Family Educational Rights and Privacy Act (FERPA)

FERPA was passed in 1974.²⁴ The primary goal of FERPA is to protect the privacy of student educational records. An educational record includes any personal and education data on a student maintained by an educational agency or institution. Under FERPA, parents have the right to inspect and review a student’s educational records. However, these rights do not belong to a parent forever. When the student reaches age 18, these rights pass to the student.

Scope

FERPA applies to any education agencies or institutions that receive funding from the U.S. Department of Education (ED). Educational agencies or institutions include:

• Primary and secondary schools
• Vocational colleges
• Colleges and universities
• Community colleges
• State and local educational agencies
• Schools or agencies offering preschool programs

For readability, the phrase “educational agency or institution” will often be shortened to “school” in this section.

The type of funding that these institutions receive from the federal government can be direct or indirect. Schools may receive funding outright from the ED. This is direct funding. If a college student receives a federal grant or federal aid and uses this as payment to a university, then the university is receiving federal funding. This is indirect funding and the university must comply with FERPA. Because federal funding is so valuable, and comes from so many different sources, almost all schools comply with FERPA.

If any educational agency or institution chooses not to comply with FERPA, it cannot receive any federal funds. Sometimes private schools and universities do not receive federal funds. In these cases, these institutions do not have to comply with FERPA.

Main Requirements

FERPA has four main requirements: annual notification, access to education records, amendment of education records, and disclosure of education records.

To carry out these requirements, FERPA has several important definitions.²⁵ These include:

• Student—Any individual that has ever been in attendance at an educational institution and for whom the institution maintains education records.
• Attendance—A student’s physical attendance at an educational institution. It includes any virtual attendance such as video conference or correspondence course. Attendance via the internet, by satellite, or through other methods used by the school is also included.
• Education records—Any records related to a student maintained by an educational agency or institution. These include written documents, computer media, video, film, or photographs. Records maintained by any outside party acting for the agency or institution are also included.

FERPA also defines PII and places limits on how this data can be used and disclosed. Under FERPA, PII includes:

• A student’s name
• The name of the student’s parent or other family members
• The address of the student or student’s family
• A personal identifier, such as the student’s SSN, student number, or biometric record
• Other identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name
• Other information that is connected to a specific student that would allow a reasonable person in the school community to identify the student
• Information requested by a person who the school reasonably believes knows the identity of the student to whom the education record relates

It is important to know what might be included in a student’s education record. The rules can be complex. Demographic information such as race and gender cannot be given out if it is directly connected with a student name. FERPA protects grades or transcripts of grades. Disciplinary records are considered a part of the student educational record. Behavioral notes on the student are also protected if the notes are kept in the student record. Under FERPA, the private notes of faculty and staff are not usually considered educational records. If the faculty or staff notes are kept in a student record then they are considered part of the educational record.

It is possible for a student record to contain additional information outside the scope of FERPA. FERPA does not require schools to reveal this data when access to an educational record is requested. For example, a school does not have to reveal parental financial records, confidential letters of recommendation, or statements of recommendation.

Annual Notification

FERPA requires schools to provide an annual notification to students and parents. This notice lets parents and eligible students know what their FERPA rights are. The annual notification also must state how to file a complaint with the Department of Education if the school violates any of FERPA’s provisions.²⁶

The annual notification must identify school officials that have access to educational records without consent. FERPA allows any school official that has legitimate educational interest in the record to view it without specific consent. These officials must be identified in the annual notification. The school has great freedom in identifying these officials. They could be teachers, instructors, professors, administrative personnel such as principals or provosts, or local board of education personnel.

Finally, FERPA requires that the school provide the annual notice “by any means that are reasonably likely to inform the parents or eligible students of their rights.”²⁷ This means that the school might have to translate the notice into different languages. It also must consider whether it should provide the notice in alternative formats to disabled students or parents.

Access to Education Records

The most fundamental right under FERPA is student and parental access to the student’s educational records. The parent or eligible student has the right to inspect and review any educational records maintained by the school.²⁸ Under FERPA, schools must respond within 45 days to a request to inspect and review educational records.

In most instances, the school does not have to make copies of the records. It only needs to make them available for review and inspection. If the parent or student requests copies, the school may charge a small copying fee.

There are special access rules for colleges and universities. These rules apply to situations where an educational record for the student may also contain confidential information about the student’s parents. This happens often in situations where parents provide their own financial information to help a student receive federal financial aid. In these situations, colleges and universities do not have to give a student access to the financial records of his or her parents.²⁹

FYI

Finally, a school is not required to create an educational record where none exists. Sometimes students or parents might request a report or record that is not already part of the educational record. In these cases, the school does not have to create that report just because a parent asked for it.

