Education agency administrators and parents share a common interest in ensuring that personal information about children in elementary and secondary schools is kept confidential. Many are unaware of the protection offered by state and federal laws. In this section, we inform administrators and parents about how federal laws protect information maintained in school and education agency records. The guidelines in this section offer practical information to education agency personnel and policymakers on developing procedures that will work for families and schools.
A. Education agencies and institutions that collect and maintain education records are subject to federal privacy laws if they receive funds from the U.S. Department of Education. If information derives from an education record or is maintained in the record, federal as well as state and local privacy rules apply. See Section 2, Guidelines A.
A. Privacy components of laws are administered by federal agencies other than the U.S. Department of Education, and these may be applicable to programs directed in schools.However, the Family Educational Rights and Privacy Act (FERPA) is a comprehensive law that applies broadly to information collected in public agencies or schools that receive federal education funds. Thus, FERPA applies to information collected and maintained by most public elementary, secondary, and postsecondary education institutions and by some private institutions in this country. See Section 2, Guidelines A.
A. No, not typically. Institutions receiving funds from the U.S. Department of Education are legally responsible for complying with these laws. Individual liability would depend on state laws and local policies. See Section 2, Guidelines A1.
A. Strong federal laws protect the privacy of education records in schools. Individuals who work with education records in agencies or schools are responsible for knowing the privacy regulations that apply to their work. Agency administrators need to understand federal and state laws, as well as local policies, that govern parent access to records and restrict inappropriate disclosure of information about students and their families. See Section 2, Guidelines A and B.
A. FERPA and the Protection of Pupil Rights Amendment (PPRA) are the two major laws governing the protection of education records and student and family privacy. The other key laws with specific federal regulatory requirements pertaining to schools are the National School Lunch Act and the Individuals with Disabilities Education Act. See Section 2, Guidelines B to E.
A. FERPA generally prohibits data matches without parent consent except to (1) officials in other schools or school systems where a student intends to enroll; (2) authorized state or federal education representatives; and (3) organizations that are conducting approved studies on behalf of an education agency. Under certain circumstances, school officials can make cooperative data sharing arrangements, but they cannot reveal personally identifiable information. See Section 2, Guidelines B5.
A. A state education agency must provide parents and eligible students with access to education records the agency maintains. Although these agencies are not required to establisha written policy, they are obligated to honor rights of access and to restrict disclosure of information except to authorized individuals. See Section 2, Guidelines B6.
Education agencies and institutions that receive funds from the U.S. Department of Education must adhere to federal privacy laws pertaining to education records of students. These generally include public elementary and secondary schools, school districts, intermediate education agencies, and state education agencies or their representatives. Most private and public colleges and universities are also subject to federal privacy laws because they receive federal funds from the U.S. Department of Education. However, because few private elementary and secondary schools receive federal funds directly, they are rarely subject to these privacy restrictions.
State or local education agencies that conduct programs administered by other federal agencies--the U.S. Departments of Agriculture, Health and Human Services, or Labor, for example--may also be required to meet confidentiality provisions of applicable statutes.
A number of federal laws govern data collections by schools, districts, and state education agencies, and two of those laws apply most broadly: FERPA and PPRA. Exhibits 2-1 and 2-2 contain fact sheets describing FERPA and PPRA. Together, the two laws have far-reaching legal implications for state and local policies and procedures that guide three aspects of education agencies' data collection activities:
In addition to FERPA and PPRA, other federal laws affect school, district, or state education agency data collection, maintenance, and disclosure procedures. Among them are:
The Federal Policy for the Protection of Human Subjects, administered by sixteen federal departments and agencies, establishes procedures for protecting the rights of individuals--including students and families--who participate in federally sponsored research activities and programs. This statute establishes the preliminary rules researchers must follow when they conduct studies sponsored by federal agencies. Although these regulations may apply to data collections by schools, FERPA establishes additional basic disclosure restrictions that guide the treatment of any information collected in schools--whether the activity is sponsored by an education or other agency or individual--if the information either derives from education records or is maintained in those records for any period of time.
The U.S. Congress passed FERPA in 1974 to protect student and family privacy. Also known as the Buckley Amendment, FERPA grants parents certain rights of access to their children's education records and restricts disclosure of information from those records without their consent. It also allows parents and eligible students to amend records they believe to be inaccurate or misleading. Appendices B, C, and D contain the original FERPA regulations,subsequent changes, and the most recently issued regulations. The original FERPA statute and its amendments are incorporated in the U.S. Code (20 USC 1232g). The Federal Register (34 CFR Part 99) contains regulations for administering the law.
