FERPA Frequently Asked Questions - FERPA for School Officials

General (8)

The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents the right to have access to their children’s education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records.  When a student turns 18 years old, or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student (“eligible student”). The FERPA statute is found at 20 U.S.C. § 1232g and the FERPA regulations are found at 34 CFR Part 99.

What is FERPA?

FERPA does not specifically afford minors who are separated from their parents the rights that are afforded to parents and eligible students under the law.  However, schools may use their judgment in determining whether an unaccompanied minor is responsible enough to exercise certain privileges, such as inspecting and reviewing education records and providing consent for disclosure.  34 CFR § 99.5(b).

Do students under the age of 18 and not in college who are on their own and not in the physical custody of a parent or guardian have rights under FERPA?

Exempted from the definition of education records are those records which are kept in the sole possession of the maker of the records and are not accessible or revealed to any other person except a temporary substitute for the maker of the records. Once the contents or information recorded in sole possession records is disclosed to any party other than a temporary substitute for the maker of the records, those records become education records subject to FERPA. Generally sole possession records are of the nature to serve as a “memory jogger” for the creator of the record. For example, if a school official has taken notes regarding telephone or face to face conversations, such notes could be sole possession records depending on the nature and content of the notes.

Click to see related scenario

What records are exempted from FERPA?

Yes.  Educational agencies and institutions must annually notify parents and eligible students of their rights under FERPA.  Specifically, schools must notify parents and eligible students of the right:  to inspect and review education records and the procedures to do so; to seek amendment of records the parent or eligible student believes are inaccurate and the procedures to so do; to consent to disclosures of education records, except to the extent that FERPA authorizes disclosure without consent; and to file a complaint with FPCO concerning potential violations.   Postsecondary institutions are only required to notify eligible students of their rights under FERPA.

Source: 34 CFR § 99.7

Are educational agencies and institutions required to notify parents and eligible students of their rights under FERPA?

Yes.  FERPA does not require schools to create education records nor does it require schools to maintain education records, unless there is an outstanding request by a parent or eligible student to inspect and review the records.

Source: 34 CFR § 99.10(e)

Does an educational agency or institution have discretion over what education records it decides to create and keep?

FERPA applies to educational agencies or institutions that receive funds from programs administered by the U.S. Department of Education.  By “educational agencies or institutions” we mean public schools, school districts (or “local educational agencies” (LEAs)), and postsecondary institutions, such as colleges and universities.  Private and parochial schools at the elementary and secondary level generally do not receive such funding and are, therefore, not subject to FERPA. See: FERPA 101 Webinar

To which educational agencies or institutions does FERPA apply?

Education records are records that are directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of the agency or institution.  These records include but are not limited to grades, transcripts, class lists, student course schedules, health records (at the K-12 level), student financial information (at the postsecondary level), and student discipline files.  The information may be recorded in any way, including, but not limited to, handwriting, print, computer media, videotape, audiotape, film, microfilm, microfiche, and e-mail.

Source: 34 CFR § 99.2 “Education Records” and “Record”

What is an Education Record?

Subject to certain exceptions addressed below, schools must maintain a record of each request for access to and each disclosure of PII from the education records of each student, as well as the names of State and local educational authorities and federal officials and agencies listed in § 99.31(a)(3) that may make further disclosures of PII from students’ education records without consent.  The school must maintain the record with the education records of the student as long as the education records are maintained.      

For each request or disclosure, the record must include:  1) the parties who have requested or received PII from the education records; and, 2) the legitimate interest the parties had in requesting or obtaining the information (i.e., under which exception to consent was the disclosure made).  The school must record additional information whenever it discloses PII from a student’s education records in connection with a health or safety emergency.  There are other requirements that relate to recording further disclosures made by State and local authorities and federal officials and agencies listed under § 99.31(a)(3) with which schools should be familiar.  See § 99.32(a)(4).

Schools do not have to record disclosures of PII from education records that were made to:  1) the parent or eligible student; 2) a school official under § 99.31(a)(1); 3) a party with written consent from the parent or eligible student; 4) a party seeking directory information; or 5) a party seeking or receiving records in accordance with the provisions in FERPA related to disclosures pursuant to certain types of subpoenas or court orders as set forth in § 99.31(a)(9)(ii)(A)-(C).  See § 99.32(d).

In most cases, yes.  Written consent is generally required before personally identifiable information (PII) from students’ education records may be disclosed to community-based organizations.  Except as set forth in § 99.31 of the regulations and in the statutory exceptions to consent at 20 U.S.C. 1232g, FERPA requires written consent from parents or eligible students before PII from education records are disclosed (34 CFR § 99.30).  For activities that do not fit within the statutory exceptions to consent, we recommend that schools, local educational agencies (LEAs), and/or community-based organizations build written consent into the registration process so that when parents sign students up for services offered by a community-based organization, the organization obtains the consent needed to access those education records of the student that will be needed to provide its services to that student.  

FERPA requires that the parent or eligible student “provide a signed and dated written consent” before a school or LEA discloses PII from a student’s education record, unless one of the conditions in § 99.31 of the regulations applies.  There is nothing in FERPA that would preclude a community-based organization from obtaining a signed and dated written consent as long as the consent: (1) specifies the education records that may be disclosed, (2) states the purpose of the disclosures; and (3) identifies the organization or other parties to whom the disclosure may be made.  34 CFR § 99.30(b).  

Generally yes.  FERPA allows schools that have adopted directory information policies to disclose properly designated directory information without consent on students whose parents (or eligible students) have not opted out of the disclosure of directory information.  See § 99.37(a).  However, if a school adopts a directory information policy specifying that disclosure of directory information will be limited to specific parties, for specific purposes, or both, then the school is required to limit its directory information disclosures to those specified in its public notice.  See § 99.37(d).

Yes. Schools do not need to obtain written consent or to inform parents or eligible students when releasing properly de-identified information.  For additional information on de-identified data and recommended practices, see § 99.31(b)(1) of the regulations and a relevant case study released by the Department, Case Study #5: Minimizing Access to PII: Best Practices for Access Controls and Disclosure Avoidance Techniques.

Yes.  If the disclosure meets one of the exceptions set forth in § 99.31 of the regulations, a school or LEA may disclose PII from an education record of a student without consent to a community-based organization.  We note, however, that there are three exceptions to the written consent requirement that schools or LEAs most often consider when disclosing PII from education records to community-based organizations.  These exceptions are the “school official,” “studies,” and “audit/evaluation” exceptions (see 34 CFR §§ 99.31(a)(1), 99.31(a)(6), and 99.31(a)(3) and 99.35, respectively).  

The school or LEA has discretion under FERPA to decide what and how much PII from education records to disclose to community-based organizations (except in certain cases such as a court order or a subpoena).  The school or LEA should determine which data elements are necessary for the activity in question and provide only those elements.  Often LEAs and schools will discover that the organization can do the work in question without receiving PII from education records.

A community-based organization may be considered a “school official” only if it:

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records; and
  3. Is subject to the requirements of § 99.33(a) governing the use and redisclosure of PII from education records.
  4. Meets the criteria specified in the school’s or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records. 

Once a school determines that a community-based organization meets the above criteria, the organization may have access to PII from education records, without consent, under the school official exception, in order to perform the required institutional services and functions for the school. (See § 99.31(a)(1)(i)(B))

Yes.  If a school chooses to outsource to a community-based organization a tutoring program that it would otherwise use school employees to provide, then the school may disclose the education records without the consent of the parents or eligible students under the school official exception.  However, the community-based organization must meet all the requirements in § 99.31(a)(1)(i)(B) to be considered a school official before the school may disclose the education records to the organization.   

Yes.  A community-based organization acting as a school official must be under the ‘‘direct control’’ of the school or LEA with respect to the use and maintenance of education records (§ 99.31(a)(1)(i)(B)(2)) and is also subject to FERPA’s use and redisclosure requirements in § 99.33(a).  The community-based organization must not disclose the information it receives as a school official to any other party without the prior consent of the parent or eligible student, and the organization may only use the information for the purposes for which the disclosure was made.  One way of achieving that direct control is through a written agreement, requiring that any PII from education records provided to the community-based organization by the school only be used to perform the outsourced service or function and may not be used for any other purpose.

Yes.  The school is required to use reasonable methods to ensure that school officials, (including community-based organizations) obtain access to only those education records in which they have legitimate educational interests.  While a school may disclose education records to a community-based organization in order to outsource institutional services or functions, it is important for the school to only share the information which is necessary for the service or function to be performed by the community-based organization.  For recommended practices on data access controls and data security, see the Privacy Technical Assistance Center (PTAC) resources:  Best Practices for Access Controls and Disclosure Avoidance Techniques webinar and Security Best Practices document library.

No.  While FERPA does not require written agreements or contracts when a school chooses to outsource an institutional service or function to a community-based organization under the “school official” exception, we highly recommend the use of written agreements in this context.  Written agreements help ensure that the community-based organization understands its obligations and responsibilities with respect to the use of and privacy protections accorded to the FERPA protected information.  Further, appropriate contractual provisions can establish the direct control required by FERPA under this exception.  Additionally, local or State policies or laws may require the use of written agreements or contracts for procurement.  

No.  While there is no specific notification requirement regarding disclosures under the exceptions to consent, FERPA does require that each school or LEA annually notify parents and eligible students of their rights under FERPA.  34 CFR § 99.7.  As a part of the annual notice, the school or LEA must include in the notification a specification of the criteria for determining who constitutes a school official and what constitutes a legitimate educational interest.  34 CFR § 99.7(3)(iii).  Additional information about the annual notification of rights can be found on the Family Policy Compliance Office’s (FPCO’s) website at: http://www.ed.gov/policy/gen/guid/fpco/index.html. For a model of a K-12 annual notice, see Model Notification of Rights for Elementary and Secondary Schools.

As a best practice for transparency, we recommend that schools and districts post information on their websites about the information they collect about students, how they protect the information, how they use it, parties with whom they share it, and why.  

Yes.  The studies exception allows for the disclosure of PII from education records without consent to community-based organizations conducting studies for, or on behalf of, the school or LEA.  FERPA limits the purpose of the studies conducted under this exception to:  (1) developing, validating, or administering predictive tests; (2) administering student aid programs; or (3) improving instruction.  See 34 CFR § 99.31(a)(6)(i).  

Yes.  Under the studies exception, the school or LEA may non-consensually disclose PII from education records to the community-based organization only if—

  1. The study is conducted in a manner that does not permit personal identification of parents and students by individuals other than representatives of the organization that have legitimate interests in the information;
  2. The information is destroyed when no longer needed for the purposes for which the study was conducted; and
  3. The school or LEA enters into a written agreement with the community-based organization.

