Guide

to Protecting 

the Privacy of Student Information:

State and Local Education Agencies

Forum
Guide

to Protecting 

the Privacy of Student Information:

State and Local Education Agencies

Forum
National Cooperative Education Statistics System

The National Center for Education Statistics established the National Cooperative Education Statistics System

(Cooperative System) to assist in producing and maintaining comparable and uniform information and data on early

childhood education and elementary and secondary education. These data are intended to be useful for policymaking

at the federal, state, and local levels.

The National Forum on Education Statistics, among other activities, proposes principles of good practice to assist state

and local education agencies in meeting this purpose. The Cooperative System and the National Forum on Education

Statistics are supported in these endeavors by resources from the National Center for Education Statistics.

Publications of the National Forum on Education Statistics do not undergo the formal review required for products of

the National Center for Education Statistics. The information and opinions published here are the product of the

National Forum on Education Statistics and do not necessarily represent the policy or views of the U.S. Department of

Education or the National Center for Education Statistics.

March 2004

This publication and other publications of the National Forum on Education Statistics may be found at the National

Center for Education Statistics web site.

The NCES World Wide Web Home Page is http://nces.ed.gov

The NCES World Wide Web Electronic Catalog is http://nces.ed.gov/pubsearch

The Forum World Wide Web Home Page is http://nces.ed.gov/forum

Suggested Citation

National Forum on Education Statistics. Forum Guide to Protecting the Privacy of Student Information: State and Local

Education Agencies, NCES 2004–330. Washington, DC: 2004.

For ordering information on this report, write:

U.S. Department of Education

ED Pubs

P.O. Box 1398

Jessup, MD 20794–1398

Or call toll free 1–877–4ED–PUBS; or order online at http://www.edpubs.org

Technical Contact:

Ghedam Bairu

(202) 502–7304

Ghedam.Bairu@ed.gov
iii

Chair

Dennis Powell,

Illinois State Board of Education

Task Force Members

Nancy Resch

New Jersey Department of Education

Mary Schifferli

Office for Civil Rights 

U.S. Department of Education

Leland Tack

Iowa Department of Education

Kathleen Wolan

Family Policy Compliance Office 

U.S. Department of Education

Consultant

Oona Cheung

Project Officer

Ghedam Bairu

National Center for Education Statistics 

U.S. Department of Education

Members

Annette Barwick

Hillsboro County Florida School District

Patricia Gonzalez

Office of Special Education Programs 

U.S. Department of Education

John Haigh

Office of Vocational and Adult Education 

U.S. Department of Education

Jerry Hottinger

Pennsylvania Department of Education

Susan Meston

Muskegon Area ISD, Michigan

v

Acknowledgments

The Task Force would like to thank a number of

individuals who generously provided assistance at

various stages during the development of this project. Their knowledge and expertise contributed to

the project’s success.

The Task Force received consistent support from the

U.S. Department of Education. David Berthiaume of

the Department’s Office of General Counsel provided assistance during the research phase,

reviewed the document, and offered valuable suggestions. Ellen Campbell of the Family Policy

Compliance Office painstakingly reviewed the document before its publication and provided many

good suggestions. Wendy Tada of the Office of

Special Education Programs and Ed Trepacz, Office

of General Counsel, gave final reviews that helped

to ensure the accuracy of the information. 

Melinda Fowler of the Texas Education Agency and

Mary Ann Merano of the Illinois State Board of

Education reviewed the draft manuscript from the

perspective of its potential audiences. 

Andy Rogers of the Education Statistics Services

Institute (ESSI) coordinated the technical support

for the initial phase of this project. Molly Soule, formerly with ESSI, conducted background research

for the Task Force when it was first established.

Oona Cheung was the principal writer. Under subcontract with Westat, Inc., she coordinated and followed through with the writing, review, and

publication process of the document. Robin Gurley

of ESSI provided editing services. Sanjay Seth of

ESSI coordinated the design and typesetting tasks,

making the document ready for printing.

The support of the National Center for Education

Statistics was crucial to the success of the project.

This publication would not have been possible

without the leadership of Ghedam Bairu and Lee

Hoffman, who are with the Division of

Elementary/Secondary Cooperative Systems and

Institutional Studies.

Finally, the Task Force wishes to thank the Policy,

Programs and Implementation Committee of the

National Forum on Education Statistics for its continuing support and guidance throughout the

development of this report.

vii

Preface

The primary purpose of this document is to help

state and local education agencies and schools

develop adequate policies and procedures to protect information about students and their families

from improper release, while satisfying the need

for school officials to make sound management,

instructional, and service decisions. The document

was developed under the direction of the National

Forum on Education Statistics (Forum).1

The Forum is part of the National Cooperative

Education Statistics System (Cooperative System)

that was established by the Hawkins-Stafford

Education Amendments of 1988 (Public Law

100–297) to “produce and maintain, with the

cooperation of the States, comparable and uniform

education information and data” and retains this

responsibility under the mandate of the Education

Sciences Reform Act of 2002 (Public Law 107–279).

To assist in meeting this goal, the National Center

for Education Statistics (NCES) established the

Forum to improve the collection, reporting, and use

of elementary and secondary education statistics.

The Forum recognized the significance of such

security issues and raised concerns about the privacy of student data being collected, used, and

released at all levels. In 1994, the Forum completed

a report entitled Education Data Confidentiality:

Two Studies. The Data Confidentiality Task Force

was then established to identify ways to help state

education agencies, school districts, and schools

ensure the privacy of education records and to clarify the laws that exist for these agencies and the

general public.

Under the Task Force’s direction, Protecting the

Privacy of Student Records: Guidelines for

Education Agencies was first published in 1997. A

companion brochure, Protecting the Privacy of

Student Education Records, was developed to help

educators and the general public understand the

Family Educational Rights and Privacy Act (FERPA).

The document was well received and widely used

by state education agencies and local school districts. Since the publication of that document, new

laws affecting the privacy issue have passed and

more guidelines have been provided by the U.S.

Department of Education and the U.S. Department

of Agriculture. A new Task Force was formed by

the Forum in 2002 to study the issue, and revision

to the guidelines began in 2003. This publication is

the result of collaborative efforts among various

federal agencies and state and school district officials. The focus of this report has been expanded to

include other types of privacy concerns in addition

to education records.

