose

the foregoing information in a referral letter. If the employer has written permission from the

student, the reference provider should obtain a copy of the permission statement from the

employer (NACE, 2008). Once written permission has been secured, the reference or

recommendation should be based on facts and not insinuation. In addition, the student’s right to

privacy should always be protected. Personal information not germane to the student’s

qualifications for the opportunity in question (health, race, religion, marital status, children, etc.)

should be avoided at all costs.

It is acceptable and in some cases more practical to obtain a "Reference Letter Request,

Consent, and Waiver" at the time a student requests a letter of reference from the professor,

rather than after a prospective employer asks for the reference letter. Having the waiver on file is

the most important requirement. FERPA further requires an educational institution to grant

students access to their educational records, including letters of recommendation. A student may

waive the right to access confidential letters of recommendation. Such a waiver must be in

writing. Should a student provide a waiver to the institution, this should be explicitly stated in the

letter of recommendation itself. Appendix C has examples of such permission statements.

Additional Relevant Issues

Another issue involves student recruitment. As stated earlier, the nature of RMI

programs require a greater emphasis in educating and recruiting students. To the author’s

16

knowledge, only two universities include a course in risk management and insurance in their

core courses required by all business majors (Florida State University and Temple University).

Interestingly, a discussion at the RIMS Professors and Instructors Session during the 2012 Risk

and Insurance Management Society (RIMS) annual conference in Philadelphia provided the

genesis that eventually led to this paper. It was led by a panel, with frequent input from nearly

everyone in attendance. One question on the itinerary was whether any programs sent recruiting

letters to high achieving students in the Introductory or Principles of Risk Management and

Insurance course, which for most programs is a prerequisite for most of the other RMI classes

offered. Some professors indicated that they did send out a letter of encouragement to students

demonstrating promise in a risk management or insurance career. One participant indicated that

such a letter was also sent to their parents.

An encouraging letter from an instructor to a student does not violate FERPA. FERPA is

not violated until information is disclosed outside the instructor/student relationship.

Information sent to the parent (presuming adult child) about the RMI program is probably not a

FERPA violation as long as it did not disclose that the child was (a) a student enrolled in a

specific class, or (b) how the student performed. However, if the student has selected the

"confidential" option at the university, even directory information (the fact that the individual is a

student at the institution) cannot be disclosed. In that case, sending even an informational letter

to the parent could be a violation if it directly or indirectly revealed that the child was even a

student at that institution. Any specific information about the student’s activities or performance

at the university that is provided to a third party is probably a FERPA violation. The fact that the

information is favorable does not make any difference.4 In addition, this could inadvertently link 4 If the school has designated information like honors and awards as “directory information” (each school must give notice of what information it considers “directory” but it can – and most do - include information about honors and awards in the list). However, students can request that their directory information NOT BE released, and then the

17

to anti-discrimination laws (Title IX). In order to avoid violating the equal opportunity mandate,

referring to the course context (the scenario above), if letters of “encouragement” are being sent

to selected students, there should probably be objective criteria for determining who gets the

letter – e.g., everyone with an A grade in the class and a 3.2 GPA or better. Such a scenario

should be successful in avoiding the perception of discriminatory selection.

Other areas related to faculty responsibilities such as teaching and research have also

been the subject of new legislation related to FERPA. Updates at the Family Policy Compliance

Office (FPCO) web site, for example, includes the issue of anonymity in class. When a student

requests privacy and confidentiality, it does not prevent a school from identifying the student in

class. Students can be listed on class rosters and called upon in class by name, etc. It is not

unusual to see published research whose methodology includes a survey of RMI or business

students (Cox and Kamssu, 2000; Cory, et al., 2007; Power, et al., 2011, among others). In the

updated regulations, de-identified information can be used for research purposes not tied to the

identity of students. Research universities can also provide compliance information through

their Institutional Review Board (IRB) which exists, among other responsibilities, to protect the

rights of participants in cases where the protocols of research require human subjects.

FERPA should also be a consideration if student work is widely distributed, including

electronic theses and dissertations (ETDs), e-portfolios, senior capstone projects, etc. Concern

about whether the FERPA definition of “education records” included the work of students was

mounting in the early 1990s, culminating by a request for clarification by the American Library

Association. The Director of the Department of Education’s Family Policy Compliance Office

school is obligated to not release that information.

18

provided the following response in 1993, supported by a resolution of the Society of American

Archivists in 2004 (Chute and Swain, 2004):

“Undergraduate and graduate ‘theses’ often differ in nature from typical student research papers and other education records, such as written examinations, in that they are published or otherwise made available as research sources for the academic community through the institution’s library. It has been and remains our understanding that in these circumstances an educational institution would ordinarily have obtained the student’s permission to make his or her work available publicly before doing so, perhaps in connection with notifying the student of specific course or program requirements. Consequently, an institution need not obtain a student’s signed and dated specific written consent to disclose or publish a thesis in the library or elsewhere at the institution. Neither the statute, the legislative history, nor the FERPA regulations require institutions to depart from established practices regarding the placement or disclosure of student theses so long as students have been advised in advance that a particular undergraduate or graduate thesis will be made publicly available as part of the curriculum process.” (Department of Education, 1993).

Relatively few universities address FERPA within the context of their ETD initiatives.

Many Texas universities such as Baylor, Houston, and UT-Austin require that students explicitly

waive their non-disclosure rights under FERPA. Several American educational institutions have

FERPA guidelines university-wide, and their privacy issues are not always unequivocally

correlated with ETDs. The university registrar or legal affairs offices typically administer these

policies (Ramirez and McMillan, 2010).

Conclusion

The purpose of this paper is to draw attention to areas of ethical and regulatory

regulations that impact those in a position of managing, promoting and teaching at a Risk

Management and Insurance Studies program. While general areas of concern university-wide

19

are mentioned, the primary focus of this paper is on those particular situations that are more

frequently encountered by risk management and insurance faculty.

Regarding privacy, some general rules of thumb that RMI faculty can apply to a

seemingly unclear situation are: (1) Ask, is this information critical to performing my job? (2)

Always keep confidential student information private and secure within the university. (3) Never

release student information to anyone outside of the university without a dated release signed by

the student; if the FERPA exceptions clearly apply, notify the proper university administrator.

(4) Any questions or uncertainty about a situation should be resolved by contacting the university

department responsible for student privacy, usually the Registrar’s Office. As a general rule of

thumb, if in doubt, don't give it out.

While not limited to institutions of higher learning, the escalating number of policies,

regulations, and liability exposures are increasing the complexity of the university professor and

RMI center director. The ambiguity upon which some of these laws are written creates a

scenario of vagueness that often results in their resolution within a provocative legal system.

Changes and clarifications to FERPA regulations continue to evolve. For example, the definition

of a student’s attendance has been expanded from the original law by adding other situations

where students “attend” classes but are not physically present, i.e., distance education. It can be

frustrating to those faculty members who chose this career for the creatively of inquiry it

provides along with being in a position to significantly and positively impact the lives of students

and their futures. Accepting the reality of these rules and attempting to understand their

intention, along with their application in a prudent and reasonable manner seems to be the best

course of action under the circumstances.

20

21

References

20 U.S.C. 1232 (Supp. IV, 1974) (FERPA)

“A Faculty Guide to Ethical and Legal Standards in Student Hiring.” 2012. National Association of Colleges and Employers (NACE). http://www.naceweb.org/legal/faculty_guide/

Blanchard, Joy, 2014, “Institutional Response to the Changing Legal Environment Regarding Student Safety: A Multi-Campus Case Study, “Kentucky Journal of Higher Education Policy and Practice,” vol. 2: 1-24.

Chute, Tamar G. and Ellen D. Swain, 2004, “Navigating Ambiguous Waters: Providing Access to Student Records in the University Archives.” American Archivist, Fall/Winter: 212-233.

Compton, Nina and Pia Albinsson, 2013, “Reference Letters and the Uniformed Business Educator: A U.S. Legal Perspective,” Administrative Issues Journal, vol. 3: 7-19.

Cory, Suzanne N., Dana Kerr, and Jerry D. Todd, 2007, "Student Perceptions of the Insurance Profession," Risk Management & Insurance Review, vol. 10: 121-136.

Cox, Larry A. and Aurore J. Kamssu, 2000, “Revealed Preferences of Business Students at a Major State University,” Risk Management and Insurance Review, vol. 3: 81-97.

Daggett, Lynn, 2008, “FERPA in the Twenty-First Century: Failure to Effectively Regulate Privacy for All Students,” Catholic Law Review, 58:59-113.

“Department of Education Clarifies Access to Theses.” ALA Washington Office Newsline, 8 Sept. 1993. Retrieved 15 Oct. 2012 http://serials.infomotions.com/alawon/alawon-v2n37.txt.

Family Policy Compliance Office (FPCO), Family Educational Rights and Privacy Act (FERPA) and the Disclosure of Student Information Related to Emergencies and Disasters, June 2010.

Farrell, E. F., 2002, “A Suicide and Its Aftermath,” Chronicle of Higher Education, retrieved from www.chronicle.com.

Gilley, Ann and Jerry W. Gilley, 2006, “FERPA: What Do Faculty Know? What Can Universities Do?” College and University Journal, Vol. 82: 17-26.

“ Gonzaga Univ. v. Doe - 536 U.S. 273, 2002.” Justia: The US Supreme Court Center.

Krasnow, Melissa, 2013, “State Social Media Account Laws for Educational Institutions,” International Risk Management Institute, Inc. August 2013. http://www.irmi.com/expert/articles/2013/krasnow08-cyber-privacy-risk-insurance.aspx

National Association of Colleges and Employers (NACE), 2008, “Suggested Guidelines for Writing References.” Principles for Professional Practice Committee.

