Family Educational Rights and Privacy Act (FERPA)

1. Do parents and eligible students have to provide consent before a school discloses personally identifiable information from education records?

Generally, yes. A parent or eligible student must provide written consent before a school or school district discloses personally identifiable information from the student’s education records, unless one of the exceptions to FERPA’s general consent rule applies. (See Q&A 8.) FERPA requires that a consent form be signed and dated by the parent or eligible student and (1) specify the records that may be disclosed; (2) state the purpose of the disclosure; and (3) identify the party or class of parties to whom the disclosure may be made. 34 CFR § 99.30(b).

2. How does FERPA define “parent”?

Under FERPA, a “parent” means a parent of a student and includes a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or guardian. 34 CFR § 99.3 definition of “Parent.” Additionally, in the case of the divorce or separation of a student’s parents, schools are required to give full rights under FERPA to either parent, unless the school has been provided with evidence that there is a court order, State statute, or legally binding document relating to such matters as divorce, separation, or custody that specifically revokes these rights. 34 CFR § 99.4.

3. If a student is separated from his or her parent or guardian and is in the care of another individual who is acting as a parent in the absence of a parent or a guardian, can that individual have access to the student’s education records and provide consent for disclosures under FERPA?

Generally, yes. If a student is living in the care of an individual on a day-to-day basis who is not his or her natural parent or guardian, such as a grandmother, another relative, or a family friend, that individual may be considered a “parent” under FERPA. As such, he or she may have access to the student’s education records and may provide consent for disclosures of information from the student’s education records. The definition of “parent” is more specific under 34 CFR § 3 300.30 of IDEA and school officials should be familiar with those requirements. See also 34 CFR § 300.519 of IDEA.

4. How does FERPA define “eligible student”?

An “eligible student” means a student who has reached 18 years of age or is attending a postsecondary institution at any age. 34 CFR § 99.3 definition of “Eligible student.” This means that, at the secondary level, once a student turns 18, all the rights that once belonged to his or her parents transfer to the student. However, a secondary school or postsecondary institution may still provide an eligible student’s parents with access to education records, without the student’s consent, if the student is claimed as a dependent for IRS tax purposes. Other exceptions to FERPA’s general consent rule may also apply, such as disclosures to parents in a health or safety emergency. 34 CFR § 99.5(a)(1)-(2).

5. Can elementary and secondary schools provide FERPA rights to minor students in addition to those provided to their parents?

Yes. FERPA permits an elementary and secondary school to provide students, who are not eligible students, rights in addition to those given to their parents, as long as it does not supersede the rights of parents under FERPA. For example, a school may permit a minor student to inspect and review his or her education records, but the school would be required to provide parents access to the records. 34 CFR § 99.5(b).

6. Do students who are on their own and not in the physical custody of a parent or guardian have rights under FERPA?

FERPA does not specifically afford minors who are separated from their parents the rights that are afforded to parents and eligible students under the law. However, schools may use their judgment in determining whether an unaccompanied minor is responsible enough to exercise certain privileges, such as inspecting and reviewing education records and providing consent for disclosure. 34 CFR § 99.5(b).

7. What are the specific rights that parents and eligible students have under FERPA?

FERPA provides that an educational agency or institution that receives Department funds may not have a policy or practice of denying parents and eligible students the right to:

· Inspect and review education records (34 CFR § 99.10);

· Seek to amend education records (34 CFR §§ 99.20, 99.21, and 99.22); and

· Consent to the disclosure of personally identifiable information from education records except as specified by law (34 CFR §§ 99.30 and 99.31).

8. What are the exceptions to FERPA’s consent requirement that would permit a school to disclose personally identifiable information from a student’s education records to an outside party in connection with a disaster?

Directory Information

Depending on the circumstances, several exceptions to FERPA’s general consent requirement might apply to disclosing students’ personally identifiable information from their education records in a disaster. In some situations, the disclosure of “directory information” on students might suffice. Directory information means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. 34 CFR § 99.3 definition of “Directory information.” “Directory information” includes items such as the student’s name, address, telephone listing, and e-mail address. At the elementary/secondary school level, the parents’ names may also be considered “directory information.” FERPA has certain requirements that schools must follow in designating “directory information” (see 34 CFR § 99.37) and may not disclose “directory information” on those students whose parents have opted out (or when the eligible student has opted out). In a situation in which a flood or some other disaster has displaced families from their homes and children are brought to a shelter, the school may disclose “directory information” to an emergency management agency that is trying to locate the parents.

Health or Safety Emergency

In some situations, a school may determine that it is necessary to disclose non-directory information to appropriate parties in order to address a disaster or other health or safety emergency. FERPA permits school officials to disclose, without consent, education records, or personally identifiable information from education records, to appropriate parties (see Q&A 9) in connection with an emergency, if knowledge of that information is necessary to protect the health or safety of the student or other individuals. See 34 CFR §§ 99.31(a)(10) and 99.36. This exception to FERPA’s general consent requirement is temporally limited to the period of the emergency and generally does not allow for a blanket release of personally identifiable information from the student’s education records.

