family educational rights and privacy act (ferpa) › files › zcehnt4... · referred professor to...

Family Educational Rights and Privacy Act (FERPA)

AACRAO 2007

Primary Rights under FERPA

Right to inspect and review education records

Right to seek to amend education records

Right to have some control over the disclosure of information from education records

Education Records

“Education records” are records which –

(1) contain information which is directly related to a student; and

(2) are maintained by an educational agency or institution or by a party acting for the agency or institution.

Education Records, cont.

Exceptions to “education records” include:

Sole Possession RecordsLaw Enforcement RecordsEmployment Records Treatment RecordsAlumni Records


• College professor requested access to a student’s health center records to determine if a student was really sick the day she was absent from class. Student consented for the health center to release the dates she was seen by the center, but professor wanted to know whether, in the opinion of the nurse at the center the student was too sick to come to class. The nurse claimed the information was confidential medical information.

FPCO responded that the records are subject to FERPA, not to theHIPAA (Health Insurance Portability & Accountability Act) Privacy Rule. Referred professor to 2004 letter to University of North Alabama, on the FPCO website: http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/copeuna.html

http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/copeuna.html


Records are subject to FERPA, but first a determination needs to be made as to whether the records are “treatment records” under FERPA and what the college’s policy is with regard to the treatment records.

If records are not “treatment records,” then the professor may be able to have access to the records, assuming that the school’s notification of rights under FERPA includes criteria for “school officials” and for a “legitimate educational interest.”


“Education records” do not include records on an eligible student that are:

(1) Made or maintained by a physician, psychiatrist, psychologist, or other recognized professional or paraprofessional acting in his or her professional capacity or assisting in a paraprofessional capacity;

(2) Made, maintained, or used only in connection with treatment of the student; and

(3) Disclosed only to individuals providing the treatment. For the purpose of this definition, “treatment” does not include remedial educational activities or activities that are part of the program of instruction at the agency or institution.


Once “treatment records” are disclosed outside of the requirements described above, the records become “education records” under FERPA.Records maintained by an office of disability services are “education records” because they contain information that is directly related to a student. “Treatment” does not include determining appropriate accommodations for a disability.There is no exclusion from the definition of “education records” for “health” or “medical” records, except for “treatment” records that meet the requirements described above.HIPPA Privacy Rule specifically excludes from its definition of “protected health information” individually identifiable health information contained in an “education record” covered by FERPA, as well as “treatment” records excluded from the definition of “education records.”

Personally Identifiable Information

“Personally identifiable information” includes, but is not limited to:

Student’s nameParent’s nameAddress of the student or student’s family.A personal identifier, such as a social security number or student numberA list of personal characteristics or other information that would make the student’s identity easily traceable

Personally Identifiable Information, cont.

University of Oklahoma (08/11/06)

• The University of Oklahoma received numerous media requests under the State’s open records law for material concerning investigation of certain student athletes in the football program and potential violations of NCAA rules.

• University asked whether, after redacting student athletes’ names and other personal identifiers, investigative material could be released without violating FERPA.


A student’s identity may be “easily traceable,” even after removal of nominally identifying information from student-level data.

This may be the case, for example, in a highly publicized disciplinary action, where the student could be identified in the community even after the record had been “scrubbed” of identifying data.


In such circumstances, FERPA does not permit the disclosure of the education record in any form, without consent, because the presence of “personal characteristics” or “other information” make the student’s identity “easily traceable.”

A student’s identity may also be “easily traceable” in the release of aggregated or statistical information derived from education records. (See 9/25/03 letter to the Board of Regents of the University System of Georgia, available on FPCO website.)


• Where a disclosure does not fall within an exception to the prior written consent rule, an institution itself is in the best position to determine, at least at the outset, what information must be removed from education records in order to ensure that a student’s identity is not easily traceable.

• If, because of other records that have been released or the notoriety of certain events, the redaction of names, ID numbers,and dates and times of incidents is not sufficient to prevent the identification of a student involved in an investigation or proceeding, then FERPA prohibits the institution from having a policy or practice of releasing the information as such.

• The University must either remove or redact the information in the education record that would make a student’s identity easily traceable or refuse to release the requested education record.

Inspection and Review of Education Records

§ 99.10 What rights exist for a parent or eligible student to inspect and review education records?

– School must comply with request within 45 days.– Generally required to give copies only if failure to do so

would effectively deny access – example would be a student or former student who does not live within commuting distance.

– School may not destroy records if request for access is pending.