Yes.  Written agreements are required under the studies exception, §99.31(a)(6)(iii)(C), and must—

  1. Spiytepupos, p, nd dution oftestuynd teinomtion o be dislosd. 
  2. Rquietheorganizationto useIom dtion ods onyto mt thepupose(s) ofthestuys sttd in theittn gmnt.
  3. Rquietheorganizationto ondut thestuyin amnnrtht dos not pmit the psonl idntiition ofpnts nd studnts yoeothrthnpnttivs of theorganization ith lgitimteintsts.  his pilymns tht theorganization should llowintnl ss to Iom dution ods onytoindividuls ith and to kno, nd tht theorganization should tkestps to mintin theonidntiliyftheIom dtion ods ll sts fthestu.
  4. Rquietheorganizationto dstyll Iom ution ds hn the inomtion is no lonrndd rthepupos orhih thestuysondutd, nd spiythetimeod in hih theinomton must bedstd.

 

(For more information on drafting written agreements, see Guidance for Reasonable Methods and Written Agreements by FPCO and PTAC’s Data Sharing Agreement checklist.)

No.  Absent the prior, written consent from the parent or eligible student, FERPA prohibits PII from education records from being published in a way that would allow individual students and their parents to be identified.  The organization conducting the study can use PII from education records to conduct the study for the school, but results must be published in a way that protects the privacy and confidentiality of the individuals involved. For example, when publishing data tables, the organization may need to use cell suppression or other methods of disclosure avoidance so that students cannot be identified through small numbers displayed in table cells.  Additional information on disclosure avoidance methods is available on PTAC’s website at http://ptac.ed.gov/toolkit.  

Yes.  FERPA’s audit or evaluation exception allows an LEA to designate a community-based organization as its authorized representative and disclose PII from education records without consent of parents or eligible students to audit or evaluate a Federal- or State-supported education program, or to enforce or comply with Federal legal requirements that relate to those education programs (audit, evaluation, or enforcement or compliance activity).  See 34 CFR § 99.35.  (This provision does not apply to individual schools that are not considered local educational authorities under State or local law.)  

Yes.  The LEA must use a written agreement to designate the community-based organization as its authorized representative.  The written agreement must include certain mandatory components as described in § 99.35(a)(3)(ii) of the regulations.  The specific policies and procedures outlined in the agreement should be consistent with FERPA and all other applicable laws.)  For additional information, see § 99.35 of the regulations, Guidance for Reasonable Methods and Written Agreements by FPCO, and PTAC’s Data Sharing Agreement checklist.

Generally no.  The audit or evaluation by an community-based organization of its own program (i.e., to determine whether or not the organization’s program is effective) in most cases would not be permitted under the audit or evaluation exception because the audit or evaluation exception only permits the audit or evaluation of Federal- or State-supported education programs, which FERPA defines as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution.    

Yes.  Before the LEA discloses PII from education records to a community-based organization designated as an authorized representative, the LEA is required to use “reasonable methods” to ensure to the greatest extent practicable that the community-based organization is FERPA-compliant. This specifically means ensuring that the community-based organization:

  1. Uses PII from education records only to carry out an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with, Federal legal requirements related to these programs.  The LEA should make sure that the proposed audit or evaluation is legitimate, and require in the written agreement that the community-based organization use the PII from education records only for that audit, evaluation, or enforcement or compliance activity. 
  2.  Protects the PII from education records from further disclosures or other uses, except as authorized by the LEA in accordance with FERPA. The agreement must specify that the community-based organization may not further disclose the PII from education records, unless authorized.
  3.  Destroys the PII from education records when no longer needed for the audit, evaluation, or enforcement or compliance activity.  The agreement must specify that the community-based organization is required to destroy the PII from education records when it is no longer needed and specify the time period in which the PII must be destroyed.  See 34 CFR § 99.35(a)(2).

If the community-based organization misuses or inappropriately rediscloses PII from education records, the school or LEA should immediately take steps to address and mitigate any harm or damage caused by the violation.  The LEA or school should evaluate its options under the penalty and termination provisions of its written agreement, contract, or arrangement with the community-based organization and check any relevant State or local laws.  Depending on the severity of the circumstance, the LEA or school may decide to terminate its relationship with the community-based organization and require the organization to destroy or return the education records to the school or LEA.  

While FERPA does not require that you notify us, we recommend that you contact FPCO if a community-based organization violates FERPA and provide us with information concerning the violation and any actions that you have taken.  FPCO has the authority to impose what is informally known as “the five-year rule ban” against the community-based organization if FPCO determines that it has violated certain provisions under FERPA.  The five-year rule means that FPCO can instruct the originating LEA or school to not provide the community-based organization with further access to PII from students’ education records for a minimum period of five years.  FPCO may impose a longer period of time in which the community-based organization may not have access to PII.  The five-year rule ban applies regardless of whether the community-based organization is a recipient of Department funds.  For more information on penalties for FERPA violations, see 34 CFR § 99.67.

No.  Regardless of whether the community-based organization received the PII under the school official, studies, or audit/evaluation exception, the answer is the same – the community-based organization may not redisclose it unless such redisclosure is on behalf of the disclosing entity and is consistent with FERPA.  (34 CFR § 99.33).  If further redisclosure is contemplated, we recommend that provisions addressing authorized redisclosures be included in any agreement with the community-based organization.

A community-based organization may make further disclosures of PII from education records if the disclosure of the information is on behalf of the educational agency or institution, the disclosure meets one of the exceptions to consent (listed in § 99.31), and the educational agency or institution has complied with any applicable recordkeeping requirements in § 99.32(b).  Thus, any community-based organization receiving PII from a school or LEA may only use it for the purposes for which the disclosure was made, and is not permitted to further disclose it to other parties unless authorized to do so by the school or LEA under one of the exceptions to consent. 

Yes.  Generally when a school or LEA discloses without consent PII from education records to a community-based organization, with the exception of disclosures made under the “school official” exception, the disclosure must be recorded.  FERPA require schools to record all requests for access to, and all disclosures of, PII from the education records of each student, except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the parent or eligible student.  See 34 CFR § 99.32(d).  Schools and LEAs must maintain these records with the student’s education records for as long as the student’s records are maintained.  The recorded information must include the parties who have requested or received PII and their legitimate interests in requesting or obtaining the information. Parents and eligible students have a right to inspect and review the record of disclosures.  See 34 CFR § 99.32 for the full list of recordation requirements.

Yes, if certain conditions apply.  A law enforcement unit official, just like any other employee of the school, may generally be considered a school official with a legitimate educational interest if the employee needs to see education records in order to perform his or her professional duties.  In several questions below, we discuss how the school official provision applies in situations in which the law enforcement unit is not comprised of school employees.

Yes, if certain conditions are met.  FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party: 

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records; 
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records. 

As indicated in the listing above, local police officers acting as school officials may only use PII from education records for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of the students.  See §§ 99.31(a)(1)(i)(B)(3) and 99.33(a)(2).  In addition, these officers are subject to FERPA’s redisclosure requirements in § 99.33(a).  This means that a local police officer who is acting as a “school official” under FERPA may not redisclose PII from education records to others, including other employees of his or her police department who are not acting as school officials without consent, unless the disclosure fits within one of the exceptions to consent in FERPA.

Other exceptions may also permit police officers or other outside parties access to PII from students’ education records without consent, such as the subpoena or court order exception, the health or safety emergency exception, or the directory information exception. If the directory information exception is used, the school should verify that the parent or eligible student in question has not opted out of the disclosure of directory information.  

A threat assessment team is a group of officials that convene to identify, evaluate, and address threats or potential threats to school security.  Threat assessment teams review incidents of threatening behavior by students (current and former), parents, school employees, or other individuals.  These teams are more common in university settings but are also being instituted in K-12 schools.

Some schools may need assistance in determining whether a health or safety emergency exists in order to know whether a disclosure may be made under FERPA’s health or safety emergency provision.  Accordingly, members of a threat assessment team might include officials who can assist in making such decisions, such as school principals, counselors, school law enforcement unit officials, as well as outside medical and mental health professionals and local law enforcement officers.

The booklet, Threat Assessment in Schools:  A Guide to Managing Threatening Situations and to Creating Safe School Climates, jointly issued by the Department and the U.S. Secret Service, includes guidance on forming a threat assessment team on pages 37-38.  Information on establishing a threat assessment program, including a link to this booklet and other helpful resources for emergency situations, can be found on the Department’s Web site:  http://www2.ed.gov/admins/lead/safety/edpicks.jhtml?src=In

 See also “Guide for Developing High-Quality School Emergency Operations Plans”:   http://rems.ed.gov/docs/REMS_K-12_Guide_508.pdf

Yes.  Under FERPA, a school or school district may disclose PII from education records without consent to threat assessment team members who are not employees of the school or school district if they qualify as “school officials” with “legitimate educational interests.”

In establishing a threat assessment team, the school must follow the FERPA provisions in § 99.31(a)(1)(i)(B) concerning outsourcing this function if team members will be privy to PII from students’ education records.  While not a requirement of FERPA, one way to ensure that members of the team do not redisclose PII obtained from education records would be to have a written agreement with each of the team members specifying their requirements and responsibilities. 

Schools are reminded that members of the threat assessment team may only use PII from education records for the purposes for which the disclosure was made, i.e., to conduct threat assessments, and must be subject to FERPA’s redisclosure requirements in § 99.33(a).  For example, a representative from the city police who serves on a school’s threat assessment team generally could not give the police department any PII from a student’s education records to which he or she was privy as a member of the team.  However, if the threat assessment team determines that a health or safety emergency exists, then the police officer may disclose, on behalf of the school, PII from a student’s education records to appropriate officials under the health or safety emergency exception under §§ 99.31(a)(10) and 99.36, as discussed below.

Under FERPA, “law enforcement unit” means any individual, office, department, division, or other component of a school, such as a unit of commissioned police officers or noncommissioned security guards, that is officially authorized or designated by that school or school district to (1) enforce any local, State, or Federal law, or refer to appropriate authorities a matter for enforcement of any local, State, or Federal law against any individual or organization other than the agency or institution itself; or (2) maintain the physical security and safety of the agency or institution.  See 34 CFR § 99.8(a)(1). 

Schools vary in who they authorize or designate to be their law enforcement unit, usually depending upon their size and resources.  Some larger school districts have their own fully equipped police units, while others have smaller security offices.  Other schools designate a vice principal or other school official to act as the law enforcement unit officer.  And other schools may utilize local police officers and SROs as their law enforcement officials.   

