About the Document

We developed the guidelines presented in this document by using information obtained from a variety of sources and representing the best practices currently used in the relevant subjects. In preparing this document, we reviewed published books and reports, as well as policies and procedures adopted at the national, state, district, and institutional levels. 

---

Possible Users of This Document

Many members of the education community have access to confidential information. This document addresses the need for the members of the education community to understand their legal responsibilities and to develop procedures to maintain the privacy of student records. Persons who may use the information in this document include:
 
State education agency staff need to understand the legal requirements and implement proper management procedures and controls at the state level when they collect personally identifiable student information. This document can help state education agency staff to identify ways to ensure that data providers and users are informed of their rights and responsibilities when handling personally identifiable as well as aggregate data. State education agency staff also have a responsibility to advise school and school district staff on proper policies and procedures to ensure privacy.

State or local policymakers need to understand the legal requirements and identify the areas in which rules, regulations, policies, or guidelines are needed.

School district staff who maintain student records or data need to understand the legal requirements of federal and state laws and local regulations that protect the privacy of the records. They must develop proper policies that specify the roles of staff and the steps that are required to make the policies operational.

School administrators or staff who maintain files about students in their schools need to know how to handle requests for information about students and how to restrict access to student records. They also need to notify parents or eligible students of their rights under FERPA.

Program and support services staff at the district or state level need to understand their rights to see personally identifiable information about students as well as their responsibilities to share information only with appropriate persons.

Technical staff need to plan for the appropriate technical configurations to manage the security of the information system effectively.

Teachers and other school-based support professionals who receive numerous formal or informal requests from colleagues or outsiders for information about their students need to know that policies are in place to ensure the appropriate maintenance and release of personally identifiable data.

Parents, researchers, and others outside the education community could use this document to learn more about the kinds of safeguards and restrictions that need to be implemented in schools and other places where student data are maintained. However, we have focused the information in this document on education agencies and staff.
 
Throughout this document, we identify the intended audiences at the beginning of each section. Readers may select the appropriate contents that address their specific interests and needs.


---

Organization and Format of the Document

We have divided this document into six sections. Sections 2 to 6 identify the intended audience(s) and list commonly asked questions for which detailed answers may be found in the text. The text discusses general guidelines and provides examples of effective practices, sample forms, and references to other sources.

Section 1: A Primer for Privacy

Section 1 provides an overview of the issues and discusses important concepts and terminology used throughout the document. The section also presents the organization and contents of the document.

Section 2: Summary of Key Federal Laws

Section 2 describes federal laws protecting the privacy of students that have implications for the maintenance and release of student data by state and local education agencies. You are encouraged to identify relevant state laws and local regulations that also apply.

Section 3: Protecting the Privacy of Individuals during the Data Collection Process

Section 3 describes appropriate procedures for collecting individual information about students.

Section 4: Securing the Privacy of Data Maintained and Used within an Agency

Section 4 describes the management controls and policies needed to maintain and use data withinthe agency or school. This section addresses the issue of assessing who in an agency or school has a "legitimate educational interest" in specific information about an individual student.

Section 5: Providing Parents Access to Their Child's Records

Section 5 pertains to procedures for providing access to a student's education record by the eligible student or the parent.

Section 6: Releasing Information Outside an Agency

Section 6 suggests procedures for handling external requests, including the public, researchers, and other service professionals, to release information from individual student records.

The Appendices contain the text of key federal rules and regulations. The appendices, which immediately follow the text, provide the complete text of key federal rules and regulations discussed in this document. We encourage you to search for and include in this section your states' laws or statutes that further govern the privacy of education records.
 
 

Suggested Citation

U.S. Department of Education.  National Center for Education Statistics.  Protecting the Privacy of Student Records, NCES 97-527, by Oona Cheung, Barbara Clements, and Ellen Pechman.  Washington, DC: 1997.

 
For questions about the content of this product, please contact Lee M. Hoffman.