For instructors, supervisors, and project leads, the end of the semester offers a useful checkpoint. Final grades, class rosters, and course files all contain private student information, and a few minutes of review now can help protect this data before the next semester begins.

A reminder about student records

The Family Educational Rights and Privacy Act (FERPA), a federal privacy law, protects student education records, including grades, schedules, and class rosters. Those protections continue after students leave campus. Faculty, teaching assistants, and staff who work with student records are required to complete FERPA training every three years.

When a parent, employer, or someone claiming to be a university office asks about a student, records generally can’t be shared without the student’s written permission. Be careful with urgent requests because scammers often pose as family members or officials. When in doubt, refer the request to the Office of the Registrar.

Closing one semester

• Share grades only through the university’s official course and grading systems, not by email, and never post them by name or student ID.
• Keep gradebooks in approved university storage rather than on personal devices or personal cloud accounts.
• Delete class lists and grade files downloaded during the term and shred printed copies.
• Review who has access to course documents and shared folders, including any “anyone with the link” settings.

Students may hold roles such as teaching assistant, grader, researcher, or student employee. When one role ends, update the access tied to that responsibility, even if the person remains at the university. Local IT support can help adjust permissions.

Preparing for the next semester

ICON, the university’s learning management system, can connect to tools such as publisher platforms and learning applications. Depending on the connection, those tools may be able to see course roles, grades, or other information. Review which connections are still needed, and make sure any new application follows the integration request process. When setting up a new course, check whether access settings carried over from a previous term.

Reporting a concern

All suspected or confirmed security incidents should be reported promptly to the Information Security and Policy Office through Report an incident or [email protected]. Reports can be made even when details are incomplete. The office also can help campus partners meet teaching, research, and business needs while keeping information secure.