Home > Freedom of Information > Reporter’s Guide to FERPA > FERPA Nuts and Bolts

Reporter’s Guide to FERPA
Navigating the Family Educational Rights
and Privacy Act

---

FERPA Nuts and Bolts

By Jodi Cleesattle, with thanks to the Georgia First Amendment Foundation for its assistance

1. Overview
2. Records affected by FERPA
3. Records not kept secret by FERPA
4. Records releasable for specific purposes
5. Clery Act and release of campus crime records

---

1. Overview

A 1974 federal law, the Family Educational Rights and Privacy Act (FERPA), also known as the “Buckley Amendment,” protects the confidentiality of student educational records and limits their disclosure, while guaranteeing students’ rights to access their records. FERPA, which is codified at 20 U.S.C. § 1232g with regulations at 34 CFR Part 99, applies to any public or private elementary, secondary or post-secondary school and any state or local education agency that receives federal funds.

FERPA has two parts, both of which rely on the threat of the loss of federal funding to guarantee compliance.

First, FERPA gives students (and their parents, if the student is under the age of 18) the right to inspect and review their own education records, request corrections, stop the release of personally identifiable information, and obtain a copy of their school’s policy regarding access to educational records. The Act provides that schools or educational agencies that deny students’ and parents’ access to their educational records will lose federal funding.

Second, FERPA provides that federal funds will be withheld from any school or educational agency that has a “policy or practice of permitting the release of education records (or personally identifiable information contained therein other than directory information ...) of students,” to parties not authorized to receive such information, without the written consent of either the student or his or her parents.

FERPA does not provide a private cause of action allowing individuals to sue to enforce the federal funding provisions. That authority is reserved to the federal government. If an individual believes a school has improperly disclosed personally identifiable information, he or she should contact the Family Policy Compliance Office, created under FERPA, to address the issue. The Family Policy Compliance Office is located at the U.S. Department of Education, 600 Independence Avenue, S.W., Washington, D.C. 20202-4605, (202) 260-3887, http://www.ed.gov/offices/OM/fpco.

[ Top ]

---

2. Records affected by FERPA

FERPA limits access to “education records” of students and the “personally identifiable information” other than “directory information” contained in such records.

The Act defines “education records” as: “those records, files, documents, and other materials which (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution.”

“Personally identifiable information” includes:

— A student’s name;
— The name of the student’s parent or other family member;
— The address of the student or student’s family;
— A personal identifier such as the student’s social security number, student number, or biometric record;
— Other indirect identifiers, such as the student’s date of birth, place of birth, and mother’s maiden name;
— Other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty; or
— Information requested by a person who the educational agency or institution reasonably believes knows the identity of the student to whom the education record relates.

A “biometric record” is a record of one or more measurable biological or behavioral characteristics that can be used for automated recognition of an individual, such as fingerprints, retina and iris patterns, voiceprints, DNA sequence, facial characteristics, and handwriting.

The last category of personally identifiable information — information requested by a person who the school reasonably believes knows the identity of the student whose record is sought — was added in the final regulations adopted December 9, 2008 and is particularly problematic for reporters. This designation of information means that a reporter seeking information about any incident that has received news coverage or is well known on campus or in the community cannot obtain that information, even if he makes a more general request for records. For example, a student athlete has been suspended for steroid use, the student newspaper has covered the incident, and the identity of the suspended athlete is widely known on campus. A reporter who requests information about all student athletes who have been suspended for steroid use in the last year will be denied the information.

[ Top ]

---

3. Records not kept secret by FERPA

FERPA allows — but does not require — access to student records to the extent they do not meet the definition of educational records. For example, FERPA allows educational institutions to aggregate data and disclose statistical information from education records, without consent of either students or parents, so long as the student’s identity is not “easily traceable.”

The following categories are not considered educational records, and thus FERPA does not prohibit their disclosure. There might be other laws that prohibit release, but the school cannot rely upon FERPA to justify withholding.

Directory Information
FERPA prohibits disclosure of education records and personally identifiable information “other than directory information.”

