Resources

Family Education Rights and Privacy Act (FERPA) -- the Basics

What is FERPA?

What is the purpose of FERPA?

Does FERPA apply to my school?

What are "education records"?

What is "directory information"?

When is parent or "eligible student" permission not required?

What rights do Parents and "Eligible Students" have?

Who is an "eligible student"?

What is an "annual notification"?

Can the school charge a fee for copies of educational records?

What if the educational record contains information on more than one student?

Does FERPA require recordkeeping?

Should my school release information to the media?

Can education records be released after redaction or "de-identification"?

 
What is FERPA?

"FERPA" is the acronym for a federal law called the Family Educational Rights and Privacy Act (20 U.S.C. 1232g; 34 CFR part 99). FERPA protects the privacy of a student’s "education records." The law gives parents or "eligible students" particular rights, such as the right to prevent educational records from being made public. Also, the law creates certain obligations; for instance, it prohibits school districts from releasing the education records except under certain circumstances. If schools do not comply with FERPA, then they run the risk of losing federal funding or being sued by the parent/eligible student.  

What is the purpose of FERPA?

In short, the purpose of the law is to ensure educational records are kept private and guarantee access to these records by parents. FERPA states that educational records are private. In general, the only person who can authorize publication of educational records is the student’s parent(s) or an "eligible student." But, exceptions exist when the interests at stake override the student’s right to privacy, such as a legal subpoena requiring a school to provide the documents to a judge.

Does FERPA apply to my school?

FERPA applies to educational institutions and educational agencies. Educational institution means any public or private institution that receives (a) federal funds and (b) provides educational services (e.g. all public K-12 school districts; and virtually all postsecondary institutions). Educational agency means any agency authorized to direct or control public elementary or secondary, or postsecondary educational institutions (e.g. Oregon Department of Education).

What are "education records"?

"Education records" includes most information that is (a) directly related to a student and (b) maintained by the school. Common examples include grades, discipline records, and special education records. The following is more information that is commonly considered "education records.

  • Date and place of birth, parent(s) and/or guardian address, and where parents can be contacted in emergency situations.
  • Grades, test scores, courses taken, academic specializations and activities, and official letters regarding a student’s status in schools;
  • Special education records;
  • Discipline records;
  • Medical and health records that the school creates or collects and maintains;
  • Documents of attendance, schools attended, courses taken, awards conferred, and degrees earned; and
  • Personally identifiable information such as a student’s identification code, social security number, picture, or other information that would make it easy to identify or locate a student.
What is "directory information"?

But, information such as name, awards received, and weight and height of athletes is considered "directory information," and can be disclosed even though it directly relates to a student and is maintained by the school; the rationale is this information is considered less private. Before releasing "directory information," a school must comply with certain rules, and these rules are stated later in this document. In general, schools may disclose "directory information" without consent from a parent or eligible student.

The federal definition of "directory information" is very broad: if disclosed, the information would not be an invasion of privacy. Luckily, each school provides its own definition of "directory information," which can often be found in official district policy. "Directory information" commonly includes name, address, telephone number, date and place of birth, honors and awards, dates of attendance, or information found in yearbooks or athletic programs. But, schools must annually notify parents or eligible students about its particular definition of "directory information" and provide an opportunity to opt-out of the disclosure of some or all of their child’s directory information.

When is parent or "eligible student" permission not required?

FERPA allows schools to release certain information from a student’s education record without the consent of parents or eligible students under the following conditions:

  • To school officials with legitimate educational interest;
  • To other schools to which a student is transferring;
  • To specified officials for audit or evaluation purposes;
  • To appropriate parties in connection with financial aid to a student;
  • To organizations conducting certain studies for or on behalf of the school;
  • To accrediting organizations;
  • To comply with a judicial order or lawfully issued subpoena;
  • To appropriate officials in cases of health and safety emergencies; and
  • To state and local authorities, within a juvenile justice system, pursuant to specific state law;
  • "Directory information" (see above).
What rights do parents and "eligible students" have?
  • Inspect and review the student’s education records maintained by the school. Schools may charge a fee for the copies provided it does not effectively prevent a parent or eligible student from exercising their right to inspect and review.
  • Request a school to correct inaccurate or misleading records. If the request is denied, then the parent or eligible student has the right to a formal hearing. If the request is denied again, then the parent or eligible student may place a statement with the record setting forth his or her view about the contested information.
  • Provide written permission before student record information is released.
  • Receive annual notification about their rights under FERPA.
Who is an "eligible student?"

