FERPA confidentiality rules require any school that receives federal funding to keep student education records private, and to get written consent before sharing personally identifiable information from those records. The law (20 U.S.C. § 1232g) gives parents, and students once they turn 18 or enter college, the right to see the records, ask for corrections, and control who else gets access. Schools that ignore the rules risk losing federal funding.1Office of the Law Revision Counsel. 20 USC 1232g – Family Educational Rights and Privacy
What FERPA Protects
An education record is any information directly related to a student that a school, or someone acting for the school, maintains. Format is irrelevant. Paper transcripts, electronic grade books, disciplinary files, financial aid paperwork, and digital entries in student information systems all qualify.2Protecting Student Privacy. What Is an Education Record?
Several categories sit outside FERPA’s definition and can move without going through the consent process:
- Records created by a school’s law enforcement unit, kept for law enforcement purposes, and stored separately from education files. If the same officers pull student education records while acting as school officials, FERPA still applies to that information.3Protecting Student Privacy. What Is a Law Enforcement Unit Record?
- Sole-possession notes a teacher or staff member keeps as a private memory aid and never shares.
- Employment records for a school employee whose job doesn’t depend on being a student. A graduate teaching assistant’s records still count as education records, because the position is tied to student status.
- Peer-graded work that a teacher hasn’t yet collected and recorded.
- Treatment records made by a doctor, psychologist, or counselor at a college or university, used only to treat a student 18 or older, and not shared outside the treatment team. The student can have those records reviewed by a physician of their choice.4U.S. Department of Health and Human Services. Joint Guidance on the Application of HIPAA and FERPA to Student Health Records
Who Holds the Rights
For students under 18 in K–12, both parents hold FERPA rights. Custodial and non-custodial parents have equal rights to inspect records, request changes, and control disclosures unless a court order, state law, or legally binding custody agreement specifically takes that access away.5Protecting Student Privacy. 34 CFR Part 99 – Family Educational Rights and Privacy – Section 99.4 A school that turns away a non-custodial parent without documentation of a court order stripping those rights is violating FERPA.
All FERPA rights transfer from parents to the student once the student turns 18 or enrolls at any postsecondary institution at any age. From that point on, the student is an “eligible student” and controls the record.6Protecting Student Privacy. Who Is an Eligible Student? The school deals with the student directly, even when parents are paying tuition.
Parents don’t lose all access after the transfer. A school can share an eligible student’s records with parents who claim the student as a tax dependent, without the student’s consent.7Protecting Student Privacy. Eligible Student Schools can also share with parents during a genuine health or safety emergency.
The Written Consent Rule
The default is straightforward. A school needs signed, dated, written consent before sharing any personally identifiable information from a student’s education records. Oral consent doesn’t count.8Protecting Student Privacy. What Must a Consent to Disclose Education Records Contain?
A valid consent form has to spell out three things: which records are being disclosed, why they’re being disclosed, and who will receive them. A blanket “I consent to the release of my child’s records” won’t hold up. The consent must name the records, the purpose, and the recipient.8Protecting Student Privacy. What Must a Consent to Disclose Education Records Contain?
When Schools Can Share Records Without Consent
FERPA lists a set of situations where records can move without consent. These are built into the statute so that schools can function. The ones most likely to come up:
- School officials with a legitimate educational interest. Teachers, administrators, counselors, and other staff can see records they genuinely need to do their jobs. Not every employee qualifies. The school must define in its annual notice who counts as a school official and what makes an educational interest legitimate.9Protecting Student Privacy. Who Is a School Official Under FERPA?
- Transfer to another school. When a student enrolls or seeks to enroll elsewhere, the previous school can send records to the new one for enrollment or transfer purposes.10eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required
- Financial aid. Records can be shared as needed to determine eligibility, set the amount, establish conditions, or enforce the terms of the aid.10eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required
- Health or safety emergencies. During a real emergency, schools can share information needed to protect the student or others. The exception is for actual crises, not routine concerns.
- Judicial orders and subpoenas. Schools can comply with a court order or lawfully issued subpoena, but must first make a reasonable effort to notify the parent or eligible student so they can seek a protective order. Notification isn’t required for federal grand jury subpoenas, law enforcement subpoenas under a court-ordered secrecy directive, and certain counterterrorism investigations.10eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required
- Audits and authorized oversight. Federal and state educational authorities, the Comptroller General, and the Attorney General can pull records for audit, evaluation, and compliance purposes.10eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required
- Juvenile justice system. State and local juvenile justice authorities can receive records when state law specifically allows it and the information relates to serving the student.