Right to Inspect and Review—§99.10

Western Seminary (08/09/05)

• Western Seminary in Oregon asked whether FERPA requires them to repeatedly comply with a student’s requests for copies of education records to which the Seminary has previously provided the students with copies.

• FERPA requires that a school provide a student with an opportunity to inspect and review his or her education records within a reasonable period of time, but not more than 45 days after it has received the request.

• While a school is not required to comply with a standing request for access to education records, it is generally required to comply with each individual request by a student for access.

Right to Inspect and Review– §99.10

A school is required to provide a student with copies of education records, or make other arrangements, if a failure to do so wouldeffectively prevent the student from obtaining access to the records – such as when the student does not live in commuting distance ofschool.

Other arrangements could include making the student’s education records available for inspection at a location, such as at a college or university, near where the student currently resides.

Institution may want to determine whether there are any State laws dealing with harassment or related conduct that might apply.

Right to Inspect and Review –§99.10(Attorney-Client Privilege)

FPCO did not find a school district in violation of § 99.10(a) for refusing to provide the parent with access to certain education records after determining that the district provided specific facts showing that each of the five requirements for invoking a common law, attorney-client privilege had been met.

FPCO did find the school district in violation of § 99.10(c) because it failed to explain that some of the student’s education records would not be made available for inspection and review based on the on the district’s assertion of attorney-client privilege.

§ 99.10(c):“The educational agency or institution . . . shall respond to reasonable requests for explanations and interpretations of records.”


There is no specific statutory or regulatory basis in FERPA for denying a parent or eligible student’s right to inspect and review an education record because it is subject to an attorney-client privilege.

FPCO has inferred that an educational agency or institution may assert a common law, attorney-client privilege in response to a request under FERPA for access to education records – even when the parties are not in litigation – because the broad definition of “education records” may encompass some records that should be subject to the privilege, such as records created or maintained by an attorney providing confidential legal advice to a client institution.

Assertion of a common law, attorney-client privilege is generally disfavored and construed narrowly in the judicial context, since it serves to obscure or impede discovery of the truth. In the FERPA context, assertion of the privilege derogates students’ statutory right to inspect and review their education records.


Accordingly, in order to assert the privilege and refuse to provide a student with access to education records, the institution mustestablish that:

1) the asserted holder of the privilege is or sought to become a client;2) the communication is between a client and a member of the bar, or

his or her subordinate, who is acting as a lawyer in connection with the communication;

3) the communication relates to facts disclosed by the client to the attorney for the purpose of securing either an opinion of law or legal services, and not for the purpose of committing an illegal act or tort;

4) the communication is in fact confidential and not made in the presence of anyone outside the particular attorney-client relationship; and

5) the privilege has been claimed and not waived.


Only those portions of documents that contain communications between a school official and an attorney that embody legal advice, as opposed to recitation of facts, may be protected under the privilege.

The privilege protects only those communications that are necessary to obtain confidential legal advice and that would not be made without the privilege. It does not protect communications with school officials who just happen to be attorneys or that are made in regard to other matters.

Education records maintained in a student’s general or cumulative file generally fail to meet the confidentiality requirements for assertion of the privilege.


Because the privilege is disfavored – especially in the FERPA context – we apply the protections of the privilege narrowly and the concept of waiver broadly. That is, the attorney-client privilege is strictly confined within the narrowest possible limits consistent with its purposes. If any of these conditions are not met, the claim of privilege cannot succeed.

A party asserting the attorney-client privilege has the burden of establishing that all of the above requirements have been met. Whenever FPCO receives a complaint that an institution has denied a student access to education records based on its claim that the records are subject to the attorney-client privilege, the institution must provide specific information to support its claim.

Disclosure of Education Records§ 99.30 ConsentExcept for specific exceptions, a student shall provide a signed and dated written consent before a school may disclose education records.

– The consent must:Specify records that may be disclosed;State purpose of disclosure; and Identify party or class of parties to whom disclosure may be made.

Disclosure Provisions

§ 99.31 – Exceptions to the prior written consent requirement (partial).

All disclosures under §99.31 are permissive under FERPA. Only parents and eligible students have a right under FERPA to obtainaccess to education records.

School Official – §99.31(a)(1)State and local educational authorities §99.31(a)(3) and §99.35.Financial aid purposes -- §99.31(a)(4)Studies for on behalf of institution -- §99.31(a)(6) Lawfully issued subpoena or judicial order -- §99.31(a)(9)

Disclosure Provisions - § 99.31(a)(1)

Chapman University (CA) (08/08/06)

• University asked whether FERPA permits their alumni servicesoffice to contract with a third party in order to locate former students.

