New student-privacy rules that take effect this month address two burgeoning challenges in higher education: shielding students from computer-related identity theft and protecting them from peers identified as a potential threat by faculty members.

The altered privacy rules were outlined in the government's newly revised Family Educational Rights and Privacy Act, known as FERPA, which went into effect Jan. 8. The federal Education Department (ED) released the new FERPA guidelines in response to both the April 2007 massacre at Virginia Tech and the growing threat of identity theft on campus.

Seung Hui Cho, a Virginia Tech student, killed 33 people, including himself, months after Cho's behavior disturbed professors and other students. Many faculty members wanted to notify Cho's parents of his behavior, but they thought it would violate FERPA rules.

"The purpose was to clarify the fact that schools may release information on students who are considered threats to themselves or others," said ED spokesman Jim Bradshaw. "There appeared to be enough confusion to clarify the rules. We wanted to make it crystal clear that schools could release student information to parents, law enforcement [personnel], … school officials, and health officials."

The FERPA update, for the first time, now states that privacy laws protect online students as well. The rules do not stipulate that colleges and universities must alert students when their personal information is stolen. However, most states have passed laws requiring colleges to notify students whose information has been compromised.

The rules state that students' identification numbers--which have replaced Social Security numbers as identifiers on many college campuses--cannot "be used to gain access to education records except when used in conjunction with one or more factors" that "authenticate the student's identity," such as a password.

The department's original proposal was far different, barring the use of any identification number in college directories. But this more stringent version was scrapped after some higher-education officials complained that the proposed changes would have been a costly, logistical nightmare for campus IT administrators.

"That was of great concern to the IT folks, and legitimately so," said Steven McDonald, general counsel for the Rhode Island School of Design who specializes in student privacy law.

If that initial proposal had been enacted, U.S. colleges and universities would have faced a massive retrofitting process that would have charged campus IT chiefs with changing student ID numbers throughout their school's network. The undertaking would have been expensive for colleges--and doubly painful during a recession that already has campus officials scrambling to maintain operating budgets.

In the new FERPA guidelines, which are available on ED's web site, a swath of educators' opinions is included, along with the department's final decision on the ID number regulations. Some campus officials said the proposed regulations "did not go far enough" to prohibit the use of students' Social Security numbers, pointing out that keeping SSNs on academic transcripts and electronic databases could jeopardize students' identity.