Introduction
Many Texas A&M employees work with university-confidential information daily. It is your responsibility to protect this information by understanding what constitutes university-confidential data, the technologies available to secure it, and the practices that prevent its unauthorized release.
Table of Contents
What Information is University-Confidential?
Confidential information requires protection from unauthorized disclosure or public release based on state or federal law. Examples of university-confidential information include but are not limited to the following:
- Social Security numbers (SSNs)
- Research data
- Credit card numbers
- Financial account numbers
- Student education records, including schedules
- Medical records
- Passwords
Federal Laws
Several federal laws require universities to maintain confidentiality of information:
Directory Information
Directory information refers to items of information contained in the educational record that may be released without the student's prior written consent. Texas A&M designates the following items as directory information:
- Name
- Universal Identification Number (UIN)
- Address (Local)
- Address (Permanent)
- Telephone number (Local)
- Telephone number (Permanent)
- Email address
- Program of study (college, major, campus)
- Dates of attendance
- Previous educational agencies and institutions attended
- Participation in officially recognized activities and sports
- Degrees, honors, and awards received
- Classification
Students may place a directory hold on any or all of this information at Howdy. Once a student places a hold on directory information, that information may not be released without the student's prior written consent.
Storing and Transferring University-Confidential Information
Storing University-Confidential Information
University IT Security Controls for Confidential Data (DC-5) require encryption of Texas A&M related university-confidential information that resides on portable computing devices. Best practice recommends that all university-confidential data be encrypted, even on stationary systems.
Transferring University-Confidential Information
University IT Security Controls for Confidential Data (DC-5) require encryption of university-confidential information when it is transmitted through email, sent to an off-campus site, or accessed from a remote location.
Protecting FERPA Data – Quick Checklist
- Post grades using a Texas A&M approved Learning Management System. For help, visit Support – Learning Management System.
- Encrypt all university-confidential information.
- Use UINs instead of Social Security numbers. Take the appropriate steps when Social Security numbers are absolutely necessary.
- Do not allow students to see other students' grades, even by sorting through a stack of papers to pick up their graded work.
- Do not discuss the progress of any student with anyone other than the student, including parents or guardians, without the student's consent.
- Do not provide anyone with lists of students enrolled in classes for any commercial purpose.
- Do not provide anyone with student schedules or assist anyone other than professional university employees in locating a student on campus.
Safely Transferring University-Confidential Information
Filex
Do not send university-confidential information through email. Use Filex instead.
Filex is an easy tool for transferring university-confidential information. Upload files to the Filex server and add email addresses for recipients. For files containing sensitive or university-confidential information, Filex includes an encryption option. Filex sends a link via email to download the file, which recipients click to obtain the file directly from the Filex server. If you select the encryption option, Filex provides a key for you to send to your recipients to unlock the encrypted file. For step-by-step instructions, see Using the Filex file distribution system.
Safe File Transfer Tools
If you need to transfer university-confidential information between two systems that you manage, use secure protocols such as SCP or SFTP. WinSCP is an easy-to-use Windows tool for SCP and SFTP.
Safely Storing University-Confidential Information
Encrypt Files
Encrypting files ensures that unauthorized people cannot view data even if they gain physical access to it. When you use encryption, maintain a recovery plan in case you forget your key.
In accordance with security control SC-13, university-confidential data must be encrypted in storage.
For information on encrypting your entire disk, encrypting specific files, or transferring files securely, visit the article on Encryption How-tos.
Safely Posting Grades
FERPA requires that student grades remain accessible only to individual students and other authorized personnel. Posting grades in a secure course management system, such as Canvas, is the preferred method for distributing grades online at Texas A&M. For help, visit Support – Learning Management System.
If you do not use a Learning Management System, give students their grades individually.
Reporting Disclosures of University-Confidential Information
Report disclosures of university-confidential information as soon as you realize they have occurred. Contact Help Desk Central at (979) 845-8300 or helpdesk@tamu.edu. This action aligns with security control IR-6.
If you witness or commit what you believe to be a possible FERPA violation, notify the Office of the Registrar immediately at (979) 845-1711 or ferpa@tamu.edu, or contact Help Desk Central at (979) 845-8300 or helpdesk@tamu.edu (available 24 hours).
Additional Resources
Visit the following resources for information on university-confidential information:
If you have questions about FERPA, contact the Office of the Registrar at (979) 845-1711 or ferpa@tamu.edu.