• FPCO responded that, if the University can show that certain conditions are met, it may enter into the contract and, in turn,disclose student education records to that party for the purposes outlined in the contract with the University.


FERPA does not specifically address disclosure of education records to contractors, consultants, volunteers, and service providers who are not employees of an educational agency or institution.

Statutory definition of “education records” appears to recognize the use of outside service providers in calling for the protection of records maintained by “persons acting for” the agency or institution.

FPCO has advised that educational agencies and institutions subject to FERPA are not precluded from disclosing education records to parties to whom they have outsourced services, so long as they do so under the same conditions applicable to school officials who are actually employed.

However, an educational agency or institution may not disclose education records without prior consent merely because it has entered into a contract or agreement with an outside party.


Rather, the agency or institution must be able to show that –

1) the outside party provides a service for the agency or institution that it would otherwise provide for itself using employees;2) the outside party would have “legitimate educational interest”in the information disclosed if the service were performed by employees; and3) the outside party is under the direct control of the educationalagency or institution with respect to the use and maintenance ofinformation from education records.


Under § 99.33(a), any party, including a “school official” that receives education records may use the information only for the purposes for which the disclosure was made and may not redisclose the information to any other party without prior written consent, except as authorized under §99.33(b).

Education records maintained by a party providing services for an educational institution, including records created by that party, are subject to all FERPA requirements.

An outside party that does not meet these requirements may not be given access to education records without meeting the prior written consent requirements.

• An educational institution must ensure that its service provider does not use or allow anyone to obtain access to personally identifiable information from education records, except in strict accordance with the requirements established by the institution that discloses the information.


An educational institution that outsources services under these requirements remains completely responsible for its service provider’s compliance with applicable FERPA requirements and liable for any misuse of protected information.These specific protections should be incorporated into any contract or agreement between an educational institution and any non-employees it retains to provide institutional services.The disclosure of education records to school officials is ordinarily excepted from FERPA’s recordation requirements under §99.32(d)(2) because these disclosures are identified in the school’s annual FERPA notification.However, if the institution has not listed contractors and otheroutside service providers as “school officials” in its annual notification, it must record each disclosure to a qualifying contractor.

Disclosure Provisions –§ 99.31(a)(2) & § 99.34

University of Medicine & Dentistry of New Jersey’s School of Health Related Professions (07/13/06)

• The University has a recognized joint degree program with ThomasEdison State College’s School of Applied Science and Technology Center (College).

• The University asked if FERPA permitted it to ask all incoming students to provide the University registrar with the username and password they use to access their student information system account at the College, in order to streamline and expedite the clearance of degree candidates between the two institutions.


The College may disclose to the University information from the education records of joint degree program students, without consent, under § 99.34(b), which provides

An educational agency or institution may disclose an education record of a student in attendance to another educational agency or institution if:

(1) The student is enrolled in or receives services from the other agency or institution; and(2) The disclosure meets the requirements of paragraph (a) of this section.

• Section 99.34(a) contains notice and copy requirements that apply to these disclosures.


FERPA would not permit the University to require students to disclose their usernames and passwords at the College in order to gain access to college system.

An institution may not require students to waive their FERPA rights and protections as a condition for acceptance into an educational institution or receipt of educational services.

The University noted that a student’s password at the College is defaulted to the last four numbers of the SSN.

Widely available information, such as an SSN or last four-digits of an SSN, should not be used to authenticate a student’s identity because it may lead to the disclosure of personally identifiable information from education records to unauthorized parties.

See FPCO’s 11/5/04 letter to University of Wisconsin –http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/uwisc.html.

http://www.ed.gov/policy/gen/guid/fpco/ferpa/library/uwisc.html


• FPCO received inquiries asking whether FERPA permits the disclosure of personally identifiable information on F-1 students, without consent, to the Social Security Administration’s (SSA) Office of Inspector General (OIG). The SSA OIG was investigating employment activities of students on F-1 visa and asked for “enrollment dates” of F-1 students. Schools asked whether this met § 99.31(a)(3) exception of FERPA.

• § 99.31(a)(3) and § 99.35 apply only to the disclosure of education records, without consent, to Federal or State educational authorities for the audit or evaluation of Federal or State supported education programs, or for the enforcement of Federal legal requirements that relate to those programs.


Federal law permits educational agencies and institutions to disclose information on F-1 students to the Immigration and Customs Enforcement for purposes of the Student and Exchange Visitor Information System (SEVIS).

FPCO is unaware of any statutory provision in other Federal laws, such as the Inspector General Act or SSA statutes, that would supersede FERPA’s privacy requirements.