1

Full Forum members consist of federal, state, and local education representatives whose agencies have major responsibility

for collecting and reporting state and national elementary and

secondary data through the National Cooperative Education

Statistics System (Cooperative System). Associate Forum members consist of national-level agencies or organizations that collect and/or use elementary and secondary education data. In

addition, meetings are open to the general public, and experts

may be invited to participate in Forum activities and to offer

their expertise during Forum deliberations.

ix

Table of Contents

Task Force Members . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .iii

Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .v

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .vii

Section 1: An Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1

Overview, Goals, and Key Points and Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1

A. Principles Underlying Privacy Protections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2

B. Key Concepts of Privacy Laws and Confidentiality Policies . . . . . . . . . . . . . . . . . . .2

C. Important Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3

D. About the Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5

Section 2: Summary of Key Federal Laws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7

Overview, Goals, and Key Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7

A. Privacy-Related Laws That Apply to Agencies and Schools . . . . . . . . . . . . . . . . . . .8

B. Privacy Protection Under FERPA: Responsibilities of Agencies and Schools . . . . . .10

C. U.S. Department of Education-Funded Surveys and Studies . . . . . . . . . . . . . . . . .15

D. FERPA and Special Education Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17

E. Other Federal Laws Affecting Information Privacy in Schools . . . . . . . . . . . . . . . .18

F. Resources for Interpreting Federal Laws That Protect the Privacy of Education

Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Commonly Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .22

Exhibit 2–1 Fact Sheet: Family Educational Rights and Privacy Act of 1974 . . . . . . . .24

Exhibit 2–2 Fact Sheet: Protection of Pupil Rights Amendment . . . . . . . . . . . . . . . . .25
x

Forum Guide to Protecting the Privacy of Student Information

Exhibit 2–3 Access to High School Students and Information on Students by Military 

Recruiters: Questions and Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26

Exhibit 2–4 Model Notification of Rights Under FERPA for Elementary and Secondary Schools . .29

Exhibit 2–5 USDA Memorandum Concerning Limited Disclosure of Children’s Free

and Reduced Price Meal or Free Milk Eligibility Information . . . . . . . . . . . . . . . . . . .30

Exhibit 2–6 USDA Memorandum Concerning Limited Disclosure of Children’s Free and 

Reduced-Price Meal or Free Milk Eligibility Information in the State Medicaid Program 

and the State Children’s Health Insurance Program . . . . . . . . . . . . . . . . . . . . . . . . .34

Exhibit 2–7 A Summary of Disclosure of School Lunch Information . . . . . . . . . . . . . . . . . . . . . .37

Exhibit 2–8 USDA Guidance on Implementing the NCLB Act . . . . . . . . . . . . . . . . . . . . . . . . . . .38

Exhibit 2–9 USDA Guidance on Implementing the NCLB Act in Provision 2 and 3 Schools . . . . .40

Figure 2–1 A Brief Review of Federal Laws Protecting the Privacy of Education Records . . . . . .42

Section 3: Protecting the Privacy of Individuals During the Data Collection Process . . . . . . . . . . .43

Overview, Goals, and Key Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .43

A. Determining the Agency’s Student Data Needs and Uses . . . . . . . . . . . . . . . . . . . . . . . . . . . .44

B. Justifying Data Collection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .44

C. Ensuring Data Integrity and Accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

D. Protecting Unique Identification Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45

E. Determining the Longevity of Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .46

Commonly Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .47

Section 4: Securing the Privacy of Data Maintained and Used Within an Agency . . . . . . . . . . . . .49

Overview, Goals, and Key Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .49

A. Management Responsibilities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50

B. Defining “Legitimate Educational Interests” . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .51

C. Training Agency Staff . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52

D. Professional Ethical Standards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52

E. Research Use Within an Agency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52

F. Data Disposal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53

Commonly Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .53
xi

Exhibit 4-1 Some Ways to Promote Secure Maintenance of Automated Student Records . . . . .55

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .56

Section 5: Providing Parents Access to Their Child’s Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

Overview, Goals, and Key Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57

A. Notifying Parents of Their Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58

B. Providing Access to Individual Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58

C. Handling a Parent’s Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58

D. Managing the Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59

E. Providing Copies or Charging a Fee . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59

F. Handling Challenges to Record Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59

G. Managing the Hearing Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60

Commonly Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .60

Exhibit 5–1 Rights of Noncustodial Parents in the Family Educational Rights

and Privacy Act of 1974 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62

Exhibit 5–2 Sample Request to Review an Education Record . . . . . . . . . . . . . . . . . . . . . . . . . . .64

Exhibit 5–3 Sample Notification to Review an Education Record . . . . . . . . . . . . . . . . . . . . . . . .65

Exhibit 5–4 Sample Consent Form to Allow Accompanying Person to Review Record . . . . . . . .66

Exhibit 5–5 Sample Request to Amend an Education Record . . . . . . . . . . . . . . . . . . . . . . . . . . .67

Exhibit 5–6 Sample Notification for Approval/Disapproval of Request for Amendment . . . . . . . .68

Exhibit 5–7 Sample Notification for a Hearing of Request for Amendment . . . . . . . . . . . . . . . . .69

Section 6: Releasing Information Outside an Agency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71

Overview, Goals, and Key Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71

A. Types of Information Release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .72

B. Release of Directory Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73

C. Release With Prior Consent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .73

D. Release Without Prior Consent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74

E. Release to Researchers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74

F. Release to Other Service Agencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75

G. Review Prior to Release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77

Table of Contents
xii

Forum Guide to Protecting the Privacy of Student Information

H. Avoid Misuse of Information by Nonintended or Secondary Users . . . . . . . . . . . . . . . . . . . . .77

I. Document the Release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77

J. Ensure the Security of Data in Electronic Transmission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77

Commonly Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78

Exhibit 6–1 Sample Request to Withhold Release of Directory Information . . . . . . . . . . . . . . . . .80

Exhibit 6–2 Sample Request of Nonparent for Access to Education Record . . . . . . . . . . . . . . . .81

Exhibit 6–3 NCES Statistical Standards on Maintaining Confidentiality . . . . . . . . . . . . . . . . . . . .82

Exhibit 6–4 Sample Affidavit of Nonrelease by Researchers . . . . . . . . . . . . . . . . . . . . . . . . . . . .84

Exhibit 6–5 Sample Statement of Nondisclosure of Released Information . . . . . . . . . . . . . . . . . .85

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .86

List of Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .89
1

OVERVIEW 

Students and their parents entrust schools with

their personal information with the expectation

that this information will be used by the schools to

serve the needs of the students effectively and efficiently. School districts maintain and use personal

information for a variety of educational purposes

while students are in school. To protect the privacy

of students and their families, school staff are

legally and ethically responsible for safeguarding

the information collected about and from students.

Many federal and state laws and regulations

related to maintaining and releasing student information must be followed; however, school districts

and schools need additional policies and procedures to guide everyday operations. Since schools

and districts vary in how they collect and maintain

information about students, the types of policies

and procedures also vary. This document provides

examples of policies and procedures as well as

guidelines for deciding what is needed to ensure

the privacy of student information.

This document is intended to provide a general

overview of privacy laws and professional practices

related to the information collected for, and maintained in, student records. It should not be considered an authoritative interpretation of any law or

policy. Specific questions about student record confidentiality should be referred to the appropriate

legal or administrative agents.

Section 1 presents an overview of the principles

related to the privacy of student information,

explains key concepts, defines important terms,

and describes the uses and organization of this

document.

GOALS 

✓ Explain basic concepts of privacy and their

underlying assumptions

✓ Define key terms used in this document

✓ Present brief overview of this document

KEY POINTS AND DEFINITIONS 

• Strong federal statutes protect the privacy rights

of students and their families. These statutes

encompass education records kept in electronic

and paper media.

• Agency and school personnel are legally and

ethically obliged to safeguard the confidentiality

of student data.

