What Counts as an Education Record Under FERPA?

Under the Family Educational Rights and Privacy Act, an education record is any information directly related to a student that a school, or someone acting on the school’s behalf, maintains. That’s the whole legal definition, and it’s wider than most people picture. What counts as an education record under FERPA includes transcripts and report cards, but also the file in the nurse’s office, the discipline folder in the dean’s drawer, the financial aid documents on the bursar’s server, emails saved into a student’s file, and — in some situations — surveillance footage.

The Two-Part Test

Federal regulations set two conditions that both have to be met. The information must be directly related to a student, and a school (or someone working on the school’s behalf) must maintain it.¹ Miss either half and FERPA doesn’t apply.

“Directly related” doesn’t require the student’s name on the document. A file keyed to a student ID number, a photo focused on one individual, or any record tied to a student through another identifier can satisfy the first prong. “Maintained” means the school stores the information in some organized way, on paper or in a database. A quick note on a whiteboard that gets erased the same day isn’t maintained. A file saved to the school’s server is.

The Supreme Court walked through the “maintained” piece in Owasso Independent School District v. Falvo (2002). The question was whether students grading each other’s papers in class ran afoul of FERPA. The Court held that peer-graded papers aren’t education records at that moment, because the classmate handing back the quiz isn’t maintaining anything and isn’t acting on the school’s behalf.² Once the teacher collects those papers and enters the grades in a gradebook, the analysis changes. The same information can shift from unprotected to protected depending on who holds it and how it’s stored.

Records That Fall Inside the Definition

The Department of Education’s own list of clear examples includes grades, transcripts, class schedules, student financial information at the postsecondary level, K–12 health records, and student discipline files.³ Those are the obvious cases. Anything else that passes the two-part test is in too, whether or not it fits a familiar label.

Academic and Administrative Files

Transcripts, grade reports, class schedules, standardized test scores, and enrollment applications are the prototypical education records. Attendance logs and student ID numbers qualify when the school uses them to tie an individual to broader institutional data. Routine administrative details get the same confidentiality treatment as a final GPA.

Financial Aid Records

At colleges and universities, financial aid records are education records. Aid applications, award letters, and related financial documents held by the institution all fall under FERPA. One narrow limit on student access: a postsecondary institution isn’t required to let students inspect their parents’ financial records, even when those records sit inside the student’s file.⁴ Schools may also share financial aid information without consent when it’s necessary to determine eligibility, set the award amount, or enforce the terms of an award.

Health Records Held by the School

Health records kept by a school nurse or K–12 health clinic are education records governed by FERPA, not by HIPAA. That surprises people. Immunization records, physical exam results, and nurse’s notes follow FERPA rules as long as the school maintains them.⁵ Campus health clinics at colleges and universities follow the same rule, and the HIPAA Privacy Rule explicitly excludes records that qualify as education records or treatment records under FERPA.

Disciplinary Files

Files from conduct proceedings — hearing records, witness statements, sanctions — are education records subject to FERPA’s protections. Whether the incident is a dress-code violation or a serious conduct charge, the file gets the same confidentiality as an academic record.

A notable carve-out: schools may disclose the final results of a disciplinary proceeding when a student has been found responsible for a crime of violence or a sex offense.⁶ The carve-out exists so alleged victims can learn the outcome. It doesn’t open the whole disciplinary file; only the final result and the specific offense may be disclosed.

Digital Records and Emails

The two-part test applies to digital information just as it does to paper. The federal definition of a “record” explicitly includes information stored in computer media, video, audio, and any other format.⁴ Emails about a student saved into a school’s system, learning management system data, and electronic grade portals all qualify if they’re directly related to a student and maintained by the institution. A teacher’s personal email draft that never gets saved into a school system likely doesn’t qualify. An email forwarded to an administrator and filed in a student’s record almost certainly does.

