The Family Educational Rights and Privacy Act (FERPA) gives parents, and students once they turn 18 or start college, the right to see their education records, ask for corrections, and control who else the school shares them with. When a school gets it wrong, your remedy is an administrative complaint to the U.S. Department of Education, not a lawsuit. Understanding both sides — the rights themselves and how violations are actually handled — is what lets you push back effectively.
Who Holds FERPA Rights
At the K–12 level, parents hold the rights. “Parent” covers a natural parent, a guardian, or anyone acting in that role. The rights transfer automatically to the student when the student turns 18 or enrolls in a postsecondary institution at any age.1Protecting Student Privacy. Who Is an Eligible Student A 17-year-old starting college holds their own FERPA rights from day one. A high school senior who turns 18 in March becomes the rights-holder at that point, mid-semester.
Once a student is eligible, the school communicates directly with the student and the parent’s access rights end. This catches many families off guard when a child leaves for college. Three situations still let a school share an eligible student’s records with a parent: the student is claimed as a tax dependent under IRS rules,2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights the student gives written consent, or there is a health or safety emergency.
FERPA reaches every school, district, college, and university that receives funding administered by the U.S. Department of Education.3Protecting Student Privacy. To Which Educational Agencies or Institutions Does FERPA Apply Private and religious K–12 schools generally do not receive that funding and are not covered. If your child attends a private elementary or high school, FERPA almost certainly does not apply, and you would need to look to state privacy laws or the school’s own policies.
What Counts as an Education Record
An education record is any record directly related to a student and maintained by the school or by someone acting on the school’s behalf.4eCFR. 34 CFR 99.3 – What Definitions Apply to These Regulations Format does not matter — handwritten notes, digital transcripts, emails about a student, and video recordings can all qualify. Common examples: grades, transcripts, class schedules, disciplinary files, and student financial information.5Protecting Student Privacy. What Is an Education Record
A few categories are excluded even though they concern students. Sole-possession notes a teacher keeps as a personal memory aid and never shares are outside FERPA, though the moment those notes are shown to a colleague or placed in a file, they become education records. Records created and maintained by a school’s law enforcement unit for law enforcement purposes are excluded. Employment records for someone who happens to work at the school are excluded, unless the person works there because of their student status. And treatment records for students 18 or older, made and used only by medical or counseling professionals and shared only with treatment providers, sit outside the definition too.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights
The Right to Inspect Records
Parents and eligible students can see all education records the school maintains on the student. Submit a request to the appropriate school official and the school has 45 days to provide access.6Protecting Student Privacy. How Long Does an Educational Agency or Institution Have to Comply With a Request to View Records Some states require faster turnaround. The school must also provide explanations or interpretations if you ask, and if distance makes an in-person review impractical, the school may need to send copies.
Schools can charge a reasonable fee for copies but cannot charge you to search for or retrieve the records.7eCFR. 34 CFR 99.11 A fee that would effectively block your ability to review the records is not permitted.
The Right to Correct Records
If you believe a record is inaccurate, misleading, or violates the student’s privacy, you can ask the school to amend it. If the school refuses, you have the right to a formal hearing. The school must schedule it within a reasonable time, give you advance notice, and let you present evidence. You can bring an attorney at your own expense. The hearing officer cannot be someone with a direct interest in the outcome, and the decision must be in writing and based solely on the evidence presented.8eCFR. 34 CFR 99.22 – What Minimum Requirements Exist for the Conduct of a Hearing
If the hearing goes against you, the school keeps the record as it stands, but you can place a written statement in the file explaining your disagreement. The school must keep that statement attached to the contested record for as long as the record exists, and must disclose the statement whenever it shares that portion of the record.9Protecting Student Privacy. What Rights Does a Parent or Eligible Student Have if the School Decides the Information Is Not Inaccurate
One limit worth knowing: the amendment process covers factual accuracy and privacy, not substantive judgments. You cannot use it to challenge a grade you think was unfair or dispute a teacher’s evaluation of your work.
When Schools Can Share Records Without Your Consent
Written consent is the default. FERPA carves out specific exceptions where the school can disclose without asking.10eCFR. 34 CFR 99.31 – Under What Conditions Is Prior Consent Not Required to Disclose Information The ones that come up most often:
- School officials with a legitimate educational interest — administrators, teachers, and staff performing professional duties, along with contractors and consultants performing services the school would otherwise handle in-house.
- Transfer to another school where the student enrolls or seeks to enroll.
