Family Educational Rights and Privacy Act (FERPA)
Process

Document Number: RIGHTTOKNOW--002pr Revision #: 1.0
Document Owner: Executive VP Date Last Updated: 08/17/2012
Primary Author: Executive VP Status: Approved
Date Originally Created: 05/25/2012

General Description Process Overview Process Steps or Stages
Performance Metrics Subject Experts Regulations

General Description
Description / Scope:

Information relative to the Family Educational Rights and Privacy Act (FERPA) relative to Student Right-to-Know.


When Performed:

Annually


Responsibilities: Administration
Executive VP
Legal Counsel

Terms and Definitions: Additional training

Corrective Action

Back to Top Back to Top

Process Overview
1.

Introduction

2.

Summary

3.

Background

4.

Questions and Answers Relative to FERPA

5.

Additional Resources

Back to Top Back to Top

Process Steps or Stages
1.

Introduction


What happens:

The purpose of this guidance is to answer questions that have arisen about the sharing of personally identifiable information from students’ education records to outside parties when responding to emergencies, including natural or man-made disasters. Understanding how, what, and when information can be shared with outside parties is an important part of emergency preparedness.


Who Performs / Responsibility:

Administration, Executive VP, Legal Counsel


Requirements:

Policy and Procedure Handbook


2.

Summary


What happens:

The Family Educational Rights and Privacy Act (FERPA) prohibits a school from disclosing personally identifiable information from students’ education records without the consent of a parent or eligible student, unless an exception to FERPA’s general consent rule applies. In some emergency situations, schools may only need to disclose properly designated “directory information” on students that provide general contact information. In other scenarios, school officials may believe that a health or safety emergency exists and more specific information on students should be disclosed to appropriate parties. Understanding the options available under FERPA empowers school officials to act quickly and decisively when concerns arise. FERPA is not intended to be an obstacle in addressing emergencies and protecting the safety of students.


Who Performs / Responsibility:

Administration, Executive VP, Legal Counsel


Requirements:

Policy and Procedure Handbook


3.

Background


What happens:

FERPA (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. The law applies to all educational agencies and institutions that receive funds under any program administered by the Department of Education (“Department”). In this guidance, when we refer to “school districts,” “schools,” or “postsecondary institutions” we mean “educational agencies and institutions” subject to FERPA. Private schools at the elementary and secondary school levels generally do not receive funds from the Department and are, therefore, not subject to FERPA.

FERPA gives parents certain rights with respect to their children’s education records at elementary and secondary schools that are subject to FERPA’s requirements. These rights transfer to the student when he or she reaches the age of 18 or attends a postsecondary institution at any age (“eligible student”). Under FERPA, a parent or eligible student must provide a signed and dated written consent before a school discloses personally identifiable information from the student’s education records. 34 CFR § 99.30. See 34 CFR § 99.3 for the definition of “personally identifiable information.” Exceptions to the general consent requirement are set forth in § 99.31 of the FERPA regulations. The term “education records” is defined as those records that are: (1) directly related to a student; and (2) maintained by an educational agency or institution, or by a party acting for the agency or institution. See 34 CFR § 99.3 for the definition

of “education records” and a list of records that are not included in the definition. Accordingly, all records, including immunization and other health records, as well as records on services provided to students under the Individuals with Disabilities Education Act (IDEA) and records on services and accommodations provided to students under Section 504 of the Rehabilitation Act of 1973 and Title II of the Americans with Disabilities Act of 1990, that are directly related to a student and maintained by a school are “education records” under FERPA.

 

The questions and answers below provide guidance to school officials on how FERPA applies to disclosures of students’ personally identifiable information that relate to natural or man-made disasters that affect students and their families. This guidance explains the various provisions in FERPA that might relate to and permit such disclosures, and addresses how FERPA applies to schools working with other agencies in emergency preparedness activities.


Who Performs / Responsibility:

Registrar, Administration, Executive VP, Legal Counsel


4.

Questions and Answers Relative to FERPA


What happens:

1. Do parents and eligible students have to provide consent before a school discloses personally identifiable information from education records?

 

Generally, yes. A parent or eligible student must provide written consent before a school or school district discloses personally identifiable information from the student’s education records, unless one of the exceptions to FERPA’s general consent rule applies. (See Q&A 8.) FERPA requires that a consent form be signed and dated by the parent or eligible student and (1) specify the records that may be disclosed; (2) state the purpose of the disclosure; and (3) identify the party or class of parties to whom the disclosure may be made. 34 CFR § 99.30(b).

 

2. How does FERPA define “parent”?

 

Under FERPA, a “parent” means a parent of a student and includes a natural parent, a guardian, or an individual acting as a parent in the absence of a parent or guardian. 34 CFR § 99.3 definition of “Parent.” Additionally, in the case of the divorce or separation of a student’s parents, schools are required to give full rights under FERPA to either parent, unless the school has been provided with evidence that there is a court order, State statute, or legally binding document relating to such matters as divorce, separation, or custody that specifically revokes these rights. 34 CFR § 99.4.

 

3. If a student is separated from his or her parent or guardian and is in the care of another individual who is acting as a parent in the absence of a parent or a guardian, can that individual have access to the student’s education records and provide consent for disclosures under FERPA?

 

Generally, yes. If a student is living in the care of an individual on a day-to-day basis who is not his or her natural parent or guardian, such as a grandmother, another relative, or a family friend, that individual may be considered a “parent” under FERPA. As such, he or she may have access to the student’s education records and may provide consent for disclosures of information from the student’s education records. The definition of “parent” is more specific under 34 CFR § 3 300.30 of IDEA and school officials should be familiar with those requirements. See also 34 CFR § 300.519 of IDEA.

 

4. How does FERPA define “eligible student”?

 

An “eligible student” means a student who has reached 18 years of age or is attending a postsecondary institution at any age. 34 CFR § 99.3 definition of “Eligible student.” This means that, at the secondary level, once a student turns 18, all the rights that once belonged to his or her parents transfer to the student. However, a secondary school or postsecondary institution may still provide an eligible student’s parents with access to education records, without the student’s consent, if the student is claimed as a dependent for IRS tax purposes. Other exceptions to FERPA’s general consent rule may also apply, such as disclosures to parents in a health or safety emergency. 34 CFR § 99.5(a)(1)-(2).

 

5. Can elementary and secondary schools provide FERPA rights to minor students in addition to those provided to their parents?

 

Yes. FERPA permits an elementary and secondary school to provide students, who are not eligible students, rights in addition to those given to their parents, as long as it does not supersede the rights of parents under FERPA. For example, a school may permit a minor student to inspect and review his or her education records, but the school would be required to provide parents access to the records. 34 CFR § 99.5(b).

 

6. Do students who are on their own and not in the physical custody of a parent or guardian have rights under FERPA?

 

FERPA does not specifically afford minors who are separated from their parents the rights that are afforded to parents and eligible students under the law. However, schools may use their judgment in determining whether an unaccompanied minor is responsible enough to exercise certain privileges, such as inspecting and reviewing education records and providing consent for disclosure. 34 CFR § 99.5(b).

 

7. What are the specific rights that parents and eligible students have under FERPA?

 

FERPA provides that an educational agency or institution that receives Department funds may not have a policy or practice of denying parents and eligible students the right to:

· Inspect and review education records (34 CFR § 99.10);

· Seek to amend education records (34 CFR §§ 99.20, 99.21, and 99.22); and

· Consent to the disclosure of personally identifiable information from education records except as specified by law (34 CFR §§ 99.30 and 99.31).

 

8. What are the exceptions to FERPA’s consent requirement that would permit a school to disclose personally identifiable information from a student’s education records to an outside party in connection with a disaster?

 

Directory Information 

Depending on the circumstances, several exceptions to FERPA’s general consent requirement might apply to disclosing students’ personally identifiable information from their education records in a disaster. In some situations, the disclosure of “directory information” on students might suffice. Directory information means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. 34 CFR § 99.3 definition of “Directory information.” “Directory information” includes items such as the student’s name, address, telephone listing, and e-mail address. At the elementary/secondary school level, the parents’ names may also be considered “directory information.” FERPA has certain requirements that schools must follow in designating “directory information” (see 34 CFR § 99.37) and may not disclose “directory information” on those students whose parents have opted out (or when the eligible student has opted out). In a situation in which a flood or some other disaster has displaced families from their homes and children are brought to a shelter, the school may disclose “directory information” to an emergency management agency that is trying to locate the parents.