This section reflects the 1996 revision of FERPA regulations that resulted from modifications to FERPA made in the Improving America's Schools Act of 1994. The U.S. Department of Education published revised regulations in the Federal Register on November 21, 1996 (pp. 59291-59298), to ensure greater flexibility in implementing the privacy laws pertaining to student records. See Appendix D for a copy of these revised regulations.
The law regards as an education record most information that teachers, school administrators, and education officials maintain about students in a tangible format, whether in electronic, photographic, or paper files. Regardless of where the information about students originates, if it is maintained by schools or education agencies, protecting its privacy is governed by FERPA. School districts, schools or state education agencies, if asked, must comply with parents' or eligible students' requests for access and review.
FERPA requires school districts--but not state education agencies--to notify parents and eligible students annually of their rights under FERPA. Among the changes in FERPA that resulted from the 1996 regulations was the removal of requirements for districts to adopt written policies pertaining to FERPA. Although local written policies are no longer required, regulations continue to encourage districts to develop privacy policies, but they grant agencies the discretion to adopt local implementation procedures and policies. Because state or local privacy protection laws or policies may supplement or refine FERPA, many state and local education agencies establish written policies to ensure the law will be applied uniformly.
Some information about students is not considered an education record and is not subject to access or disclosure rules under FERPA:
If a school district has a policy for disclosing directory information, it must give public notice of what is considered in this category and indicate that parents may refuse to allow the agency to designate any or all of their child's record as directory information. The law requires the notification to specify the period of time in which parents must inform the school or district of any directory information whose release they disallow. Such notification can occur through a school newsletter, student handbook, or some other publication that parents reasonably can be expected to receive.
FERPA regulations require school districts and institutions acting in their behalf to give annual notification to parents and eligible students of their rights to review education records and to request corrections of records they perceive to be inaccurate. Exhibit 2-3 presents a model privacy notification. These regulations apply to the education records maintained in any school, education agency, or institution representing an education agency. FERPA applies to all educational institutions, defined as agencies that provide:
FERPA requires local agencies to provide their annual notification in a manner that "effectively informs" those who have a disability or who speak a primary or home language other than English. Methods for notifying parents may include either providing notice in alternative formats such as audio tape, braille, computer diskette, or large print, or translating information into the native language of requesting parents.
State education agencies are not required by FERPA to have written policies about the rights afforded to the parents of eligible students; however, the law does require state education agencies to let parents and eligible students inspect and review records maintained by the state education agencies. Examples of records state education agencies may maintain are students' state test records, records of special education evaluation or treatment, or records of participation in schooltowork programs.
FERPA also grants records inspection and review rights to eligible students who are over eighteen or who have graduated from high school and are attending a postsecondary education institution. A student under eighteen who is still in high school but is also taking college courses has access to records held by the college, but access rights to records held by the high school stillbelong to the parents. Parents who claim students as dependents for income tax purposes may be given access to school records, even if the rights under FERPA have transferred to the student.
Parents and eligible students may request an explanation or interpretation of their education records, whether these records are held by schools, agencies, or representatives of educational institutions. The agency must respond to requests to review education records within forty-five days of the inquiry. If parents or eligible students believe a record is inaccurate or misleading, they may petition for the record to be amended or changed. The education agency must decide within a reasonable period of time if the request to change the record is consistent with the agency's own assessment of the record's accuracy. The agency cannot destroy records if there is an outstanding request to inspect or review them.
If a request to amend records is denied, the applicant can subsequently appeal the decision in a hearing conducted by the education agency. After the hearing, a parent or eligible student who continues to disagree with the contents of a record can insert an explanation of the objection into the official record, and that explanation must remain with the record as long as it is held by the agency.
FERPA gives either a parent or a legal guardian equal rights to review an education record unless there is evidence of a court order or a law revoking these rights. A parent refers to a natural or adoptive parent, including non-custodial or foster parents, a legal guardian, or an individual acting in the parent's absence. The law grants parent rights to foster parents acting on behalf of the child. Agencies or schools can require parents to verify their relationship with a child before providing access to records. Further specification of eligibility requirements is not stipulated in the federal law but can be detailed in state laws or local policies.
Certain additional restrictions apply to records disclosure procedures. Without consent of the parent or eligible student, education records can be disclosed only to school officials designated as having a "legitimate educational interest." The law leaves to the district the authority to define the criteria for determining the legitimacy of an educational interest, which generally includes situations where officials need to review education records to fulfill their professional responsibilities. This includes access to records by teachers, counselors, and administrators who routinely work with students. The following lists some example situations in which legitimate educational interest prevails:
Disclosure of information to an individual or agency outside the school, school district, or state education agency--a third party--generally is not allowed without prior consent of a parent. Under certain circumstances (e.g., governmentrequired audits, evaluations, or court orders), a district can release records without approval of the parent, but it must make clear the criteria for determining which institution or agency representatives may receive such information and under what conditions. FERPA stipulates that records disclosure without consent of the parent is permissible for the following individuals and organizations:
FERPA generally prohibits matches of computerized education records held by local or state education agencies with data from other agencies. These prohibitions apply broadly, to data sharing about special education programs, evaluating or monitoring the use of federal funds, or coordinating interagency social service assistance to students and families.
Beginning in 1994, the U.S. Congress established penalties for inappropriate release of personally identifiable information from education records by a third party. An agency or institution cannot allow that third party access to personally identifiable information from education records for at least five years.
However, cross-agency cooperative use of information from education records is an area of developing law and interpretation that experts are continually reexamining. States and local government agencies, along with schools, are seeking means to reduce fragmentation and duplication across service systems. Occasionally, interagency partnerships can be formed to exchange information about individual students in a manner that provides useful information but retains the anonymity of an individual student. Those who have experimented with such interagency partnerships are overcoming legal obstacles to collaboration without threatening the confidentiality of students who receive services. We address this topic in greater detail in Section 6.
In addition to reducing the requirements for local education agencies to have written FERPA policies, the 1996 regulations implementing the 1994 Improving America's Schools Act (IASA) clarified several other components of FERPA. The regulations:
PPRA, amended in 1994 by the Goals 2000: Educate America Act, specifies that information collected from students through surveys, research, analyses, or evaluations funded by the U.S. Department of Education must be available for parents to review. If parents ask, the surveys or evaluation materials must be made available for review. Surveys administered under the auspices of federally sponsored programs that are conducted in elementary or secondary schools fall within this law.
Like FERPA, PPRA applies to programs administered by the U.S. Department of Education. PPRA grants parents access to information that local or state education agencies collect from students under the auspices of federally funded activities. Agencies that collect information from students must explain to parents the rights that PPRA affords them. Information to parents must be readily understood by parents with disabilities or whose home language is not English.
PPRA protects the rights of students and their parents in two ways. First, it requires that parents have the opportunity to review certain federal surveys or instructional materials used in conjunction with surveys and to provide consent for their child's participation in them. Second, PPRA requires that state or local education agencies, and their contractors or representatives, obtain prior consent from the parent if they plan to collect information from students concerning:
Parents may register complaints, if they believe their privacy rights under PPRA have been violated, by submitting their complaints directly to the appropriate local or state officials. Federal officials will review unresolved complaints and document local attempts to resolve the complaints.
The Family Policy Compliance Office (FPCO) of the U.S. Department of Education interprets FERPA and PPRA. The office also responds to complaints about interpreting or applying the laws. Any conflicts between PPRA and state laws or local policies should be forwarded for adjudication to the FPCO within forty-five days after the conflict was observed.
The Individuals with Disabilities Education Act (IDEA), Part B, provides grants to states to support the education of children with disabilities ages three to twentyone; Part H supports statesponsored early intervention programs for children from birth through age two. Confidentiality provisions in IDEA incorporate the provisions in FERPA and describe specific applications of the law to records of students with disabilities. The confidentiality regulations under IDEA that go beyond FERPA apply only to the records of children with disabilities who are eligible for special education services under IDEA. Parents of children with disabilities must have the opportunity to inspect all education records associated with the special services their children receive. In particular, they must have access to state or local records pertaining to the identification, evaluation, and education placement of their child and services their child receives.
IDEA confidentiality regulations apply to "participating agencies," defined by the law as any agency or institution that collects, maintains, or uses personally identifiable information. Records of teachers, counselors, and medical or psychological and counseling practitioners within participating agencies who work directly with children in schools fall within IDEA confidentiality provisions. Similarly, IDEA applies to the records of agencies and individuals who are contracted to assess students or render services on behalf of state or local education agencies. Thus, state or local records about the identification, evaluation, and educational placement of their children and the provision of free and appropriate education services may be reviewed by parents and eligible students. This includes cumulative files with any medical or psychological assessment records that are created by specialists outside the school but kept within the school files.
The rules governing the treatment of records of students with disabilities must be well understood both by educators who work directly with families and by administrators whocollect, maintain, and analyze those records. IDEA requires participating agencies to fully inform personnel who collect or use personally identifiable information about their responsibilities for implementing confidentiality provisions. Participating agencies must protect the confidentiality of information at collection, disclosure, and records destruction stages. To accomplish this oversight, one official at each participating agency must assume responsibility for ensuring the confidentiality of information.
The definition of parent under IDEA parallels the FERPA definition and also includes surrogate parents whom the state designates for students without parents. IDEA broadens slightly the definition of parent from FERPA, giving access rights to individuals acting in the place of a parent or legal guardian, such as a grandmother or stepparent with whom a child lives, a surrogate parent the state appoints, or others who might be legally responsible for a child's welfare.
As under FERPA, agencies must also afford privacy rights to eligible students who are over eighteen or attend postsecondary school, even if they are identified for special education services. If necessary, records must be interpreted for those who speak a language other than English or who have disabilities. The law obligates state and local education agencies to comply with requests for access to records within forty-five days after requests are received. In addition, parents have access to records before individualized education program (IEP) meetings or hearings are conducted.
Several other features of IDEA pertain to the confidentiality of records on children with disabilities and exceed FERPA's requirements:
Student records may be protected simultaneously by laws administered by the U.S. Department of Education as well as by other state and federal agencies. FERPA establishes a high level of privacy protection, but statutes administered by agencies within the U.S. Departments of Agriculture, Health and Human Services, and Justice also protect records privacy and may apply to the records of students in schools. Professional standards of ethical practice, under which school doctors and nurses, psychologists, and other professionals operate, may also establish privacy restrictions. Following are some examples:
When uncertainty occurs about when and with whom information should be shared, individuals in schools should act with caution and understand that their fundamental obligation is to maintain confidentiality. School personnel should never share with another individual--even a professional--more than is necessary to benefit the student. Legal counsel and school officials are available to interpret matters where privacy issues are involved. Teachers, paraprofessionals, and principals should not hesitate to consult these individuals when they are uncertain about their obligations or their responsibilities. The references at the end of this section contain additional guidance related to the information presented here.
Individual student records held by schools or education agencies are primarily education records and are therefore subject to FERPA regulations, even when other statutes also may apply. If officials perceive a conflict between FERPA and any state or other federal statutes or regulations, they should seek counsel from appropriate legal authorities to identify the issues involved and to establish policies that accurately reflect applicable legal statutes.
The National School Lunch Act (NSLA), administered by the U.S. Department of Agriculture, provides free or reduced-price meals for eligible students. The NSLA governs the National School Lunch Program, the School Breakfast Program, and the Special Milk Program. It strictly limits how school districts may use individual student and household information obtained as part of the eligibility process or once students are identified to receive program services. The act ensures that neither eligibility nor program identification information may be incorporated into student's education record. Furthermore, the statute establishes criminal penalties for unauthorized disclosures and improper uses of individual school lunch eligibility orenrollment information.
Although the use of information collected under the auspices of the NSLA about individuals is restricted, in 1994 a modification of the law relaxed certain restrictions on how state and local education agencies may use information from NSLA records for legally specified program evaluations and audits. The amendment allowed limited disclosure of information to individuals or agencies that are "directly connected with the administration or enforcement" of the NSLA, as amended in Public Law 104-149, Section 9 (iii). Specifically, education agencies are now permitted to use data about free and reducedprice meal eligibility status for limited federal and state education purposes related to the implementation and evaluation of Title I programs under the Improving America's Schools Act.
In general, state and local education agencies can expect to continue restricting information about students receiving NSLA benefits. The key determinant for allowing disclosure will be a need-to-know, the conditions of which will be defined through future regulations. If an agency's database includes personally identifiable information about students, except where allowable by memoranda of agreement, database managers must impose controls on the disclosure of that information. Before these data can be released, agencies must require potential information users to specify the conditions of confidentiality under which such information will be disclosed. Information provided for one purpose may not be used for another purpose unless the reasons for releasing it again have been defined and approved according to the law.
Regulations restricting the use of information collected under the auspices of the NSLA were not available at the time these guidelines were published. However, a memorandum from the U.S. Department of Education dated March 18, 1996 confirmed that education agencies may use free and reducedprice meal eligibility data for allocating services and for evaluating and reporting of aggregate achievement data pertaining to Title I. See Exhibit 2-6 for a copy of the memorandum.
Federal confidentiality laws and regulations prohibit the disclosure of information about students who apply for or receive alcohol or drug abuse treatment services. The Federal Drug and Alcohol Patient Records Confidentiality Law (42 CFR) is administered by the Substance Abuse and Mental Health Services Administration of the U.S. Department of Health and Human Services. The Department of Health and Human Services confidentiality regulations apply to records of any patient, even a minor student in school, who receives treatment from a federally assisted program. Under the law, patients include students who receive counseling because they are children of alcoholics or drug abusers.
The confidentiality rules, known as 42 CFR, apply to assessment, diagnosis, counseling, group counseling, treatment, or referral for treatment in most programs in which students participate, including programs sponsored by public and many private schools. They forbid the release of any information without a patient's consent, even when the patient is a student inschool and under eighteen years of age.
The 42 CFR restrictions may conflict with the obligations of school-based programs to provide parent access to education records of their student. However, the U.S. Department of Education and the Substance Abuse and Mental Health Services Administration issued a joint opinion in 1990 that suggests potential solutions to this conflict. One solution requires students to consent to parent access to records as a condition of receiving diagnostic, treatment, or referral services; a second solution limits the information kept in school records, recognizing that parents may have access to them. Both solutions are imperfect, however, and school officials are advised to seek information and advice about potential confidentiality conflicts from their state attorney general or from the Family Policy Compliance Office in the U.S. Department of Education. Exhibit 2-7 includes examples of forms pertaining to releasing confidential information and informing patients of their rights under FERPA.
The federal government monitors the paperwork burden of federal legislation through the Paper Reduction Acts of 1980 and 1995, which authorize the Office of Management and Budget (OMB) in the Executive Office of the President to restrict the information that agencies may collect from the public. Federal agencies and non-education agencies receiving federal funds must obtain OMB clearance authorizing each approved data collection instrument or form. An approved information collection form is assigned a clearance number and an expiration date to confirm that it is authorized. Approved federal data collections must explain the data collection purpose prominently on the form, whether the data collection is mandated or voluntary, and the benefit(s) to be obtained from the data collection.
The clearance process also requires that plans for data collection stipulate how the data are to be used, along with provisions for ensuring confidentiality of any personal data collected. OMB clearance is not required for the clearance of state or local forms, however. OMB clearance ensures that requests for information from student records meet the requirements of FERPA. It is unlikely than any records requiring release of personally identifiable information would be requested in OMB-approved data collections.
Section 7(a) of the Privacy Act of 1974 addresses the use of social security numbers by federal, state, or local governments. It states that it is
A number of private and public agencies monitor federal activity on privacy and confidentiality issues. In the federal government, the Office of Information and Regulatory Affairs (OIRA) in OMB of the Executive Office of the President, oversees the implementation of major privacy laws. For each law, specific agency offices respond to questions and complaints from citizens. As new issues arise and the U.S. Congress passes new laws, these agencies develop regulations that define the regulations for applying the laws.
Two federal offices can respond to questions. First, the U.S. Department of Education can assist in interpreting FERPA and PPRA and respond to complaints about the interpretation or application of these laws through:
Second, the Information Resources Group can provide additional information about broad issues administered by OMB:
The Council of Chief State School Officers (CCSSO), working with representatives of state education agencies, is also monitoring the evolution of privacy laws. As the need arises, CCSSO will develop public information to clarify the legal responsibilities and obligations of state and local school officials and concerned parents. Additional information can be obtained by contacting:
Other national groups have organized to monitor and interpret privacy implications of federal laws about the education, health, and social services for children. Among them are the following organizations that provide information and respond to questions:
American Association of Collegiate Registrars and Admission Officers. 1995. Guidelines for postsecondary institutions for implementation of the Family Educational Rights and Privacy Act of 1974 as amended. Washington, DC: American Association of Collegiate Registrars and Admission Officers.
Gelfman, M., and Schwab, N. 1991. School health services and educational records: Conflicts in the law. Education Law Reporter, 64: 319338.
Legal Action Center. 1996. Handbook: Legal issues for schoolbased programs, 2nd edition. New York: Author.
Panel on Confidentiality and Data Access [of the] Committee on National Statistics, Commission on Behavioral and Social Sciences and Education, National Research Council, and the Social Science Research Council. 1993. Private lives and public policies: Confidentiality and accessibility of government statistics. Washington, DC: National Academy Press.
Oakland (Michigan) Schools. 1992. Resource handbook for School administrators: Confidentiality requirements of general education and handicapped student education records. Waterford, MI: Department of Pupil Services, Oakland Schools.
Schwab, N., and Gelfman, M. 1991. School health records: Nursing practice and the law. School Nurse, 7(2), 1721.
Seigler, G. E. 1996. What should be the scope of privacy protection for student health records? A look at Massachusetts and federal law. Journal of Law and Education, 25 (2): 237269.
Soler, M.I., and Peters, C.M. 1993. Who should know what? Confidentiality and information sharing in service integration, Resource Brief 3. New York: National Center for Service Integration, Columbia University.
For questions about the content of this product, please contact Lee M. Hoffman.