• Federal and state privacy statutes pertaining to

students build on the concepts of common law

and constitutional provisions that imply privacy

guarantees.

• The underlying important concepts include

notification, disclosure, and informed written

consent.

• Education records means records, files, documents, and other materials that contain information directly related to a student and that are

maintained by education agencies or institutions, or by individuals acting on behalf of the

agencies.

• Personal or individual information refers to

information about a single individual.

The information and opinions published here are the product of the National Forum on Education Statistics and do not

necessarily represent the policy or views of the U.S Department of Education or the National Center for Education

Statistics.

SECTION 1

An Overview
• Personally or individually identifiable information

reveals an individual’s identity.

• Confidentiality refers to an obligation not to disclose

or transmit information to unauthorized parties.

• Privacy reflects an individual’s freedom from intrusion.

• Security refers to technical procedures that ensure only

authorized and intended parties have access to data.

• Disclosure includes permitting access to, revealing,

releasing, transferring, disseminating, or otherwise

communicating all or any part of any individual record

orally, in writing, or by electronic or any other means

to any person or entity.

• The Family Educational Rights and Privacy Act (FERPA)

defines parent as a natural or adoptive parent, a legal

guardian, or an individual acting as a parent in the

absence of the parent or guardian. The rights under

FERPA transfer to the student (“eligible student”)

when he or she reaches 18 or attends a postsecondary

education institution at any age.

• Within this publication, an agency or school refers to

the entity that collects, maintains, uses, and releases

information from education records.

A. Principles Underlying Privacy

Protections

To protect the privacy of families whose children are in

school, states and the federal government have established legal statutes to keep private the education records

that schools maintain on students. These laws frame data

collection procedures, restrict information disclosure, and

safeguard the quality of the information that school systems routinely collect and maintain. All education records

about students, whether handwritten or computerized,

are protected by the same privacy regulations.

Education personnel are responsible for protecting the

integrity and accuracy of the information they gather and

maintain. Therefore, data managers, their staff, and other

agency and school personnel must become familiar with

the laws that ensure the confidentiality of the records, as

well as the legal concepts underlying those laws.

The term “education records” means records, files, documents, and other materials that contain information

directly related to a student and that are maintained by

education agencies or institutions, or by individuals acting on behalf of the agencies. It contains the administrative reports of students’ educational progress, along with

any information about past or current use of schoolrelated services, such as special education, social work

services, or other supplementary educational support.

The Family Educational Rights and Privacy Act (FERPA)

(20 USC § 1232g; 34 CFR Part 99), a federal law, limits

who can have access to an education record without the

consent of the student’s parent, and it provides for a parent’s right to see what is kept in the records. These two

basic features have broad implications for the treatment

of information about students by teachers, administrators, and researchers.

In addition, schools that participate in a federally assisted

school nutrition program have personal information

about students’ eligibility for free and reduced-price

school meals or free milk. The program has regulations

that are more restrictive than FERPA’s regarding the disclosure and use of this information. Section 2 of this document discusses in detail how this type of information is

safeguarded under federal laws.

In addition to the everyday use of student information by

teachers and administrators, education records are a

source of basic data used for administrative purposes and

policymaking. Statistical information summarized from

education records can be an important resource for monitoring programs and for evaluating the success or failure

of education policies. Administrative use of computerized

records means that education records are used increasingly farther from their point of origin. As a result, it has

become more complicated but no less essential for school

officials to be vigilant about protecting the confidentiality

of records. Those who work with education records have

legal and ethical obligations to observe rigorous procedures for protecting the privacy of the original information and the individuals whose records are involved.

B. Key Concepts of Privacy Laws

and Confidentiality Policies

Privacy laws lead to establishing regulations that education agencies and schools must follow so that information about children is available only to officials who are

authorized to know such information. The laws were

2

Forum Guide to Protecting the Privacy of Student Information
information will be used. Once a parent’s consent is given

for a particular purpose or set of purposes, the information cannot be “redisclosed” (used by a third party)

except as originally indicated.

C. Important Terms

Education Record

According to FERPA, a record means any information

recorded in any way, including, but not limited to, handwriting, print, computer media, videotape or audiotape,

film, microfilm, and microfiche. An education record,

sometimes referred to as a student record, may include a

variety of details about a student, such as the date of

birth, date of enrollment, bus route, immunization history, achievement test scores and grades, enrollment and

attendance, awards, degrees achieved, and special education plans and evaluations. Personal notes by teachers

or other staff, kept in the sole possession of the maker,

used only as a personal memory aid, and that are not

accessible or revealed to any other person except a temporary substitute, are not subject to FERPA. A record of a

student may be maintained in more than one location

within an agency or school (e.g., enrollment record in the

school’s administrative office and health information in

the school health clinic).

Information included in an education record is collected

primarily from the student (or family members), teachers,

and other school staff. It may also be collected from other

sources outside the school, such as health care providers

or testing companies. Personal information about students is a vital resource for teachers and school staff in

planning responsive education programs and services;

designing individual education plans; scheduling students

into appropriate classes; planning school bus routes; and

completing reports for local, state, and federal authorities. In emergencies, the information is readily available to

school officials to assist students and their families. A limited amount of this information, as defined by the school

district or state, makes up a student’s permanent record

or transcript.

Confidentiality

Confidentiality refers to a person’s obligation not to disclose or transmit information to unauthorized parties.

Confidentiality extends to information about either indipassed by the U.S. Congress to ensure parents the right

of access to information about their children, while allowing education officials the flexibility they need to use the

information in making decisions that serve children well.

Federal and state privacy statutes pertaining to students

in elementary and secondary schools build on concepts

of common law and privacy guarantees found in the

U.S. Constitution. Fundamental to the government’s

rulemaking about data collection, privacy, and appropriate use are three concepts—notification, disclosure, and

informed consent.

Notification, according to FERPA, refers to an agency’s

responsibility to annually notify parents and eligible students of their rights under FERPA. Though not specified

in FERPA, when school officials collect information about

families or students, they should explain the legal basis

for compiling data, or “give public notice,” of the reasons

the data are being collected.

Disclosure refers to access, release, or transfer of personally identifiable information about individuals. Privacy

laws define appropriate or inappropriate information disclosures or releases. According to FERPA, data about students may be disclosed without parental consent only

under certain conditions specified in the law and regulations. For example, FERPA permits schools to disclose

information from students’ education records to school

officials who have a legitimate educational interest in the

information. Any instance in which unauthorized individuals see or use private information about students is an

inappropriate and often illegal disclosure, unless the parent or student gives consent or a law makes such access

legal. FERPA regulations require that prior written consent

be given by parents for the disclosure of information to

persons not authorized by FERPA to have access to the

records without consent.

