FERPA (Family Educational Rights and Privacy Act of 1974) is legislation that protects the privacy of students’ personally identifiable information (PII). The act sets limits on the disclosure of personally identifiable information from school records and defines the rights of the student to review the records and request a change to the records. This legislation applies to all educational institutions that receive federal funds.
FERPA generally gives postsecondary students the right to review their education records, to seek to amend inaccurate information in their records, and to provide consent for the disclosure of their records.
These rules apply to all education records the school keeps, including admissions records (only if the student was admitted) and academic records, as well as any financial aid records pertaining to the student. Therefore, the financial aid office is not usually the office that develops the school’s FERPA policy or the notification to students and parents, although it may have some input.
A school is required to—
- annually notify students of their rights under FERPA. The Department of Education has posted a model notification on the Family Policy Compliance Office website at http://www2.ed.gov/policy/gen/guid/fpco/index.html
- include in that notification the procedure for exercising their rights to inspect and review education records; and
- maintain a record in a student’s file listing to who personally identifiable information was disclosed and the legitimate interests the parties had in obtaining the information (does not apply to school officials with a legitimate educational interest or to directory information).
A student has the right to—
- inspect and review any education records pertaining to the student;
- request an amendment to his/her records; and
- consent to disclosure of personally identifiable information from education records, except when FERPA permits disclosure without consent.
A school must provide a student with an opportunity to review his or her education records within 45 days of the receipt of a request. Your school is also required to provide the student with copies of education records or make other arrangements to provide the student access to the records if a failure to do so would effectively prevent the student from obtaining access to the records. While the school may not charge a fee for retrieving the records, it may charge a reasonable fee for providing copies of the records, provided that the fee would not prevent access to the records.
While the rights under FERPA have transferred from a student’s parents to the student when the student attends a postsecondary institution, FERPA does permit a school to disclose a student’s education records to his or her parents if the student is a dependent student under IRS rules.
Note that the IRS definition of a dependent is quite different from that of a dependent student for FSA purposes. For IRS purposes, students are dependent if they are listed as dependents on their parent’s income tax returns. (If the student is a dependent as defined by the IRS, disclosure may be made to either parent, regardless of which parent claims the student as a dependent.)
Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. The written consent must state the purpose of the disclosure, specify the records that may be disclosed, identify the party or class of parties to whom the disclosure may be made, and be signed and dated. However, FERPA allows schools to disclose those records, without consent, to the following parties or under the following conditions (34 CFR § 99.31):
- School officials with legitimate educational interest;
- Other schools to which a student is transferring;
- Specified officials for audit or evaluation purposes;
- Appropriate parties in connection with financial aid to a student;
- Organizations conducting certain studies for or on behalf of the school;
- Accrediting organizations;
- To comply with a judicial order or lawfully issued subpoena;
- Appropriate officials in cases of health and safety emergencies; and
- State and local authorities, within a juvenile justice system, pursuant to specific State law.
Schools may disclose, without consent, “directory” information such as a student’s name, address, telephone number, date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible students about directory information and allow parents and eligible students a reasonable amount of time to request that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (special letter, inclusion in orientation material, or student handbook, etc.) is left to the discretion of each school.
The Guide for Developing High-Quality Emergency Operations Plans for Institutions of Higher Education at http://rems.ed.gov/docs/REMS_IHE_Guide_508.pdf includes a very helpful FERPA section, among other valuable guidance.
