Institutions have a legal responsibility to keep private student data secure, and to limit sharing of student data only under the specific circumstances permitted by law. When it comes to how and with whom they can share student data, colleges and universities must abide by three federal laws: the Privacy Act, the Family Educational Rights and Privacy Act (FERPA), and the Higher Education Act (HEA) of 1965, as amended. Administration of your emergency aid program may be impacted by one or more of these laws; it is essential that you understand them and apply them properly to ensure compliance.
The HEA is the most limited in the scope of data it protects, only restricting the sharing of data that appears or is derived from the Free Application for Federal Student Aid (FAFSA). Any data an institution has from a source other than the FAFSA is not subject to HEA data-sharing rules—however, those data are still subject to FERPA and the Privacy Act. Despite its limited scope, the HEA is the most restrictive in how data can be shared, because it does not permit data to be shared for unauthorized purposes or with unauthorized recipients even in cases where the student approves such disclosure by providing written consent, so the HEA often trumps the other two data-sharing laws. Fortunately, changes in 2017 and 2018 to the HEA data-sharing rules have expanded institutions’ ability to share student data that falls under the HEA.
Permissible sharing of FAFSA data under the HEA includes cases in which the information will be used for the application, award, and/or administration of federal student aid funds, state aid, and/or institutional aid programs, if—per FERPA—that disclosure is to other school officials determined to have a legitimate educational interest in the disclosed information; and in instances where the disclosure is to a scholarship-granting organization, tribal organization, or other organization assisting the student in applying for and receiving federal, state, local, or tribal financial assistance for any component of the applicant’s cost of attendance, and the student has provided explicit written consent for the disclosure.
Some examples of student data that are considered FAFSA data and, as such, protected by HEA data-sharing rules include student or parent income, the student’s Expected Family Contribution (EFC), or the student’s financial need. However, if any of those data items can be obtained or derived from a source other than the FAFSA, such as from an institutional application or the CSS/Financial Aid Profile form, then the HEA data-sharing rules do not apply, although FERPA and the Privacy Act still do.
Emergency aid programs might run up against student data privacy laws in cases where an office other than the financial aid office administers the emergency aid program or is charged with evaluating the emergency aid program. Other examples include proactive efforts on the institution’s behalf to stave off financial emergencies, or retroactive efforts that take place after emergency aid has been awarded to connect students with resources like means-tested benefits to address a student’s more holistic financial needs.
Below we’ll dig more into these scenarios with some specific examples.
Scenario #1: Emergency aid is administered by an administrative office other than the financial aid office
We’ve already covered the fact that, except in limited circumstances, emergency aid must be considered a part of the student’s financial aid package regardless of who administers the emergency aid program on your campus; this means the student must demonstrate unmet financial need in order to qualify. In this instance, prior to making an emergency aid award, the office charged with making emergency aid awards must confirm the student’s unmet need, which, as noted earlier, is considered FAFSA data. If the financial aid office were awarding emergency aid, data-sharing concerns would not arise since they already maintain students’ FAFSA data. As to whether sharing a student’s unmet need with another office on campus is permitted for the purposes of awarding emergency aid, the answer is probably yes, because the data will be used for the application, award, and/or administration of institutional aid and because the recipients of the student’s FAFSA data are school officials determined to have a legitimate educational interest in the disclosed information. The answer is not definitively “yes” because institutions themselves are responsible for determining what they consider to be a legitimate educational interest.
Scenario #2: An office other than the financial aid office is charged with evaluating the effectiveness of the emergency aid program
Your institution should be evaluating your emergency aid program to ensure that it is meeting the goals your administration set when developing the program. It is possible that the financial aid office might not be charged with this evaluation and that it is assigned to another department on campus, such as the institutional research office. They may want to evaluate, among other things, income levels of emergency aid recipients, or the amounts of other financial aid that emergency aid recipients received. We’ve already discussed the fact that income, unless collected elsewhere by the institution, is considered FAFSA data. However, the HEA permits the financial aid office to share student FAFSA data, like income, with another office for the purpose of evaluating a financial aid program. The office receiving the private student data should still be determined to have a legitimate educational interest in the disclosed information, which, as noted above, is a determination institutions must make for themselves.
Scenario #3: Institution wants to take a holistic approach to student needs beyond financial aid
Some institutions are looking toward more holistic approaches to addressing student needs beyond traditional financial aid programs or even beyond emergency aid. They may be making efforts to proactively identify students most prone to experience emergencies and connect them with resources, such as on-campus child care or means-tested benefits to keep them from experiencing a financial crisis in the future. Or, they may incorporate these efforts into their emergency aid program; offering emergency aid when students request it, but going beyond that to connect the student with other resources that will provide them with more financial stability for the longer term. To do so, they may need access to information like student income and household size in order to determine what services they might qualify for. Student income and whether the student has dependents is considered FAFSA data, however, sharing this data would be permitted under the HEA (with the student’s written permission) because the data-sharing would be for the purpose of assisting the student in applying for and receiving federal, state, or local financial assistance for a component of the Cost of Attendance. If the institution decides to take a proactive approach, versus waiting for the student to initiate the process of applying for emergency aid, student permission would likely have had to have been obtained separately, possibly via an institutional admissions or financial aid application, or through the institution’s student portal, in order to achieve the maximum impact of these efforts.
Scenario #4: Housing office wants to identify students who might qualify to live on campus during breaks
Taking the proactive approach a step further, say an institution’s housing office wants to conduct outreach to students with housing insecurity to notify them of the option to stay on campus during scheduled breaks and they want to know which students have self-identified as homeless or at risk of homelessness on the FAFSA. The student’s responses to these FAFSA questions are subject to the HEA data-sharing rules. But, unlike the previous example, the information will not be used for the application, award, or administration of Title IV, state, or institutional aid programs, nor will it go to an organization assisting the student in applying for or receiving federal, state, local, or tribal assistance. In this case, the financial aid office cannot share the information the housing office seeks. The financial aid office could, however, offer to reach out on behalf of the housing office to at-risk students without disclosing to the housing office exactly what criteria were used to identify those students, and students could then follow up on their own with the housing office.
Student data privacy is a very complex issue, and compliance with privacy laws is essential to protecting both your students and your institution. For more help with understanding how private student data can be shared for the purposes of administering your emergency aid program, see NASFAA’s data sharing decision tree and the data sharing decision tree developed for Student ARC.
Thanks to NASFAA for providing this blog post.