Informed consent, though not specifically a FERPA

requirement, involves an individual’s agreement in the

context of a written account of why personal information

is requested and how it will be used. In general, parents

should have the option, without penalty, of agreeing or

declining to provide the information that an education

agency or school requests. Certain information, however,

is required by schools, and parents must provide the

information in order for their children to be enrolled. The

parents’ agreement should be an informed decision,

based on an understandable explanation of how the

3

Section 1: An Overview
viduals or organizations. In schools, districts, or state education agencies, that usually means establishing procedures that limit access to information about students or

their families. This access extends to the school officials

who work directly with the students, agency representatives who serve as evaluators or auditors, or individuals

who act on behalf of authorized education officials.

Privacy

Privacy is a uniquely personal right that reflects an individual’s freedom from intrusion. Protecting privacy means

ensuring that information about individuals is not disclosed to unauthorized persons without the individual’s

consent.

A parent or eligible student’s right of privacy is violated

when personal information is disclosed to unauthorized

third parties without consent. While confidentiality,

defined above, refers to restricting disclosure of information to authorized individuals only, privacy refers to

protection from personal intrusion.

Security

Security refers to the process that focuses on the “confidentiality, integrity, and availability” (National Forum on

Education Statistics 2003) of information systems and

data. For the purpose of discussion in this document,

security includes technical procedures that ensure only

authorized and intended parties have access to data.

Parent or Eligible Student

FERPA grants parents the rights to review, request

amendment to, and consent to the release of education

records. A parent means a natural or adoptive parent, a

legal guardian, or an individual acting as a parent in the

absence of the parent or guardian. These rights transfer

to eligible students when they reach 18 or when they

attend a postsecondary education institution. However,

parents can still have access if the eligible student is a

dependent for tax purposes. When used in this document, the term parent refers to the person who is given

the rights described in FERPA. FERPA defines a student as

any person, who is or has been in attendance, about

whom an agency or institution maintains education

records or personally identifiable information.

Education Agency or Institution

In FERPA, an education agency typically refers to a state

or local education agency that is authorized to direct and

control public elementary or secondary or postsecondary

institutions. An education institution refers to an institution or school that provides educational services or

instruction, or both, to students. FERPA also refers to

state or local education authorities. While not defined in

FERPA, the phrase generally refers to any educational

entity with authority and responsibility under state or

local law for the administration of educational functions

at the elementary, secondary, or postsecondary level.

This includes all education agencies and institutions that

are the recipient of funds under any program administered by the U.S. Secretary of Education. Throughout

this document, agency or institution refers to the entity

that collects, maintains, uses, and releases information

from education records. This entity may be a state education agency, school district, public or private school or

institution, intermediate education unit, or an institution

to which funds have been available to administer an

educational program for students with disabilities or

work-based education programs administered on behalf

of an education agency.

D. About the Document

Guidelines presented in this document are based on

information obtained from a variety of sources and represent the best practices currently used in the relevant

subjects. These include published books and reports, as

well as policies and procedures adopted at the national

level. This 2004 edition highlights the changes in legal

requirements made in the years following the first edition

published in late 1997. For example, the No Child Left

Behind (NCLB) Act of 2001 requires state education

agencies to have a procedure in place to facilitate the

transfer of disciplinary records, with respect to a suspension or expulsion, by a school district to any private or

public school. The law also gives parents more rights with

regard to the surveying of minor students, the collection

of information from students for marketing purposes,

and certain nonemergency medical examinations. The

same law also allows the disclosure of directory-type

information (students’ names, addresses, and telephone

listings) to military recruiters. The Patriot Act of 2001

allows the U.S. government, via an ex parte court order,

to collect and use education records relevant to investigations and prosecutions of specified crimes or acts of terrorism (domestic or international). These laws, and others

4

Forum Guide to Protecting the Privacy of Student Information
Section 4: Securing the Privacy of Data Maintained

and Used Within an Agency

Section 4 describes the management controls and policies needed to maintain and use data within the agency

or school. This section addresses the issue of assessing

who in an agency or school has a “legitimate educational interest” in specific information about an individual student.

Section 5: Providing Parents Access to Their Child’s

Records

Section 5 pertains to procedures for providing access to

a student’s education record by the eligible student or

the parent.

Section 6: Releasing Information Outside an Agency

Section 6 suggests procedures for handling external

requests (made by the public, researchers, and other service professionals) to release information from individual

student records.

Readers are encouraged to search for and include in this

section their states’ laws or statutes that further govern

the privacy of education records.

Other Resources

Other resources and tools that may help readers are provided. They include the following:

• an abbreviated topical index at the end of this document that will help readers locate topics of interest;

• highlights for each section that summarize key points

for easy reference or for other uses such as training;

and

• a list of commonly asked questions that will guide

readers to find answers in sections 2 to 6.

There are a number of URLs cited in this guide. Every

effort has been made to verify their accuracy at the time

of publication. If a URL is no longer working, try using the

root directory to search for a page that may have moved.

that may affect a school, district, or state education

agency’s handling of education records, are discussed in

Section 2: Summary of Key Federal Laws.

While this document intends to sort out the very complex

issues related to the privacy of student records, it is not a

“one-size-fits-all” manual that provides direct and simple

answers to all the questions. Users need to understand

the issues presented in this document, but resolve them

by developing policies and procedures pertinent to their

state or district. This document is intended to provide

guidance and references for this purpose.

This document will be most useful for staff in state and

local education agencies who are responsible for maintaining student records. It will help them to understand

the legal requirements, as well as implement proper management procedures and controls at the state or district

level when they collect personally identifiable student

information. Additionally, the document can help identify

ways to ensure that data providers and users are

informed of their rights and responsibilities when handling personally identifiable, as well as aggregate, data.

Organization and Format of the Document

The document is divided into five remaining sections containing general guidelines and examples of effective practices, sample forms, and references to other sources.

Section 2: Summary of Key Federal Laws

Section 2 describes federal laws protecting the privacy of

students that have implications for the maintenance and

release of student data by state and local education

agencies. Readers are encouraged to identify relevant

state laws and local regulations that also apply.

Section 3: Protecting the Privacy of Individuals

During the Data Collection Process

Section 3 describes appropriate procedures for collecting

individual information about students.

5

REFERENCES

National Forum on Education Statistics. (1994). Education Data Confidentiality: Two Studies. Issues in Education Data

Confidentiality and Access, and Compilation of Statutes, Laws, and Regulations Related to the Confidentiality of

Education Data (NCES 94–635). Washington, DC: U.S. Government Printing Office.

National Forum on Education Statistics. (2003). Weaving a Secure Web Around Education: A Guide to Technology

Standards and Security (NCES 2003–381). U.S. Department of Education. Washington, DC: National Center for

Education Statistics.

Section 1: An Overview

7

OVERVIEW 

Education agency administrators and parents share

a common interest in ensuring that personal information about children in elementary and secondary schools is kept confidential. Many are unaware

of the protection offered by state and federal laws.

In this section, we inform administrators and parents about how federal laws protect information

maintained in school and education agency

records. The guidelines in this section offer practical information to education agency personnel and

policymakers on developing procedures that will

work for families and schools.

