Skip Navigation
The Forum Guide to Data Ethics
NCES 2010-801
March 2010

Appendix D: Family Educational Rights and Privacy Act (FERPA)

Many states and localities have enacted laws and regulations to protect a student's right to privacy. So, too, has the federal government, in the form of the Family Educational Rights and Privacy Act of 1974 (FERPA), which guarantees the privacy of educational records for students and their parents; the Education Sciences Reform Act of 2002 (ESRA); the Confidential Information Protection and Statistical Efficiency Act of 2002 (CIPSEA); the Freedom of Information Act (FOIA); the Paperwork Reduction Act of 1995; and the Computer Security Act of 1987. In addition, the federal Health Insurance Portability and Accountability Act (HIPAA) established standards regarding the electronic exchange of health information. Certain activities performed by school staff, including school nurses, may be subject to provisions of HIPAA. For more information about the intersection of FERPA and HIPAA, see Health and Healthcare in Schools, The Impact of FERPA and HIPAA on Privacy Protections for Health Information at School: Questions from Readers (2003, Volume 4, Number 4).

This is a summary of the federal Family Educational Rights and Privacy Act (FERPA).

Family Educational Rights and Privacy Act (FERPA)

Statute: 20 U.S.C. § 1232g. Regulations: 34 CFR Part 99.

I. FERPA General Overview

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. 20 U.S.C 1232g; 34 CFR part 99. FERPA applies to all schools that receive funds from the U.S. Department of Education. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification is left to the discretion of each school.

Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions:

  • school officials with legitimate educational interest;
  • other schools to which a student is transferring;
  • specified officials for audit or evaluation purposes;
  • appropriate parties in connection with financial aid to a student;
  • organizations conducting certain studies for, or on behalf, of the schools;
  • accrediting organizations;
  • to comply with a judicial order or lawfully issued subpoena;
  • appropriate officials in cases of health and safety emergencies; and
  • state and local authorities within a juvenile justice system, pursuant to specific state law. 34 CFR 99.31

FERPA confers rights to parents with respect to their children's education records. Local education agencies (LEAs) must annually notify parents and eligible students of their rights under FERPA. 34 CFR § 99.7. Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Parents or eligible students have the right to request that schools correct records they believe to be inaccurate or misleading.

II. Balancing the Interests of Privacy and Safety

School officials are asked to balance the interests of safety and privacy for individual students. The U.S. Department of Education issued a guide pertaining to the safety issue in October of 2007. The provisions follow below:

A. Health or Safety Emergency

In an emergency, FERPA permits school officials to disclose without consent education records, including personally identifiable records, to protect the health or safety of students or other individuals. In a health or safety emergency, records and information may be released to appropriate parties such as law enforcement officials, public health officials, and trained medical personnel. 34 CFR 99.31(a)(10) and 99.36. This exception is limited to the period of the emergency.

B. Law Enforcement Unit Records

Many school districts employ security staff to monitor safety and security in and around schools. Investigative reports and other records created and maintained by these "law enforcement units" are not considered "education records" subject to FERPA. Schools may disclose information from the law enforcement unit records to anyone, including outside law enforcement authorities, without parental consent. 34 CFR 99.8.

Schools must indicate which office serves as the school's law enforcement unit. As an example, the U.S. Department of Education has posted a model notification.

C. Security Videos

Images of students captured on security videotapes maintained by school law enforcement units are not considered education records under FERPA.

According to the U.S. Department of Education, schools that do not have a designated law enforcement unit might consider designating an employee to serve as the "law enforcement unit," in order to maintain the security camera(s) and determine the appropriate circumstances in which the school would disclose recorded images.

D. Personal Knowledge

FERPA does not prohibit a school official from disclosing information about a student if the information is obtained through the school official's knowledge or observation, and not from the student's education records. For example, if an official overhears a student making threatening remarks to other students, FERPA does not protect that information.

E. Transfer of Education Records

School officials may disclose any and all education records, including disciplinary records and records that were created as a result of a student receiving special education services under part B of the Individuals with Disabilities Act, to another school or secondary institution at which the student seeks or intends to enroll. Schools must make a reasonable attempt to disclose that the information transfer has occurred, which can be part of the school's annual FERPA notification. Parents can request a copy of information disclosed, and they have an opportunity for a hearing.

F. Directory Information

Schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow them a reasonable amount of time to request that the school not disclose directory information about them.

III. Protection of Pupil Rights Amendment

The Protection of Pupil Rights Amendment (PPRA) affords parents certain rights regarding the conduct of surveys, collection and use of information for marketing purposes, and certain physical exams.1 20 U.S.C. § 1232h; 34 CFR Part 98. Parents or eligible students have the right to consent before students are required to complete a survey; receive notice and the opportunity to opt out; and inspect protected information. PPRA also requires written parental consent if a survey includes questions on the list of prohibited topics.

IV. Recordkeeping Requirements

FERPA also requires that educational organizations maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student (as long as a student's educational records are maintained by the education agency or institution). For each request or disclosure the record must include

  1. the parties who have requested or received personally identifiable information from the education records; and
  2. the legitimate interests the parties had in requesting or obtaining the information.

If the personally identifiable information is disclosed, the educational agency or institution must document

  1. the names of any additional parties to which the receiving party may disclose the information on behalf of the educational agency or institution; and
  2. the legitimate interests under FERPA 99.31 which each of the additional parties has in requesting or obtaining the information.

This does not apply if the request was from, or the disclosure was to

  1. the parent or eligible student;
  2. a school official under 99.31(a)(1);
  3. a party with written consent from the parent or eligible student;
  4. a party seeking directory information; or
  5. a party seeking or receiving the records as directed by a Federal grand jury or other law enforcement subpoena, and the issuing court or other issuing agency has ordered that the existence or the contents of the subpoena or the information furnished in response to the subpoena not be disclosed.

V. Contact Information

U.S. Department of Education
Family Policy Compliance Office (FPCO)
400 Maryland Avenue, SW
Washington, DC 20202–5920
(202) 260–3887

Informal inquiries may be sent to FPCO via the following email addresses: ferpa@ed.gov and ppra@ed.gov.

Top