“Law enforcement unit records” are those records that are:  (1) created by a law enforcement unit; (2) created for a law enforcement purpose; and (3) maintained by the law enforcement unit.  See 34 CFR § 99.8(b)(1). 

Law enforcement unit records are not protected by FERPA because they are specifically excluded from the definition of “education records” and thus, from the privacy protections afforded to parents and eligible students by FERPA.  Therefore, investigative reports and other records created and maintained by these law enforcement units that meet this definition are not considered “education records” subject to FERPA. 

Accordingly, under FERPA, schools may disclose information from law enforcement unit records to anyone, including outside law enforcement authorities, without consent from parents or eligible students.  (Schools should be aware of any other applicable policies or laws, including federal civil rights laws, regarding any requirements for disclosure or restrictions of disclosure of law enforcement unit records.)  Law enforcement unit records do not include: (1) records created by a law enforcement unit for a law enforcement purpose that are maintained by a component of the educational agency or institution other than the law enforcement unit (such as a principal or other school official); or (2) records created and maintained by a law enforcement unit exclusively for a non-law enforcement purpose, such as a disciplinary action or proceeding conducted by the educational agency or institution.  See 34 CFR § 99.8(b)(2).  

In order for law enforcement unit officials to be considered school officials, they must meet the criteria for who constitutes a school official that are set forth in the school’s or LEA’s annual notification to parents and eligible students of their rights under FERPA.  See § 99.7(a)(3)(iii).  This notification must be distributed by a school or LEA every year through a forum that is likely to be viewed by parents and eligible students, such as a student handbook, school website, a direct letter to parents, or a combination of methods, and must inform parents and eligible students of their rights under FERPA.  (Please see http://www2.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html for a model notification.)  Schools must also determine that the school official’s interest in accessing the education records meets the criteria for legitimate educational interests, as set forth in the school or LEA’s annual notification of FERPA rights.  Under these notifications, school official typically would have a “legitimate educational interest” if the official needs to review an education record in order to fulfill his or her professional responsibility.

Having law enforcement unit officials who are “school officials” with a “legitimate educational interest” will permit the school to non-consensually disclose PII from students’ education records to its law enforcement unit officials so that they may perform their professional duties and assist with school safety matters.  For example, if a student is expelled from school and barred from campus, the principal could disclose the student’s disciplinary report to the law enforcement unit officials so that they would know that the student is not supposed to be on campus.  The information from education records that is provided to the school’s law enforcement unit officials remains subject to FERPA and may be further disclosed by that unit (e.g., to the local police department) only with consent or in accordance with the exceptions to the consent requirement at § 99.31.  Because the school’s law enforcement unit may not redisclose PII from students’ education records that it receives, except in compliance with FERPA, it is advisable for law enforcement units to maintain law enforcement unit records separately from education records.  

The manner in which a school establishes its law enforcement unit is outside the scope of FERPA.  Accordingly, FERPA does not require a school to use only employees to staff its law enforcement unit.  Local police officers and other law enforcement personnel employed by local or State authorities also may serve as the “law enforcement unit” of an educational agency or institution.  

Not automatically.  These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they: 

  1. Perform an institutional service or function for which the agency or institution would otherwise use employees;
  2. Are under the direct control of the agency or institution with respect to the use and maintenance of education records; 
  3. Are subject to the requirements in § 99.33(a) that the PII from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and 
  4. Meet the criteria specified in the school or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Yes.  If the school or school district has a directory information policy under FERPA that permits this disclosure, then the directory information of those students whose parents (or the eligible students) have not opted out of such a disclosure may be disclosed. 

The disclosure of appropriately-designated directory information under the conditions set forth in § 99.37 is one of the exceptions to FERPA’s general consent requirement (§§ 99.31(a)(11) and 99.37).  FERPA defines “directory information” as information in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed.  See § 99.3 "Directory information."  Directory information may include the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended.  Id.

A school may disclose directory information if it has given public notice of the types of information which it has designated as "directory information," the parent or eligible student’s right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as "directory information.   See § 99.37(a).  

No.  As noted previously, an SRO typically serves as an on-site law enforcement officer and as a liaison with the local police or sheriff’s department.  An SRO also works with teachers and school administrators to promote school safety and to help ensure physical security.  An SRO may be designated by the school as a “law enforcement unit” official under FERPA (§ 99.8).  However, in order for a school to disclose PII from education records to an SRO, the SRO must be considered a “school official” under FERPA in accordance with § 99.31(a)(1)(i)(B) concerning outsourcing.  A school may only non-consensually disclose PII from students’ education records to its law enforcement unit if those individuals in the law enforcement unit meet the requirements set forth in FERPA’s school official exception or if some other FERPA exception to the general consent rule applies. 

A school must have direct control over an SRO’s maintenance and use of education records in providing SRO services in order for the SRO to be considered a school official.  Further, under the school official exception (as well as any FERPA exception to consent), SROs may only use the PII from education records for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of the students.  See §§ 99.31(a)(1)(i)(B)(3) and 99.33(a)(2).  In addition, SROs are subject to the redisclosure requirements of § 99.33(a).  This means that an SRO who is serving as a “school official” under FERPA may not disclose PII from education records to others, including other employees of his or her local police department who are not acting as school officials, without consent unless the redisclosure fits within one of the exceptions to FERPA’s consent requirement.

FERPA permits schools to non-consensually disclose PII from education records to State and local officials or other authorities if the disclosure is allowed by a State law adopted after November 19, 1974, and if the disclosure concerns the juvenile justice system and its ability to serve, prior to adjudication, the student whose records are disclosed.  See §§ 99.31(a)(5) and 99.38.  The officials and authorities to whom such information is disclosed must certify in writing to the school that the information will not be provided to any other party, except as provided for under State law without written consent.  

There are exceptions to consent in FERPA that permit, but do not require, local educational agencies (LEAs) and schools to disclose personally identifiable information (PII) from education records under certain conditions without the written consent of the parent or eligible student.  Congress amended FERPA to add an additional exception to the general requirement of consent in FERPA that permits LEAs and schools to disclose education records of students placed in foster care, without consent of the parent or eligible student, to an agency caseworker or other representative of a State or local child welfare agency (CWA) or tribal organization authorized to access a student’s case plan when such agency or organization is legally responsible, in accordance with State or tribal law, for the care and protection of the student. 

To summarize, a “case plan” is defined at 42 U.S.C. 675(1) as a written document that must include a number of specified items that, among other things, must address both the proper care of children in foster care placement.  The plan also addresses the services that are provided to children in foster care placement, their parents, and their foster parents.  The plan also includes, but is not limited to, ensuring the educational stability of children in foster care. 

Therefore, the amendment to FERPA only applies to those children for whom the CWA or tribal organization is legally responsible, in accordance with State or tribal law, for the care and protection of a child in foster care placement.  FERPA would not permit LEAs and schools and  to disclose PII from education records to the CWA or tribal organization for children who are not in foster care placement, even if those children  are receiving other services through the CWA or tribal organization (e.g., vocational and skill assessments, training, tutoring, educational services, family services, and community enrichment activities). 

Yes.  Once a student reaches 18 years old or attends a postsecondary institution at any age, the student becomes an eligible student and the rights under FERPA transfer to that student.  FERPA governs the disclosure of PII from the education records of an eligible student in the same fashion as it governs the disclosure of PII from the education records of a student under the age of 18.  As a practical matter, most States consider an individual who has reached the age of 18 to be an adult; therefore, the individual would generally not remain in foster care placement.  However, if under State or tribal law an individual is who is 18 or older or is attending a postsecondary institution  remains in a foster care placement, then the educational agency or institution may choose to disclose education records to the CWA that is legally responsible for the care and protection of the eligible student without the consent of the eligible student.

No.  Congress created a new exception to FERPA under 20 U.S.C. § 1232g(b)(1)(L) that permits, but does not require, LEAs and schools to disclose PII from the education records of a student who is in foster care placement to CWAs or tribal organizations.  Further, under FERPA, an LEA or school may choose to disclose all or part of the education records it maintains on a student who is in foster care placement.  We encourage LEAs and schools to disclose the information from education records that a child’s welfare caseworker would need to effectively implement a child’s case plan and to ensure the child’s education needs are met.

Yes.  FERPA requires recordkeeping on requests for access to and disclosures of education records.  See § 99.32.  The FERPA regulations state that an educational agency or institution:  (1) shall maintain a record of each request for access to and each disclosure of PII from the education records of each student; and (2) shall maintain the record with the education records of the student as long as the records are maintained.  Thus, if a school discloses education records to the CWA or tribal organization under this exception, the school must be compliant with the recordation requirements under FERPA and also must include:  (1) the parties who have requested or received PII from the education records, and (2) the legitimate interests the parties had in requesting or obtaining the information.  If an educational agency or institution discloses PII from education records with the understanding that further disclosures will be made, the educational agency’s or institution’s record of disclosure must include the names and legitimate interests of the additional parties.   

Yes, in some cases, FERPA does permit a CWA or tribal organization to redisclose PII from education records for a limited purpose.  Specifically, it provides that redisclosures may only be made to an individual or entity “engaged in addressing the student’s education needs” and authorized by such agency or organization to receive such disclosure and such disclosure must be consistent with the State or tribal laws applicable to protecting the confidentiality of a student’s education records.  20 U.S.C. § 1232g(b)(1)(L).

No.  FERPA does not require the CWA or tribal organization to record any redisclosure of PII from education records that it may make to an individual or entity, such as a contractor providing services to address a student’s education needs.  However, if the CWA or tribal organization does redisclose PII from an education record on a student in foster care placement to anyone other than an agency- or organization-employed caseworker or other representative who has the right to access a student’s case plan, the Department recommends, as a good data management practice, that the CWA or tribal organization record the redisclosure and inform the school of the redisclosure for record keeping purposes. 

No.  FERPA is clear that the PII from education records disclosed to the CWA or tribal organization under the 2013 exception to FERPA must only be used to address the educational needs of children in foster care placement. 

No.  The PII from education records disclosed to the CWA or tribal organization under the exception in FERPA must only be used for the purpose of addressing the education needs of children in foster care placement.  Thus, the PII from education records disclosed under the exception to FERPA may not be used for any other purpose, including to audit or evaluate a Federal- or State-supported education program.  

When a State educational agency (SEA) or LEA discloses PII from education records to a CWA or tribal organization under the exception in FERPA, may the SEA or LEA and the CWA or tribal organization collaborate to conduct an audit or evaluation of an education program or child welfare program using the education records disclosed under the that exception? 

