2D-2-Family Education Rights and Privacy Act of 1974 (FERPA)
v. Notice of Rights
Parents and students must be provided notice of their rights under FERPA. This notice must be provided at least annually and include information related to accessing student records, the process by which parents and students may seek to amend student records, consent requirements for disclosing student records, and the right to file a complaint with the DOE. This notice may be provided by any means "reasonably likely to inform the parents or eligible students of their rights."
iv. Disclosure Restrictions
Educational institutions receiving federal funds must have a policy prohibiting the disclosure of education records or other personally identifying information about a student without first obtaining parental or student consent. This consent must be in writing, dated and signed (either physically or electronically).26 The waiver must specify the records to be disclosed, the purpose of disclosure, and the identity of whom disclosure will be made. Parents and students also have the right to obtain a copy of any disclosure made pursuant to a written waiver. There are numerous situations, however, in which education records may be disclosed without student or parental consent. Consent is not required when disclosure is made: (1) To other school officials that have legitimate educational interests in obtaining the records; (2) To officials of other schools where the student seeks to enroll, upon condition that the student or parents be notified of the transfer, receive a copy of the record if desired, and have an opportunity for a hearing to challenge the content of the record; (3) To certain federal authorities or agencies; (4) In connection with a student's application for, or receipt of, financial aid where disclosure of such information is necessary, (5) To state and local officials or authorities to whom such information is specifically allowed to be reported or disclosed pursuant to qualifying State statute; (6) To organizations developing predictive tests, administering student aid, or improving school instruction, subject to additional significant obligations; (7) To accrediting organizations in order to carry out their accrediting functions; (8) To parents of a dependent student, parents of a student under the age of 18, or to the student; (9) In connection with an emergency and where necessary to protect the health or safety of the student or other persons; (10) Pursuant to a grand jury or law enforcement subpoena; (11) To federal and state education officials conducting program audits; (12) To victims of an alleged perpetrator of violence or sex offenses related to the outcome of disciplinary proceedings related to those alleged offenses; (13) Regarding the results of a disciplinary proceeding for violence or sex offenses where a post-secondary institution has determined that the student has committed a violation of student rules or policies, subject to certain restrictions; (14) Regarding certain sex offenders required to register under federal law; (15) To the parent or legal guardian of a student under the age of 21 of information regarding the violation of law or school policy related to the possession of alcohol or controlled substances, if the institution determines that the student committed a disciplinary violation; (16) In aggregate form to the Secretary of Agriculture for the purposes of conducting program monitoring, evaluations, and performance measurements of State and local educational and other agencies and institutions receiving federal benefits; or (17) To a child welfare agency legally responsible for the student. Records that have been "de-identified" by stripping the data of any "personally identifiable information" may also be disclosed without parental or student consent. "Personally identifiable information" is defined under FERPA similarly to how it is defined in other laws and includes but is not limited to: (1) a student name; (2) the names of students' family members; (3) students' or families' addresses; (4) social security or student id numbers; (5) dates of birth; (6) any other information that, alone or in combination, could be linked to a student with reasonable certainty; and (7) information requested by a person that the school reasonably believes has knowledge of the student's identity to which the education record is linked. Before releasing education records pursuant to any of the above exceptions, educational institutions must use "reasonable methods" to identify the person to whom disclosure is made, whether disclosure is made to a parent, student, or another person. Examples of reasonable methods include providing passwords, personal security questions, or other indicators that are possessed only by the person seeking the record. Similarly, schools must use "reasonable methods" to ensure that employees only have access to education records in which they have a "legitimate educational interest." In disclosing information with parental or student consent, or under an applicable exception, the educational institution must maintain a record of anyone that has requested or obtained access to the student's educational records. This log must identify the persons requesting or obtaining access and their legitimate interest in obtaining the records. And it must be maintained for as long as the education records themselves are maintained. In addition to these above exceptions, federal law enforcement may also apply to a court for permission to access educational records for purposes of terrorism-related investigations, subject to certain restrictions.
