The Family Educational Rights and Privacy Act (FERPA) protects the privacy of students’ personal records held by “educational agencies or institutions” that receive federal funds under programs administered by the U.S. Secretary of Education.²⁹

“Educational agencies or institutions” are defined as institutions that provide direct instruction to students, such as schools; as well as educational agencies that direct or control schools, including school districts and state education departments.³⁰ Almost all public schools and public school districts receive some form of federal education funding and must comply with FERPA.

Organizations and individuals that contract with or consult for an educational agency also may be subject to FERPA if certain conditions are met.³¹ These conditions are discussed later on in greater detail later on.

Student health records maintained by a school or school employees, such as treatment records, IEP assessments, or immunization documents, are part of the education file in almost all cases^.37 FERPA does not treat health and mental health records in a minor’s education file differently than it does any other information, such as grades or demographic information in the file.³⁸ That said, FERPA generally limits access to all student records, and for example, only school staff with a “legitimate educational interest” in the information should be able to access it. FERPA requires schools to include in their annual notices to parents a statement indicating whether the school has a policy of disclosing information from the education file to school officials, and, if so, which parties are considered school officials for this purpose and what the school considers to be a “legitimate educational interest.”³⁹ There is one small exception. Some treatment records are not part of the “education record.” Records of treatment provided students who are 18 and older, created by a medical provider, only used for treatment purposes and not shared with others are not subject to FERPA. This is a very limited exception, however. These records become a part of the education file and are subject to FERPA as soon as the records are used for anything beyond treatment or shared with anyone other than providers — for example, disclosed to the parent or shared to obtain reimbursement for the care.

Real-World Example

A teacher personally witnesses an incident, such as one student bullying another. Can the teacher call the victim’s parents and tell them what she observed and who she saw bullying their child?

Yes. This is because FERPA prohibits the improper disclosure of information derived from education records. Therefore, information that is based on observation or hearsay and not specifically contained in education records would not be protected from disclosures under FERPA.

Records of a law enforcement unit mean those records, files, documents, and other materials that are (i) Created by a law enforcement unit; (ii) Created for a law enforcement purpose; and (iii) Maintained by the law enforcement unit.⁴⁰ Law enforcement unit records are not considered part of the “education record” and are not subject to FERPA.

The law enforcement unit of a school is any individual, office, department, division, or other component of an educational agency or institution, such as a unit of commissioned police officers or non-commissioned security guards, that  is  officially authorized or designated by that agency or institution to:

• Enforce any local, State, or Federal law, or refer to appropriate authorities a matter for enforcement of any local, state, or federal law against any individual or organization other than the agency or institution itself; or
• Maintain the physical security and safety of the agency or institution.⁴¹

For information on how and when schools can disclose information to law enforcement and the law enforcement unit at a school, please consult school district counsel.

When can a school official's notes be considered a "sole possession" record?

The U.S. Department of Education provides this guidance: “Generally sole possession records are of the nature to serve as a ‘memory jogger’ for the creator of the record. For example, if a school official has taken notes regarding telephone or face to face conversations, such notes could be sole possession records depending on the nature and content of the notes.”

The DOE also cautions in its guidance: “Once the contents or information recorded in sole possession records is disclosed to any party other than a temporary substitute for the maker of the records, those records become education records subject to FERPA.”

Source: U.S. Dept. of Education, “What records are exempted from FERPA?” available at: https://studentprivacy.ed.gov/faq/what-records-are-exempted-ferpa

 

Sole possession records are records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except a temporary substitute. Sole possession records are not considered part of the education record and are not subject to FERPA. These records become a part of the education file and are subject to FERPA, however, as soon as they are shared with anyone other than a temporary substitute for the maker.

Generally, FERPA prohibits educational agencies from releasing any information in the education record unless they have written permission for the release.⁴² In most cases, a parent⁴³ must sign that release. Requirements for a FERPA-compliant release can be found in Requirements for Release of Information Forms in Additional Resources. When students are eighteen years old or older, they sign their own release forms. FERPA also requires educational agencies to allow parents to access their minor children’s education records.