Some of the FERPA exceptions to consent require the recipient of education records to destroy PII from education records when it is no longer needed; however, the 2013 amendment to FERPA did not include any requirement related to the maintenance or destruction of PII from education records disclosed to a CWA or tribal organization.  We recommend that the school or LEA and the CWA or tribal organization work together to determine how long the CWA or tribal organization should maintain the education records disclosed under this exception.  For example, the CWA or tribal organization could use its standard records retention and destruction guidelines or return the records to the disclosing school or LEA.  Further, CWA and tribal organizations should be aware of the potential consequences of improperly redisclosing PII from the education records that are received from the school or LEA under the FERPA exception. 

No.  The written agreement requirements in the FERPA regulations do not apply to a disclosure of PII from education records made under this particular exception by an LEA or school.  However, LEAs and schools may want to consider a written agreement, data sharing agreement, or memorandum of understanding (MOU) with a CWA or tribal organization to ensure that the CWA or tribal organization is aware of its responsibility under FERPA to protect PII from education records from unauthorized disclosure. 

Yes.  FERPA requires that entities to which educational agencies and institutions disclose PII from education records protect that information from further disclosure.  See § 99.33.  Additionally, § 99.67(e) of the FERPA regulations provides that if the Family Policy Compliance Office (FPCO) determines that a third party outside the LEA or school improperly redisclosed PII from education records in violation of § 99.33 of the FERPA regulations, then the educational agency or institution may not provide that third party access to education records for a minimum period of five years.  Thus, if FPCO determines that a CWA or tribal organization improperly redisclosed PII from the education records that it had received from the school or LEA, the school or LEA then would be banned from providing the CWA or tribal organization with access to education records for a minimum of five years.  

Yes.  An SEA may redisclose PII from the education records of students in foster care placement to a CWA or tribal organization that is legally responsible for the care and protection of the student.  The disclosure must be made on behalf of the LEA, as permitted under § 99.33(b)(1) of the FERPA regulations. 

Yes.  Section 99.32(b)(2)(i) of the FERPA regulations generally requires that an SEA that makes further disclosures of PII from education records must record the names of the additional parties (e.g., the CWA) to which it discloses PII from education records on behalf of the LEA and their legitimate interests in the information under FERPA.  However, the SEA would not have to make a record of the redisclosure if the LEA had made a record of the disclosure to the SEA and included in that record the name of the CWA or tribal organization and its legitimate interest (i.e., to permit the CWA or tribal organization to address the education needs of the child) to which the additional disclosure of the education records would be made.

No.  The written agreement requirement of FERPA does not apply to disclosures of education records made under this exception to FERPA’s general consent requirement including the redisclosure of education records by an SEA.  The written agreement requirement applies only in the context of other exceptions to FERPA’s general consent requirement (e.g.., the studies exception and the audit/evaluation exception).  See §§ 99.31(a)(6) and 99.35(a)(3).

FERPA requires that educational agencies and institutions comply with a request by a parent or eligible student for access to education records within a reasonable period of time, but not more than 45 days after receipt of a request.  Some States have laws that may require that parents and eligible students be granted access in a shorter time period.  34 CFR § 99.10(b).

How long does an educational agency or institution have to comply with a request to view records?

FERPA requires that an educational agency or institution respond to reasonable requests for explanations and interpretations of education records.  34 CFR § 99.10(c).

Does a school have to explain or interpret education records when requested by a parent or eligible student?

“Law enforcement unit records” (i.e., records created by a law enforcement unit at the educational agency or institution, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA.  As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent or eligible student’s prior written consent.

Are law enforcement records protected under FERPA?

FERPA requires that a consent for disclosure of education records be signed and dated, specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made.  34 CFR § 99.30.  As such, oral consent for disclosure of information from education records would not meet FERPA’s consent requirements.

What must a consent to disclose education records contain?

Yes, the educational agency or institution may disclose to the court the education records of the student that are relevant for the educational agency or institution to proceed with or defend against the legal action.  34 CFR § 99.31(a)(9)(iii).

May an educational agency or institution disclose education records if they are involved in litigation against a parent of student or an eligible student?

While FERPA does not specifically prohibit a school from disclosing personally identifiable information from a student’s education records over the telephone, it does require that the school use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the school discloses personally identifiable information from education records.   34 CFR § 99.31(c).

May an educational agency or institution disclose information over the phone?

Records and information are de-identified once all personally identifiable information has been removed including but not limited to any information that, alone or in combination is linkable to a specific student that a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

What constitutes de-identified records and information?

If the education records of a student contain personally identifiable information on other students, the parent or eligible student may inspect or review or be informed of only the specific information about the student in question.    34 CFR § 99.12.

May parents or eligible students be provided access to education records that contain information on more than one student?

No.  FERPA does not generally permit a school to disclose a student’s GPA without the parent’s or eligible student’s consent.

Is it permissible to release GPA to honors organizations without consent?

A teacher should check with their school administration to see what has been defined as directory information.  As long as using the application would not require disclosing more than directory information and none of the students have opted out of directory information, it would not be a violation of FERPA.

I want to use online tool or application as part of my course. However, I am worried that it is a violation of FERPA. What should I do?

Education records that have been appropriately designated as "directory information" by the educational agency or institution may be disclosed without prior consent.  See 34 CFR §§ 99.31(a)(11) and 99.37.  FERPA defines directory information as information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.  34 CFR § 99.3. 

FERPA provides that a school may disclose directory information if it has given public notice of the types of information which it has designated as "directory information," the parent or eligible student’s right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as "directory information."  34 CFR § 99.37(a).  A school is not required to inform former students or the parents of former students regarding directory information or to honor their request that directory information not be disclosed without consent.  34 CFR § 99.37(b).  However, if a parent or eligible student, within the specified time period during the student's last opportunity as a student in attendance, requested that directory information not be disclosed, the school must honor that request until otherwise notified.

May an educational agency or institution disclose directory information without prior consent?

Schools may disclose honors and awards received by students if it has properly designated “honors and awards” as a category in its directory information policy and has followed the requirements in FERPA for notifying parents and/or eligible students about the policy.

May schools publish honors and awards received by a student?

A school may not designate a student’s social security number as directory information.  However, directory information may include a student’s user ID or other unique identifier used by the student to access or communicate in electronic systems, but only if the electronic identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the student’s identity, such as a personal identification number (PIN), password, or other factor known or possess only by the student or authorized user.   34 CFR § 99.3 “Directory information”

May a social security number or other student identification number be listed as directory information?

FERPA contains an exception to its general consent rule under which an educational agency or institution may disclose personally identifiable information from education records without consent to organizations conducting studies for, or on its behalf.  Studies must be only for the purpose of:  developing, validating, or administering predictive tests; administering student aid programs; or improving instruction.  A written agreement with the organization is required specifying the purposes of the study and the use and destruction of the information.   34 CFR § 99.31(a)(6)

May an educational agency or institution disclose personally identifiable information from students’ education records to third parties for the purpose of conducting a study on its behalf?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent. The mandatory elements of that agreement vary slightly between the two exceptions.  See FPCO’s  Guidance for Reasonable Methods and Written Agreements for more information regarding the mandatory elements for written agreements.

Must an educational agency or institution have a written agreement to disclose PII from education records without consent for the purposes of conducting a study or an audit or evaluation of an education program?

FERPA permits schools to disclose PII from students’ education records, without consent, to authorized representatives of State and local educational authorities, the Secretary of Education, the Comptroller General of the United States, and the Attorney General of the United States for specified purposes.  Disclosures may be made under this exception as necessary in connection with the audit or evaluation of Federal or State supported education programs, or in connection with the enforcement of Federal legal requirements that relate to those program.   34 CFR §§ 99.31(a)(3) and 99.35.

May an educational agency or institution disclose personally identifiable information from students’ education records for the purpose of a specified audit, evaluation, or for compliance and enforcement purposes under FERPA?

“Education program” is defined as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution.   34 CFR § 99.3 “education program.”          

What is an “education program”?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent. The mandatory elements of that agreement vary slightly between the two exceptions.  See FPCO’s  Guidance for Reasonable Methods and Written Agreements for more information regarding the mandatory elements for written agreements.

Must an educational agency or institution have a written agreement to disclose PII from education records without consent for the purposes of conducting a study or an audit or evaluation of an education program?

In some situations, school administrators may determine that it is necessary to disclose PII from a student’s education records to appropriate parties in order to address a health or safety emergency.  FERPA’s health or safety emergency provision permits such disclosures when the disclosure is necessary to protect the health or safety of the student or other individuals.  See 34 CFR §§ 99.31(a)(10) and 99.36.  This exception to FERPA’s general consent requirement is limited to the period of the emergency and generally does not allow for a blanket release of PII from a student’s education records.  Rather, these disclosures must be related to an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease.  See “Addressing Emergencies on Campus” for additional information:  http://www2.ed.gov/policy/gen/guid/fpco/pdf/emergency-guidance.pdf

A threat assessment team is a group of officials that convene to identify, evaluate, and address threats or potential threats to school security.  Threat assessment teams review incidents of threatening behavior by students (current and former), parents, school employees, or other individuals.  These teams are more common in university settings but are also being instituted in K-12 schools.

Some schools may need assistance in determining whether a health or safety emergency exists in order to know whether a disclosure may be made under FERPA’s health or safety emergency provision.  Accordingly, members of a threat assessment team might include officials who can assist in making such decisions, such as school principals, counselors, school law enforcement unit officials, as well as outside medical and mental health professionals and local law enforcement officers.

The booklet, Threat Assessment in Schools:  A Guide to Managing Threatening Situations and to Creating Safe School Climates, jointly issued by the Department and the U.S. Secret Service, includes guidance on forming a threat assessment team on pages 37-38.  Information on establishing a threat assessment program, including a link to this booklet and other helpful resources for emergency situations, can be found on the Department’s Web site:  http://www2.ed.gov/admins/lead/safety/edpicks.jhtml?src=In

 See also “Guide for Developing High-Quality School Emergency Operations Plans”:   http://rems.ed.gov/docs/REMS_K-12_Guide_508.pdf.    

Yes.  Under FERPA, a school or school district may disclose PII from education records without consent to threat assessment team members who are not employees of the school or school district if they qualify as “school officials” with “legitimate educational interests.”

In establishing a threat assessment team, the school must follow the FERPA provisions in § 99.31(a)(1)(i)(B) concerning outsourcing this function if team members will be privy to PII from students’ education records.  While not a requirement of FERPA, one way to ensure that members of the team do not redisclose PII obtained from education records would be to have a written agreement with each of the team members specifying their requirements and responsibilities. 