This material reflects only the broad outline of federal privacy policy requirements. The material

describes federal policy principles, many of which

are supplemented by additional state statutes or

local regulations. Readers should be cautioned

that these descriptions are not legally binding and

that they should direct specific questions either to

local and state legal experts or to the appropriate

federal government offices. Figure 2–1, found at

the end of this chapter, summarizes federal laws

that govern the privacy of education records for

elementary and secondary education.

GOALS 

✓ Provide an overview of all federal laws that are

primarily concerned with or include provisions

to safeguard the privacy of student education

records

✓ Familiarize readers with specific aspects of student records that are governed by current federal laws and regulations

✓ Provide resources to further understanding of

federal laws

KEY POINTS 

• FERPA applies to education agencies, institutions, and schools that receive funds from the

U.S. Department of Education.

• FERPA establishes broad privacy protections for

education records.

• Other federal laws, such as the National School

Lunch Act, affect data collection, maintenance,

and disclosure procedures.

• FERPA grants parents and eligible students

access to education records and restricts disclosure of this information without their consent,

with some exceptions.

• Districts’ written privacy policies ensure the uniform application of FERPA.

• FERPA protects most information collected by

schools about students. However, sole possession records (e.g., teachers’ informal notes),

records of school-based law enforcement units,

and employment records do not fall under the

jurisdiction of FERPA.

• Directory information of individual students may

be released without prior consent. However,

school districts must give public notice of what

is considered in this category and provide parents an opportunity to opt out.

• The U.S. Department of Education does not

require local education agencies to notify parents or eligible students individually of their

rights, but agencies must provide notice where

it is likely to be seen.

• Parents and eligible students may inspect,

review, and request to amend education records.

• FERPA prohibits record matching of students’

education records and restricts which parties

SECTION 2

Summary of Key Federal Laws
8

Forum Guide to Protecting the Privacy of Student Information

may have access to personally identifiable information. It also establishes penalties for inappropriate

redisclosure by third parties.

• The Protection of Pupil Rights Amendment (PPRA) was

originally enacted to govern the administration to students of surveys that contain questions about certain

protected information. It was amended by NCLB to

generally apply to local education agencies that are

the recipients of any funds from the Department of

Education.

• The privacy of special education records is protected by

FERPA and the Individuals with Disabilities Education

Act (IDEA).

• Records pertaining to the identification, evaluation,

and educational placement of children with disabilities

must be available for inspection by parents.

• Any participating agency or institution that collects,

maintains, or uses personally identifiable information

about students with disabilities must protect the privacy of these special education records.

• Each public agency must have one official who is

responsible for ensuring the confidentiality of any personally identifiable information and must train all persons who are collecting or using personally identifiable

information regarding the state’s policies on confidentiality and FERPA.

• Agencies must maintain, for public inspection, a list of

employees who have access to personally identifiable

information.

• Education records may be protected by laws administered simultaneously by other state and federal agencies, as well as by the U.S. Department of Education.

• The Children’s Online Privacy Protection Act of 1998

(COPPA) also impacts student privacy. Certain web

sites must obtain parental consent before collecting

personal information from children under age 13.

Parents can review and delete the child’s personal

information. The privacy notices of these web sites

also have to disclose certain privacy requirements.

• The National School Lunch Act of 1994 protects the

privacy of information that agencies collect from families of children who are eligible to receive free or

reduced-price meals.

• Confidentiality regulations generally apply to records

of students who receive assistance or treatment under

laws administered by the federal Substance Abuse

and Mental Health Services Administration.

• The Office of Management and Budget reviews and

approves federally administered questionnaires, surveys, or forms before they are to be completed by

state and local education agencies and programs that

receive federal funds.

• The Privacy Act of 1974 stipulates allowable uses of

social security numbers by government agencies and

gives individuals the right to refuse to disclose or use

their social security numbers except for the purposes

defined by the social security law.

• Experts in government offices and education organizations can assist education agencies in protecting the

privacy of education records.

A. Privacy-Related Laws That

Apply to Agencies and

Schools

A1. Types of organizations required 

to adhere to federal education 

privacy laws

Education agencies and institutions that receive funds

from the U.S. Department of Education must adhere to

federal privacy laws pertaining to education records of

students. These generally include public elementary and

secondary schools, school districts, intermediate education agencies, and state education agencies or their

representatives. Most private and public colleges and universities are also subject to federal privacy laws because

they receive federal funds from the U.S. Department of

Education. However, because few private elementary and

secondary schools receive federal funds directly, they are

rarely subject to these privacy restrictions.

State or local education agencies that conduct programs

administered by other federal agencies—the U.S.

Departments of Agriculture, Health and Human Services,

or Labor, for example—may also be required to meet

confidentiality provisions of applicable statutes.

A2. Federal laws that directly affect 

data collected and maintained by 

education agencies

A number of federal laws govern data collections by

schools, districts, and state education agencies, and two

of those laws apply most broadly: the Family Educational

Rights and Privacy Act (FERPA) and the Protection of
Pupil Rights Amendment (PPRA). Exhibits 2–1 and 2–2

contain fact sheets describing FERPA and PPRA.

Together, the two laws have far-reaching legal implications for state and local policies and procedures that

guide the following three aspects of education agencies’

data collection activities:

• rights of a parent to review education records maintained by state or local education agencies or their

representatives;

• procedures by which education records can be released

and protected; and

• rights of parents to review and, under some circumstances, provide consent for their child’s participation

in surveys, analyses, or evaluations that are administered by state or local education agencies or their representatives.

Privacy protection under FERPA is generally incorporated

into laws authorizing federal education programs. Thus,

FERPA and PPRA requirements apply to programs such as

Title I, Migrant Education, Safe and Drug-Free Schools 

and Communities, Carl D. Perkins Vocational and Applied Technical Education Act, Education of Neglected and

Delinquent Youth, Even Start, and Even Start Family

Literacy. Similarly, most states include the core privacy protection of FERPA in their education legislation; in many

cases, they extend and strengthen this protection.

In addition to FERPA and PPRA, other federal laws affect

school, district, or state education agency data collection, maintenance, and disclosure procedures. Among

them are:

• The Individuals with Disabilities Education Act (IDEA),

which applies to the education records covered by this

law. However, IDEA release and disclosure requirements are substantially identical to those in FERPA.

• The federal Drug and Alcohol Patient Records

Confidentiality Law (42 CFR), which applies to the

services and treatment of records belonging to students who receive assistance from programs administered by the Substance Abuse and Mental Health

Services Administration.

• The Richard B. Russell National School Lunch Act

(NSLA), which restricts the release of eligibility and

services information about students and families who

participate in the federal free and reduced-price lunch

program.

• The Health Insurance Portability and Accountability

Act (HIPAA) of 1996, which provides privacy regula9

Section 2: Summary of Key Federal Laws

tions to protect patients by limiting the ways that

health plans, pharmacies, hospitals, and other covered

entities can use patients’ personal medical information. The Privacy Rule of the law, however, provides a

broad exemption for personal health information

maintained in education records, which is protected

under FERPA.

• The Paperwork Reduction Acts of 1980 and 1995,

which include rules that restrict what the federal government can ask state and local agencies to collect for

the federal government.