Interplay Between FERPA and HIPAA's Privacy Rule
The exception for certain health treatment records from the definition of "education records" under FERPA raises some interesting questions related to the privacy of health information held by educational institutions. In most cases, educational institutions are not subject to the Health Insurance Portability and Accountability Act ("HIPAA") because they do not fall within the definition of a "covered entity," as explained in Module II.B.2. This is true even though most schools have a school nurse or other healthcare professionals on staff because the treatment schools most often provide is rarely associated with a "covered transaction," such as a healthcare claim submitted to insurance. Where a school may otherwise fall within the definition of "covered entity," however, HIPAA's Privacy Rule exempts any records covered by FERPA from the definition of "protected health information."Because health treatment records that are shared with persons other than the treating health professional are not exempt from the definition of "education records" under FERPA, these records would be covered by the FERPA disclosure rules, rather than HIPAA's Privacy Rule. In other words, as a general rule, health records are subject to FERPA and not HIPAA. In cases where a school health facility treats both students and staff—something that occurs at many post-secondary institutions—the records of non-students may still be subject to HIPAA's Privacy Rule. Likewise, in cases where a school does not accept federal funding, even the health records of students may be subject to HIPAA's Privacy Rule if the school meets the definition of a "covered entity" by engaging in "covered transactions" related to a student's "protected health information."
Substantive Policies Under FERPA
The substantive policies required to be adopted under FERPA, if an educational institution wishes to obtain federal funding, incorporate many important Fair Information Practices ("FIPs"). As a general rule, where consent, access, or another FIP applies, the authority to consent to disclosure or to access information resides in the student, if over the age of 18, and in the parent of the student, if the student is under the age of 18. Policies that must be implemented under FERPA include the following: i. Right to Access and Review Education Records ii. Right to Contest Record Accuracy iii. Rights Regarding Directory Information iv. Disclosure Restrictions v. Notice of Rights
iii. Rights Regarding Directory Information
Educational institutions are permitted to release certain directory information about their students, which includes but is not limited to "the student's name, address, telephone listing, date and place of birth, major field of study, participation in officially recognized activities and sports, weight and height of members of athletic teams, dates of attendance, degrees and awards received, and the most recent previous educational agency or institution attended by the student." This list is merely illustrative. Under the rules adopted by the Department of Education ("DOE"), schools can designate additional information as "directory information." Social security numbers, however, may never be designated as such. Before releasing designated directory information, an educational institution must provide notice of the information it intends to publicly release and provide a reasonable period of time after notice is given for parents or students to opt-out of having this information shared publicly. This right to opt-out may not be used to block the release of other information under FERPA. Directory information of former students may be disclosed without providing notice and the opportunity to opt-out of information sharing, but any prior opt-out must still be respected after the student becomes an alumnus.
Key Points
FERPA applies based upon Congress' authority to appropriate federal funds - This effectively exempts any educational institution that does not receive federal funding - No preemption of state law Applies to "education records," which are hardcopy and electronic records that directly relate to a student and that are maintained by an educational institution - There are numerous exceptions to this definition, including: (1) ancillary records; (2) campus police records; (3) employment records; (4) health treatment records; (5) alumni and applicant records; and (6) peer-reviewed papers As a general rule, if a right is provided under FERPA, the right resides in the student, if over the age of 18, and in the parent, if the student is under the age of 18 Access to records must be provided in a "reasonable time" not to exceed 45 days, with some exceptions (e.g., parent's financial aid information and letters of recommendation) FERPA provides a right to contest accuracy of records and include a note if correction is denied after a hearing Educational institutions can disclose "directory information," but students maintain a right to opt out Disclosure of education records is prohibited without student (or parental) consent, but there are seventeen enumerated exceptions to this rule - If records are "de-identified," then consent is not necessary - If records are released pursuant to an exception, educational institutions must use "reasonable methods" to identify the person to whom disclosure is made and keep records of the disclosure Students or parents must be provided notice of their rights under FERPA Enforced by the DOE, who has the authority to pull funding but only if voluntary compliance cannot be obtained - Students and parents may file a complaint within 180 days of alleged violation As a general rule, health records are subject to FERPA and not HIPAA
Education Records and Exceptions
FERPA applies to "education records," which are those records that relate directly to a student and that are maintained by an educational institution or agency, or any party acting on behalf of an educational institution or agency. The term "records" is defined broadly to include "any information recorded in any way," whether in hardcopy or electronic form. Education records therefore include both hardcopy and electronic records of grades, disciplinary actions, and financial aid information, among other data. There are a number of significant exceptions to what is considered an "education record" under FERPA, including: (1) Ancillary Records - Records that are kept in the sole possession of the maker, are used only as a personal memory aid, and are not accessible or revealed to any other person except as a temporary substitute for the maker of the record are not "education records." (2) Campus Police Records - Records held by campus police for purposes of law enforcement are similarly excepted from the definition of "education records." These records, however, are nonetheless subject to additional regulations adopted under 34 C.F.R. § 99.8. (3) Employment Records - Employment records that are maintained in the normal course of business, relate only to employment, and are used for no other purpose are considered employment records, not "education records" under FERPA. (4) Health Treatment Records - Health treatment records are not considered education records when they are related to the treatment of a student who is 18 years of age or older if the records are disclosed only to the individual providing health treatment. (5) Alumni and Applicant Records - Records created or received by an educational agency or institution after an individual is no longer a student in attendance and that are not directly related to the individual's attendance as a student are not protected under FERPA. (6) Peer-Reviewed Papers - Grades on peer-graded papers before they are collected and recorded by a teacher or school official are not considered education records.