Schools are reminded that members of the threat assessment team may only use PII from education records for the purposes for which the disclosure was made, i.e., to conduct threat assessments, and must be subject to FERPA’s redisclosure requirements in § 99.33(a).  For example, a representative from the city police who serves on a school’s threat assessment team generally could not give the police department any PII from a student’s education records to which he or she was privy as a member of the team.  However, if the threat assessment team determines that a health or safety emergency exists, then the police officer may disclose, on behalf of the school, PII from a student’s education records to appropriate officials under the health or safety emergency exception under §§ 99.31(a)(10) and 99.36, as discussed below.

Typically, local or State law enforcement officials, public health officials, trained medical personnel, and parents (including parents of an eligible student) are the types of appropriate parties to whom schools may disclose information under this FERPA exception.  An appropriate party under the health or safety emergency exception to FERPA’s general consent requirement is a party whose knowledge of such information is necessary to protect the health or safety of the student or other persons.  

The phrase “articulable and significant threat” means that a school official is able to explain, based on all the information available at the time, what the significant threat is under § 99.36 when he or she makes and records the disclosure.  For instance, if a school official believes that a student poses a significant threat, such as a threat of substantial bodily harm to any person, including to the student, then, under FERPA, the school official may disclose PII from the student’s education records without consent to any person whose knowledge of the information will assist in protecting a person from that threat.  This is a flexible standard under which school administrators may bring appropriate resources to bear on the situation.  If, based on the information available at the time of the determination, there is a rational basis for the educational agency’s or institution’s decisions about the nature of the emergency and the appropriate parties to whom the information should be disclosed, the Department will not substitute it’s judgment for that of the school in evaluating the circumstances and making its determination.  

No.  Disclosures made under the health or safety emergency provision must be “in connection with an emergency,” which means it must be related to an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease. 

Yes.  When an educational agency or institution makes a disclosure under the health or safety exception, it must record in the student’s education records the articulable and significant threat that formed the basis for the disclosure, and the parties to whom the information was disclosed.  See § 99.32(a)(5). 

Yes.  Under FERPA, a school may share PII from education records with school officials within the school whom the school has determined to have legitimate educational interests in the behavior of a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community.  See § 99.36(b)(2) and Q&A 9 and § 99.36(b)(1) and (2). 

The school may also disclose PII from education records about a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community, to school officials at another school who have been determined to have legitimate educational interests in the behavior of the student, if deemed necessary. 

For instance, if a school official knows that a student, who has been disciplined for bringing a gun or knife to school or threatened to hurt students and/or teachers, is planning to attend a school-sponsored activity at another high school, FERPA would allow that school official to notify school officials at the other high school who have been determined to have legitimate educational interests in the behavior of the student.  See § 99.36(b)(3). 

An educational agency or institution must make this determination on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of a student or others.  If the school determines that there is an articulable and significant threat to the health or safety of a student or other individuals and that a third party needs PII from education records to protect the health or safety of the student or other individuals, it may disclose that information to appropriate parties without consent. 

A “school official”  includes a teacher, school principal, president, chancellor, board member, trustee, registrar, counselor, admissions officer, attorney, accountant, human resources professional, information systems specialist, and support or clerical personnel.  A contractor, consultant, volunteer, or other party to whom a school or institution has outsourced institutional services or functions may also be considered a “school official” provided that they are performing an institutional service or function for which the agency would otherwise use employees and is under the direct control of the agency or institution with respect to the use and maintenance of education records.  See 34 CFR § 99.31(a)(1)(i)(B).

Who is a “school official” under FERPA?

No.  FERPA permits an educational agency or institution to disclose, without consent, personally identifiable information from students’ education records only to school officials within the educational agency or institution that the educational agency or institution has determined to have legitimate educational interests in the information. 34 CFR § 99.31(a)(1).  Generally, a school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.

Under FERPA, may an educational agency or institution disclose education records to any of its employees without consent?

An educational agency or institution must use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests. An educational agency or institution that does not use physical or technological access controls must ensure that its administrative policy for controlling access to education records is effective and that it remains in compliance with the legitimate educational interest requirement.

What must educational agencies or institutions do to ensure that only school officials with a legitimate educational interest see protected education records?

FERPA applies to the disclosure of education records and of PII from education records that are maintained by the school.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation, rather than from the student’s education records.  For example, if a teacher overhears a student making threatening remarks to other students, FERPA does not protect that information from disclosure.  Therefore, a school official may disclose what he or she overheard to appropriate authorities, including disclosing the information to local law enforcement officials, school officials, and parents.

The general rule regarding personal knowledge and observations does not apply where a school official learns of information about a student through his or her official role in making a determination about the student and the determination is maintained in an education record.  For example, under FERPA a principal or other school official who took official action to suspend a student may not disclose that information, absent consent or an exception under § 99.31 that permits the disclosure.

Yes.  FERPA states a school may disclose education records, without parental consent (§ 99.31(a)(2)), to another school in which a student seeks or intends to enroll, subject to conditions set forth in § 99.34.  This exception to FERPA’s general consent requirement also permits a school to disclose education records when a student is being placed in a juvenile justice facility that is considered a school. 

Section 4155(b) of the Elementary and Secondary Education Act (ESEA), as amended, 20 U.S.C. § 7165(b), required, in accordance with FERPA, each State receiving funds under the ESEA to provide an assurance to the Secretary that it had “a procedure in place to facilitate the transfer of disciplinary records, with respect to a suspension or expulsion, by local educational agencies to any private or public elementary school or secondary school for any student who is enrolled or seeks, intends, or is instructed to enroll, on a full- or part-time basis, in the school.”  LEAs and schools, therefore, should include a notice in their annual notification of rights under FERPA that they forward education records to other schools that have requested the records and in which the student seeks or intends to enroll (§§ 99.7, 99.31(a)(2), and 99.34(a)(1)(ii)).  Unless the school or LEA includes this notice in their annual notification of FERPA rights or the parent or eligible student initiates the transfer of records, the school or LEA otherwise would be required to make a reasonable effort to notify the parent or eligible student of the disclosure at the last known address of the parent or eligible student.  (See FPCO’s model notification of rights:  http://www2.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html.)  

Yes, a postsecondary institution may disclose only the final results of the disciplinary proceeding to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense.  In disclosures to the victim, the institution may disclose the final results of the disciplinary proceeding regardless of whether the institution concluded a violation was committed.

May a postsecondary institution disclose information about a disciplinary proceeding to the victim of a crime of violence or a non-forcible sex offense?

Yes.  FERPA permits disclosure of education records without consent in compliance with a lawfully issued subpoena or judicial order.  See § 99.31(a)(9)(i) and (ii).  However, a school must generally make a reasonable effort to notify the parent or eligible student of the subpoena or judicial order before complying with it in order to allow the parent or eligible student the opportunity to seek protective action, unless certain exceptions apply.   Exceptions to the requirement of prior notification apply to:  (1) a federal grand jury subpoena or other subpoena issued for a law enforcement purpose if the court or other issuing agency has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed; (2) an ex parte order obtained by the United States Attorney General (or designee not lower than Assistant Attorney General) concerning investigations or prosecutions of an act of terrorism or other specified offenses.  See § 99.31(a)(9)(ii).   For example, if a school received a law enforcement subpoena that requested information on a student suspected of selling drugs, it would not have to make an effort to notify the parent or eligible student if the court or other issuing agency ordered that the existence or the contents of the subpoena or information furnished in response to the subpoena not be disclosed.  Additionally, when a parent is a party to a court proceeding involving child abuse and neglect (as defined in section 3 of the Child Abuse Prevention and Treatment Act (42 U.S.C. 5101 note)) or dependency matters, and the order is issued in the context of that proceeding, additional notice to the parent by the educational agency or institution is not required, the school does not have to notify the parent. 

Yes, an educational institution or agency is permitted to disclose student records to the extent accrediting organizations need the records in order to carry out their accrediting function.

Is an educational institution or agency permitted to disclose student records without consent to accrediting organizations?

General (9)

The Family Educational Rights and Privacy Act (FERPA) is a federal law that affords parents the right to have access to their children’s education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records.  When a student turns 18 years old, or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student (“eligible student”). The FERPA statute is found at 20 U.S.C. § 1232g and the FERPA regulations are found at 34 CFR Part 99.

What is FERPA?

No, spouses of eligible students have no rights under FERPA.  Before a college or university discloses information from a student’s education records to his or her spouse, the student would have to provide written consent.

Does a spouse of an eligible student have rights with respect to that student’s education records?

Exempted from the definition of education records are those records which are kept in the sole possession of the maker of the records and are not accessible or revealed to any other person except a temporary substitute for the maker of the records. Once the contents or information recorded in sole possession records is disclosed to any party other than a temporary substitute for the maker of the records, those records become education records subject to FERPA. Generally sole possession records are of the nature to serve as a “memory jogger” for the creator of the record. For example, if a school official has taken notes regarding telephone or face to face conversations, such notes could be sole possession records depending on the nature and content of the notes.

Click to see related scenario

What records are exempted from FERPA?

FERPA generally prohibits the nonconsensual disclosure of information derived from education records, except in certain specified circumstances. One of these exceptions permits the nonconsensual disclosure of information derived from education records to that student's parent if the student is a dependent student. Further, neither the age of the student nor the parent's status as custodial parent is relevant to determining whether disclosure of information from the education records of eligible students to a parent without written consent is permissible under FERPA. If a student is claimed as a dependent by either parent for tax purposes, then either parent may have access under this provision.

Click to see related scenario

Can parents view a child’s post-secondary education record?

Yes.  Educational agencies and institutions must annually notify parents and eligible students of their rights under FERPA.  Specifically, schools must notify parents and eligible students of the right:  to inspect and review education records and the procedures to do so; to seek amendment of records the parent or eligible student believes are inaccurate and the procedures to so do; to consent to disclosures of education records, except to the extent that FERPA authorizes disclosure without consent; and to file a complaint with FPCO concerning potential violations.   Postsecondary institutions are only required to notify eligible students of their rights under FERPA.

Source: 34 CFR § 99.7

Are educational agencies and institutions required to notify parents and eligible students of their rights under FERPA?

Yes.  FERPA does not require schools to create education records nor does it require schools to maintain education records, unless there is an outstanding request by a parent or eligible student to inspect and review the records.

Source: 34 CFR § 99.10(e)

Does an educational agency or institution have discretion over what education records it decides to create and keep?

FERPA applies to educational agencies or institutions that receive funds from programs administered by the U.S. Department of Education.  By “educational agencies or institutions” we mean public schools, school districts (or “local educational agencies” (LEAs)), and postsecondary institutions, such as colleges and universities.  Private and parochial schools at the elementary and secondary level generally do not receive such funding and are, therefore, not subject to FERPA. See: FERPA 101 Webinar

To which educational agencies or institutions does FERPA apply?