 

Health or Safety Emergency

In some situations, a school may determine that it is necessary to disclose non-directory information to appropriate parties in order to address a disaster or other health or safety emergency. FERPA permits school officials to disclose, without consent, education records, or personally identifiable information from education records, to appropriate parties (see Q&A 9) in connection with an emergency, if knowledge of that information is necessary to protect the health or safety of the student or other individuals. See 34 CFR §§ 99.31(a)(10) and 99.36. This exception to FERPA’s general consent requirement is temporally limited to the period of the emergency and generally does not allow for a blanket release of personally identifiable information from the student’s education records.

 

Under this health or safety emergency provision, an educational agency or institution is responsible for making a determination whether to make a disclosure of personally identifiable information on a case-by-case basis, taking into account the totality of the circumstances pertaining to a threat to the health or safety of the student or others. If the school district or school determines that there is an articulable and significant threat to the health or safety of the student or other individuals and that a party needs personally identifiable information from education records to protect the health or safety of the student or other individuals, it may disclose that information to such appropriate party without consent. 34 CFR § 99.36. This is a flexible standard under which the Department defers to school administrators so that they may bring appropriate resources to bear on the situation, provided that there is a rational basis for the educational agency’s or institution’s decisions about the nature of the emergency and the appropriate parties to whom information should be disclosed. We note also that, within a reasonable period of time after a disclosure is made under this exception, an educational agency or institution must record in the student’s education records the articulable and significant threat that formed the basis for the disclosure and the parties to whom information was disclosed. 34 CFR § 99.32(a)(5).5.

 

Judicial Order or Lawfully Issued Subpoena

Another provision in FERPA that permits disclosure without consent is a disclosure that is necessary to comply with a lawfully issued subpoena or judicial order. A school generally must make a reasonable effort to notify the parent or eligible student of the subpoena or judicial order before complying with it in order to allow the parent or eligible student to seek protective action, unless certain exceptions apply. 34 CFR § 99.31(a)(9). This exception could be used when an emergency no longer exists or the party seeking personally identifiable information from students’ education records would not typically be considered an “appropriate party” under the health or safety emergency exception to general consent.

 

9. Under the health or safety emergency provision, who is considered an “appropriate party”?

 

Typically, law enforcement officials, public health officials, trained medical personnel, and parents (including parents of an eligible student) are the types of appropriate parties to whom information may be disclosed under this FERPA exception. In some situations, State and local emergency management agencies who are coordinating a disaster response might be considered appropriate parties if their knowledge of the information is necessary to protect the health or safety of the student or other individuals. Students who are separated from their families may have serious medical needs. A school could disclose information about the student’s medication or special needs to appropriate officials who are seeking to address those needs.

 

10. In connection with a disaster, such as a flood, would FERPA permit school officials to disclose to public health authorities immunization records to determine whether or not students are vaccinated for typhus or other water borne illnesses?

 

FERPA would generally permit school officials to disclose immunization and other education records to public health authorities under the health or safety emergency provision of FERPA if it is in connection with a health or safety emergency and the knowledge of the information disclosed was necessary to protect the health and safety of the students or other individuals. 34 CFR § 99.36.

 

11. In situations in which the education records of an LEA are destroyed during a disaster, when are SEAs permitted under FERPA to nonconsensually redisclose personally identifiable information from education records?

 

In some cases, State educational agencies (SEAs) have education records on students. Under FERPA, SEAs would be permitted to nonconsensually redisclose personally identifiable information from the education records of students, on behalf of the school, under any of the exceptions to the general consent requirement that might apply, such as disclosing records to a new school under its enrollment provision. 34 CFR § 99.35(b)(1). SEAs that make nonconsensual redisclosures of personally identifiable information from education records on behalf of a school or school district need to ensure that the recordation requirements set forth in 34 CFR § 99.32 have been met.

 

12. Does an interagency agreement with other State or local agencies enable a school to nonconsensually disclose education records?

 

No. Interagency agreements do not supersede the consent requirements under FERPA. Although an interagency agreement would be a helpful tool for planning purposes, schools must comply with FERPA’s requirements regarding the disclosure of personally identifiable information from students’ education records.

 

13. Does FERPA permit a school to nonconsensually disclose personally identifiable information on students to State or local agencies in emergency preparation activities?