Amendment of Education Records

FERPA allows parents and students the right to request amendment of student educational records. A parent may ask that a school amend information in the record that is incorrect or misleading. The school’s annual notification must specify the procedure for how to request this correction.³⁰

Schools are not required to honor the request for correction if the school does not believe that the student’s record is incorrect. The school must notify the parent or student of this decision. If a school does not amend a student educational record, then the parent or eligible student has the right to a hearing on that decision.³¹ The purpose of the hearing is to determine if the school’s decision was appropriate. The school and the parents will present their cases to the hearing officer. If the hearing officer decides that the school’s decision was appropriate, then the parent or eligible student must be allowed an opportunity to provide a written statement that is added to the student’s educational record. The written statement can comment on the information under dispute in the record. It can also state why the parent or student disagrees with the decision of the school not to amend the record.

Disclosure of Education Records

In general, educational agencies or institutions must have permission from either a student or the student’s parents in order to disclose educational records and student PII. The school must obtain written consent to release this data. Most schools have forms for this purpose. The procedure for using these forms is usually included in the school’s annual notification.

To disclose student educational records, written consent must include:

• Which records will be disclosed
• The purpose of the disclosure
• Who will receive the record
• The date the consent is granted
• Signature of the student or parent
• Signature of the school official releasing the data³²

Parents and students can refuse to give consent to have their data released. However, the school can still release data to certain entities under FERPA exceptions. The next section explains these exceptions.

Disclosure Exceptions Under FERPA

A school can release student records without prior consent in some cases. As mentioned earlier in this section, school officials, such as principals or teachers, can view student educational records. These officials must have a legitimate educational interest to view the record. School officials cannot view a student record merely if they are curious about a student’s performance.

Directory information can also be released without student or parental consent. Directory information includes a student’s name, address, telephone number, date and place of birth, awards, and dates of attendance. Under no circumstances should the directory information include PII information such as a student’s SSN or student identification number.

Schools must identify which student data is specifically defined as directory information. Schools also must tell parents and eligible students how to request that the school not share this information. All of this information must be included in the school’s annual notice.³³ The release of directory information is the primary FERPA disclosure exception. Schools frequently rely on this exception.

FERPA allows a school to disclose student PII in several other ways that do not require prior written consent:

• Schools can transfer a student’s educational record to a new school if a student is moving from one school to another.
• Schools can provide student PII to an accrediting organization to prove that the school is performing to specific standards.
• Schools can provide student PII in some financial aid situations.
• Schools may disclose student educational records in response to a court order or lawful subpoena.
• School may disclose student PII if it will aid personnel in an emergency situation.
• Postsecondary schools can disclose the PII of a student over age 18 to that student’s parents if the student is considered a dependent for U.S. federal tax purposes.

The emergency situation exception became important in early 2020 during the coronavirus disease 2019 (COVID-19) outbreak. During the outbreak, the Department of Education reminded all schools that health records maintained by the school could be disclosed, without consent, if the school believed that the COVID-19 virus posed a serious risk to the health or safety of an individual student at the school. The emergency situation exception is limited in time to the period of the emergency and generally does not allow for a blanket release of PII from student education records.³⁴

Schools must maintain records of all of the requests and disclosures of student educational records.³⁵ These records must include the parties who received the student PII and the reason for the disclosure. This record of disclosures must be maintained for as long as the school maintains the underlying educational record.

Security of Student Records Under FERPA

FERPA has no specific information security requirements that schools must use to protect student educational records. For example, FERPA does not contain a requirement that schools notify parents and students if an unauthorized person accesses student records. Instead, schools just have to record the unauthorized disclosure in the student record.

Even though it is not required under FERPA, the U.S. Department of Education does encourage educational institutions to take steps to protect student information. The department suggests that schools consider the following factors to implement security measures:

• The type of information to be protected
• The size and complexity of the educational institution
• The resources available to the institution
• Security safeguards used by other institutions in similar circumstances³⁶

Although FERPA does not have specific information security requirements, the Department of Education often uses other laws to encourage colleges and universities, in particular, to protect student data. For example, the U.S. Department of Education Office of Federal Student Aid (FSA) administers student financial aid awards. Colleges and universities that administer federal student financial aid have agreed to comply with the Gramm-Leach-Bliley Act (GLBA) as part of their agreement with FSA. This means that those colleges and universities must show that all federal student aid applicant information is protected from unauthorized access.³⁷

Oversight

The Family Policy Compliance Office (FPCO) in the U.S. Department of Education provides oversight for FERPA and investigates FERPA complaints. Only parents and students over the age of 18 may make complaints against schools for FERPA violations. Complaints must be submitted to the FPCO within 180 days of the date that the FERPA violation is alleged to have occurred.³⁸ The FPCO resolves FERPA complaints and enforces its decisions by withholding federal funding to the schools that have violated the law.

State Laws Protecting Student Data

In addition to the protections afforded by FERPA, many states also have state laws designed to protect student privacy. For example, 40 states passed 125 laws related to student privacy from 2013 to 2018.³⁹ Many of these laws were put into place because of the rise in online learning activities. States were worried that vendors would have access to student information and would use or share student data improperly. Often these laws try to extend FERPA protections and have even more restrictions about what student data a school can share with others.