CEC Privacy Regulations & Ethical Standards 2 — Questions and Answers
Question 1: Under FERPA, which of the following is considered 'directory information' that may be disclosed without consent unless the student opts out?
- Social Security number and financial aid amount
- Student's name, address, and enrollment status (Correct answer)
- Grades and GPA records
- Disciplinary records and medical information
Correct answer: Student's name, address, and enrollment status
FERPA permits schools to designate certain non-sensitive data such as name, address, and enrollment status as directory information, which may be released without prior consent unless the student opts out.
Question 2: A prospective student asks an enrollment counselor to share another enrolled student's financial aid package as a comparison. What is the correct response?
- Share it if the enrolled student gave verbal permission
- Decline, as sharing another student's financial records violates FERPA (Correct answer)
- Provide a redacted version omitting the student's name
- Share only the total award amount, not individual components
Correct answer: Decline, as sharing another student's financial records violates FERPA
FERPA prohibits disclosure of any student's educational records, including financial aid information, to third parties without written consent from that student.
Question 3: Which federal law primarily governs the privacy of health information that an enrollment counselor might encounter when assisting students with health insurance enrollment?
- FERPA
- COPPA
- HIPAA (Correct answer)
- GLBA
Correct answer: HIPAA
HIPAA (Health Insurance Portability and Accountability Act) governs the privacy and security of protected health information in healthcare and health insurance contexts.
Question 4: An enrollment counselor discovers a colleague is accessing applicant records out of personal curiosity, not for work purposes. What is the ethical obligation?
- Ignore it unless the colleague shares the information externally
- Report the behavior to a supervisor or compliance officer (Correct answer)
- Warn the colleague privately and take no further action
- Access the same records to verify what the colleague saw
Correct answer: Report the behavior to a supervisor or compliance officer
Unauthorized access to applicant records, even without external disclosure, violates privacy regulations and ethical standards, requiring reporting to ensure institutional compliance.
Question 5: When collecting a prospective student's Social Security number during enrollment, what is the primary ethical obligation of the counselor?
- Store it in a shared spreadsheet for team access
- Explain why it is needed and how it will be protected (Correct answer)
- Collect it only if the student insists on providing it
- Transmit it via email for faster processing
Correct answer: Explain why it is needed and how it will be protected
Ethical data collection requires transparency—counselors must inform individuals why sensitive data like SSNs is needed and how it will be safeguarded.
Question 6: A student who is 17 years old and applying to college asks a counselor to keep their application details confidential from their parents. Under FERPA, the counselor should:
- Honor the request because the student is the applicant
- Inform the student that parents retain FERPA rights for dependent minors under 18 (Correct answer)
- Refuse to assist the student without parental consent
- Share the records only with one parent, not both
Correct answer: Inform the student that parents retain FERPA rights for dependent minors under 18
FERPA transfers rights to the student once they enroll in a postsecondary institution, but for applicants who are still eligible dependents, parental rights may still apply.
Question 7: Which of the following best describes the principle of 'data minimization' in the context of enrollment counseling?
- Storing applicant data on the smallest available server
- Collecting only the personal data necessary for the enrollment purpose (Correct answer)
- Minimizing the number of staff who can view applicant data
- Reducing the file size of stored documents
Correct answer: Collecting only the personal data necessary for the enrollment purpose
Data minimization is a privacy principle requiring organizations to collect only the personal information that is strictly necessary for the stated purpose.
CEC Privacy Regulations & Ethical Standards 2
Under FERPA, which of the following is considered 'directory information' that may be disclosed without consent unless the student opts out?