October 7, 2005

B. Alan McGraw, Esq.

Altizer, Walk & White

209 East Main Street

P.O. Box 30

Tazewell, Virginia 24651

Dear Mr. McGraw:

This responds to your August 12, 2005, request for guidance on behalf of
the Tazewell County, Virginia School Board about restricting physical
access to education records. This Office is responsible for
administering the Family Educational Rights and Privacy Act (FERPA), 20
U.S.C. § 1232g and 34 CFR Part 99. Under that authority we investigate,
process and review complaints and violations and provide technical
assistance to ensure compliance with the statute and regulations. 34 CFR
§ 99.60(b).

FERPA provides that no funds administered by the Secretary of Education
shall be made available to an educational agency or institution that has
a "policy or practice of permitting the release of education records" or
"providing access to" any personally identifiable information in
education records, without the prior written consent of a parent or
eligible student (as defined in § 99.3 of the regulations) except as
authorized by law. See 20 U.S.C. § 1232g(b)(1) and (b)(2). Under § 99.30
of the regulations, a parent or eligible student must provide a signed
and dated written consent before education records are disclosed, except
as provided in § 99.31. "Disclosure" is defined to mean "to permit
access to or the release, transfer, or other communication of personally
identifiable information contained in education records to any party, by
any means, including oral, written, or electronic means." 34 CFR § 99.3.

The term "education records" is defined in FERPA as those records that
are directly related to a student; and maintained by an educational
agency or institution, or by a party acting for the agency or
institution. 34 CFR § 99.3. "Record," in turn, means "any information
recorded in any way, including, but not limited to, hand writing, print,
computer media, video or audio tape, film, microfilm, and microfiche."
34 CFR § 99.3.

While the law does not prescribe specific methods that should be used to
protect education records from unauthorized access or disclosure, the
prohibition in FERPA against disclosing or permitting access to
education records without consent clearly does not allow an educational
agency or institution to leave education records unprotected or subject
to access by unauthorized individuals, whether in paper, film,
electronic, or any other format. We interpret this prohibition to mean
that an educational agency or institution must use physical,
technological, administrative and other methods, including training, to
protect education records in ways that are reasonable and appropriate to
the circumstances in which the information or records are maintained.

Your letter indicates that the Tazewell County Board of Supervisors
recently proposed a plan in which various county government offices and
agencies would share computer network hardware, software, and personnel
resources with the Tazewell County school system. According to your
letter,

> school system technical support personnel inform us that the county
> government's "penetration'" of the school system's network resources
> would be significant, such that electronic student educational records
> could be accessed by persons or entities not employed by the school
> system.

You explained that these individuals are not authorized to obtain access
to education records, without consent, under § 99.31 of the regulations
and you are concerned that the proposal would violate FERPA.

Based on the provisions described above, this Office would consider a
record management system that allows unauthorized individuals to have
access to education records to constitute a policy or practice of
violating FERPA. In the context of paper records, for example, this
means that a school district may not place the report cards of all
students in a box on a teacher's or principal's desk and allow parents
or students to look through the box to find the student's own record.
Similarly, with respect to electronic recordkeeping, a school district
may not maintain a system that provides for access to education records
by parties that are not parents, students, authorized "school
officials," or otherwise permitted to have access as specified in §
99.31 of the regulations.

I trust that the above information is helpful in explaining the scope
and limitations of FERPA as it relates to your concern.

Sincerely,

/s/

LeRoy S. Rooker

Director

Family Policy Compliance Office