“Directory information” means information contained in an education record of a student that would not generally be considered harmful or an invasion of privacy if disclosed. It includes, but is not limited to the student’s:

— name
— address
— telephone listing
— electronic mail address
— photograph
— date and place of birth
— major field of study
— grade level
— enrollment status (e.g., undergraduate or graduate; full-time or part-time)
— dates of attendance
— participation in officially recognized activities and sports
— weight and height of members of athletic teams
— degrees
— honors and awards received
— most recent educational agency or institution attended.

However, individual students may withhold disclosure of information if they so choose.

Teacher Records Not Shared With Others
“Education records” does not include records of instructional, supervisory and administrative personnel that are in the sole possession of the maker of the records and that are not accessible or revealed to any other person except a substitute.

Law Enforcement Records
“Education records” does not include records maintained by a law enforcement unit of the educational agency or institution that were created by that law enforcement unit for the purpose of law enforcement, so FERPA cannot be cited as grounds for refusing to disclose campus law enforcement records.

However, records created and maintained by a law enforcement unit exclusively for a non-law enforcement purpose — such as a school disciplinary action or proceeding — do not fall within the exemption.

Health or safety emergency records
An educational institution may release records without eligible student or parent consent if the records are in connection with an emergency if knowledge of the information is necessary to protect the health or safety of the student or other individuals.

The institution must consider the seriousness of the threat to the health or safety of the student or other individuals; the need for the information to meet the emergency; whether the parties to whom the information is disclosed are in a position to deal with the emergency; and the extent to which time is of the essence in dealing with the emergency.

Disciplinary records to protect others
An educational institution may release records without eligible student or parent consent where the records concern disciplinary action taken against such student for conduct that poses a significant risk to the safety of that student, other students, and the school community.

Also, an educational institution may release certain records without eligible student or parent consent if the disclosure is to a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense. The institution may disclose the final results of the disciplinary proceeding to the victim, regardless of whether it concluded that a violation of its rules or policy was committed.

The institution may also disclose to the public at large a limited version of the final results of the disciplinary proceeding conducted by the institution of post-secondary education with respect to that alleged crime or offense only if the institution concludes that the offender violated its policy or rule with respect to the alleged offense.

Medical Records
“Education records” does not include records regarding a student who is 18 years of age or older or is attending a post-secondary school, which are made or maintained by a physician, psychiatrist, psychologist or other recognized professional acting in his professional capacity, and which are made, maintained or used only in connection with the provision of treatment to the student, and are not available to anyone other than persons providing such treatment. The records might be kept secret under other laws (e.g., HIPAA), but they are not secret under FERPA.

Records of Former Students
Records that are created after the student leaves the educational institution and that are not directly related to the individual’s attendance as a student are subject to disclosure.

Employment Records
Employment records are subject to disclosure unless the employee is a student at the university, and the employment is a result of the student’s status as a student at the university.

Peer-Graded Records
“Education records” does not include records on peer-graded papers before they are collected and recorded by a teacher.

Educational Records Releasable With Consent
The following educational records can only be released with consent:

Medical & Psychological Records
— Elementary and secondary
— Student medical and psychological records prepared by a physician or psychologist in connection with treatment of a student are releasable under FERPA only with a parent or eligible student’s consent.
— Post-secondary or over age 18
Student medical and psychological records prepared by a physician or psychological in connection with treatment of a student may be released by the student to a physician or psychologist of his choice.

Academic Records
— A student’s academic records are subject to disclosure under FERPA only with a parent or eligible student’s consent or pursuant to one of the exceptions to consent set forth in the federal act.

Admissions Records
— To the extent a prospective student does not earn admission to a particular school, his or her admission records are subject to disclosure under FERPA. However, to the extent a prospective student gains admission to and attends a particular school, his or her admission records are subject to disclosure under FERPA only with a parent or eligible student’s consent.

Letters of Recommendation
— Letters of recommendation placed in a student’s file before January 1, 1975 are subject to disclosure under FERPA only with a parent or eligible student’s consent.

[ Top ]

---

4. Records releasable for specific purposes

Subpoenaed records
An educational institution may release records without eligible student or parent consent if the records are subpoenaed or court ordered to be released. However, the educational institution must make a reasonable effort to inform the eligible student or parent in advance of compliance with the subpoena or court order.