Unless there is a specific statutory authority requiring this disclosure, institutions may not disclose the information without consent or without benefit of a lawfully issued subpoena. Therefore, if SSA’s OIG issued a subpoena for this information, institutions may comply with the subpoena under § 99.31(a)(9) of FERPA.

Disclosure Provisions –§ 99.31(a)(4)

Consent is not required when the disclosure is in connection with financial aid for which the student has applied or which the student has received, if the information is necessary for such purposes as to –

(A) Determine eligibility for the aid;(B) Determine the amount of the aid;(C) Determine the conditions for the aid; or(D) Enforce the terms and conditions of the aid.


Louisiana Student Financial Assistance Commission (05/26/06)

Commission asked whether FERPA permits postsecondary institutions in Louisiana to disclose to the Commission enrollment and academic data about financial aid students.

Commission is the designated guarantor in Louisiana for student loans made under the Federal Family Education Loan Program.

FERPA permits the nonconsensual disclosure of education records when the disclosure is “in connection with a student’s application for, or receipt of, financial aid.”

FERPA would permit disclosure of enrollment and academic data about financial aid students if any of the provisions described above apply.


South Dakota Department of Labor (05/11/06)

SDDOL asked whether FERPA would permit the South Dakota Department of Education (SDDOE) to disclose education records to SDDOL under an agreement to determine what happens to high school students after they graduate.

SSOL believed that § 99.31(a)(6) permitted the SDDOE to disclose information on students, including SSNs, for this research project in order to “improve instruction.”

§ 99.31(a)(6) permits an educational agency or institution to retain the services of an outside organization and disclose education records, without consent, so that the organization can perform a student for the purposes specified, including improvement of instruction.


The SDDOL research project does not meet the requirements of this exception because SDDOL is not conducting a study for the SDDOE but rather matching the SDDOE data (i.e., student SSNs) with information in SDDOL’s possession (i.e., follow-up data on student employment).

Also, State educational agencies, such as SDDOE, are not permitted to redisclose information from education records it has received from school districts under § 99.31(a)(3) & § 99.35 in personally identifiable form to anyone other than an employee, appointed official, or contractor under the “direct control” of the SEA. See Deputy Secretary’s 01/30/03 memorandum http://www.ed.gov/policy/gen/guid/fpco/pdf/ht031103.pdf.

Nothing in FERPA would prevent SDDOE itself from conducting the data match in question by having SDDOL submit its records directly to SDDOE, which may then release the results in non-personally identifiable form to other agencies and officials.

http://www.ed.gov/policy/gen/guid/fpco/pdf/ht031103.pdf

Disclosure Provisions - §99.31(a)(9)

White v. National Collegiate Athletic Association (02/16/07)

Several universities asked about FERPA’s notification requirements in complying with a subpoena issued in the class action lawsuit White v. NCAA.

FERPA permits an educational agency or institution to disclose personally identifiable information from education records if the disclosure is to “comply with a judicial order or lawfully issued subpoena.”

Disclosure Provisions - §99.31(a)(9)An institution must first make a reasonable effort to notify the eligible student of the order or subpoena in advance of compliance, so that the student may seek protective action, unless the disclosure is in compliance with –

(1) A Federal grand jury subpoena and the court has ordered that the existence or contents of the subpoena or information furnished in response to subpoena not be disclosed; or

(2) Any other subpoena issued for a law enforcement purpose and the court or other issuing agency has ordered that the existence of the contents of the subpoena or the information furnished in response to the subpoena not be disclosed.

Disclosure Provisions - §99.31(a)(9)FERPA does not state the time-period an institution must wait before complying with it the court order or subpoena. Whether or not a school has made a reasonable attempt to notify the student in advance of compliance with a subpoena is considered on a case-by-case basis.

FPCO generally recommends that a school wait 10 to 14 days before disclosing education records in response to a subpoena. More or less time than this could be needed, depending on the circumstances in a particular case.

Institutions may use mail, telephone call/message, or email to provide notification.

The school should keep a record of its notification action(s) for each student, and make sure that each student is contacted separately so that education records are not improperly disclosed. Only one student should be included in each email message.


Los Angeles County Office of Education (LACOE) (08/11/06)

LACOE and the Los Angeles Unified School District (District) had previously asked whether FERPA would permit them to disclose students’ education records in order to comply with a proposed “blanket court order.” The Presiding Judge of the Juvenile Division, Superior Court of Los Angeles County later issued the order

The “blanket court order” requires LACOE and the District to disclose records on a continuing, as needed basis on a broad category of students, in connection with the California Education and Welfare and Institutions Codes.