Three other federal laws—the Freedom of Information

Act (FOIA) of 1966, the Privacy Act of 1974, and the

Computer Matching and Privacy Protection Act of

1988—do not apply to the education records maintained

by schools, districts, or state education agencies because

these federal laws pertain only to data the federal government collects. However, many states have passed their

own open records laws or other privacy laws very much

like the federal statutes that may apply to the information

schools collect. When agencies or schools establish data

policies and procedures, they should consult state

statutes on these matters, as well as the federal requirements. Many state open records laws indicate that each

agency make available for public inspection and duplication copies of all records, regardless of form or format,

that have been released to any person and that because

of their subject matter content have become the subject

of request for substantially the same record. However,

state open records laws do not supersede FERPA, and

educational agencies and institutions subject to FERPA

should seek advice from the Family Policy Compliance

Office (FPCO) if any conflicts are evident. (See section 2F

below for contact information.)

The federal Policy for the Protection of Human Subjects,

administered by 16 federal departments and agencies,

establishes procedures for protecting the rights of individuals—including students and families—who participate

in federally sponsored research activities and programs.

This statute establishes the preliminary rules researchers

must follow when they conduct studies sponsored by

federal agencies. Although these regulations may apply

to data collections by schools, FERPA establishes additional basic disclosure restrictions that guide the treatment of any information collected in schools if the

information either derives from education records or is

maintained in those records for any period of time. These

restrictions apply to activities sponsored by an education

or other agency or an individual.
whether in electronic, photographic, or paper files.

Regardless of where the information about students originates, if it is maintained by schools or education agencies, protecting its privacy is governed by FERPA or

another federal statute, such as NSLA. School districts,

schools, or state education agencies, if asked, must comply with parents’ or eligible students’ requests for access

and review.

FERPA requires school districts—but not state education

agencies—to notify parents and eligible students annually of their rights under FERPA. Among the changes in

FERPA that resulted from the 1996 regulations was the

removal of requirements for districts to adopt written

policies pertaining to FERPA. Although local written policies are no longer required, regulations continue to

encourage districts to develop privacy policies and procedures. Because state or local privacy protection laws or

policies may supplement or refine FERPA, many state and

local education agencies establish written policies to

ensure the law will be applied uniformly.

FERPA currently permits schools to transfer any and all

education records, including disciplinary records, for a

student who is transferring to another school. A new provision of the NCLB Act requires state education agencies

that receive funds under the Elementary and Secondary

Education Act (ESEA) to provide an assurance to the U.S.

Secretary of Education. The assurance stipulates that the

state has a procedure in place to facilitate the transfer of

disciplinary records, with respect to a suspension or

expulsion, by local education agencies to any private or

public school for any student who is enrolled or seeks to

enroll in the school.

B1. FERPA defines protected education

records

FERPA defines education records as information:

• directly related to a student, specifically any information recorded in any way, including but not limited to

handwriting, print, computer media, videotape or

audiotape, film, microfilm, and microfiche; and

• maintained by an education agency or institution, or

by parties acting for the agency or institution (e.g.,

special education schools and health or social services

institutions).

Records pertaining to special education students are subject to the same FERPA requirements as all other student

records.

10

Forum Guide to Protecting the Privacy of Student Information

The No Child Left Behind (NCLB) Act of 2001 includes

amendments to PPRA that give parents more rights with

regard to the inclusion of minor students as survey

respondents, the collection of information from students

for marketing purposes, and certain nonemergency

medical examinations. See section C, “U.S. Department

of Education-Funded Surveys and Studies,” for detailed

discussion.

In addition, the Patriot Act of 2001 allows the U.S.

Attorney General or his or her deputy to apply for an ex

parte court order requiring an education agency or institution to allow the Attorney General or his designee to

collect and use education records relevant to investigations and prosecutions of specified crimes or acts of terrorism (domestic or international). The Attorney General

must certify that there are specific facts giving reason to

believe that the records contain the required information.

An education agency or institution that in good faith

releases records in accordance with the court’s order is

not liable to any person for releasing the records subject

to confidentiality procedures developed in consultation

with the Secretary of Education.

B. Privacy Protection Under

FERPA: Responsibilities of

Agencies and Schools

The U.S. Congress passed FERPA in 1974 to protect student and family privacy. Also known as the Buckley

Amendment, FERPA grants parents certain rights of

access to their children’s education records and restricts

disclosure of information from those records without

their consent. It also allows parents and eligible students

to amend records they believe to be inaccurate or misleading. The original FERPA statute and its amendments

are incorporated in the U.S. Code (20 USC 1232g). The

Code of Federal Regulations (34 CFR Part 99) contains

regulations for administering the law.

In 1994, FERPA was amended in the Improving America’s

Schools Act. The U.S. Department of Education published

revised regulations in the Federal Register on November

21, 1996 (pp. 59291–59298) to ensure greater flexibility

in implementing the privacy laws pertaining to student

records.

The law regards as an education record most information

that teachers, school administrators, and education officials maintain about students in a tangible format,
11

• records created by law enforcement units of schools or

school districts, for a law enforcement purpose, that

are maintained separately from education records; and

• information about individuals obtained after they are

no longer students.

Another type of information is not subject to “consent”

rules under FERPA. FERPA allows school systems to establish a policy that designates some types of information as

directory information—the portion of the education

record that would not generally be considered harmful or

an invasion of privacy if disclosed. Local education agency

definitions of directory information may vary, but they

generally include a student’s name and school activities,

family members’ names, address, and telephone number.

Some school districts also include as directory information

the biographical materials found in school yearbooks,

such as videotapes and pictures of students; participation

in various extracurricular activities; degrees and awards

received; and names of previous schools attended. The

height and weight of athletes may also be included as

directory information. Once notice of directory information is given, school officials can distribute the information to anyone who requests it inside or outside the

school.

If a school district has a policy for disclosing directory

information, it must give public notice of what is considered in this category and indicate that parents may refuse

to allow the agency to designate any or all of their child’s

record as directory information. The law requires the notification to specify the period of time in which parents

must inform the school or district of any directory information whose release they disallow. Such notification can

occur through a school newsletter, student handbook, or

some other publication that parents can be expected to

receive.

FERPA currently allows schools to designate and disclose

without consent certain items of information as directory

information. The FERPA regulations define “directory

information” under § 99.3 of the regulations and set forth

the requirements for implementing a directory information policy under § 99.37 of FERPA. Generally, directory

information may be disclosed by a school to any party,

provided the requirements of FERPA are followed.

The NCLB Act also addresses the disclosure of directorytype information (students’ names, addresses, and telephone listings) to military recruiters. Congress also

Education records include but are not limited to:

• family information, such as name and address of the

student and parent or guardian, emergency contact

information, date and place of birth, and number of

siblings;

• personal information, such as an identification code,

social security number, picture, and list of personal

characteristics that would make it easy to identify a

student;

• grades, test scores, courses taken, academic specializations and activities, and official letters about a student’s status in school;

• test records, answer sheets (including written

responses to performance assessments and portfolios),

and records of individualized education programs;

• special education records;

• disciplinary records established and maintained by

school officials;

• medical and health records that the school collects

and maintains. Individually identifiable health information of students under the age of 18 created by a

nurse in a primary or secondary school that receives

federal funds and that is subject to FERPA is an education record, not protected health information.