Surveillance Footage

Video is more nuanced. Footage created and kept by a school’s law enforcement unit for a law enforcement purpose is excluded from the education record definition. If the school copies that footage and uses it in a disciplinary proceeding, though, the copy can become an education record once it’s directly related to a specific student and maintained outside the law enforcement unit.⁷ Factors that push footage toward “directly related” include whether the school uses it in a disciplinary action, whether it shows a student violating a law or school rule, and whether the student was deliberately the focus of the recording. Incidental background appearances in hallway footage generally don’t count.

Directory Information: The Public-by-Default Subset

Directory information is a special subset of education records that schools may release publicly without written consent. It covers details generally considered not harmful if disclosed: name, address, phone number, date and place of birth, dates of attendance, degrees received, and participation in school-sponsored activities or sports.⁸

Schools can’t just start publishing this material without warning. Before releasing directory information, a school must give public notice identifying which data points it has designated as directory information, explain the right to opt out, and provide a window for parents or eligible students to submit a written objection.⁸ Once someone opts out, the school must treat that information as fully confidential. If you’ve never read the directory information notice your school sends at the start of the year, it’s worth pulling out — the default is disclosure unless you act.

What Is Not an Education Record

The statute carves out several explicit exclusions. Records outside the definition don’t carry FERPA’s privacy protections, and schools aren’t required to let you inspect them on request.

Sole possession records. Personal notes a teacher or administrator keeps as a private memory aid are excluded, as long as they’re never shared with anyone else (except a temporary substitute filling in for the note-taker). The moment those notes get shared with a colleague or placed in a common file, they lose this status.¹
Law enforcement unit records. Records created and maintained by a school’s law enforcement unit for law enforcement purposes are excluded if kept separate from academic files.⁶
Employment records. If a student works for the school, records about that employment are excluded, but only when the job isn’t contingent on the person’s enrollment status. A work-study position tied to being a student doesn’t qualify for this exclusion.⁴
Treatment records. At the postsecondary level, records made by a doctor, psychologist, or other treatment provider are excluded if used solely for treatment and not shared outside the treatment team. This applies to students 18 or older, or attending a postsecondary institution at any age. The student may have the records reviewed by a professional of their own choosing.⁶
Alumni records. Information a school creates about a former student after that person is no longer enrolled — such as alumni fundraising contact data — is generally not considered an education record. Records created while the student was enrolled remain protected even after graduation.

Why the Classification Matters

Whether a document is an education record decides three practical things. First, access: parents, and eligible students once rights have transferred, can inspect anything inside the education record. Second, consent: the default rule is that a school needs written permission before disclosing an education record to a third party, subject to a list of statutory exceptions covering school officials with a legitimate educational interest, transfers to another school, financial aid processing, health or safety emergencies, judicial orders and subpoenas, and directory information.⁴ Third, enforcement: if a school mishandles a covered record, complaints go to the Student Privacy Policy Office at the U.S. Department of Education, not to court. The Supreme Court held in Gonzaga University v. Doe (2002) that FERPA creates no private right of action.⁹

So when you’re trying to figure out whether a particular document — a nurse’s note, a security video clip, a professor’s email, a residence life incident report — is protected, run the two-part test. Directly related to a student? Maintained by the school or someone acting for it? If both answers are yes, and none of the specific exclusions apply, it’s an education record.

1
eCFR. 34 CFR 99.3 – Definitions
2
Legal Information Institute. Owasso Independent School District No I-011 v Falvo
3
U.S. Department of Education. What Is an Education Record
4
U.S. Department of Education. 34 CFR Part 99 – Family Educational Rights and Privacy
5
U.S. Department of Education. Know Your Rights – FERPA Protections for Student Health Records
6
Office of the Law Revision Counsel. 20 USC 1232g – Family Educational and Privacy Rights
7
U.S. Department of Education. FAQs on Photos and Videos Under FERPA
8
U.S. Department of Education. Directory Information
9
Justia. Gonzaga University v Doe, 536 US 273