“Legitimate educational interests”
An educational institution may release records without eligible student or parent consent to other school officials, including teachers, within the educational institution whom it has determined to have “legitimate educational interests.”

Transfer schools
An educational institution may release records without eligible student or parent consent to officials of another school, school system, or institution of post-secondary education where the student seeks or intends to enroll.

Financial aid
An educational institution may release records without eligible student or parent consent in connection with financial aid for which the student has applied or received, if the information is necessary to determine eligibility for the aid, the amount of the aid, the conditions for the aid, or enforce the terms and conditions of the aid.

Federal, state, and local authorities
An educational institution may release records without eligible student or parent consent to authorized representatives of the Comptroller General of the United States, the Attorney General of the United States, the Secretary of United States Department of Education, or state and local authorities.

Research and studies
An educational institution may release records without eligible student or parent consent to organizations conducting studies or educational institutions to develop or administer predictive tests, student aid programs, or improve instruction. In order to receive this information, the studies must be conducted in a manner that does not permit the personal identification of parents and students by individuals other than representatives of the organization.

Accrediting agencies
An educational institution may release records without eligible student or parent consent to accrediting organizations to carry out their accrediting functions.

Parents
An educational institution may release records without eligible student consent to a parent regarding that student’s violation of any federal, state, local, or institutional rule governing the use or possession of alcohol or a controlled substance if the institution determines that the student has committed a disciplinary violation with respect to that use or possession and the student is under age 21 at the time of disclosure to the parent.

[ Top ]

---

5. Clery Act and release of campus crime records

The Clery Act is the federal law requiring reporting of campus crime data. The law is named for Lehigh University freshman Jeanne Clery, 19, who was raped, beaten and murdered by a fellow student in her dorm room in 1986. When Clery’s parents learned that the attack on their daughter was one of several violent crimes that had occurred on campus but were not reported, they formed Security on Campus, Inc., an organization that works to make sure that campus crime information is made public.

The Clery Act, 20 U.S.C. § 1092(f), requires colleges and universities receiving federal funding to make their crime information public. Specifically, it requires schools to provide: (1) an annual statistical report; (2) a daily campus crime log; and (3) “timely reports” regarding crimes that present an ongoing threat to the campus community.

Annual Security Reports
Colleges and universities are required to publish an annual security report containing campus security policies and procedures, the law enforcement authority status of security personnel, a description of drug and alcohol abuse, crime prevention and sexual assault education programs available to the campus community, a listing of any policies that encourage accurate and prompt reporting of crime to the appropriate police agencies, campus policies regarding law enforcement relating to drug and alcohol use, and actual crime statistics.

Statistics must be maintained for: (1) criminal homicide; (2) sex offenses; (3) robbery; (4) aggravated assault; (5) burglary; (6) motor vehicle theft, and (7) arson. Where an arrest or disciplinary referral is made, a school must also report statistics concerning: (8) liquor law violations; (9) drug law violations; and (10) illegal weapons possession.

Statistics must also be maintained for the above categories (1) through (7) when the victim was intentionally selected because of his or her actual or perceived race, gender, religion, sexual orientation, ethnicity, or disability.

Daily Campus Crime Logs
All public and private post-secondary institutions that receive federal funding and maintain a police department must keep a daily log, in a form that can be easily understood, recording all crimes reported to the police department. Crimes must be added to the log within two days of their initial report. Log entries must include the nature of the crime, its date, time, and general location, and the disposition if known.

“Timely Reports” Regarding Crimes That Present An Ongoing Threat To The Campus Community
All campus security personnel and other officials of an educational institution who have responsibility for student activities are responsible for issuing timely warnings concerning the crimes listed in the school’s annual statistical report.

[ Top ]

---

Jodi Cleesattle is a deputy attorney general at the California Department of Justice and a former reporter and editor. She is SPJ's Region 11 director and the SPJ Project Sunshine Chair for Southern California and serves on SPJ's Freedom of Information Committee and Legal Defense Fund Committee.

We thank the Georgia First Amendment Foundation for their graciousness in sharing their report, "Georgia Public Schools and the Open Records Act: A Citizen’s Guide to Accessing School Records," with us as we compiled our FERPA report.

> Next: Top Ten Story Ideas For FERPA Enterprisers