Agencies or schools should maintain records of access, retrieval, or release of records, including the names of persons retrieving records and the purposes for each release, and a list of personnel authorized to have access to the file. They should also maintain a record of user requests for data that have been denied or only partially fulfilled. Such information can be used for periodic reviews of agency confidentiality and data release policies.
Information about releases with or without prior consent of the parent should remain with the education record as long as the record is maintained. It is a good practice to document all access and release. However, documentation is not required if the request was made by or release was made to the most common users: