The Family Educational Rights and Privacy Act (FERPA)

What is FERPA?

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. Enacted in 1974 and also known as the Buckley Amendment, FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education.

The primary purposes of FERPA are to ensure that parents and students have access to their educational records while protecting the privacy of those records from unauthorized disclosure. FERPA gives parents certain rights with respect to their children's education records, which transfer to the student at age 18 or upon attendance at a postsecondary institution.

Who is Protected Under FERPA?

FERPA protects the education records of students who are currently enrolled or formerly enrolled at an educational institution. The rights under FERPA transfer from the parents to the student when the student:

• Turns 18 years old, or
• Begins attending an institution of postsecondary education (such as a college or university)

Once these rights transfer to the student, the parents no longer have the right to access the student's records without the student's consent. However, parents may still access records if the student is claimed as a dependent for tax purposes. Schools may require proof of dependency, such as a tax return, before releasing records to parents without student consent.

FERPA does not apply to:

• Records of applicants who are denied admission
• Alumni records
• Records of deceased students

Rights Under FERPA

FERPA grants students and their parents (when the student is a minor or dependent) several specific rights regarding their education records:

1. Right to Inspect and Review Records

Students and eligible parents have the right to inspect and review the student's education records maintained by the school. Schools must comply with a request for access to records within a reasonable period of time, but no more than 45 days after receiving the request. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

2. Right to Request Amendment of Records

Students and eligible parents have the right to request that a school correct records they believe to be inaccurate, misleading, or in violation of the student's privacy rights under FERPA. If the school decides not to amend the record as requested, the school must inform the parent or eligible student of their right to a hearing. After the hearing, if the school still refuses to amend the record, the parent or eligible student has the right to place a statement with the record commenting on the contested information and setting forth reasons for disagreeing with the school's decision.

3. Right to Consent to Disclosures

Generally, schools must have written permission from the eligible student or parent to release any information from a student's education record. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions:

• School officials with legitimate educational interest
• Other schools to which a student is transferring
• Specified officials for audit or evaluation purposes
• Appropriate parties in connection with financial aid to a student
• Organizations conducting studies for or on behalf of the school
• Accrediting organizations
• To comply with a judicial order or lawfully issued subpoena
• Appropriate officials in cases of health and safety emergencies
• State and local authorities within a juvenile justice system

4. Right to File a Complaint

Students and eligible parents have the right to file a complaint with the U.S. Department of Education concerning alleged failures by the school to comply with the requirements of FERPA. The appropriate office to contact is:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202

Exceptions to FERPA Privacy Requirements

While FERPA generally requires written consent for the disclosure of personally identifiable information from education records, there are several important exceptions that educational institutions should be aware of:

Directory Information

Schools may disclose, without consent, "directory information" such as a student's name, address, telephone number, date and place of birth, honors and awards, dates of attendance, and other similar information. However, schools must:

• Notify parents and eligible students annually of the types of information designated as directory information
• Provide a reasonable period of time after notification for parents or eligible students to request that the school not disclose directory information without prior consent
• Honor requests from parents or eligible students to prevent disclosure of directory information

Legitimate Educational Interest

School officials with a legitimate educational interest may access student records without consent. A school official typically has a legitimate educational interest if the official needs to review an education record in order to fulfill his or her professional responsibilities for the school.

Schools must determine who constitutes a school official and what constitutes a legitimate educational interest in their annual FERPA notification.

Lawfully Issued Subpoenas and Court Orders

Schools may disclose education records without consent in compliance with a lawfully issued subpoena or court order, provided they:

• Make a reasonable effort to notify the parent or eligible student of the subpoena or court order in advance of compliance
• Unless the subpoena or court order specifically prohibits notification
• Respond to the subpoena in a timely manner

Health and Safety Emergencies

Schools may disclose personally identifiable information from education records without consent to appropriate parties in connection with a health or safety emergency if knowledge of the information is necessary to protect the health and safety of the student or other individuals.

This exception requires schools to make a case-by-case determination of whether there is an articulable and significant threat to the health or safety of a student or other individuals, and whether the information is necessary to protect against that threat.

