Adhering to FERPA While Computing in the Cloud and Proctoring Exams Online

Vendor EPs
Author Information
Don Kassner
Jarrod Morgan
Franklin Hayes
Institution(s) or Organization(s) Where EP Occurred: 
ProctorU, Inc.
Institution(s) or Organization(s) Where EP Occurred: 
Andrew Jackson University
Effective Practice Abstract/Summary
Abstract/Summary of Effective Practice: 


As the popularity of cloud computing grows throughout the IT industry, educational administrators must be aware of the implications federal law has on the storage and transmission of education records and student information in accordance to the Family Educational Rights and Privacy Act (FERPA). This law, enacted in 1974, was designed to protect students and covers many pieces of information collected by institutions of higher learning and associated vendors. While not all collected information is to be treated with the same scrutiny, data that can be deemed an educational record, such as a course name, assessment grades or video sessions of a proctored exam, are highly protected. With the rise of distance education being conducted over the Internet, educational IT administrators must be highly aware of the sensitive information that is passing along institutional networks, and more importantly, what information leaves the internal network and is passed to a cloud network.

Description of the Effective Practice
Description of the Effective Practice: 



Since 2008, ProctorU has monitored well over 125,000 exams online as of June 2012 and ensured the academic integrity for over 180 institutions’ online tests. Since ProctorU was formed as an academic service inside Andrew Jackson University before being developed as its own business, company leadership has always had a deep respect for FERPA regulations and their impact on online proctoring. Due to this understanding of existing federal law, ProctorU was designed in such a way as to avoid violating these regulations and limiting risk to our partner institutions. 


Techniques used in online proctoring come under the jurisdiction of FERPA. Recording video files of exam proctoring is creating a permanent educational record that must be given the highest security required by current federal law. Therefore, ProctorU relies on live human proctors and records video sessions only to document instances of academic dishonesty.  


To operate within the limitations of FERPA, distance education administrators must be sure to control sensitive student data and may want to limit educational records outside of its jurisdiction, such as a video recording of an online proctoring session. While FERPA permits disclosure of directory information such as student name, address and contact information, protected information such as student ID numbers and course information may only be shared with outside parties that are considered school officials with a legitimate educational interest. Problems arise however, when outside parties increase their liability by creating additional protected educational records and keeping them on file permanently on external servers. The record and review model, which some vendors employ for each individual exam session, also raises other privacy concerns. Typically, only the test-taker has agreed to be recorded during their exams session and not other parties that may enter the camera’s range.  


Technology and online learning are blending elements within the academic world at an increasing rate, and many times existing federal law may unfortunately be a casualty in the name of innovation. When specifically examining the case of online proctoring, it is sometimes necessary to document incidents of academic dishonesty via video recording. Some vendors, however, record each and every session and keep them on file to be reviewed at a later date for security purposes. These practices may pose a higher risk of violating FERPA, especially if these records are kept on a cloud server.


Additionally, educators should ensure that contractors employed by their institution should not subcontract labor to third-party labor forces because this may also violate FERPA. 


More than half of data loss in the education industry comes from the exploitation of a system vulnerability. Therefore, outside vendors should try to limit their vulnerabilities to data loss by keeping fewer sensitive files permanently. By only keeping the utmost necessary data permanently, outside parties reduce the probability that they will disclose protected information either accidentally or by a malicious attack by cyber criminals.  

Supporting Information for this Effective Practice
Evidence of Effectiveness: 


ProctorU’s model has been trusted on over 125,000 exams between 2008 and May of 2012 for over 180 institutions. This is a proven track record of handling student information and adhering to federal law.   

How does this practice relate to pillars?: 



Access: Online proctoring methods that adhere to all FERPA guidelines make higher education more readily available to students globally by using common computing devices while ensuring the academic integrity of the exam for the institution. Additionally, this service should be structured in a way to protect students’ personal information by limiting the numbers of video recordings that are kept on file permanently that may be maliciously accessed by unknown parties. 


Faculty Satisfaction: Online proctoring should come as close as possible to the classroom equivalent of face-to-face monitoring during exams. The most effective service should ensure the academic integrity of an online exam while also authenticating the identity of the student. Face-to-face online proctoring with an authenticated student has been shown to satisfy academic requirements for secure online learning. Faculty members are directly involved with ProctorU’s process because they communicate directly with the service’s administrators and can view proctoring session notes in real time as the sessions are completed. ProctorU follows the Andrew Jackson University model of online proctoring where proctors can see the student, see what they are doing and know who they are.  


Learning Effectiveness: A proctored online exam is more effective for measuring what a student has learned in an online course. Using an online proctoring service that authenticates the students’ identity ensures that the correct student is taking the exam.