22

Owasso Independent School District No. I011 v. Falvo. The Oyez Project at IIT Chicago-Kent College of Law. 26 January 2014. <http://www.oyez.org/cases/2000-2009/2001/2001_00_1073>.

Power, Mark L., Jonathan M. Hobbs, and Ashley Ober, 2011, "An Empirical Analysis Of The Effect Of Financial Education On Graduating Business Students' Perceptions Of Their Retirement Planning Familiarity, Motivation, And Preparedness." Risk Management & Insurance Review, vol. 14: 89-105.

Rainsberger, R.A., 1998, Guidelines for Postsecondary Institutions for Implementation of the Family Educational Rights and Privacy Act of 1974 as Amended. Washington, D.C.: American Association of Collegiate Registrars and Admissions Officers.

Ramirez, Marisa and Gail McMillan, 2010, “FERPA and Student Work: Considerations for Electronic Theses and Dissertations,” D-Lib Magazine, Vol. 16.

Sontag, Deborah (2002-04-28). "Who Was Responsible For Elizabeth Shin?" New York Times.

U.S. Code § 1232g - Family Educational and Privacy Rights. Legal Information Institute, Cornell University Law School. http://www.law.cornell.edu/uscode/text/20/1232g

U.S. Department of Education, “Family Educational Rights and Privacy Act (FERPA),” http://www.ed.gov/policy/gen/guid/fpco/ferpa/index.html

23

APPENDIX A

TO FACULTY regarding Email Communications:  Your XYZU email account is the

official means of communicating with the university.  Information critical to your success

at XYZU is delivered to you via this account, and you are expected to follow rules and

policies provided to you via this communication method.  Any email from you to the

instructor should be sent either through the university course management system or

through your official XYZU email account. Please be advised that due to privacy and

security concerns, we are unable to respond to emails from or about students that do

not originate from an official XYZU email address. 

 

We are also recommending a response such as that provided below to use when you

get an email which appears to be from a current XYZU student but is coming from a

non-XYZU account: 

 Dear Ms. xxx –

Thank you for your recent communication.  Please be advised that due to privacy and security concerns, we are unable to respond to emails from or about students that do not originate from an official XYZU email address.  XYZU policy requires all students to communicate with the university via their XYZU email account.   For a response to your inquiry, please resubmit your communication using your XYZU email address. Warm regards,xx

24

APPENDIX B

Reference Letter Request, Consent and Waiver

This form is to be completed by students who are requesting an academic reference. The completed form should be retained by the referee as confirmation of the request for a reference. It should not be returned to the student, sent to the program to which the student is applying, or to potential employers.

Student making request:

Name: _______________________________________________

Address: _______________________________________________

Email: _______________________________________________

Telephone: _______________________________________________

Student Objective: ____________________________________________(e.g. “Job with financial planning firm;” “admission to Master of Finance program,” etc.)

Consent and WaiverBy signing this form, I give permission for _____________________ (name of reference) to write letters of recommendation or respond to reference checks on my behalf. I hereby authorize disclosure of any truthful information about me, including but not limited to my academic performance, grades, grade point average and opinions regarding my character and my aptitude for success in the relevant graduate program, job or career. By signing his letter, I hereby waive any right to privacy or confidentiality with respect to such matters. This permission continues in effect until I notify the instructor in writing that it has been revoked.

I _________________ (waive / do not waive) my right to review a copy of any reference letter written pursuant to this consent at any time in the future.

______________________________________________________________________Student Signature                              Date

Required Information (Recommender will check items to be provided by student)

___ Unofficial transcript ___ Writing Sample

___ Resume ___ Project/Assignment from Class

___ Personal Statement (if available)

___ List of Classes taken from this instructor including dates:

Names and addresses to whom recommendations should be sent (or attach):

Source: http://business.nmsu.edu/academics/finance/student-info/reference-letter/

25

APPENDIX C

Calif. Educ. Code Sections 99120-99122

Application

Public and private postsecondary educational institutions, and their employees and representatives, shall not require or request a student, prospective student, or student group to do any of the following:

(1) Disclose a user name or password for accessing personal social media.

(2) Access personal social media in the presence of the institution's employee or representative.

(3) Divulge any personal social media information. Section 99121(a).

A public or private postsecondary educational institution shall not suspend, expel, discipline, threaten to take any of those actions, or otherwise penalize a student, prospective student, or student group in any way for refusing to comply with a request or demand that violates this section. Section 99121(b).

Exceptions

This section shall not do either of the following:

(1) Affect a public or private postsecondary educational institution's existing rights and obligations to protect against and investigate alleged student misconduct or violations of applicable laws and regulations.

(2) Prohibit a public or private postsecondary educational institution from taking any adverse action against a student, prospective student, or student group for any lawful reason. Section 99121(c).

Source: California Laws & Codes, California Department of Education