Research Studies

Educational agencies and institutions may, under certain conditions, disclose education records without consent to organizations conducting studies for, or on behalf of, educational agencies or institutions to develop, validate, or administer predictive tests, administer student aid programs, or improve instruction.

Schools must ensure that the study is conducted in a way that does not permit personal identification of students to anyone other than representatives of the organization with legitimate interests, and that the information is destroyed when no longer needed for the purposes for which the study was conducted.

FERPA Compliance Requirements

Educational institutions that receive federal funding must implement policies and procedures to comply with FERPA requirements:

• Adopting a written policy regarding the disclosure of directory information
• Notifying parents and eligible students annually of their rights under FERPA
• Maintaining a record of requests for and disclosures of information from education records
• Establishing procedures for parents and eligible students to inspect and review education records
• Providing opportunities for parents and eligible students to request amendment of education records
• Training staff on FERPA requirements and ensuring proper handling of student records

Annual Notification Requirements

Schools must notify parents and eligible students annually of their rights under FERPA. The notice must include:

• The rights of parents and eligible students to inspect and review the student's education records
• The intent of the school to limit the disclosure of personally identifiable information contained in the student's education records, except as permitted by FERPA
• The right of parents and eligible students to seek to amend parts of the student's education records that they believe to be inaccurate, misleading, or in violation of the student's rights
• The right of parents and eligible students to file a complaint with the Department of Education concerning alleged failures by the school to comply with FERPA

Record Keeping Requirements

Schools must maintain records of requests for and disclosures of education records. The record must indicate the parties who have requested or received personally identifiable information from education records and the legitimate interests those parties had in requesting or obtaining the information.

These records are maintained for as long as the education records are kept by the school.

Consequences of Non-Compliance

Failing to comply with FERPA can have serious consequences for educational institutions. The U.S. Department of Education may investigate complaints and can take several actions if it finds a violation:

• Withholding further federal funds from the institution
• Issuing a notice of non-compliance
• Requiring the school to develop a corrective action plan
• Referring the case to the U.S. Department of Justice for legal action

Individuals do not have the right to sue schools for FERPA violations. Only the U.S. Department of Education can enforce FERPA.

FERPA in the Digital Age

With the increasing use of technology in education, FERPA has been interpreted to apply to electronic student records and data as well. Schools must ensure that:

• Student information in educational apps and online learning platforms is protected
• Electronic security measures are in place to prevent unauthorized access to student records
• Providers of educational technology services are aware of their FERPA obligations when handling student data
• Cloud-based storage of student records meets FERPA requirements

Protecting Student Data in Educational Technology

When selecting and using educational technology, schools should:

• Review the privacy policies and data security practices of vendors
• Ensure that vendors understand their obligations under FERPA when acting as school officials
• Consider the minimum data necessary for educational purposes when collecting student information
• Implement appropriate security measures for electronic records, including encryption and access controls

Online Learning and Educational Apps

Many educational apps and online learning platforms collect and store student data. When using these tools, schools must maintain control over personally identifiable information from education records. This means that:

• The school must have direct control over the data
• The service provider must use the data only for educational purposes as instructed by the school
• The service provider must protect the data as required by FERPA

Recent guidance from the U.S. Department of Education has addressed how FERPA applies to emerging technologies and clarified the responsibilities of schools and third-party service providers in protecting student privacy in the digital environment.

FERPA Resources

For more information about FERPA, consult these resources:

• U.S. Department of Education Family Policy Compliance Office: The official source for FERPA information, guidance, and regulations. Visit their website for the most current information.
• FERPA Regulations: The full text of FERPA regulations is available in Title 34 of the Code of Federal Regulations, Part 99.
• FERPA Guidance Documents: The Department of Education publishes various guidance documents, including "Protecting Student Privacy While Using Online Educational Services" and "Model Notification of Rights for Elementary and Secondary Schools."
• Professional Development: Many educational organizations offer FERPA training for administrators, teachers, and other school personnel.