August 10, 2007
[Letter to a School District]
Dear [School Official]:
We are providing guidance under the Family Educational Rights and Privacy Act (FERPA), as it pertains to your August 1, 2007 email memorandum entitled "Ensuring Student Privacy," which was addressed to Approved Supplemental Educational Services Providers ("ASSP" or "SES Providers"), and a copy of which was forwarded to my office.
In your memorandum, you cited FERPA as prohibiting SES providers from contacting parents and guardians of [District] students served in SES programs last year or in previous years. While we appreciate [the District's] endeavor to ensure compliance with FERPA, as explained more fully below, FERPA does not prohibit SES providers from using contact information for parents of students they previously served to contact those parents again regarding their services. However, it should be noted that FERPA does not permit a provider to disclose to third parties the identity of any student who is receiving services under the SES program, without the written consent of the student's parent.
In your memorandum, you stated the following: "[A] small number of ASSP may be in violation of [FERPA] which states that the disclosed information cannot be used for any other purpose than the purpose disclosed and [contacting parents] are 'other purposes.'" The requirement that information disclosed to third parties may be used only for the purposes for which the disclosure was made is contained in §99.33(a)(2) of the FERPA regulations.
However, the intent of that regulatory provision is to ensure that personally identifiable information from student's education records is not redisclosed to other parties for other purposes. The Department does not interpret this to mean that a third party, such as an SES provider, may not use the information it legally obtained under FERPA to contact parents in regard to the services it provides. Therefore, [the District] has no legal basis in saying that FERPA does not permit SES providers to utilize the information they received from [the District], with parental consent, to contact the parents for the purposes of recruitment.
Moreover, while we do not know what stipulations [the District] may have in its agreements with SES providers, your statement that SES providers would be in violation of FERPA should they use the information they have in their possession to contact parents is not correct. Section 99.33(a) clearly states that the recipient of education records may not redisclose the information to any other party "without the prior consent of the parent or eligible student." A parent or eligible student does not have to consent for information to be provided to them. Therefore, we do not believe that an improper disclosure would take place when a party contacts a parent or eligible student.
I trust that this adequately explains the scope and limitations of FERPA as it pertains to the use of education records held by SES providers for recruitment purposes. Please do not hesitate to contact us directly at 202-205-4500 should you have any questions about FERPA or SES in general or this subject in particular.
Morgan S. Brown
Assistant Deputy Secretary
Office of Innovation and Improvement