Privacy regulations generally applied to health records

do not apply;

• documentation of schools attended, courses taken,

attendance, awards conferred, and degrees earned;

and

• videotapes of individuals or groups of students.

A school district may establish policies that list the types

and locations of education records, with a schedule of

fees (which must be reasonable) that are charged for

duplicating records. Agencies may not, however, charge

a fee to search or retrieve education records. The following information about students is not considered part of

an education record and is not subject to access or disclosure rules under FERPA:

• notes (handwritten or typed) kept in the sole possession of the maker (teachers, supervisors, school counselors, and administrators) which are used only as a

personal memory aid and are not revealed to any

other person other than a temporary substitute teachers or other replacement personnel;

Section 2: Summary of Key Federal Laws
The U.S. Department of Education does not require local

education agencies to notify parents or eligible students

individually of their rights, but agencies must provide

notice where it is likely to be seen. FERPA regulations

regarding records access apply to state and local agencies, but only local agencies must give annual notification

of rights under FERPA. The annual notification must

inform parents that they have the right to:

• inspect and review their child’s record;

• seek to amend the record if they believe the record to

be inaccurate, misleading, or otherwise in violation of

their child’s rights;

• consent to disclosures of personally identifiable information in the record, with certain exceptions authorized by FERPA; and

• file a complaint with the U.S. Department of

Education concerning the district’s failures to comply

with the requirements of FERPA.

Parents’ access to records is limited to information about

their own child. In cases where an education record contains information about more than one child, the information must be separated so that parents do not have

access to the records of any child other than their own.

FERPA requires local agencies to provide their annual notification in a manner that “effectively informs” those who

have a disability or who speak a primary or home language other than English. Methods for notifying parents

may include either providing notice in alternative formats

such as audiotape, Braille, computer diskette, or large

print, or translating information into the native language

of requesting parents.

Under the provisions of NCLB, the U.S. Department of

Education is required to notify annually each state education agency and local education agency of their obligations under FERPA and PPRA. The web site of FPCO

(www.ed.gov/policy/gen/guid/fpco) contains the annual

notices to Chief State School Officers as well as district

superintendents.

B3. Parents and eligible students may inspect

and review education records

FERPA also grants records inspection and review rights to

eligible students who are over age 18 or who have graduated from high school and are attending a postsecondary education institution at any age. A student under

12

Forum Guide to Protecting the Privacy of Student Information

included similar language in the National Defense

Authorization Act for Fiscal Year 2002. Both laws, with

some exceptions, require schools to provide directorytype information to military recruiters who request it.

Typically, recruiters are requesting information on junior

and senior high school students that will be used for

recruiting purposes and college scholarships offered by

the military. Upon such request, school districts are

required to provide student names, addresses, and telephone listings to military recruiters unless a parent has

elected to “opt out” of the public, nonconsensual disclosure of directory information or has opted out of a specific notice provided by the school regarding disclosure to

the military. The laws do not permit school districts to

institute a policy of not providing the required information unless a parent has affirmatively agreed to provide

the information.

The NCLB Act makes it clear that, even if a local education agency does not have a policy of disclosing “directory information” under FERPA, the school district must

still comply with a request from a military recruiter for

names, addresses, and telephone listings of students.

The referenced laws require an “opt-out” notification

process.

Exhibit 2–3 includes a questions and answers sheet provided by the Family Policy Compliance Office (FPCO) to

clarify the new provisions of access to high school students and information on students by military recruiters.

B2. Each of the local, state, and federal 

education agencies has a role in 

protecting the privacy of education

records

FERPA regulations require education agencies and institutions to give annual notification to parents and eligible

students of their rights to review education records and

to request corrections of records they perceive to be inaccurate. Exhibit 2–4 presents a model privacy notification.

These regulations apply to the education records maintained in any school, education agency, or institution representing an education agency. FERPA applies to all

educational institutions, defined as agencies that provide:

• educational services or instruction, or both, to students; or

• administrative control or services to public elementary

or secondary schools or postsecondary institutions.
13

18 who is still in high school but is also taking college

courses has access to records held by the college, but

access rights to records held by the high school still

belong to the parents. Parents who claim students as

dependents for income tax purposes may be given access

to school records, even if the rights under FERPA have

transferred to the student.

Parents and eligible students may request an explanation

or interpretation of their education records, whether

these records are held by schools, agencies, or representatives of educational institutions. The agency must

respond to requests to review education records within

45 days of the inquiry. If parents or eligible students

believe a record is inaccurate or misleading, they may

petition for the record to be amended or changed. The

education agency must decide within a reasonable period

of time if the request to change the record is consistent

with the agency’s own assessment of the record’s accuracy. The agency cannot destroy records if there is an outstanding request to inspect or review them.

If a request to amend records is denied, the applicant can

subsequently appeal the decision in a hearing conducted

by the education agency. After the hearing, a parent or

eligible student who continues to disagree with the contents of a record can insert an explanation of the objection into the official record, and that explanation must

remain with the record as long as it is held by the agency.

However, the amendment is limited to items other than

school grades, assessments, placements, and “substantive” decisions.

FERPA gives either a parent or legal guardian equal rights

to review an education record unless there is evidence of

a court order or law revoking these rights. A “parent”

refers to a natural or adoptive parent, including a noncustodial or foster parent, a legal guardian, or an individual

acting in the parent’s absence. The law grants parental

rights to foster parents acting on behalf of the child.

Agencies or schools can require parents to verify their

relationship with a child before providing access to

records. Further specification of eligibility requirements is

not stipulated in the federal law, but can be detailed in

state laws or local policies.

B4. FERPA restricts release of information

without prior consent

Without consent of the parent or eligible student, education records can be disclosed to school officials designated as having a “legitimate educational interest.” The

law leaves to the district the authority to define the criteria for determining the legitimacy of an educational interest, which generally includes situations where officials

need to review education records to fulfill their professional responsibilities. This includes access to records by

teachers, counselors, and administrators who routinely

work with students. The following lists some example situations in which legitimate educational interest prevails:

• to perform education- or discipline-related tasks in

connection with a student;

• to provide services to a student or a student’s family,

such as emergency health care, counseling, or school

or job placement; or

• to perform administrative or other educational

responsibilities prescribed by the agency or school.

If an educational agency or institution has a policy of disclosing education records to officials considered to have a

legitimate educational interest, it must include in the

annual notification of FERPA rights the criteria for determining who constitutes a “school official” and the criteria

for what constitutes a “legitimate educational interest.”

Depending on the policy defined locally, school officials

might include any or all of the following:

• a school administrator, supervisor, instructor, or support staff (including health or medical staff or law

enforcement unit personnel);

• a school board member with an authorized reason to

review a record;

• a person or company with whom the district has contracted to perform a special task (e.g., an attorney,

auditor, medical consultant, or therapist); or

• a parent or student serving on an official committee,

such as a disciplinary or grievance committee, or

assisting another school official in performing required

tasks.