Under this health or safety emergency provision, an educational agency or institution is responsible for making a determination whether to make a disclosure of personally identifiable information on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of the student or others. If the school district or school determines that there is an articulable and significant threat to the health or safety of the student or other individuals and that a party needs personally identifiable information from education records to protect the health or safety of the student or other individuals, it may disclose that information to such appropriate party without consent. 34 CFR § 99.36. This is a flexible standard under which the Department defers to school administrators so that they may bring appropriate resources to bear on the situation, provided that there is a rational basis for the educational agency’s or institution’s decisions about the nature of the emergency and the appropriate parties to whom information should be disclosed. We note also that, within a reasonable period of time after a disclosure is made under this exception, an educational agency or institution must record in the student’s education records the articulable and significant threat that formed the basis for the disclosure and the parties to whom information was disclosed. 34 CFR § 99.32(a)(5).5.

Judicial Order or Lawfully Issued Subpoena

Another provision in FERPA that permits disclosure without consent is a disclosure that is necessary to comply with a lawfully issued subpoena or judicial order. A school generally must make a reasonable effort to notify the parent or eligible student of the subpoena or judicial order before complying with it in order to allow the parent or eligible student to seek protective action, unless certain exceptions apply. 34 CFR § 99.31(a)(9). This exception could be used when an emergency no longer exists or the party seeking personally identifiable information from students’ education records would not typically be considered an “appropriate party” under the health or safety emergency exception to general consent.

9. Under the health or safety emergency provision, who is considered an “appropriate party”?

Typically, law enforcement officials, public health officials, trained medical personnel, and parents (including parents of an eligible student) are the types of appropriate parties to whom information may be disclosed under this FERPA exception. In some situations, State and local emergency management agencies who are coordinating a disaster response might be considered appropriate parties if their knowledge of the information is necessary to protect the health or safety of the student or other individuals. Students who are separated from their families may have serious medical needs. A school could disclose information about the student’s medication or special needs to appropriate officials who are seeking to address those needs.

10. In connection with a disaster, such as a flood, would FERPA permit school officials to disclose to public health authorities immunization records to determine whether or not students are vaccinated for typhus or other water borne illnesses?

FERPA would generally permit school officials to disclose immunization and other education records to public health authorities under the health or safety emergency provision of FERPA if it is in connection with a health or safety emergency and the knowledge of the information disclosed was necessary to protect the health and safety of the students or other individuals. 34 CFR § 99.36.

11. In situations in which the education records of an LEA are destroyed during a disaster, when are SEAs permitted under FERPA to nonconsensually redisclose personally identifiable information from education records?

In some cases, State educational agencies (SEAs) have education records on students. Under FERPA, SEAs would be permitted to nonconsensually redisclose personally identifiable information from the education records of students, on behalf of the school, under any of the exceptions to the general consent requirement that might apply, such as disclosing records to a new school under its enrollment provision. 34 CFR § 99.35(b)(1). SEAs that make nonconsensual redisclosures of personally identifiable information from education records on behalf of a school or school district need to ensure that the recordation requirements set forth in 34 CFR § 99.32 have been met.

12. Does an interagency agreement with other State or local agencies enable a school to nonconsensually disclose education records?

No. Interagency agreements do not supersede the consent requirements under FERPA. Although an interagency agreement would be a helpful tool for planning purposes, schools must comply with FERPA’s requirements regarding the disclosure of personally identifiable information from students’ education records.

13. Does FERPA permit a school to nonconsensually disclose personally identifiable information on students to State or local agencies in emergency preparation activities?

No. Disclosures under FERPA’s health or safety emergency provision do not include disclosures to address the threat of a possible or eventual disaster or other emergency for which the likelihood of occurrence is unknown, such as would be addressed in emergency preparedness activities. As explained previously, disclosures made under the health or safety emergency provision must be “in connection with an emergency,” which means to be related to the threat of an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease. (See the guidance on FERPA and disclosures concerning H1N1 at: http://www2.ed.gov/policy/gen/guid/fpco/pdf/ferpa-h1n1.pdf.) However, properly designated “directory information” on students whose parents have not opted out of the disclosure of “directory information” may be disclosed to State or local agencies for emergency preparation purposes. Additionally, information on students that has been properly de-identified, such as the number of students in a school who have been vaccinated for a particular disease or the number of students with disabilities, may be disclosed, as long as the school has made a reasonable determination that a student’s identity is not personally identifiable by the disclosure. See 34 CFR § 99.31(b). If school officials believe that, in order to make transportation or other accommodations as part of its emergency preparation activities, it needs to disclose to emergency preparation partners information on students with disabilities, who have special needs, or who are taking special medications, parents of these students or the eligible students must provide consent for this disclosure.

14. Is the school required to record disclosures of information provided to an outside party, even in connection with a disaster or other health or safety emergency?

Yes. FERPA generally requires that schools maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student. 34 CFR § 99.32(a)(1). Moreover, when making a disclosure under the health or safety emergency provision in FERPA, schools are specifically required to record the articulable and significant threat to the health or safety of a student or other individuals that formed the basis for the disclosure and the parties to whom the school disclosed the information. 34 CFR § 99.32(a)(5). The record must be maintained with the education records of each student as long as the records are maintained. 34 CFR § 99.32(a)(2). This requirement enables parents and eligible students who do not provide consent for disclosure of education records to see the circumstances under which and the parties to whom their information was disclosed. However, schools are not required to record disclosures that are made for which the parent or eligiblestudent has provided consent, nor are they required to record the disclosure of “directory information.” 34 CFR § 99.32(d)(3)-(4).