Education records are records that are directly related to a student and that are maintained by an educational agency or institution or a party acting for or on behalf of the agency or institution.  These records include but are not limited to grades, transcripts, class lists, student course schedules, health records (at the K-12 level), student financial information (at the postsecondary level), and student discipline files.  The information may be recorded in any way, including, but not limited to, handwriting, print, computer media, videotape, audiotape, film, microfilm, microfiche, and e-mail.

Source: 34 CFR § 99.2 “Education Records” and “Record”

What is an Education Record?

Subject to certain exceptions addressed below, schools must maintain a record of each request for access to and each disclosure of PII from the education records of each student, as well as the names of State and local educational authorities and federal officials and agencies listed in § 99.31(a)(3) that may make further disclosures of PII from students’ education records without consent.  The school must maintain the record with the education records of the student as long as the education records are maintained.      

For each request or disclosure, the record must include:  1) the parties who have requested or received PII from the education records; and, 2) the legitimate interest the parties had in requesting or obtaining the information (i.e., under which exception to consent was the disclosure made).  The school must record additional information whenever it discloses PII from a student’s education records in connection with a health or safety emergency.  There are other requirements that relate to recording further disclosures made by State and local authorities and federal officials and agencies listed under § 99.31(a)(3) with which schools should be familiar.  See § 99.32(a)(4).

Schools do not have to record disclosures of PII from education records that were made to:  1) the parent or eligible student; 2) a school official under § 99.31(a)(1); 3) a party with written consent from the parent or eligible student; 4) a party seeking directory information; or 5) a party seeking or receiving records in accordance with the provisions in FERPA related to disclosures pursuant to certain types of subpoenas or court orders as set forth in § 99.31(a)(9)(ii)(A)-(C).  See § 99.32(d).

FERPA requires that educational agencies and institutions comply with a request by a parent or eligible student for access to education records within a reasonable period of time, but not more than 45 days after receipt of a request.  Some States have laws that may require that parents and eligible students be granted access in a shorter time period.  34 CFR § 99.10(b).

How long does an educational agency or institution have to comply with a request to view records?

FERPA requires that an educational agency or institution respond to reasonable requests for explanations and interpretations of education records.  34 CFR § 99.10(c).

Does a school have to explain or interpret education records when requested by a parent or eligible student?

“Law enforcement unit records” (i.e., records created by a law enforcement unit at the educational agency or institution, created for a law enforcement purpose, and maintained by the law enforcement unit) are not “education records” subject to the privacy protections of FERPA.  As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent or eligible student’s prior written consent.

Are law enforcement records protected under FERPA?

FERPA requires that a consent for disclosure of education records be signed and dated, specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties to whom the disclosure may be made.  34 CFR § 99.30.  As such, oral consent for disclosure of information from education records would not meet FERPA’s consent requirements.

What must a consent to disclose education records contain?

Yes, the educational agency or institution may disclose to the court the education records of the student that are relevant for the educational agency or institution to proceed with or defend against the legal action.  34 CFR § 99.31(a)(9)(iii).

May an educational agency or institution disclose education records if they are involved in litigation against a parent of student or an eligible student?

While FERPA does not specifically prohibit a school from disclosing personally identifiable information from a student’s education records over the telephone, it does require that the school use reasonable methods to identify and authenticate the identity of parents, students, school officials, and any other parties to whom the school discloses personally identifiable information from education records.   34 CFR § 99.31(c).

May an educational agency or institution disclose information over the phone?

Records and information are de-identified once all personally identifiable information has been removed including but not limited to any information that, alone or in combination is linkable to a specific student that a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

What constitutes de-identified records and information?

If the education records of a student contain personally identifiable information on other students, the parent or eligible student may inspect or review or be informed of only the specific information about the student in question.    34 CFR § 99.12.

May parents or eligible students be provided access to education records that contain information on more than one student?

FERPA permits institutions to disclose, without consent, personally identifiable information from students’ education records when the disclosure is in connection with a student's application for, or receipt of, financial aid.   Disclosures under this exception to consent may be made if the information is necessary for such purposes as to:  (a) determine eligibility for the aid; (b) determine the amount of the aid; (c) determine the conditions for the aid; or (d) enforce the terms and conditions of the aid.

May a postsecondary institution disclose financial aid records without written consent?

FERPA permits a college or university to let parents of students under the age of 21 know when the student has violated any law or policy concerning the use or possession of alcohol or a controlled substance.

Can parents be informed about students' violation of alcohol and controlled substance rules?

FERPA permits a college or university to let parents of students under the age of 21 know when the student has violated any law or policy concerning the use or possession of alcohol or a controlled substance.

Can parents be informed about students' violation of alcohol and controlled substance rules?

FERPA contains an exception to its general consent rule under which an educational agency or institution may disclose personally identifiable information from education records without consent to organizations conducting studies for, or on its behalf.  Studies must be only for the purpose of:  developing, validating, or administering predictive tests; administering student aid programs; or improving instruction.  A written agreement with the organization is required specifying the purposes of the study and the use and destruction of the information.   34 CFR § 99.31(a)(6)

May an educational agency or institution disclose personally identifiable information from students’ education records to third parties for the purpose of conducting a study on its behalf?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent. The mandatory elements of that agreement vary slightly between the two exceptions.  See FPCO’s  Guidance for Reasonable Methods and Written Agreements for more information regarding the mandatory elements for written agreements.

Must an educational agency or institution have a written agreement to disclose PII from education records without consent for the purposes of conducting a study or an audit or evaluation of an education program?

No.  FERPA does not generally permit a school to disclose a student’s GPA without the parent’s or eligible student’s consent.

Is it permissible to release GPA to honors organizations without consent?

A teacher should check with their school administration to see what has been defined as directory information.  As long as using the application would not require disclosing more than directory information and none of the students have opted out of directory information, it would not be a violation of FERPA.

I want to use online tool or application as part of my course. However, I am worried that it is a violation of FERPA. What should I do?

Education records that have been appropriately designated as "directory information" by the educational agency or institution may be disclosed without prior consent.  See 34 CFR §§ 99.31(a)(11) and 99.37.  FERPA defines directory information as information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed.  34 CFR § 99.3. 

FERPA provides that a school may disclose directory information if it has given public notice of the types of information which it has designated as "directory information," the parent or eligible student’s right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as "directory information."  34 CFR § 99.37(a).  A school is not required to inform former students or the parents of former students regarding directory information or to honor their request that directory information not be disclosed without consent.  34 CFR § 99.37(b).  However, if a parent or eligible student, within the specified time period during the student's last opportunity as a student in attendance, requested that directory information not be disclosed, the school must honor that request until otherwise notified.

May an educational agency or institution disclose directory information without prior consent?

No.  Under FERPA, a student may not use his or her right to opt out of directory information disclosures to prevent school officials from identifying the student by name or disclosing the student’s electronic identifier or institutional e-mail address in class.

A student has opted out of directory information and wants to be anonymous on an online course. Are we required to allow the student to take the course anonymously?

Schools may disclose honors and awards received by students if it has properly designated “honors and awards” as a category in its directory information policy and has followed the requirements in FERPA for notifying parents and/or eligible students about the policy.

May schools publish honors and awards received by a student?

A school may not designate a student’s social security number as directory information.  However, directory information may include a student’s user ID or other unique identifier used by the student to access or communicate in electronic systems, but only if the electronic identifier cannot be used to gain access to education records except when used in conjunction with one or more factors that authenticate the student’s identity, such as a personal identification number (PIN), password, or other factor known or possess only by the student or authorized user.   34 CFR § 99.3 “Directory information”

May a social security number or other student identification number be listed as directory information?

No, a school is required to honor the eligible student’s request to opt out of the disclosure of directory information made while the student was in attendance, unless the student rescinds the opt out request.

An eligible student that opted out of directory information has left the school. Now that the student is no longer in attendance, may the school disclose that student’s directory information?

FERPA permits schools to disclose PII from students’ education records, without consent, to authorized representatives of State and local educational authorities, the Secretary of Education, the Comptroller General of the United States, and the Attorney General of the United States for specified purposes.  Disclosures may be made under this exception as necessary in connection with the audit or evaluation of Federal or State supported education programs, or in connection with the enforcement of Federal legal requirements that relate to those program.   34 CFR §§ 99.31(a)(3) and 99.35.

May an educational agency or institution disclose personally identifiable information from students’ education records for the purpose of a specified audit, evaluation, or for compliance and enforcement purposes under FERPA?

“Education program” is defined as any program principally engaged in the provision of education, including, but not limited to, early childhood education, elementary and secondary education, postsecondary education, special education, job training, career and technical education, and adult education, and any program that is administered by an educational agency or institution.   34 CFR § 99.3 “education program.”          

What is an “education program”?

Yes. Both the studies exception and the audit or evaluation exception specifically require that the parties execute a written agreement when disclosing PII from education records without consent. The mandatory elements of that agreement vary slightly between the two exceptions.  See FPCO’s  Guidance for Reasonable Methods and Written Agreements for more information regarding the mandatory elements for written agreements.

Must an educational agency or institution have a written agreement to disclose PII from education records without consent for the purposes of conducting a study or an audit or evaluation of an education program?

In some situations, school administrators may determine that it is necessary to disclose PII from a student’s education records to appropriate parties in order to address a health or safety emergency.  FERPA’s health or safety emergency provision permits such disclosures when the disclosure is necessary to protect the health or safety of the student or other individuals.  See 34 CFR §§ 99.31(a)(10) and 99.36.  This exception to FERPA’s general consent requirement is limited to the period of the emergency and generally does not allow for a blanket release of PII from a student’s education records.  Rather, these disclosures must be related to an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease.  See “Addressing Emergencies on Campus” for additional information:  http://www2.ed.gov/policy/gen/guid/fpco/pdf/emergency-guidance.pdf

A threat assessment team is a group of officials that convene to identify, evaluate, and address threats or potential threats to school security.  Threat assessment teams review incidents of threatening behavior by students (current and former), parents, school employees, or other individuals.  These teams are more common in university settings but are also being instituted in K-12 schools.

Some schools may need assistance in determining whether a health or safety emergency exists in order to know whether a disclosure may be made under FERPA’s health or safety emergency provision.  Accordingly, members of a threat assessment team might include officials who can assist in making such decisions, such as school principals, counselors, school law enforcement unit officials, as well as outside medical and mental health professionals and local law enforcement officers.

