What Is an Education Record Under FERPA: Test and Exclusions

Under the Family Educational Rights and Privacy Act, an education record is any record that is directly related to a student and maintained by an educational agency or institution, or by a party acting on the school’s behalf. That two-part test decides what FERPA covers. The format doesn’t matter, and neither does the department that holds it. A handwritten note in a filing cabinet and a digital transcript in a student information system both qualify if they meet both parts of the test.

The Two-Part Test

FERPA’s regulations set two conditions, and both have to be true at the same time. The information must be directly related to a student, and it must be maintained by the school or by someone acting for the school.¹ A document about a student that the school never keeps isn’t an education record. A school policy manual that doesn’t relate to any individual student isn’t one either.

Medium is irrelevant. Handwritten, printed, stored on a computer, captured on video, recorded as audio, saved on microfilm, or sent by email — if it passes the two-part test, it’s an education record.² The shift to cloud platforms and learning management systems hasn’t changed the definition.

What Records Qualify

The Department of Education gives a non-exhaustive list of what falls inside the definition. At the K–12 level, that includes grades, transcripts, class lists, course schedules, health records maintained by the school, and discipline files.¹ Special education records, including Individualized Education Programs, qualify because they are tied to a specific student and kept by the school.

At the postsecondary level, the same categories apply, plus student financial information such as financial aid applications and award letters.¹ Different offices hold different pieces. The registrar keeps transcripts, the financial aid office holds loan and grant data, and the dean of students office may keep disciplinary files. All are education records regardless of which office stores them.

Photos and Videos of Students

A photo or video is an education record when it satisfies the same two-part test.³ Surveillance footage is the common example. If a school camera captures two students in a hallway fight and the school uses that footage in a disciplinary proceeding, the video is directly related to those students and becomes an education record.

There’s a wrinkle for law enforcement units. Footage created and kept by a school’s law enforcement unit strictly for law enforcement purposes falls under a separate exclusion and is not an education record. But if that unit hands a copy to the principal’s office to support a suspension, the copy can become an education record of the students involved once it is maintained outside the law enforcement unit.³ Who maintains the record, and why, is what decides it.

What Is Excluded From the Definition

FERPA carves out six categories from the education record definition, even when the records relate to a student. These exclusions matter, because records that fall inside them aren’t subject to FERPA’s access and disclosure rules.

Sole possession records. Notes a teacher, counselor, or administrator keeps as a personal memory aid, and never shares with anyone except a temporary substitute, are not education records. The moment the notes are shared with another school employee or placed in a student’s file, the exclusion disappears.²
Law enforcement unit records. Records created and maintained by a school’s law enforcement unit for law enforcement purposes are excluded. Copies transferred to other school offices for non-law-enforcement purposes can lose this protection.⁴
Employment records. Records about someone who works for the school, made in the normal course of business and relating solely to that person as an employee, are excluded. But if the employee is also a student and the employment depends on student status, as in a work-study job, the records are education records.²
Treatment records. Records made by a doctor, psychiatrist, psychologist, or similar professional, used only for treating a student who is at least 18 or enrolled in a postsecondary institution, are excluded, as long as they’re disclosed only to the individuals providing treatment. The student can have these reviewed by a physician of their choice. This exclusion does not cover K–12 health records kept by a school nurse; those are education records.⁴
Alumni records. Records a school creates or receives after someone is no longer a student, and that don’t relate to the person’s time as a student, are excluded. Records from when the person was enrolled remain education records even decades later.²
Peer-graded work. Papers graded by classmates are not education records until the teacher collects and records the scores. Once the grade enters the teacher’s gradebook, it becomes part of the student’s education record.²

Directory Information Sits Inside the Record

Directory information is part of a student’s education record, but FERPA lets schools share it with third parties without consent if the school follows the right steps first. Directory information typically includes a student’s name, address, phone number, date and place of birth, participation in activities and sports, and dates of attendance.⁵

Before disclosing directory information, a school must give public notice to parents and eligible students describing which types of information it has designated as directory information, the right to opt out, and the deadline for submitting a written opt-out request. If you miss the deadline, the school can share that information until the next notice period. Schools can also limit their directory disclosures to specific parties or purposes, and if they say they will, they have to follow through.⁶

One thing the opt-out can’t do: it can’t stop a school from identifying you by name in class or requiring you to wear a student ID badge showing information properly designated as directory information.⁶

Student Health Records: FERPA or HIPAA?

Parents and students often assume HIPAA governs all medical information, but that’s usually wrong in a school setting. The HIPAA Privacy Rule specifically excludes records that are protected by FERPA from its definition of protected health information.⁷ In practice:

At K–12 schools, health records kept by the school nurse or in a student’s file are almost always education records under FERPA. Even if the school technically qualifies as a HIPAA covered entity, it doesn’t have to follow HIPAA rules for those records.⁷
At colleges and universities, records kept by campus health clinics and counseling centers are either education records or treatment records under FERPA. Both categories are excluded from HIPAA coverage. Treatment records are also excluded from FERPA’s definition of education records, which puts them in a narrow space where neither HIPAA’s access rules nor FERPA’s standard access rights fully apply, though the student can have them reviewed by a physician of their choice.⁷

If your child’s school has health information about them, your access and challenge rights almost certainly come from FERPA, not HIPAA.

Which Schools This Definition Applies To

FERPA applies to any educational agency or institution that receives funds from programs administered by the U.S. Department of Education. That covers public schools, school districts, and postsecondary institutions such as colleges and universities. Private and parochial K–12 schools generally do not receive this type of federal funding and are therefore not subject to FERPA.⁸ Many private colleges and universities do participate in federal student aid programs and are covered.

If your child attends a private K–12 school, FERPA’s definition and its protections likely don’t apply to their records. Some states have their own student privacy laws that fill part of the gap, but the scope varies.

Third Parties Holding Records for the School

The “maintained by the school or someone acting on the school’s behalf” half of the test reaches outside vendors, too. Schools rely on outside providers for learning management platforms, cloud-based student information systems, and much more. A third-party provider can hold education records without triggering an unauthorized disclosure if it meets specific conditions: it performs a function the school would otherwise handle with its own employees, it is under the school’s direct control regarding how it uses and maintains the records, it is identified in the school’s annual FERPA notification as a school official, and it may not re-disclose the information without authorization.⁹

If a school signs up for an app without an agreement restricting how the vendor uses student data, the vendor may not meet these criteria, and the school may have made an unauthorized disclosure. Parents who want to know which vendors have access to their child’s records can ask the school for its list of designated school officials, which the school is required to publish in its annual FERPA notification.

1
U.S. Department of Education. What Is an Education Record?
2
eCFR. 34 CFR 99.3 – What Definitions Apply to These Regulations?
3
U.S. Department of Education. When Is a Photo or Video of a Student an Education Record Under FERPA?
4
Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights
5
U.S. Department of Education. Directory Information
6
eCFR. 34 CFR 99.37 – What Conditions Apply to Disclosing Directory Information?
7
U.S. Department of Health and Human Services. Joint Guidance on the Application of FERPA and HIPAA to Student Health Records
8
U.S. Department of Education. To Which Educational Agencies or Institutions Does FERPA Apply?
9
U.S. Department of Education. Responsibilities of Third-Party Service Providers Under FERPA