- Health or safety emergencies. The school evaluates the totality of the circumstances, and the Department of Education defers to that judgment when there was a rational basis for concluding a significant threat existed.11Protecting Student Privacy. FERPA – Protecting Student Privacy
- Court orders and lawfully issued subpoenas. The school must make a reasonable effort to notify you first so you can seek protective action, with limited exceptions for federal grand jury subpoenas, certain law enforcement subpoenas with a court-ordered gag, and national security investigations.
- State and local juvenile justice authorities, when state law permits and the information is needed to serve the student.
- Parents of a student who qualifies as a dependent under Section 152 of the Internal Revenue Code.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights
Directory Information and Opting Out
Directory information is a subset of student data the school can share publicly without consent. Typical examples: student’s name, address, dates of attendance, degree earned, and participation in officially recognized activities. Each school decides what it designates, so the scope varies.12Student Privacy Policy Office. Directory Information
Before releasing directory information, a school must give public notice of the categories it has designated and inform parents or eligible students of the right to opt out. Opting out requires written notification to the school within the time period the school specifies. Once you opt out, the school must treat that information as a protected education record.
A school can never designate a student’s Social Security number as directory information.13Protecting Student Privacy. May a Social Security Number or Other Student Identification Number Be Listed as Directory Information Student ID numbers used to log in to school systems can only qualify as directory information if the ID alone cannot access records without a separate authentication factor like a password.
One directory-information rule surprises many parents. Secondary schools receiving funds under the Elementary and Secondary Education Act must give student names, addresses, and telephone numbers to military recruiters and institutions of higher education on request, unless the parent has specifically opted out.14Protecting Student Privacy. What Are the Requirements of Section 9528 of the ESEA Regarding Access to Student Contact Information by Military Recruiters The military-recruiter opt-out and the general directory-information opt-out are separate decisions, so read the school’s notification carefully.
Health Records: FERPA, Not HIPAA
Parents often assume a school nurse’s records or a college health clinic’s files are covered by HIPAA. In most cases they are not. Health records maintained by a school that receives Department of Education funding fall under FERPA, and the HIPAA Privacy Rule explicitly excludes FERPA-protected records from its definition of protected health information.15U.S. Department of Health and Human Services. Joint Guidance on the Application of HIPAA and FERPA to Student Health Records
At the K–12 level, immunization records, school nurse notes, and similar health information are education records. At the postsecondary level, campus health clinic records are FERPA records too — though if they qualify as “treatment records” (made by a medical professional, used only for treatment, and shared only with treatment providers), they sit in the excluded category and are not accessible through a standard FERPA records request. Filing a HIPAA complaint about a school health record usually goes nowhere. FERPA is the governing framework.
How to File a FERPA Complaint
The Department of Education encourages you to try resolving the issue directly with the school first. If that fails, you file a written complaint with the Student Privacy Policy Office (SPPO). You have 180 days from the date you knew or reasonably should have known about the violation.16Protecting Student Privacy. File a Complaint
Only a parent, an eligible student, or an attorney or advocate acting on their behalf can file. The SPPO dismisses anonymous complaints and those from unauthorized parties. Your complaint has to contain specific factual allegations giving reasonable cause to believe a FERPA violation occurred. Vague concerns about general school practices are not enough.
For complaints about denied access to records, include the specific records you requested, the dates and methods of your request, who you sent it to, and any response the school provided.17U.S. Department of Education. FERPA Complaint Form Submit the completed form by email to FERPA.Complaints@ed.gov or by mail to the Student Privacy Policy Office, 400 Maryland Ave, SW, Washington, DC 20202-8520.16Protecting Student Privacy. File a Complaint
What Actually Happens When Schools Violate FERPA
Enforcement is administrative, not judicial. The Department of Education investigates, issues findings, and gives the school a timeline to come back into compliance voluntarily. If a school refuses, the Secretary of Education can withhold federal funding in whole or in part, but only after voluntary compliance efforts have been exhausted.2Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights
The threat of losing federal funds is powerful enough that schools almost always correct violations before it gets that far. The Department has never actually terminated funding over a FERPA violation. Enforcement works through pressure and negotiation rather than punishment.
One consequence frustrates families most: you cannot sue a school directly for a FERPA violation. In Gonzaga University v. Doe (2002), the U.S. Supreme Court ruled that FERPA does not create a private right of action. The statute’s provisions direct federal funding; they do not grant individual rights enforceable in court. Your avenue is the administrative complaint process through the SPPO. If the same conduct also violates a state privacy law or another federal statute, a lawsuit under that separate law may be possible — just not under FERPA itself.