A FERPA release authorization is a signed, written consent in which a student gives their school permission to share specific education records with a named third party, such as a parent, spouse, or scholarship sponsor. Without one, the Family Educational Rights and Privacy Act bars schools that receive U.S. Department of Education funding from disclosing most personally identifiable information from a student’s records.1U.S. Department of Education. Legislative History of Major FERPA Provisions The release puts you in control of who can see your grades, transcripts, financial aid file, billing records, and disciplinary history.
Once you turn 18 or enroll in any postsecondary institution, FERPA rights transfer from your parents to you.2University of Pittsburgh Human Research Protection Office. FERPA (Family Educational Rights and Privacy Act) From that point on, if you want anyone else to talk to the registrar, the bursar, or your dean about your record, the school generally needs your written consent.
What the Release Covers
An education record is any record directly related to a student and maintained by the school or by someone acting on the school’s behalf, in any format.3eCFR. 34 CFR 99.3 – What Definitions Apply to These Regulations Grades, transcripts, class schedules, disciplinary files, financial aid records, and billing records are all in scope. Your release can cover all of these or just a slice.
Two categories are worth knowing about because students often misread them:
Directory information. Schools may release directory information without your consent unless you opt out. This typically includes your name, address, phone number, date and place of birth, major, activities and sports participation, dates of attendance, and degrees and awards.4Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights Each school publishes its own directory list and its own opt-out window, often within the first weeks of a semester. If you want to block those disclosures, ask the registrar about the deadline.5U.S. Department of Education. Directory Information
Campus health clinic records. Health records maintained by a college- or university-run clinic on students are education records under FERPA, and the HIPAA Privacy Rule expressly excludes them.6U.S. Department of Health and Human Services / U.S. Department of Education. Joint Guidance on the Application of HIPAA and FERPA to Student Health Records To share those records with a parent, the correct form is a FERPA release, not a HIPAA authorization. Records from a university-affiliated hospital that serves the general public are typically HIPAA, not FERPA, even when the patient is a student.
What a Valid Release Must Contain
Federal regulations spell out what a written consent to disclose education records needs. It must be signed and dated, specify the records that may be disclosed, state the purpose of the disclosure, and identify the party or class of parties who will receive the information.7U.S. Department of Education. What Must a Consent to Disclose Education Records Contain Oral consent does not satisfy FERPA.
Electronic signatures are valid so long as the system identifies and authenticates the signer and shows their approval of the consent.8eCFR. 34 CFR 99.30 – Under What Conditions Is Prior Consent Required Most schools now handle releases entirely through the student portal.
Be specific about scope. You can limit a release to financial aid so a parent can sort out a billing question, or to your transcript so a scholarship committee can verify grades. A blanket release lets anyone you name pull anything the school holds, including disciplinary and health clinic records.
How to Grant a Release at Your School
The mechanics vary by institution, but the core steps are consistent:
- Find the form through the registrar’s office or your online student portal. Some schools have a stand-alone FERPA release; others build it into the student information system.
- Choose the scope: which records the third party can access (grades, financial records, disciplinary, or all), and, if the school allows it, how long the release lasts.
- Identify the recipient by full name, relationship, and contact information. Many schools also require you to set a PIN or passphrase that the recipient must give when they call or write, so staff can verify identity before speaking.
- Sign and submit. Electronic signature through the portal is the fastest route; some schools still accept paper submissions at the registrar’s office or by mail.
The release takes effect once the school processes it, usually within a few business days. Until it’s active in the system, staff cannot share records with the person you named, even if you’ve already turned the form in.
How to Revoke a Release
You can revoke a release at any time, but the revocation must be in writing.9U.S. Department of Education. Family Educational Rights and Privacy Act (FERPA) A phone call to the registrar isn’t enough. Most schools offer a revocation form on the same portal or web page as the release itself.
Identify the person whose access you’re removing and the records involved. The revocation takes effect when the school receives it and applies going forward only. Anything the school has already disclosed stays disclosed. That’s a reason to keep the initial scope tight rather than open everything and try to walk it back later.
When Your School Can Share Records Without a Release
FERPA carves out situations where a school may share records without your written consent. These matter because they define what your release actually controls, and they explain why certain disclosures can happen without your involvement.
- School officials with a legitimate educational interest, including faculty, advisors, administrators, and contractors performing institutional functions. Schools must define who qualifies in their annual FERPA notification.10eCFR. 34 CFR Part 99 Subpart D – May an Educational Agency or Institution Disclose Personally Identifiable Information From Education Records
- Transfer of records to another school where you enroll or seek to enroll.
- Financial aid purposes, including determining eligibility, setting award amounts, and enforcing aid conditions.
- Accrediting organizations carrying out accreditation functions.
- Health or safety emergencies, where the school determines there is a significant threat and shares relevant information with people whose knowledge is necessary to protect against it, including parents.11eCFR. 34 CFR 99.36 – What Conditions Apply to Disclosure of Information in Health and Safety Emergencies
- Judicial orders and subpoenas. Schools may comply, and generally must make a reasonable effort to notify you first so you can seek protective action, though that notice requirement drops away in some law enforcement scenarios such as federal grand jury subpoenas with nondisclosure orders.9U.S. Department of Education. Family Educational Rights and Privacy Act (FERPA)
- Federal and state audits, where authorized representatives of the Comptroller General, the Secretary of Education, or state educational authorities need records to audit or evaluate federally supported education programs.12U.S. Department of Education. FERPA Exceptions Summary
The Parent Tax-Dependent Exception
If a student is claimed as a dependent on a parent’s federal tax return (as defined under Section 152 of the Internal Revenue Code), the school may disclose education records to that parent without the student’s consent.13U.S. Department of Education. Must Postsecondary Institutions Provide a Parent With Access to an Eligible Student’s Education Records9U.S. Department of Education. Family Educational Rights and Privacy Act (FERPA)
Schools are permitted to use this exception. They aren’t required to. Many prefer a signed release from the student rather than verifying tax status, because it’s cleaner for staff. If you’re a parent trying to rely on this exception, expect to produce documentation of the dependent claim and be prepared for the school to ask for a signed release anyway as a matter of institutional policy.
If a School Discloses Records Without Your Consent
The U.S. Supreme Court ruled in Gonzaga University v. Doe that FERPA does not give individuals the right to sue a school directly for violations.14Justia Law. Gonzaga Univ. v. Doe, 536 U.S. 273 (2002) The enforcement path runs through the federal government. You file a complaint with the Student Privacy Policy Office at the U.S. Department of Education, and the potential consequence to the school is loss of federal funding.
Your complaint has to meet three requirements:15U.S. Department of Education. File a Complaint
- It must be in writing and describe specific facts giving reasonable cause to believe a violation occurred. Vague allegations don’t move forward.
- It must come from the right person: a parent of a minor student, or the eligible student themselves once rights have transferred.
- It must be timely, filed within 180 days of the alleged violation or of when you learned about it.
The Department encourages you to try resolving the issue with the school first, though that isn’t required. Submit the complaint by email to FERPA.Complaints@ed.gov or by mail to the Student Privacy Policy Office at 400 Maryland Ave SW, Washington, DC 20202-8520.16U.S. Department of Education. How May a Parent or Eligible Student File a FERPA Complaint With the Department of Education Incomplete filings can be dismissed, so answer every field on the form.