Scale: The online proctoring industry has grown along with the large numbers of students choosing to take college courses online. Since starting with only a handful of partner institutions in 2008, the number of schools and certification agencies that rely on ProctorU has blossomed to over 180 in 2012. This continued growth among some of the nation’s top institutions such as the University of Florida, the University of Illinois and Northwestern University shows that the company’s methodology concerning student privacy and FERPA regulations is a winning formula. The cost for online proctoring can either be paid by the institution, or by the student per individual testing session. This billing model is consistent with distance students needing to find a physical proctor on their own at a testing center. According to a spring 2011 survey conducted by Oregon State University, more than half of the responding students said ProctorU was less expensive than what they would have otherwise spent to have their exams proctored. 


Student Satisfaction: According to internal customer service surveys collected by ProctorU, more than 90 percent of students are satisfied with their online proctoring experience. We see the same online students return to use ProctorU over and over again because they trust the service not only with their personal information, but also with their proctored exam attempt. According to a spring 2011 survey conducted by Oregon State University, 96 percent of students responding to the survey said they would use ProctorU again. 

Equipment necessary to implement Effective Practice: 

Students need a well-functioning computer, high-speed Internet and a webcam to be proctored. Faculty members only need access to the Internet and ProctorU with a basic, well-functioning computer. 

Estimate the probable costs associated with this practice: 

The only cost associated with ProctorU is the usage fee per proctored exam. Depending on the institution’s requests or needs, this cost is sometimes covered by the institution and other times by the student. However, this is a nominal fee that is equal to or less than finding a physical proctor at a testing center. 

References, supporting documents: 


Below are the titles, links and brief descriptions of peer-reviewed articles that help define educational records and other FERPA related issues.


FERPA: What Exactly Is an Educational Record?


This paper examines what exactly an educational record is. The definition of educational record is central to how the provisions of the Family Educational Rights and Privacy Act (FERPA) are laid out. In order to gain FERPA protection, a document must be considered an educational record. To set context, the paper describes FERPA as an act stating that no funds are to be made available under any applicable program to any educational agency or institution that has a policy of denying, or effectively prevents, the parents of students who attended or do attend a school, the right to inspect and review the education records of their children. In this paper, an educational record is broadly defined to include records, files, documents, and other materials, which contain information directly related to a student and are maintained by an educational agency, institution, or by a person acting for such an agency or institution. A court case is discussed, in which the practice of teachers having students grade other students' assignments was questioned as a possible violation of FERPA. A court case involving the release of student disciplinary records and FERPA is also analyzed.


FERPA: What Do Faculty Know? What Can Universities Do?


Student privacy and confidentiality are protected by the Family Educational Rights and Privacy Act of 1974 (FERPA), also known as the Buckley Amendment. Among the four specific rights granted to students who have reached the age of eighteen or who attend a postsecondary institution, "consent to disclosure of records" is the most commonly violated by faculty and administrators. This article examines how much faculty members know about FERPA, how information was received, how it should be disseminated to be effective given varied individual learning styles, and who within the university should provide FERPA information and updates. The results of this study will enable universities to gain insight into faculty knowledge of FERPA, how information is currently being shared, and what means of dissemination are most effective and, therefore, appropriate.

Other Comments: 


ProctorU provides distance proctoring services for colleges, universities and certification organizations that offer examinations online. The service allows students to take their exams from anywhere in a secured environment. ProctorU uses a patent-pending three-step process that confirms that the student who registered for the exam is the student who is taking the exam and is following the institution’s testing requirements. ProctorU proctors monitor the entire process in order to ensure that a high level of integrity is maintained throughout. ProctorU offers live, person to person, real time monitoring to more than 180 colleges, universities and certification organizations, including Troy University, the University of Alabama and Northwestern University. ProctorU operates dedicated proctoring centers in San Francisco, Calif. and Birmingham, Ala. For more information, visit


At ProctorU we adhere to a set of company pillars that help shape our corporate culture and ensure that we go above and beyond the expectations of our partner institutions and their test-takers. The pillars serve as a framework for how we interact with each other and our patrons.


Integrity: This is the most important and influential pillar that we keep in the forefront of all that we do. Our primary function is to ensure academic integrity for the exams that we proctor. Integrity is defined as adherence to moral and ethical principles or a soundness of moral character.


Service: We always strive to render better service than what is expected of us and to make sure students enjoy the process of taking their examinations online. We define service as the assistance and other resources that we provide to our patrons.


Simplicity: At ProctorU we like to make sure our process is as streamlined and effortless as possible to reduce the stress on examinees.


Fun: We enjoy what we do and hope that our jubilant attitude carries over to our interactions with partner institutions and students. We work hard to make the ProctorU offices an amicable environment and promote a sense of camaraderie among our employees.

Contact(s) for this Effective Practice
Effective Practice Contact: 
Don Kassner
Email this contact:
Effective Practice Contact 2: 
Jarrod Morgan
Email contact 2:
Effective Practice Contact 3: 
Franklin Hayes
Email contact 3: