In addition to FERPA, most states have statutes or common law rules that generally provide that persons shall have a right against any unreasonable, substantial, or serious interference with their privacy. Like FERPA, these principles may be construed to prohibit schools from disclosing records or other information pertaining to students to persons or entities other than students or their legal guardians unless the person seeking the records has a "legitimate need to know" the information contained in those records. Persons who normally have a need to know such information include teachers or administrators within the student's school or other schools in which the student is seeking to enroll. Schools should take the time to determine which state laws may also apply to their schools.
Much of the information contained in this article has been gleaned from the regulations found on the Department of Education website. The Department has supplied very readable regulations and other information at http://www.ed.gov/offices/OM/fpco/ferpalist.html.
When does FERPA apply?
FERPA will apply to your school only if:1. Your school takes funding from a Department of Education program. This seems like an easy thing to determine. However, this definition includes funds “provided to the agency or institution by grant, cooperative, agreement, contract, sub grant, or subcontract.” In other words, look very closely at the money coming in from seemingly innocuous sources. FERPA is not triggered if your school or students receive materials or other benefits under a program. For instance, participation in E-Rate does not trigger FERPA, neither does receipt of materials “on loan” from another federal program. The triggering funding must in fact be funding; other sources of assistance are not sufficient to obligate schools.
Or
2. Your state has adopted FERPA as its overall standard and mandates the application of FERPA to all schools. Not many states have adopted this approach, but if you are unsure if your state has taken such steps, it may be worth a look.
Who has rights under FERPA?
Generally, only parents of minority age students and students 18-years-old and older may exercise rights under FERPA. Once a student reaches majority age, all of the FERPA rights pass to that student. For the sake of this article, when a parent is mentioned, the reader should keep in mind that a majority aged student will have the same rights.Schools should also bear in mind that rights under FERPA do not begin until a child is actually a student of the school. In other words, FERPA is not triggered during the admission process. However, once a child matriculates, those admission records can be considered education records.
Which records are covered by FERPA?
FERPA addresses education records. These records are those that are directly related to the student and maintained by the school or by a party acting on behalf of a school. The latter includes teachers, staff members, consultants, etc. Records include any information recorded in any way, including, but not limited to, handwriting, print, computer media, video or audio tape, film, microfilm, and microfiche.That is a pretty broad definition. Are there any exceptions?
There are a variety of exceptions to this definition. The ones most relevant to independent schools are:1. The Note-Taking Teacher or Admission Officer Exception: Records that are kept solely in possession of the maker and are used only for a personal memory aid and are not accessible or revealed to any other person except a temporary substitute for that person. In other words, if an admission officer keeps a personal notebook of his observations of a student, does not share those notes with anyone (even after the student is admitted), those records are not part of the student’s educational record. Schools should note that just because these documents are not considered an educational record does not mean that the documents are unattainable by another party if a subpoena requesting these documents is issued during the course of litigation.
2. Security / Safety Records: If records are made by the schools safety personnel (e.g., security officers), these records are not part of the student’s educational record. However, this exception does not extend to any records made by safety personnel that reflect a disciplinary action against a student. In other words, a school cannot keep disciplinary records from falling under FERPA by folding the records into the campus security office.
3. Alumni Exception: Records that only contain information about an individual after he or she is no longer a student at the school. Records created by the alumni office are not part of the education record.
4. Medical Records for Students 18 and Older: Records of students 18 and older which are made or maintained by a physician, psychiatrist, or other recognized professional or paraprofessional acting in this capacity or assisting in that capacity. These records must be made, maintained, or used only in connection with the treatment of the student and are not available to anyone other than the person providing the treatment. Such records can be reviewed by an appropriate professional of the student’s choice.
What about recommendations written by school staff members?
The FERPA regulations provide a waiver provision for references and recommendations written and kept in the student’s higher education recommendations. However, this provision does not appear to apply to those recommendations found in the educational records of students from K-12 schools. In other words, it is unclear from the regulations whether parents or students can effectively waive their rights under FERPA to obtain these records. Some schools have decided that neither faculty members nor the school should retain copies of recommendations for this reason. Other schools have told staff to keep notes in order to help them remember the substance of the recommendation, but not an actual copy. These notes remind the staff member that they wrote the recommendation, but the notes fall safely within the first exception provided above.Which information is not covered by FERPA?
Directory information is not covered by FERPA. The Department of Education has defined this as:information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. It includes, but is not limited to, the student’s name, address, telephone listing, electronic mail address, photograph, date and place of birth, major field of study, dates of attendance, grade level, enrollment status, participating in officially recognized activities and sports, weight and height of members of athletic teams, degrees, honors and awards received, and the most recent educational agency or institution attended.
Can we disclose directory information?
A school may disclose directory information if it has given the parents and majority age students public notice of the kinds of information considered by the school to be directory information, has notified parents of their right to request that the school not release any or all of the information for that student; and has specified the period of time in which parents may notify the school of their wish not to have that information released. Schools do not have to perform this notification with parents of students or majority age students not in attendance at the school. In other words, FERPA does not require that this notification be made for purposes of alumni directories and other such information collections.This provision of FERPA gives schools a lot of flexibility. A school should determine which information it is going to treat as directory information, give parents notice of what that information is and how the school anticipates using the information, and give parents notice of their right not to have that information released as well as a time by which the parent must notify the school that he or she will exercise this right.
How do we give parents notice of their rights under FERPA and what should the notice include?
The notification a school gives to parents must be given “by any means that are reasonably likely to inform the parents of their rights.” The regulations do not clarify exactly what this means, likely because the answer may be different in many schools. When a school notifies parents of what information the school has designated as directory information, the school should also include other notification information. Part of FERPA includes notifying parents of their more general rights under the Act. Again, these rights automatically transfer to the student when he or she turns 18. This notice must include the parent’s or student’s right to:1. Inspect and review the student’s education records;
2. Seek amendment of the student’s education records that the parent or eligible student believes to be misleading, inaccurate, or otherwise in violation of the student’s privacy rights;
3. Consent to disclosures of personally identifiable information contained in the student’s education records; and
4. File with the Department of Education a complaint concerning alleged failures by the school to comply with the FERPA requirements.
The notice must also include:
1. The procedure for exercising the right to inspect and review education records (the school generally sets this procedure within reasonable bounds);
2. The procedure for requesting amendment of the records (again, the school may set this procedure within reasonable bounds); and
3. If the school allows staff access to the records, an explanation of how the school determines who fulfills the necessary requirement of having a legitimate educational interest in the student’s records.
The parent has a right to inspect the records?
A parent has the right to inspect and review the student’s educational record. The school must comply with a parent’s request to do so within a reasonable time after the request, but within no more than 45 days. The school must also respond to the “reasonable requests” of the reviewing individual for explanations and interpretations of the records. In other words, if a parent requests that a school administrator explain certain aspects of the student’s record, the school must make a good faith effort to do so.If the individual is unable to review the records personally, the school must provide the parent or student with a copy of the records requested or make other reasonable arrangements for the individual to view the records. The school may charge for copies of the records, but only if doing so would not effectively prevent the request. The school may not charge for retrieving the records. The school may also not destroy the records as long as there is an outstanding request to review the records.
Limitation on the Right to Inspect
If the record contains information on more than one student, the reviewer may only see the information about the appropriate student.
May a parent ask the school to amend the record?
Once the parent has reviewed the education record, he or she may ask the school to amend the record if it contains what the parent believes is inaccurate or misleading information, or if it is in violation of the student’s right to privacy. Once the school receives the parent’s request, the school makes an initial decision about whether it will amend the record and notifies the parent of the decision. If the school decides not to amend the record then the notification of this decision must make clear that the parent has a right to request a hearing.We have to hold a hearing?
Holding a hearing is not particularly complicated. The school must hold the hearing within a reasonable time after receiving the parent’s request for a hearing. The school must give the parent or student notice of the time, date, and place of the hearing within a reasonable time of the appointed date. Any individual, who does not have a direct interest in the outcome of the proceeding, including a school official, may conduct the hearing. The parent or student must have a full and fair opportunity to present evidence relevant to the matter and they may, at their own expense, hire a representative to assist or represent them. This representative may be an attorney. The school must make a decision in writing within a reasonable time after the hearing, and the decision must be based solely on the evidence presented at the hearing. The decision must include a summary of the evidence and the reasons for the decision.What do we do after the hearing?
If, as a result of the hearing, the school decides to amend the record it should do so and inform the parent or student of the amendment in writing. If the school does not amend the record, the school must inform the parent or student of the right to place a statement in the file commenting on the contested information and stating why the individual disagrees with the school’s decision. If the individual does exercise this option, the school must keep this statement with the contested part of the record as long as that part of the record is maintained and disclose the statement whenever that information is released.Sometimes we have to disclose records. How do we do that?
The parent must provide a signed and dated written consent before the school may disclose personally identifiable information from the students’ educational records. This consent must specify the records to be disclosed, the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made. The school must provide a copy of the disclosed records to the parent or student if requested.Do we always need prior consent?
No. The school does not need prior consent to release personally identifiable information from an education record in any of the following circumstances:1. The disclosure is to school officials, including teachers, who the school has determined have a legitimate educational interest in seeing the records.
2. The disclosure is to officials of another school, school system, or postsecondary school where the student seeks to enroll. However, schools should verify that the student is seeking enrollment at these other institutions and request written permission to release the information either by virtue of a copy of the permission from the requesting institution or written permission from the student’s parents or the student himself.
3. The disclosure is to the Comptroller General of the United States, the Attorney General of the United States, the Secretary of the United States, or state and local educational authorities. There are provisions here that should be considered before turning the information over. If your school should receive such a request, contact your lawyer to make sure that the request is proper under FERPA.
4. The disclosure relates to financial aid for which the student has applied or received, as long as the information is necessary to determine eligibility for the aid, determine the amount of the aid, determine the conditions for the aid, or enforce the terms and conditions of the aid.
5. The disclosure is required under state law. If your school should receive such a request, contact your lawyer to make sure that the request is proper under FERPA.
6. The disclosure is to organizations conducting studies to develop, validate, or administer predictive tests, administer student aid programs, or improve instruction. These studies must be conducted in a way that the personally identifiable information of the parents and students are not available to anyone but the representatives of the organization conducting the study and the information must be destroyed when it is no longer needed.
7. The disclosure is to an accrediting body for the purpose of accreditation.
8. The disclosure is to the parent of the student or student of he or she is 18-years-old or older.
9. The disclosure is to comply with a court order or subpoena. In this case, the school should make every reasonable effort to contact the parent or majority-age student so that the parent or student may seek protective action. The only exception to this rule is if the subpoena is for law enforcement purposes and specifies that the contents of the subpoena and the information requested should not be disclosed. If your school receives such a subpoena, contact your school’s attorney before complying.
10. The disclosure is necessary to protect the health and safety of the student or others. This disclosure should be made only to those staff members at the school or another school that have a legitimate educational interests in the behavior of the student or, in the case of an emergency, to appropriate parties in connection with an emergency if the knowledge is necessary to protect the health and safety of the student or those around him. If your school receives such a subpoena, contact your school’s attorney before complying.
11. The disclosure is information that the school has designated as directory information and the school has sent out the appropriate notice to parents of this designation.
How do we keep track of all this stuff? Record Keeping Requirements
The school must keep track of each request for access or disclosure of personally identifiable information from the records of each student. The record of access must be kept for as long as the education record is kept. This record of access must include who has requested or received the personally identifiable information, and the legitimate interests the parties had in requesting or obtaining the information. The school does not need to keep a record of the disclosure if the disclosure was to the parent or majority age student, a school official with a legitimate educational interest, a party with the written consent of the parent or majority age student, a party seeking directory information, or a party receiving records requested by a federal grand jury or law enforcement subpoena that specifies that the provision of the information should not be disclosed. Copies of any documentation for these disclosures should be kept, however, in case such access is questioned later.What about reviewing parties releasing the information without the school’s knowledge?
The school may only release personally identifiable information from an education record on the condition that the receiving party will not disclose the information without the prior consent of the parent or majority-age student. The only exception to this rule is when the re-disclosure is made to an individual to whom the school could have disclosed the information. For example, the school properly discloses the student’s education record to the school’s counselor for learning differences. This counselor then meets with the student’s English teacher to discuss the student’s dyslexia. In doing so, the counselor shows the English teacher the student’s education record in order to properly consult with the teacher about the student.What do we do when we have to disclose the information to another school?
When a school is planning to disclose the information to another school it should:1. Make a reasonable attempt to notify the parent or majority-age student at the last known address unless the disclosure is initiated by the parent or student or the annual notification includes that the school automatically forwards these records on to schools requesting the information and in which the student seeks or intends to enroll.
2. If the parent or majority-age student requests, provide a copy of the record disclosed.
3. Give the student or parent an opportunity for a hearing if necessary
What happens if we violate FERPA?
The parent or student may file a written complaint with the Family Policy Compliance Office of the Department of Education within 180 days of the violation or when the complainant knew or reasonably should have known of the violation. This Office investigates all the complaints that are properly filed. If an incident involving your school is going to be investigated the Office will send you a written notice including the substance of the complaint, it will also ask the school to submit a written response. If the school is found to have violated FERPA, the Office tells the school what must be done to resolve the breach and gives the school a reasonable amount of time to comply. If the school still does not comply, the triggering funding may be withheld, a cease-and-desist order may be used, or the ability to receive funding under any applicable program may be withheld.Conclusion
The information in this publication is a general overview of FERPA and the regulations that relate to it. The regulations and other information are available on the Department of Education’s web site: http://www.ed.gov/offices/OM/fpco/ferpalist.html. More information about both FERPA and student records generally are available in the NAIS document Questions and Answers on Student Records available on the NAIS website, www.nais.org, in the Government Relations section.N.B. This article is intended for general educational purposes only. The information in this article is not intended as, nor should it be construed or relied upon as, legal advice.