FERPA contains exceptions that allow agencies and schools to disclose information absent a written release in some circumstances. For example, schools may share “directory information”⁴⁴ about students with the public generally if the school and district have given public notice to parents about the types of information the school and district consider directory information, the parents’ right to refuse directory disclosures, and how long parents have to inform the school or district about their intent to opt out.⁴⁵

Another exception allows school staff to share information with “school  officials”⁴⁶ in the same educational agency who have a “legitimate educational interest” in the information.⁴⁷ This exception is further discussed in the answer to “Are treatment or health records in an education file treated differently than other types of information in the file?” above. Certain policies must be in place at the district level in order to implement both of these exceptions. Additional exceptions also exist, including exceptions that allow sharing information in emergency situations with contractors, and for school transfers, among others.⁴⁸ The emergency exception is discussed further in School Nurses Frequently Asked Questions in the answer to “Does FERPA still apply if a school nurse is hired with funds from an agency not subject to FERPA such as a foundation or the Department of Health?”.

When can law enforcement unit records be disclosed and what can be withheld?

The U.S. Department of Education provides this guidance: “ ‘Law enforcement unit records’ (i.e., records created by the law enforcement unit, created for a law enforcement purpose, and maintained by the law enforcement unit) are not ‘education records’ subject to the privacy protections of FERPA. As such, the law enforcement unit may refuse to provide a parent or eligible student with an opportunity to inspect and review law enforcement unit records, and it may disclose law enforcement unit records to third parties without the parent or eligible student’s prior written consent. However, education records, or personally identifiable information from education records, which the school shares with the law enforcement unit, do not lose their protected status as education records just because they are shared with the law enforcement unit.”

Source: U.S. Dept. of Education, “Are law enforcement records considered education records?” available at https://studentprivacy.ed.gov/faq/are-law-enforcement-records-considered-education-records

California has state laws that protect the confidentiality of information held by schools.⁴⁹ For the most part, the rules and exceptions in California law parallel those found in FERPA.⁵⁰ To the extent that provisions of FERPA conflict with state law or regulation, FERPA usually preempts state law. If an educational agency believes there is an actual conflict between obligations under state law and its ability to comply with FERPA, the educational agency must notify the U.S. Department of Education’s Family Policy Compliance Office.⁵¹ If a school employee believes there may be a conflict between FERPA and California law, they should contact their school district legal counsel.

California law says  that “information of a personal nature”⁵²  disclosed by a student 12 and older, or the student’s parents, to a school counselor⁵³ as part of receiving “educational counseling”⁵⁴ (as defined in state law) does not become part of the pupil record, and access to that information is very limited. ⁵⁵ (See endnote for limitations.)

The statute goes on to say that “[i]t is the intent of the Legislature that counselors use the privilege of confidentiality under this section to assist the pupil whenever possible to communicate more effectively with parents, school staff, and others.” Before relying on this rule, it is critical to discuss this law with school district legal counsel to understand its scope and any possible conflicts with FERPA.

If a school based health program has records subject to FERPA, it must meet all the administrative requirements in FERPA. Among other things, this includes:

• Making sure it has a FERPA-compliant release of information form;
• Providing the appropriate annual notices, including required notices regarding directory information, the school official exception, and inspection and confidentiality rights;
• Ensuring it has local policies in place that address and define important FERPA terms such as “legitimate educational interest”, “parent”, and “directory information”; and
• Complying with record-keeping requirements regarding releases of information.

It includes other considerations as well. The National Forum on Education Statistics has a guide to implementing FERPA.⁵⁵ Requirements for a compliant release form can be found in Requirements for Release of Information Forms in Additional Resources, and the U.S. Department of Education provides several model notices for educational agencies.⁵⁶