FPCO advised that the regulatory language indicates that this exception applies to a court order to disclose education records in connection with a specific legal proceedingand not a general or “blanket” order governing a whole segment of the population.

While the court inserted a notice requirement into the blanket court order, the court order was not valid under FERPA because it applies to a whole category of judicial proceedings rather than a particular proceeding.


The court order exception in FERPA contemplates that the court balance the need for education records against the parents’ and students’ privacy interests in the context of a specific legal proceeding.

A blanket order to disclose education records essentially creates by judicial fiat an exception to the FERPA consent requirement that doesn’t exist.

Enforcement Provisions –§§ 99.60-99.67

The Family Policy Compliance Office is authorized by the Secretary of Education to investigate, process, and review complaints and violations under FERPA.

Students may file complaints with the U.S. Department of Education.

FERPA provides specific remedies to be determined by ED in a case where a school refuses to voluntarily comply.

Conflict with State or Local Laws –§99.61

FPCO responded to a law firm, representing numerous school districts in California, which had reported an apparent conflictbetween FERPA and a California Attorney General opinion regarding the rights of parents to access their children’s education records.

Under California law, minors may consent to various types of medical treatment on a confidential basis and shall be excused from school for such appointments. The California Attorney General had determined that parental consent was not required in order to excuse the student and that schools must withhold from parents any records concerning the excused absence.


FPCO advised the California Chief State School Officer (11/15/05) that such an interpretation of State law conflicted with FERPA and that FERPA requires schools to allow parents to inspect and review any such records, if they are maintained by schools.

California Department of Education notified all superintendents and administrators by memorandum (10/17/06) stating that, if districts and schools maintain attendance records that reflect a student’s absence for a confidential medical appointment, FERPA requires that parents be permitted to inspect and review such records.


New York Education Law provides that a hearing on disciplinary charges filed against an employee shall be public or private at the discretion of the employee. State regulations stated that hearings shall be open to members of the public but that the hearing officer had the discretion to exclude individuals where warranted to protect the privacy or reputation of a person under the age of 18.

FPCO advised that State law and regulations appear to conflict with FERPA to the extent that they authorize an employee of the District or a hearing officer to compel the disclosure of personally identifiable information from education records in a hearing open to the public and where the parent or eligible student refuses to provide written consent.

School districts may not comply with State laws that require or authorize other parents to require the disclosure of education records in violation of FERPA requirements and continue to receive funds administered by the Secretary of Education.

Proposed Legislation

H. R. 128 – “David Shick Honesty in Campus Justice Act”

Introduced by Congressman Rodney Frelinghuysen (NJ)

“To amend [FERPA] to improve the access of the victims of crimes to information concerning the outcome of disciplinary proceedings by institutions of higher education.”

“Notwithstanding any other provision of this section, an institution of postsecondary education shall disclose to the alleged victim of any crime of violence . . . or a nonforcible sex offense, the final results of any disciplinary proceeding conducted by such institution against a student who is the alleged perpetrator of such crime or offense with respect to such crime or offense. If the alleged victim of such crime or offense is deceased, the next of kin of such victim shall be treated as the alleged victim for purposes of this subparagraph.”

Solomon Amendment

Department of Defense contact :

Mr. Dennis DrogoAssistant DirectorOffice of Accession PolicyU. S. Department of Defense4000 Defense PentagonWashington, DC 20301-4000Telephone 703-695-5525

Technical Assistance

For technical assistance and advice to school officials:

Family Policy Compliance Office U.S. Department of Education400 Maryland Avenue, SWWashington, DC 20202-5920

(202) 260-3887 Telephone(202) 260-9001 Fax

Informal Technical Assistance

For informal requests for technical assistance, email us at:

[email protected]

FPCO ListServ

Postsecondary officials:<http://www.ed.gov/policy/gen/guid/fpco/tps/ps/fpcopssignup.html> to http://www.ed.gov/policy/gen/guid/fpco/tps/ps/index.html

• Type the word “privacy” in both the password and user ID text boxes.

• Announcement only ListServ

http://www.ed.gov/policy/gen/guid/fpco/tps/ps/index.html

http://www.ed.gov/policy/gen/guid/fpco/tps/ps/index.html

Visit our web site:www.ed.gov/offices/OII/fpco

orhttp://www.ed.gov/policy/gen/guid/fpco/index.html

http://www.ed.gov/offices/OII/fpco

http://www.ed.gov/policy/gen/guid/fpco/index.html

family educational rights and privacy act (ferpa) › files › zcehnt4... · referred professor to...

Documents