 

No. Disclosures under FERPA’s health or safety emergency provision do not include disclosures to address the threat of a possible or eventual disaster or other emergency for which the likelihood of occurrence is unknown, such as would be addressed in emergency preparedness activities. As explained previously, disclosures made under the health or safety emergency provision must be “in connection with an emergency,” which means to be related to the threat of an actual, impending, or imminent emergency, such as a natural disaster, a terrorist attack, a campus shooting, or the outbreak of an epidemic disease. (See the guidance on FERPA and disclosures concerning H1N1 at: http://www2.ed.gov/policy/gen/guid/fpco/pdf/ferpa-h1n1.pdf.) However, properly designated “directory information” on students whose parents have not opted out of the disclosure of “directory information” may be disclosed to State or local agencies for emergency preparation purposes. Additionally, information on students that has been properly de-identified, such as the number of students in a school who have been vaccinated for a particular disease or the number of students with disabilities, may be disclosed, as long as the school has made a reasonable determination that a student’s identity is not personally identifiable by the disclosure. See 34 CFR § 99.31(b). If school officials believe that, in order to make transportation or other accommodations as part of its emergency preparation activities, it needs to disclose to emergency preparation partners information on students with disabilities, who have special needs, or who are taking special medications, parents of these students or the eligible students must provide consent for this disclosure.

 

14. Is the school required to record disclosures of information provided to an outside party, even in connection with a disaster or other health or safety emergency?

 

Yes. FERPA generally requires that schools maintain a record of each request for access to and each disclosure of personally identifiable information from the education records of each student. 34 CFR § 99.32(a)(1). Moreover, when making a disclosure under the health or safety emergency provision in FERPA, schools are specifically required to record the articulable and significant threat to the health or safety of a student or other individuals that formed the basis for the disclosure and the parties to whom the school disclosed the information. 34 CFR § 99.32(a)(5). The record must be maintained with the education records of each student as long as the records are maintained. 34 CFR § 99.32(a)(2). This requirement enables parents and eligible students who do not provide consent for disclosure of education records to see the circumstances under which and the parties to whom their information was disclosed. However, schools are not required to record disclosures that are made for which the parent or eligiblestudent has provided consent, nor are they required to record the disclosure of “directory information.” 34 CFR § 99.32(d)(3)-(4).


Who Performs / Responsibility:

Administration, Executive VP, Legal Counsel, Registrar


Requirements:

Policy and Procedure Handbook


5.

Additional Resources


What happens:

The Department’s Family Policy Compliance Office, the office that administers FERPA, is available to respond to any questions school officials may have about FERPA. For quick responses to routine questions about FERPA, school officials may e-mail the Department at FERPA@ed.gov. Should you believe you need additional technical assistance on a matter in a more formal response, you may write to us at the following address:

 

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue, SW

Washington, D.C. 20202-8520

 

You may also call us at 1-800-USA-LEARN. Additional information and guidance on FERPA is

available on the Department’s Web site at: http://www.ed.gov/policy/gen/guid/fpco/index.html.

 

Additionally, the Department offers a variety of resources to assist schools and postsecondary institutions with their preparedness efforts. The Department’s Emergency Planning Web site is available at: www.ed.gov/emergencyplan.

 

The Office of Safe and Drug-Free Schools (OSDFS) has developed the “Practical Information on Crisis Planning: A Guide for Schools and Communities” that identifies some of the key principles in developing emergency management plans. The entire Guide can be downloaded at:

http://www.ed.gov/admins/lead/safety/emergencyplan/crisisplanning.pdf.

 

The Department’s Readiness and Emergency Management for Schools (REMS) Technical Assistance (TA) Center provides support for local educational agencies (LEAs), schools, and postsecondary institutions working to strengthen and improve their emergency management plans. It offers a variety of resources including a list of current Department grantees, school emergency management related publications, and links to relevant emergency management organizations and agencies. The REMS TA Center’s Web site is available at: http://rems.ed.gov.

 

Since 2003, OSDFS has administered a discretionary grant program called the Readiness and Emergency Management for Schools (REMS) grant (CFDA 84.184E) to provide funds for LEAs to improve and strengthen their emergency management plans. Information on the grant program is available at: http://www.ed.gov/programs/dvpemergencyresponse/index.html.


Who Performs / Responsibility:

Administration, Executive VP, Legal Counsel


Requirements:

Policy and Procedure Handbook


Back to Top Back to Top

Performance Metrics
Metrics: Compliance with federal mandate
Compliance with standard policy and procedure

Back to Top Back to Top

Subject Experts
The following may be consulted for additional information.
Executive VP

Legal Counsel

Back to Top Back to Top

Regulations
This document pertains to the following regulations:
federal mandate
University governance

Back to Top Back to Top

This page created 03/07/2014 using Zavanta® version 6.0