The Family Policy Compliance Office is excited to announce the launch  of the new Student Privacy Website! This new website replaces both the Privacy Technical Assistance Center’s and the Family Policy Compliance Office’s sites.  The Student Privacy Website can be found at:  https://studentprivacy.ed.gov. Be sure to update your bookmarks accordingly!

Are there any limitations as to what education records may be disclosed to a community-based organization to which a school has outsourced an institutional service under the school official exception?

Yes.  The school is required to use reasonable methods to ensure that school officials, (including community-based organizations) obtain access to only those education records in which they have legitimate educational interests.  While a school may disclose education records to a community-based organization in order to outsource institutional services or functions, it is important for the school to only share the information which is necessary for the service or function to be performed by the community-based organization.  For recommended practices on data access controls and data security, see the Privacy Technical Assistance Center (PTAC) resources:  Best Practices for Access Controls and Disclosure Avoidance Techniques webinar and Security Best Practices document library.