- Research on the school’s behalf. Organizations conducting studies for the school (developing tests, improving instruction) can receive records, provided the data is protected and destroyed when the study ends.
One rule cuts across all of these. Anyone who receives records under an exception generally cannot pass them along to yet another party without the parent’s or eligible student’s consent, and the school must tell each recipient about that restriction at the time of disclosure.11eCFR. 34 CFR 99.33 – What Limitations Apply to the Redisclosure of Information
Directory Information and How to Opt Out
Directory information is the one category schools can share freely, without individual consent. It covers details that wouldn’t ordinarily be considered sensitive: a student’s name, address, phone number, date and place of birth, major field of study, dates of attendance, and participation in school activities are typical entries.12Protecting Student Privacy. Directory Information
Schools can’t designate anything they want. Social Security numbers are prohibited outright. A student ID number can be treated as directory information only if it can’t be used by itself to access electronic records; it has to require a separate password or PIN.13Protecting Student Privacy. May a Social Security Number or Other Student Identification Number Be Listed as Directory Information?
Before releasing any directory information, the school has to publish notice of what it has designated and give parents or eligible students a reasonable window to opt out in writing. Once someone opts out, the restriction stays in place until they reverse it, and it continues to apply after the student leaves the school.14Protecting Student Privacy. May an Educational Agency or Institution Disclose Directory Information Without Prior Consent
Right to Inspect and Correct Records
Parents and eligible students can ask to see any education record the school maintains. The school has 45 days to comply after receiving the request. Some states set shorter deadlines.15Protecting Student Privacy. How Long Does an Educational Agency or Institution Have to Comply With a Request to View Records?
A school can charge a reasonable fee for paper copies, but the fee can’t be so high that it effectively blocks access. Search and retrieval have to be free; the fee applies only to the physical copies.16Protecting Student Privacy. 34 CFR Part 99 – Family Educational Rights and Privacy – Section 99.11
If a record is inaccurate or misleading, a parent or eligible student can ask the school to correct it. This right doesn’t cover grades a student disagrees with; it applies to factual errors and misleading entries. When the school refuses, the parent or student has the right to a formal hearing. If the hearing goes against them, they can place a written statement in the file explaining why they disagree, and that statement stays attached to the contested record permanently, traveling with it whenever the school discloses that part of the file.1Office of the Law Revision Counsel. 20 USC 1232g – Family Educational Rights and Privacy
School Health Records: FERPA, Not HIPAA
Parents often assume school nurse records and immunization files are covered by HIPAA. They usually aren’t. Health records maintained by a school that receives federal education funding are education records under FERPA, and the HIPAA Privacy Rule explicitly excludes records that FERPA already covers.4U.S. Department of Health and Human Services. Joint Guidance on the Application of HIPAA and FERPA to Student Health Records
The line shifts when an outside healthcare provider, not employed by the school, delivers services on campus. That provider’s own records are covered by HIPAA while the provider holds them. Once the school adds the information (a vaccination entry, for example) to the student’s education file, FERPA governs.4U.S. Department of Health and Human Services. Joint Guidance on the Application of HIPAA and FERPA to Student Health Records
How to File a FERPA Complaint
FERPA doesn’t let you sue a school for money damages. The U.S. Supreme Court held in Gonzaga University v. Doe (2002) that the statute does not create a private right of action. Enforcement runs through federal funding instead.
If you believe a school violated your FERPA rights, file a written complaint with the Student Privacy Policy Office (SPPO) at the U.S. Department of Education within 180 days of the violation, or within 180 days of when you learned about it. Complaints can be emailed to FERPA.Complaints@ed.gov or mailed to the Department of Education at 400 Maryland Ave SW, Washington, DC 20202-8520.17Protecting Student Privacy. File a Complaint
When the Department investigates and finds a violation grounded in a school’s policy or practice, it notifies the school and gives it a reasonable window to fix the problem voluntarily. If the school refuses, the Department can withhold further federal payments, issue a cease-and-desist order, or terminate the school’s eligibility for federal funding.1Office of the Law Revision Counsel. 20 USC 1232g – Family Educational Rights and Privacy Most schools correct violations once they’re notified, because losing federal funding is an existential risk for nearly every institution.