The booklet, Threat Assessment in Schools:  A Guide to Managing Threatening Situations and to Creating Safe School Climates, jointly issued by the Department and the U.S. Secret Service, includes guidance on forming a threat assessment team on pages 37-38.  Information on establishing a threat assessment program, including a link to this booklet and other helpful resources for emergency situations, can be found on the Department’s Web site:  http://www2.ed.gov/admins/lead/safety/edpicks.jhtml?src=In

 See also “Guide for Developing High-Quality School Emergency Operations Plans”:   http://rems.ed.gov/docs/REMS_K-12_Guide_508.pdf.    

Yes.  Under FERPA, a school or school district may disclose PII from education records without consent to threat assessment team members who are not employees of the school or school district if they qualify as “school officials” with “legitimate educational interests.”

In establishing a threat assessment team, the school must follow the FERPA provisions in § 99.31(a)(1)(i)(B) concerning outsourcing this function if team members will be privy to PII from students’ education records.  While not a requirement of FERPA, one way to ensure that members of the team do not redisclose PII obtained from education records would be to have a written agreement with each of the team members specifying their requirements and responsibilities. 

Schools are reminded that members of the threat assessment team may only use PII from education records for the purposes for which the disclosure was made, i.e., to conduct threat assessments, and must be subject to FERPA’s redisclosure requirements in § 99.33(a).  For example, a representative from the city police who serves on a school’s threat assessment team generally could not give the police department any PII from a student’s education records to which he or she was privy as a member of the team.  However, if the threat assessment team determines that a health or safety emergency exists, then the police officer may disclose, on behalf of the school, PII from a student’s education records to appropriate officials under the health or safety emergency exception under §§ 99.31(a)(10) and 99.36, as discussed below.

Typically, local or State law enforcement officials, public health officials, trained medical personnel, and parents (including parents of an eligible student) are the types of appropriate parties to whom schools may disclose information under this FERPA exception.  An appropriate party under the health or safety emergency exception to FERPA’s general consent requirement is a party whose knowledge of such information is necessary to protect the health or safety of the student or other persons.  

The phrase “articulable and significant threat” means that a school official is able to explain, based on all the information available at the time, what the significant threat is under § 99.36 when he or she makes and records the disclosure.  For instance, if a school official believes that a student poses a significant threat, such as a threat of substantial bodily harm to any person, including to the student, then, under FERPA, the school official may disclose PII from the student’s education records without consent to any person whose knowledge of the information will assist in protecting a person from that threat.  This is a flexible standard under which school administrators may bring appropriate resources to bear on the situation.  If, based on the information available at the time of the determination, there is a rational basis for the educational agency’s or institution’s decisions about the nature of the emergency and the appropriate parties to whom the information should be disclosed, the Department will not substitute it’s judgment for that of the school in evaluating the circumstances and making its determination.  

No.  Disclosures made under the health or safety emergency provision must be “in connection with an emergency,” which means it must be related to an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease. 

Yes.  When an educational agency or institution makes a disclosure under the health or safety exception, it must record in the student’s education records the articulable and significant threat that formed the basis for the disclosure, and the parties to whom the information was disclosed.  See § 99.32(a)(5). 

Yes.  Under FERPA, a school may share PII from education records with school officials within the school whom the school has determined to have legitimate educational interests in the behavior of a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community.  See § 99.36(b)(2) and Q&A 9 and § 99.36(b)(1) and (2). 

The school may also disclose PII from education records about a student who has been disciplined for conduct that posed a significant risk to the safety or well-being of that student, other students, or other members of the school community, to school officials at another school who have been determined to have legitimate educational interests in the behavior of the student, if deemed necessary. 

For instance, if a school official knows that a student, who has been disciplined for bringing a gun or knife to school or threatened to hurt students and/or teachers, is planning to attend a school-sponsored activity at another high school, FERPA would allow that school official to notify school officials at the other high school who have been determined to have legitimate educational interests in the behavior of the student.  See § 99.36(b)(3). 

An educational agency or institution must make this determination on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of a student or others.  If the school determines that there is an articulable and significant threat to the health or safety of a student or other individuals and that a third party needs PII from education records to protect the health or safety of the student or other individuals, it may disclose that information to appropriate parties without consent. 

A “school official”  includes a teacher, school principal, president, chancellor, board member, trustee, registrar, counselor, admissions officer, attorney, accountant, human resources professional, information systems specialist, and support or clerical personnel.  A contractor, consultant, volunteer, or other party to whom a school or institution has outsourced institutional services or functions may also be considered a “school official” provided that they are performing an institutional service or function for which the agency would otherwise use employees and is under the direct control of the agency or institution with respect to the use and maintenance of education records.  See 34 CFR § 99.31(a)(1)(i)(B).

Who is a “school official” under FERPA?

No.  FERPA permits an educational agency or institution to disclose, without consent, personally identifiable information from students’ education records only to school officials within the educational agency or institution that the educational agency or institution has determined to have legitimate educational interests in the information. 34 CFR § 99.31(a)(1).  Generally, a school official has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibility.

Under FERPA, may an educational agency or institution disclose education records to any of its employees without consent?

An educational agency or institution must use reasonable methods to ensure that school officials obtain access to only those education records in which they have legitimate educational interests. An educational agency or institution that does not use physical or technological access controls must ensure that its administrative policy for controlling access to education records is effective and that it remains in compliance with the legitimate educational interest requirement.

What must educational agencies or institutions do to ensure that only school officials with a legitimate educational interest see protected education records?

FERPA applies to the disclosure of education records and of PII from education records that are maintained by the school.  Therefore, FERPA does not prohibit a school official from releasing information about a student that was obtained through the school official’s personal knowledge or observation, rather than from the student’s education records.  For example, if a teacher overhears a student making threatening remarks to other students, FERPA does not protect that information from disclosure.  Therefore, a school official may disclose what he or she overheard to appropriate authorities, including disclosing the information to local law enforcement officials, school officials, and parents.

The general rule regarding personal knowledge and observations does not apply where a school official learns of information about a student through his or her official role in making a determination about the student and the determination is maintained in an education record.  For example, under FERPA a principal or other school official who took official action to suspend a student may not disclose that information, absent consent or an exception under § 99.31 that permits the disclosure.

Yes.  FERPA states a school may disclose education records, without parental consent (§ 99.31(a)(2)), to another school in which a student seeks or intends to enroll, subject to conditions set forth in § 99.34.  This exception to FERPA’s general consent requirement also permits a school to disclose education records when a student is being placed in a juvenile justice facility that is considered a school. 

Section 4155(b) of the Elementary and Secondary Education Act (ESEA), as amended, 20 U.S.C. § 7165(b), required, in accordance with FERPA, each State receiving funds under the ESEA to provide an assurance to the Secretary that it had “a procedure in place to facilitate the transfer of disciplinary records, with respect to a suspension or expulsion, by local educational agencies to any private or public elementary school or secondary school for any student who is enrolled or seeks, intends, or is instructed to enroll, on a full- or part-time basis, in the school.”  LEAs and schools, therefore, should include a notice in their annual notification of rights under FERPA that they forward education records to other schools that have requested the records and in which the student seeks or intends to enroll (§§ 99.7, 99.31(a)(2), and 99.34(a)(1)(ii)).  Unless the school or LEA includes this notice in their annual notification of FERPA rights or the parent or eligible student initiates the transfer of records, the school or LEA otherwise would be required to make a reasonable effort to notify the parent or eligible student of the disclosure at the last known address of the parent or eligible student.  (See FPCO’s model notification of rights:  http://www2.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html.)  

Yes.  FERPA permits disclosure of education records without consent in compliance with a lawfully issued subpoena or judicial order.  See § 99.31(a)(9)(i) and (ii).  However, a school must generally make a reasonable effort to notify the parent or eligible student of the subpoena or judicial order before complying with it in order to allow the parent or eligible student the opportunity to seek protective action, unless certain exceptions apply.   Exceptions to the requirement of prior notification apply to:  (1) a federal grand jury subpoena or other subpoena issued for a law enforcement purpose if the court or other issuing agency has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed; (2) an ex parte order obtained by the United States Attorney General (or designee not lower than Assistant Attorney General) concerning investigations or prosecutions of an act of terrorism or other specified offenses.  See § 99.31(a)(9)(ii).   For example, if a school received a law enforcement subpoena that requested information on a student suspected of selling drugs, it would not have to make an effort to notify the parent or eligible student if the court or other issuing agency ordered that the existence or the contents of the subpoena or information furnished in response to the subpoena not be disclosed.  Additionally, when a parent is a party to a court proceeding involving child abuse and neglect (as defined in section 3 of the Child Abuse Prevention and Treatment Act (42 U.S.C. 5101 note)) or dependency matters, and the order is issued in the context of that proceeding, additional notice to the parent by the educational agency or institution is not required, the school does not have to notify the parent. 

Yes, a postsecondary institution may disclose only the final results of the disciplinary proceeding to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense.  In disclosures to the victim, the institution may disclose the final results of the disciplinary proceeding regardless of whether the institution concluded a violation was committed.

May a postsecondary institution disclose information about a disciplinary proceeding to the victim of a crime of violence or a non-forcible sex offense?

“Final results” means a decision or determination, made by an honor court or council, committee, commission, or other entity authorized to resolve disciplinary matters within the institution.

What constitutes the final results of a disciplinary proceeding?

The offenses that constitute a crime of violence or a non-forcible sex offense include arson, assault offenses, burglary, criminal homicide (manslaughter by negligence), criminal homicide (murder and nonnegligent manslaughter), destruction/damage/vandalism of property, kidnapping/abduction, robbery, forcible sex offenses, statutory rape, and incest.

What constitutes a crime of violence or a non-forcible sex offense?

Postsecondary institutions may disclose the final results of disciplinary proceedings if the institution has found that the student has violated the institution’s rules or policies in regards to a crime of violence or a non-forcible sex offense.  Furthermore, the institution may not disclose the name of any other student, including a victim or witness, without the prior written consent of that student.

May postsecondary institutions disclose results of disciplinary proceedings?

Yes, an educational institution or agency is permitted to disclose student records to the extent accrediting organizations need the records in order to carry out their accrediting function.

Is an educational institution or agency permitted to disclose student records without consent to accrediting organizations?

Yes, if certain conditions apply.  A law enforcement unit official, just like any other employee of the school, may generally be considered a school official with a legitimate educational interest if the employee needs to see education records in order to perform his or her professional duties.  In several questions below, we discuss how the school official provision applies in situations in which the law enforcement unit is not comprised of school employees.

Yes, if certain conditions are met.  FERPA (§ 99.31(a)(1)(i)(B)) permits schools to outsource institutional services or functions that involve the disclosure of education records to contractors, consultants, volunteers, or other third parties provided that the outside party: 

  1. Performs an institutional service or function for which the agency or institution would otherwise use employees;
  2. Is under the direct control of the agency or institution with respect to the use and maintenance of education records; 
  3. Is subject to the requirements in § 99.33(a) that the personally identifiable information (PII) from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and
  4. Meets the criteria specified in the school or local educational agency’s (LEA’s) annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records. 

As indicated in the listing above, local police officers acting as school officials may only use PII from education records for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of the students.  See §§ 99.31(a)(1)(i)(B)(3) and 99.33(a)(2).  In addition, these officers are subject to FERPA’s redisclosure requirements in § 99.33(a).  This means that a local police officer who is acting as a “school official” under FERPA may not redisclose PII from education records to others, including other employees of his or her police department who are not acting as school officials without consent, unless the disclosure fits within one of the exceptions to consent in FERPA.

Other exceptions may also permit police officers or other outside parties access to PII from students’ education records without consent, such as the subpoena or court order exception, the health or safety emergency exception, or the directory information exception. If the directory information exception is used, the school should verify that the parent or eligible student in question has not opted out of the disclosure of directory information.  

A threat assessment team is a group of officials that convene to identify, evaluate, and address threats or potential threats to school security.  Threat assessment teams review incidents of threatening behavior by students (current and former), parents, school employees, or other individuals.  These teams are more common in university settings but are also being instituted in K-12 schools.

Some schools may need assistance in determining whether a health or safety emergency exists in order to know whether a disclosure may be made under FERPA’s health or safety emergency provision.  Accordingly, members of a threat assessment team might include officials who can assist in making such decisions, such as school principals, counselors, school law enforcement unit officials, as well as outside medical and mental health professionals and local law enforcement officers.

The booklet, Threat Assessment in Schools:  A Guide to Managing Threatening Situations and to Creating Safe School Climates, jointly issued by the Department and the U.S. Secret Service, includes guidance on forming a threat assessment team on pages 37-38.  Information on establishing a threat assessment program, including a link to this booklet and other helpful resources for emergency situations, can be found on the Department’s Web site:  http://www2.ed.gov/admins/lead/safety/edpicks.jhtml?src=In

 See also “Guide for Developing High-Quality School Emergency Operations Plans”:   http://rems.ed.gov/docs/REMS_K-12_Guide_508.pdf

Yes.  Under FERPA, a school or school district may disclose PII from education records without consent to threat assessment team members who are not employees of the school or school district if they qualify as “school officials” with “legitimate educational interests.”

In establishing a threat assessment team, the school must follow the FERPA provisions in § 99.31(a)(1)(i)(B) concerning outsourcing this function if team members will be privy to PII from students’ education records.  While not a requirement of FERPA, one way to ensure that members of the team do not redisclose PII obtained from education records would be to have a written agreement with each of the team members specifying their requirements and responsibilities. 

Schools are reminded that members of the threat assessment team may only use PII from education records for the purposes for which the disclosure was made, i.e., to conduct threat assessments, and must be subject to FERPA’s redisclosure requirements in § 99.33(a).  For example, a representative from the city police who serves on a school’s threat assessment team generally could not give the police department any PII from a student’s education records to which he or she was privy as a member of the team.  However, if the threat assessment team determines that a health or safety emergency exists, then the police officer may disclose, on behalf of the school, PII from a student’s education records to appropriate officials under the health or safety emergency exception under §§ 99.31(a)(10) and 99.36, as discussed below.

Under FERPA, “law enforcement unit” means any individual, office, department, division, or other component of a school, such as a unit of commissioned police officers or noncommissioned security guards, that is officially authorized or designated by that school or school district to (1) enforce any local, State, or Federal law, or refer to appropriate authorities a matter for enforcement of any local, State, or Federal law against any individual or organization other than the agency or institution itself; or (2) maintain the physical security and safety of the agency or institution.  See 34 CFR § 99.8(a)(1). 

Schools vary in who they authorize or designate to be their law enforcement unit, usually depending upon their size and resources.  Some larger school districts have their own fully equipped police units, while others have smaller security offices.  Other schools designate a vice principal or other school official to act as the law enforcement unit officer.  And other schools may utilize local police officers and SROs as their law enforcement officials.   

“Law enforcement unit records” are those records that are:  (1) created by a law enforcement unit; (2) created for a law enforcement purpose; and (3) maintained by the law enforcement unit.  See 34 CFR § 99.8(b)(1). 

Law enforcement unit records are not protected by FERPA because they are specifically excluded from the definition of “education records” and thus, from the privacy protections afforded to parents and eligible students by FERPA.  Therefore, investigative reports and other records created and maintained by these law enforcement units that meet this definition are not considered “education records” subject to FERPA. 

Accordingly, under FERPA, schools may disclose information from law enforcement unit records to anyone, including outside law enforcement authorities, without consent from parents or eligible students.  (Schools should be aware of any other applicable policies or laws, including federal civil rights laws, regarding any requirements for disclosure or restrictions of disclosure of law enforcement unit records.)  Law enforcement unit records do not include: (1) records created by a law enforcement unit for a law enforcement purpose that are maintained by a component of the educational agency or institution other than the law enforcement unit (such as a principal or other school official); or (2) records created and maintained by a law enforcement unit exclusively for a non-law enforcement purpose, such as a disciplinary action or proceeding conducted by the educational agency or institution.  See 34 CFR § 99.8(b)(2).  

In order for law enforcement unit officials to be considered school officials, they must meet the criteria for who constitutes a school official that are set forth in the school’s or LEA’s annual notification to parents and eligible students of their rights under FERPA.  See § 99.7(a)(3)(iii).  This notification must be distributed by a school or LEA every year through a forum that is likely to be viewed by parents and eligible students, such as a student handbook, school website, a direct letter to parents, or a combination of methods, and must inform parents and eligible students of their rights under FERPA.  (Please see http://www2.ed.gov/policy/gen/guid/fpco/ferpa/lea-officials.html for a model notification.)  Schools must also determine that the school official’s interest in accessing the education records meets the criteria for legitimate educational interests, as set forth in the school or LEA’s annual notification of FERPA rights.  Under these notifications, school official typically would have a “legitimate educational interest” if the official needs to review an education record in order to fulfill his or her professional responsibility.

Having law enforcement unit officials who are “school officials” with a “legitimate educational interest” will permit the school to non-consensually disclose PII from students’ education records to its law enforcement unit officials so that they may perform their professional duties and assist with school safety matters.  For example, if a student is expelled from school and barred from campus, the principal could disclose the student’s disciplinary report to the law enforcement unit officials so that they would know that the student is not supposed to be on campus.  The information from education records that is provided to the school’s law enforcement unit officials remains subject to FERPA and may be further disclosed by that unit (e.g., to the local police department) only with consent or in accordance with the exceptions to the consent requirement at § 99.31.  Because the school’s law enforcement unit may not redisclose PII from students’ education records that it receives, except in compliance with FERPA, it is advisable for law enforcement units to maintain law enforcement unit records separately from education records.  

The manner in which a school establishes its law enforcement unit is outside the scope of FERPA.  Accordingly, FERPA does not require a school to use only employees to staff its law enforcement unit.  Local police officers and other law enforcement personnel employed by local or State authorities also may serve as the “law enforcement unit” of an educational agency or institution.  

Not automatically.  These officials may be considered “school officials” with “legitimate educational interests” and have access to students’ education records, but only if they: 

  1. Perform an institutional service or function for which the agency or institution would otherwise use employees;
  2. Are under the direct control of the agency or institution with respect to the use and maintenance of education records; 
  3. Are subject to the requirements in § 99.33(a) that the PII from education records may be used only for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of students, and governing the redisclosure of PII from education records; and 
  4. Meet the criteria specified in the school or LEA’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records.

Yes.  If the school or school district has a directory information policy under FERPA that permits this disclosure, then the directory information of those students whose parents (or the eligible students) have not opted out of such a disclosure may be disclosed. 

The disclosure of appropriately-designated directory information under the conditions set forth in § 99.37 is one of the exceptions to FERPA’s general consent requirement (§§ 99.31(a)(11) and 99.37).  FERPA defines “directory information” as information in a student’s education record that would not generally be considered harmful or an invasion of privacy if disclosed.  See § 99.3 "Directory information."  Directory information may include the student's name; address; telephone listing; electronic mail address; photograph; date and place of birth; major field of study; grade level; dates of attendance; participation in officially recognized activities and sports; weight and height of members of athletic teams; degrees, honors and awards received; and the most recent educational agency or institution attended.  Id.

A school may disclose directory information if it has given public notice of the types of information which it has designated as "directory information," the parent or eligible student’s right to restrict the disclosure of such information, and the period of time within which a parent or eligible student has to notify the school in writing that he or she does not want any or all of those types of information designated as "directory information.   See § 99.37(a).  

No.  As noted previously, an SRO typically serves as an on-site law enforcement officer and as a liaison with the local police or sheriff’s department.  An SRO also works with teachers and school administrators to promote school safety and to help ensure physical security.  An SRO may be designated by the school as a “law enforcement unit” official under FERPA (§ 99.8).  However, in order for a school to disclose PII from education records to an SRO, the SRO must be considered a “school official” under FERPA in accordance with § 99.31(a)(1)(i)(B) concerning outsourcing.  A school may only non-consensually disclose PII from students’ education records to its law enforcement unit if those individuals in the law enforcement unit meet the requirements set forth in FERPA’s school official exception or if some other FERPA exception to the general consent rule applies. 

A school must have direct control over an SRO’s maintenance and use of education records in providing SRO services in order for the SRO to be considered a school official.  Further, under the school official exception (as well as any FERPA exception to consent), SROs may only use the PII from education records for the purposes for which the disclosure was made, e.g., to promote school safety and the physical security of the students.  See §§ 99.31(a)(1)(i)(B)(3) and 99.33(a)(2).  In addition, SROs are subject to the redisclosure requirements of § 99.33(a).  This means that an SRO who is serving as a “school official” under FERPA may not disclose PII from education records to others, including other employees of his or her local police department who are not acting as school officials, without consent unless the redisclosure fits within one of the exceptions to FERPA’s consent requirement.

FERPA permits schools to non-consensually disclose PII from education records to State and local officials or other authorities if the disclosure is allowed by a State law adopted after November 19, 1974, and if the disclosure concerns the juvenile justice system and its ability to serve, prior to adjudication, the student whose records are disclosed.  See §§ 99.31(a)(5) and 99.38.  The officials and authorities to whom such information is disclosed must certify in writing to the school that the information will not be provided to any other party, except as provided for under State law without written consent.