Complying with Recent Guidance on FERPA from U.S. Department of Education in K-12 Schools

The Family Educational Rights and Privacy Act (FERPA) and its regulations have governed the disclosure of student education records for decades, but the U.S. Department of Education has frequently updated its guidance to schools to ensure compliance. Most recently, it clarified the definition of “education record’ and reminded school districts about FERPA’s application to disclosure of education records to vendors.

FERPA is a two-pronged statute. It guarantees parents the right to inspect education records of their children until the child turns age 18 and is no longer a dependent and it restricts school districts’ disclosure of education records without parental consent, except in limited and enumerated circumstances. One of those circumstances, an exception to the requirement that written parental consent first be obtained, is the disclosure to school officials within the school district whom the school district has determined to have a “legitimate educational interest.” Disclosure means the communication of personally identifiable information contained in education records by any means including oral, written and electronic. Those with a legitimate educational interest in the information are not limited to the student’s teachers and school administrators, but may include non-school employees and outside vendors, such as the school attorney, software vendors, volunteers, consultants, or other out-sourced educational services. Schools need to be careful, however, to not too broadly identify individuals or entities as having a legitimate educational interest; it must be limited to those who truly have a reason related to the operation of the school district to know the information contained in the record. It must be for the performance of an institutional service or function for the school; it must be under the direct control of the school with respect to the use and maintenance of education records; and it must be subject to the same requirements as is the school with respect to the use and re-disclosure of information from education records. Parents must be annually notified if the school district will disclose education records to those with a legitimate educational interest and, if so the criteria for determining who is a school official and what constitutes a “legitimate educational interest.”

The most recent guidance emphasizes that not every school official should have access to every student education record and, “the school should consider the impact of such disclosure and should only disclose the minimum amount of personally identifiable information necessary for the intended purpose.” The school is required to take steps to ensure any information is not re-disclosed by “school officials.” Any unauthorized re-disclosure of student education records, or information contained in those records, by any “School Official” can be considered a violation of FERPA.

Second, not all information about students is an “education record” for this purpose. The guidance clarifies that information about a student that is learned from an observation of the student in school is NOT an “education record,” until that observation is reduced to writing, such as initiating a disciplinary proceeding or recording grades. By way of an example, if a principal observes a student breaking the code of conduct, the principal may disclose their observations of a student’s conduct to police, parents, or other third parties, without prior parental consent. However, if the principal recorded their observations in a disciplinary referral, any disclosure of information about the student based on that disciplinary referral is subject to FERPA. Schools therefore should take special care to have clear communication to staff about unauthorized disclosures of student information after disciplinary measures.

Lastly, the guidance elaborates on the treatment of medical records of students in the K-12 school setting. For K-12 students, any medical records received by the School are “education records,” and the parent of the student is, almost always, entitled to inspect such “educational record” upon request. Similarly, although a HIPAA authorization may be required to disclose those records from the office of the student’s healthcare provider, once the record is received and maintained by the school, it becomes an education record, disclosable consistent with FERPA.

In closing, a School’s obligations to disclose or not disclose information under FERPA will change depending on various factors and it is important to be cognizant of evolving Department of Education guidance. Schools should rely on a designated administrator to be familiar with the FERPA regulations and New York Education Law. Schools should review their FERPA notices to be sure all those who may be a “school official” are designated by category or title and “legitimate educational interest” is defined. If there are any questions regarding the applicability of FERPA requirements in any given circumstance, please reach out to Ryan McCarthy or any other attorney in our office.

[1]SPPO publication 23-02. Family Educational Rights and Privacy Act Guidance for School Officials on Student Health Records