Many states and localities have enacted laws and regulations to protect a student's right to privacy. So, too, has the federal government, in the form of the Family Educational Rights and Privacy Act of 1974 (FERPA), which guarantees the privacy of educational records for students and their parents; the Education Sciences Reform Act of 2002 (ESRA); the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA); the Freedom of Information Act (FOIA); the Paperwork Reduction Act of 1995; and the Computer Security Act of 1987. In addition, the federal Health Insurance Portability and Accountability Act (HIPAA) established standards regarding the electronic exchange of health information. Certain activities performed by school staff, including school nurses, may be subject to provisions of HIPAA. For more information about the intersection of FERPA and HIPAA, see Health and Healthcare in Schools, The Impact of FERPA and HIPAA on Privacy Protections for Health Information at School: Questions from Readers (2003, Volume 4, Number 4).
This is a summary of the federal Family Educational Rights and Privacy Act (FERPA).
Statute: 20 U.S.C. § 1232g. Regulations: 34 CFR Part 99.
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. 20 U.S.C 1232g; 34 CFR part 99. FERPA applies to all schools that receive funds from the U.S. Department of Education. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification is left to the discretion of each school.
Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions:
FERPA confers rights to parents with respect to their children's education records. Local education agencies (LEAs) must annually notify parents and eligible students of their rights under FERPA. 34 CFR § 99.7. Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Parents or eligible students have the right to request that schools correct records they believe to be inaccurate or misleading.
School officials are asked to balance the interests of safety and privacy for individual students. The U.S. Department of Education issued a guide pertaining to the safety issue in October of 2007. The provisions follow below:
In an emergency, FERPA permits school officials to disclose without consent education records, including personally identifiable records, to protect the health or safety of students or other individuals. In a health or safety emergency, records and information may be released to appropriate parties such as law enforcement officials, public health officials, and trained medical personnel. 34 CFR 99.31(a)(10) and 99.36. This exception is limited to the period of the emergency.
Many school districts employ security staff to monitor safety and security in and around schools. Investigative reports and other records created and maintained by these "law enforcement units" are not considered "education records" subject to FERPA. Schools may disclose information from the law enforcement unit records to anyone, including outside law enforcement authorities, without parental consent. 34 CFR 99.8.
Schools must indicate which office serves as the school's law enforcement unit. As an example, the U.S. Department of Education has posted a model notification.
Images of students captured on security videotapes maintained by school law enforcement units are not considered education records under FERPA.
According to the U.S. Department of Education, schools that do not have a designated law enforcement unit might consider designating an employee to serve as the "law enforcement unit," in order to maintain the security camera(s) and determine the appropriate circumstances in which the school would disclose recorded images.
FERPA does not prohibit a school official from disclosing information about a student if the information is obtained through the school official's knowledge or observation, and not from the student's education records. For example, if an official overhears a student making threatening remarks to other students, FERPA does not protect that information.
School officials may disclose any and all education records, including disciplinary records and records that were created as a result of a student receiving special education services under part B of the Individuals with Disabilities Act, to another school or secondary institution at which the student seeks or intends to enroll. Schools must make a reasonable attempt to disclose that the information transfer has occurred, which can be part of the school's annual FERPA notification. Parents can request a copy of information disclosed, and they have an opportunity for a hearing.
Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow them a reasonable amount of time to request that the school not disclose directory information about them.
The Protection of Pupil Rights Amendment (PPRA) affords parents certain rights regarding the conduct of surveys, collection and use of information for marketing purposes, and certain physical exams.1 20 U.S.C. § 1232h; 34 CFR Part 98. Parents or eligible students have the right to consent before students are required to complete a survey; receive notice and the opportunity to opt out; and inspect protected information. PPRA also requires written parental consent if a survey includes questions on the list of prohibited topics.
FERPA also requires that educational organizations maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student (as long as a student's educational records are maintained by the education agency or institution). For each request or disclosure the record must include
If the personally identifiable information is disclosed, the educational agency or institution must document
This does not apply if the request was from, or the disclosure was to
U.S. Department of Education
Family Policy Compliance Office (FPCO)
400 Maryland Avenue, SW
Washington, DC 20202–5920
(202) 260–3887
Informal inquiries may be sent to FPCO via the following email addresses: ferpa@ed.gov and ppra@ed.gov.