Family Education Rights and Privacy Act ("FERPA")
In 1974, Congress passed the Family Education Rights and Privacy Act ("FERPA")—sometimes referred to as the Buckley Amendment—in order to provide students with control over how their student records were disclosed and accessed. Unlike many other federal privacy laws that impose rules upon certain entities based upon Congress's authority to regulate interstate commerce, FERPA operates under Congress's authority to appropriate federal funds. In other words, Congress has conditioned educational funding on the adoption of certain policies. Thus, while FERPA does not require educational institutions to adopt any policies or procedures, they must do so to receive federal education funding. Any institution that does not receive federal funding is therefore effectively exempt from the law and associated regulations. Moreover, this means that there is no preemption of inconsistent state laws.
i. Right to Access and Review Education Records
Parents or students must be permitted to access and review education records of the student or any portion of any education record related to the student. Access must be provided within a "reasonable" time, and no later than 45 days after the request. There are specific exceptions under this rule for students enrolled in a postsecondary education institution, including exceptions for the parents' financial information and letters of recommendation. Additionally, if the student has signed a valid written waiver, a school may be exempt from providing access to confidential information relating to recommendations concerning (1) the student's admission or enrollment at another school, (2) applications for employment, and (3) the receipt of an honor or honorary recommendation. A waiver is valid for purposes of this provision only if the student is, upon request, informed of who will be making the recommendation, the recommendation is used solely for the intended purpose, and the waiver is not a condition for admission or receipt of another service (e.g., financial aid). This waiver must also be in writing and signed by the student, regardless of age.
ii. Right to Contest Record Accuracy
Students and parents must be provided a means by which to challenge the content of inaccurate or misleading student records. A decision regarding whether to amend the record must be made by the educational institution within a "reasonable" time after the request is made. If the institution decides not to amend the record, the student is entitled to a hearing on the matter. And if, after this hearing, the educational institution determines that the record still should not be amended, the student or parent has the right to insert into such records a written explanation respecting the content of the records. This statement must be disclosed whenever the institution discloses the portion of the student record to which the statement relates.
FERPA Enforcement; Student and Parent Complaints
The DOE has enforcement authority to ensure that educational institutions comply with FERPA. In order to pull funding based upon a violation of FERPA, the Secretary of Education must find that "there has been a failure to comply with [FERPA], and he has determined that compliance cannot be secured by voluntary means." Within the DOE, the Office of the Chief Privacy Officer has primary investigative authority. Parents and students may file written complaints with the Office of the Chief Privacy Officer regarding alleged violations of FERPA. Such a complaint is timely if filed within 180 days of the alleged violation or when the complainant knew or reasonably should have known of the violation. Either in response to a parent or student complaint, or on his or her own initiative, the Chief Privacy Officer then determines whether the educational institution has violated FERPA. When the Chief Privacy Officer initiates an investigation, it must notify the complainant and the educational institution in writing about the substance of the allegations and direct the educational institution to submit a written response or other relevant information. Written notice of its findings must also be provided to the complainant and the educational institution. If a violation of FERPA is found, then the Chief Privacy Officer must also determine whether "the failure to comply was based on a policy or practice." Moreover, the DOE must identify the specific steps needed to come into compliance. From that point, the educational institution is given a reasonable amount of time to voluntarily come into compliance. Where a party fails to comply voluntarily, the DOE may then withhold funds, seek a cease-and-desist order, or terminate the institution's eligibility to receive funding.