The Family Educational Rights and Privacy Act gives you three things when it comes to student records and privacy rights under FERPA: the right to see what the school has on file, the right to ask that inaccurate information be corrected, and the right to control who else gets to see it. The law applies to nearly every public school and most colleges in the country, and it is enforced by the U.S. Department of Education rather than through the courts.1U.S. Department of Education. Protecting Student Privacy – What is FERPA
Who Holds the Rights
In K–12, FERPA rights belong to the parents. Those rights transfer to the student on the student’s 18th birthday or the moment the student enrolls in any postsecondary institution, whichever comes first. At that point the student becomes an “eligible student,” and parents lose their automatic right of access.2U.S. Department of Education. Eligible Student
There is one exception that surprises a lot of families. A college may disclose an eligible student’s records to parents if the student qualifies as a dependent for federal tax purposes.3U.S. Department of Education. Must Postsecondary Institutions Provide a Parent With Access to an Eligible Student’s Education Records The school is not required to; it is allowed to. Whether your college does depends on its own policy, so parents who claim a college student as a dependent should ask.
Which Schools Are Covered
FERPA applies to any educational agency or institution that receives funds under a program administered by the U.S. Department of Education.4eCFR. 34 CFR Part 99 – Family Educational Rights and Privacy That sweeps in essentially every public elementary, middle, and high school, along with the vast majority of colleges and universities. Private colleges are usually covered because their students receive federal financial aid.
Private K–12 schools generally are not covered, because they do not receive Department of Education funds.5U.S. Department of Education. To Which Educational Agencies or Institutions Does FERPA Apply Some voluntarily follow similar practices, but they are not legally bound by FERPA.
Every covered school must notify parents or eligible students of their FERPA rights at least once a year, explaining the right to inspect, the right to seek amendment, the right to consent to disclosures, and the right to file a complaint.6eCFR. 34 CFR 99.7 – Annual Notification The notice usually shows up in a student handbook or on the school’s website.
What Counts as an Education Record
An education record is anything directly related to a student and maintained by the school or by someone acting on the school’s behalf. Transcripts, grades, attendance, class schedules, financial aid files, and disciplinary records all qualify. So do the digital versions of the same.
Health records held by a school nurse are governed by FERPA, not HIPAA. The HIPAA Privacy Rule specifically excludes anything that qualifies as a FERPA education record, so immunization histories, nurse notes, and school screenings sit under FERPA’s rules.7eCFR. 34 CFR 99.3 – Definitions
Some categories are carved out of the definition:8U.S. Department of Education. What Records Are Exempted From FERPA
- Sole-possession notes a teacher keeps as a private memory aid, so long as they are never shared with anyone else beyond a temporary substitute. The moment they are shared or filed, they become education records.
- Records the school’s own law enforcement or security unit creates for law enforcement purposes. An education record that the school hands to that unit, however, keeps its FERPA protection.
- Treatment records made by a physician, psychiatrist, or psychologist for a student who is 18 or older, used only for treatment.
- Employment records about someone in their role as an employee, unless the employment is tied to student status such as work-study.
Seeing the Records
You have the right to inspect and review the education record. Once the school receives your request, it must give you access within a reasonable time and no later than 45 days.9eCFR. 34 CFR 99.10 – Right to Inspect and Review Education Records
Notice what the obligation is: to let you look. FERPA does not require the school to mail you copies. That changes when in-person review is impractical, for instance when a parent lives too far from the school to visit. In those cases the school must provide copies. Schools may charge a reasonable per-page fee, but not one so high it blocks access.
Getting Records Corrected
If you think something in the record is inaccurate, misleading, or violates privacy, write to the school. Identify the specific item and explain why it is wrong. The school must decide within a reasonable time whether to change it.10eCFR. 34 CFR 99.20 – Amendment of Education Records
If the school refuses, it must tell you and offer a formal hearing. The hearing can be run by anyone, including a school official, so long as that person has no direct interest in the outcome. The decision has to rest solely on the evidence presented and come back in writing with a summary of that evidence and the reasoning.11eCFR. 34 CFR 99.22 – Hearing Requirements
If you still lose, you can insert a permanent written statement of your disagreement into the file. That statement travels with the disputed record whenever the school discloses it.
One important limit. This process is for factual accuracy and privacy, not for challenging a grade or a disciplinary outcome. If a teacher gave a C and you think the work was a B, FERPA cannot fix that. You can challenge whether the file accurately records what happened in a discipline case, but not the punishment itself.
When Schools Can Share Without Your Consent
The default rule is that a school needs written consent before disclosing personally identifiable information from an education record. The exceptions matter, though, because they cover most of the routine sharing that actually happens.
