coe-staff: Fw: Important Message Regarding “Top Hat” and FERPA (Kamphaus)

[Randy Kamphaus]

Dear Faculty,


Please see the message below from Doug Blandy, Senior Vice Provost for Academic Affairs, regarding avoiding the potential of a FERPA violation.  Please contact me if you have any questions.


Thank you for your attention to this matter.


Randy

c Doug Blandy​

________________________________
Dear Dean Kamphaus,

I write regarding interactions that Top Hat, an online learning management platform vendor,  may have had with certain of your faculty and/or may be planning in the future for additional faculty.  Some UO faculty have expressed concern that they have been aggressively solicited by Top Hat to use their services.   In soliciting its product to UO faculty, Top Hat asked individual faculty members to provide it with information about UO students (including names and/or email addresses, course(s) the students are taking, and other personally identifiable information).  A UO employee’s disclosure of such information without valid written consent from the students violates federal law – specifically, the Family Educational Rights and Privacy Act of 1974 (“FERPA”).  For prior written consent to be valid under FERPA, it must (1) specify the particular education records that may be disclosed; (2) state the purpose of the disclosure; (3) identify the party or class of parties to whom the disclosure may be made; and (4) be signed and dated by the student.
When individual faculty use the Top Hat service, they are releasing non-directory information about their students to a third party without the students’ signed consent.  In most cases, students names and email addresses are considered directory information and can be released outside of UO.  But there are other issues with Top Hat’s system that make the use of its products, in current form, not compliant with FERPA:


(1)      Under FERPA, students have the right to restrict the release of all their information.  (For more information, see:  https://registrar.uoregon.edu/records-privacy, “Directory Restriction”).  This means that no information of any kind can be released to anyone outside UO (or to anyone inside UO who lacks a legitimate educational interest) without the student’s prior written consent.  Thus even releasing a student’s name and email address to any third party service would violate that student’s rights to privacy under FERPA.  Students with directory restrictions are marked on class lists in DuckWeb with a << sign, so faculty can easily tell who has filed the paperwork for the restriction.



(2)      By sending names and/or email addresses to Top Hat, faculty have also released the fact that these students are enrolled in a particular class to Top Hat, which is considered a third-party under FERPA.  The classes that a student is enrolled for is not “directory information,” and therefore cannot be shared without the student’s prior written consent.



(3)      Once Top Hat has a class list of student names and emails, the product collects and maintains additional student-specific education records such as quiz responses, clicker answers, attendance, and other course-related information on Top Hat servers.  These additional records are not directory information and cannot be shared with a third party without the student's signed consent.



An alternative to prior written consent by each student would be a signed contract with Top Hat after completing any required contract procurement steps.  PCS has confirmed that UO has not done that here.  Thus starting now and going forward, if faculty wish to use this service, they will need to collect and maintain the prior written consent of each student whose information they send to Top Hat.  This consent must comply with FERPA and cover every type of record that the student will permit to be shared with Top Hat.  (Students need to be given the choice to participate or not, and not be penalized for not participating.)  The Registrar’s Office, specifically the University Registrar, can assist in this process.  Alternatively, UO may decide to try to get an enterprise-wide contract in place so that UO is FERPA compliant, after pedagogical, technical, and legal review.
In addition to vigilantly protecting student privacy, UO is committed to supporting the instructional needs of faculty.  Those who wish to explore FERPA-compliant alternatives to what Top Hat is currently proposing can contact the UO Libraries' Center for Media and Educational Technologies (CMET) at 541-346-1942, Knight Library room 19, LMS-support at ithelp.uoregon.edu<mailto:LMS-support at ithelp.uoregon.edu>.

Finally, I have been told that Top Hat may be offering considerable gifts (such as iPads or tablets) to incentivize faculty members to use its products.  Such conduct implicates Oregon’s government ethics laws (ORS 244) and must be avoided by faculty.

Thank you for helping UO protect the privacy of student information.  Please let me know if you have any questions about these issues.

Sincerely,
Doug

Doug Blandy
Senior Vice Provost
Academic Affairs



For scheduling, please contact Sonja K. Runberg at srunberg at uoregon.edu<mailto:srunberg at uoregon.edu> or 541-346-4345.
________________________________
[cid:image003.png at 01D2A17E.C6F211F0]

DOUG BLANDY | Senior Vice Provost for Academic Affairs
dblandy at uoregon.edu<mailto:dblandy at uoregon.edu> | 541-346-3029
206 Johnson Hall
1258 University of Oregon | Eugene, OR 97403





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists-prod.uoregon.edu/pipermail/coe-staff/attachments/20170320/cba0268b/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 7674 bytes
Desc: image003.png
URL: <http://lists-prod.uoregon.edu/pipermail/coe-staff/attachments/20170320/cba0268b/attachment.png>