An "eligible student" means the student is either 18 years old or attends a postsecondary school. Once a student reaches 18 years of age or attends a postsecondary school, the parent’s rights transfer to him. In general, a school violates FERPA when it discloses the "eligible student’s" educational record to the student’s parents unless the student consents. But, three exceptions practically swallow this general rule. A school may disclose records if the "eligible student": (1) is a dependant of the parent for tax purposes; (2) violates laws or policies on alcohol or substance abuse; or (3) has a health or safety emergency.

What is an "annual notification"?

Every year, your school must notify parents or eligible students of their rights under FERPA. The notice must inform them of their right to: inspect and review records; amend inaccurate records; consent to disclosures of directory information; and file a complaint for failure to comply with FERPA. This notification must include the school's definition of "directory information."

Can the school charge a fee for copies of educational records?

Yes. If a parent or eligible student requests copies of education records, then the school may charge a fee. But, if the fee effectively prevents the person from inspecting/reviewing the records, then the school may not charge the fee.

What if the educational record contains information on more than one student?

This situation typically arises when disciplinary records are requested. When determining how FERPA applies, consider the basic rule that FERPA creates a privacy right in education records and other personally identifiable information. Unless an exception applies, only the parent or eligible student may authorize disclosure of the private information. Now, assume Student A invokes his right to review particular education records, but the documents also contain information about Student B. Here, Student A does not have the right to look at records containing information about Student B. Student A is entitled to look at or be informed about only the specific information about himself.

Does FERPA require recordkeeping?

Yes. FERPA requires schools to maintain record of (b) each request for access to information, and (b) each disclosure of personally identifiable information from education records. Moreover, some parties who request information have the authority to re-disclose information. In these situations, your school must keep a record of the parties to whom re-disclosure might be made. To determine who the secondary parties might be, your school might need to ask the party who made the original request.

Should my school release information to the media?

Sometimes events happen at school which catch the attention of local media or concerned citizens. Often, these events involve gross disciplinary infractions, health or safety concerns. If an inquiry causes your school to question whether disclosure is appropriate, then your school should consider whether FERPA applies. It is best practice to assume that requested information is private under FERPA, and then answer the following two questions. First, determine which students could be identified in the requested documents, and then determine "Did the parents or eligible student consent to disclosure"? Second, "Does an exception permit disclosure"? In these situations, it is unlikely the parents will consent. Moreover, exceptions often do not apply to these types of situations because the exceptions are quite limited.

Can education records be released after redaction or "de-identification"?

Yes. If all personally identifiable information has been redacted, then education records may be released without consent. But redacting, or deleting, all "personally identifiable information" is more difficult than it appears. "Personally identifiable information" can mean more than a name or physical description. In some instances, a brief description of an event might qualify as "personally identifiable information." For example, in a smaller community, a brief description of an event might be all that is needed to connect a particular student with the event. Therefore, when considering whether to release redacted records, the school needs to consider "other information."

"Other information" means any information that is linked or linkable to a student. For example, such information might include media coverage in the "school community", publically available records, published directories, or law enforcement records. In other words, the school must consider the totality of the circumstances, or the cumulative effect of all available information. Before disclosing redacted or questionable information, ask: "Could a reasonable person in the school community identify the student with reasonable certainty?"

Download this article (129K This file is in Adobe Acrobat PDF format.)

 

Board’s removal of board member from vice president position ruled constitutional

Disregarding signs of disability amounts to “child find” violation

Federal court finds IEP and placement appropriate over parents’ objections

More >>

View resources related to:
  1. Laws ‑ Federal
  2. Legal