School Officials With a Legitimate Educational Interest
Teachers, administrators, and counselors can see records they need to do their jobs. The annual FERPA notice has to spell out who counts as a “school official” and what a “legitimate educational interest” means at your school.12U.S. Department of Education. Under FERPA, May an Educational Agency or Institution Disclose Education Records to Any of Its Employees Not every employee gets access to every file. This category is also how outside vendors, like the companies that run online learning platforms, receive student data. The vendor has to be performing a function the school would otherwise handle in-house, the school has to maintain direct control over how the data is used, and the vendor cannot reuse or re-share it.13U.S. Department of Education. Who Is a School Official Under FERPA
Transfers to Another School
When a student enrolls elsewhere, the former school can send records to the new one without consent.
Audits, Evaluations, and Financial Aid
Federal and state officials can access records to audit, evaluate, or enforce federally supported education programs. Schools can also disclose records to determine financial aid eligibility, amounts, conditions, or enforcement.
Subpoenas and Court Orders
Schools must comply with lawful subpoenas and judicial orders. In most cases they must make a reasonable effort to notify you before turning records over, so you can go to court to try to block the disclosure if you want.14U.S. Department of Education Student Privacy Policy Office. May Schools Comply With a Subpoena or Court Order for Education Records Without the Consent of the Parent or Eligible Student
Health and Safety Emergencies
Schools can share records without consent when the information is needed to protect the health or safety of the student or others. The school must find an “articulable and significant threat” and consider the totality of the circumstances.15eCFR. 34 CFR 99.36 – Disclosure in Health and Safety Emergencies The exception applies only while the emergency lasts, and the school must document what the threat was and who received the information. Appropriate recipients include law enforcement, public health officials, trained medical personnel, and parents.
Disciplinary Results for Serious Offenses
Colleges may disclose the final results of a disciplinary proceeding when the student was found responsible for a crime of violence or a non-forcible sex offense. The disclosure is limited to the student’s name, the violation, and the sanction. Victims and other students involved are not identified.16eCFR. 34 CFR 99.39 – Nonconsensual Disclosure of Records in Connection With Disciplinary Proceedings Concerning Crimes of Violence or Non-Forcible Sex Offenses
Alcohol and Drug Violations by Students Under 21
Colleges may notify parents when a student under 21 violates a law or school policy on alcohol or controlled substances.17U.S. Department of Education. Can Parents Be Informed About Students’ Violation of Alcohol and Controlled Substance Rules This is a school’s choice, not a requirement.
Directory Information and Your Opt-Out
FERPA lets schools release “directory information” without consent. The regulations define it to include the student’s name, address, telephone, email, photograph, date and place of birth, major, grade level, enrollment status, dates of attendance, participation in activities and sports, athletic team members’ height and weight, degrees and awards, and the most recent school attended.7eCFR. 34 CFR 99.3 – Definitions
Social Security numbers are never directory information. A student ID number qualifies only if it cannot be used, by itself, to access records without a separate password or other authentication.7eCFR. 34 CFR 99.3 – Definitions
Before a school releases any of it, families must get notice and a reasonable chance to opt out. Most schools handle this at the start of the year. If you opt out, the school has to suppress that student’s directory information from public disclosures, including yearbooks, graduation programs, and online directories. Under federal law it is all or nothing, though some schools voluntarily let families make more granular choices.
How to File a FERPA Complaint
If you think a school violated FERPA, the remedy is a written complaint to the Student Privacy Policy Office (SPPO) at the U.S. Department of Education. It must be filed within 180 days of the violation or within 180 days of when you learned about it.18U.S. Department of Education. File a Complaint Only a parent or eligible student can file. Lay out the specific facts and explain why they add up to a FERPA violation.
The Department strongly encourages trying to resolve the problem with the school first. If that goes nowhere, submit the SPPO complaint form by email to FERPA.Complaints@ed.gov or by mail to the Student Privacy Policy Office at the Department of Education in Washington, D.C.18U.S. Department of Education. File a Complaint Missing information can get a complaint dismissed, so be thorough.
SPPO has no fixed statutory deadline for finishing an investigation. Acknowledgment usually comes within a few weeks; a full investigation can stretch to several months or more than a year. If SPPO finds a violation, it works with the school to bring it into compliance. The ultimate sanction is loss of federal funding, which is rare in practice.
Why You Cannot Sue Under FERPA
This is the most misunderstood point in the whole statute. FERPA does not let you sue a school. In Gonzaga University v. Doe, the Supreme Court held that FERPA creates no personal rights enforceable through a private lawsuit.19Justia U.S. Supreme Court. Gonzaga Univ. v. Doe, 536 U.S. 273 (2002) There is no path to money damages and no way for a court to order the school around based on a FERPA violation alone.
The federal enforcement path is the administrative complaint to SPPO, and that process cannot award damages either. SPPO’s authority is limited to getting the school back into compliance going forward. Some states have their own student privacy laws that add remedies on top of FERPA, and those are worth looking at if you have a serious dispute. But FERPA itself is not a courtroom weapon.