Because these officials, acting on behalf of students, have

a need to know, they can usually access information

without seeking consent.

Under FERPA, disclosure of information to an individual or

agency outside the school, school district, or state education agency—a third party—generally is not allowed

without prior consent of a parent. Under certain circumstances (e.g., government-required audits, evaluations, or

court orders), a district can release records without

Section 2: Summary of Key Federal Laws
14

Forum Guide to Protecting the Privacy of Student Information

approval of the parent, but it must record the disclosure,

explaining the legitimate interest the party had in receiving the information. FERPA permits that records may be

disclosed without consent of the parent to the following

individuals and organizations:

• officials in another school, school system, or postsecondary education institution where the student intends

to enroll. Such releases must be reported to the parent

or eligible student unless the release either is initiated

by one of them or is specified by local policy;

• the U.S. Secretary of Education, authorized representatives of the Comptroller General of the United

States, and state and designated local education

authorities for audit and evaluation of educational

programs;

• institutions to which students apply to receive financial

aid to determine eligibility, amount of aid, conditions

of aid award, and enforcement of award terms and

conditions;

• accrediting organizations to carry out their functions;

• organizations authorized by education agencies or

institutions to conduct studies that concern the development or administration of tests, the administration

of student aid programs, or the improvement of

instruction; and

• appropriate parties in a health or safety emergency.

When a record is disclosed in the types of situations indicated above, the originating agency must note in the

record the names of the parties who received the information and an explanation of the legitimate educational

interest under which the record was disclosed. FERPA

requires agencies or schools to account for all instances of

education records release, indicating the reasons the information was provided and who received it. These explanations must be recorded in the student’s record and

maintained there until the agency destroys the record.

B5. Records matching and redisclosure to

third parties

FERPA generally prohibits matches of computerized education records held by local or state education agencies

with data from other agencies. These prohibitions apply

broadly to data sharing about special education

programs, evaluating or monitoring the use of federal

funds, or coordinating interagency social service assistance to students and families.

Beginning in 1994, the U.S. Congress established penalties for inappropriate release of personally identifiable

information from education records by a third party when

conducting studies (Improving America’s Schools Act). An

agency or institution cannot allow that third party access

to personally identifiable information from education

records for at least 5 years after the incident.

However, cross-agency cooperative use of information

from education records is an area of developing law and

interpretation that experts are continually reexamining.

State and local government agencies, along with schools,

are seeking means to reduce fragmentation and duplication across service systems. Occasionally, interagency

partnerships can be formed to exchange information

about individual students in a manner that provides useful information but retains the anonymity of an individual

student. Those who have experimented with such interagency partnerships are overcoming legal obstacles to collaboration without threatening the confidentiality of

students who receive services. This topic is addressed in

greater detail in section 6.

B6. Implications of other FERPA 

regulations

In addition to reducing the requirements for local education agencies to have written FERPA policies, the 1996

regulations implementing the 1994 Improving America’s

Schools Act (IASA) clarified several other components of

FERPA. The regulations:

• remove certain requirements about the annual notification of privacy rights, simplifying and making it easier to understand the central requirements of FERPA;

• establish a standard for giving annual notification to

parents and eligible students that strikes a balance

between placing a minimal requirement on education

agencies and institutions and ensuring that parents

and eligible students are effectively informed of their

rights under FERPA;

• maintain the previously established 45-day period for

responding to requests to inspect records;

• require state education agencies to comply with the

access provisions of FERPA, but not with the notification provisions;

• clarify that nothing in FERPA prevents schools from

maintaining and disclosing to school officials specific

information regarding disciplinary actions taken
15

against students for conduct that poses a risk to the

safety of the student, other students, or other members of the school community; and

• allow officials to withhold information about a court

order and/or disclosure from parents if a court order or

subpoena related to law enforcement specifically states

that its existence should not be revealed to a parent or

student.

Since 1998, the U.S. Congress has enacted two additional exceptions to the statutory prior consent rule. The

2000 Campus Sex Crimes Prevention Act added a new

subsection (b)(7) to the statute to ensure that an educational institution may disclose information concerning

registered sex offenders provided to it under state sex

offender registration and community notification programs. The Patriot Act of 2001 added a new section (j)

that allows the U.S. Attorney General or his or her deputy

to apply for an ex parte court order requiring an education agency or institution to allow the Attorney General

(or his designee) to collect and use education records relevant to investigations and prosecutions of specified

crimes or acts of terrorism subject to confidentiality procedures developed in consultation with the Secretary of

Education. (See section A2 above).

These laws should be closely reviewed by privacy experts

within school districts and state education agencies for

their specific applicability to individual cases.

C. U.S. Department of

Education-Funded Surveys

and Studies

The Protection of Pupil Rights Amendment (PPRA),

amended in 1994 by the Goals 2000: Educate America

Act, specifies that information collected from students

through surveys, research, analyses, or evaluations

funded by the U.S. Department of Education must be

available for parents to review. If parents ask, the surveys

or evaluation materials must be made available for

review. Surveys administered under the auspices of federally sponsored programs that are conducted in elementary or secondary schools fall within this law.

PPRA protects the rights of students and their parents in

two ways. First, it states that parents have the opportunity to review certain federal surveys or instructional

materials used in conjunction with surveys and to provide

consent for their child’s participation in them. Second,

PPRA requires that state or local education agencies, and

their contractors or representatives, obtain prior consent

from the parent if they plan to collect information from

students concerning the following eight items:

• political affiliation;

• mental and psychological problems;

• sexual behavior and attitudes;

• illegal or self-incriminating behavior;

• critical assessments of other individuals or family

members;

• privileged information given to lawyers, physicians, or

ministers;

• religious practices, affiliations, or beliefs (newly added

under NCLB); and

• income (other than what is required by law for program eligibility).

Although PPRA stipulates that education agencies must

give parents the right to review and consent before their

children participate in surveys, the law does not require

that parents be given copies of the surveys. However,

they must be able to inspect the actual survey and related

instructional materials.

Section 1061 of NCLB amended PPRA to give parents

more rights with regard to the surveying of minor

students, the collection of information from students for

marketing purposes, and certain nonemergency medical

examinations. PPRA has been referred to as the “Hatch

Amendment” and the “Grassley Amendment” after

authors of amendments to the law. Now school officials

may hear the law referred to as the “Tiahrt Amendment,”

after Congressman Todd Tiahrt who introduced changes

regarding surveys to PPRA. The statute is found in 20 USC

§ 1232h and the regulations (not yet updated) are found

in 34 CFR Part 98.

The new provisions (contained in subsection c) apply (as

does FERPA) to education agencies or institutions that

receive funds from any program of the Department of

Education. Thus, public elementary and secondary schools

are subject to the new provisions of PPRA. Here are the

new requirements:

• Schools are required to develop and adopt policies—

in conjunction with parents—regarding:

Section 2: Summary of Key Federal Laws
16

Forum Guide to Protecting the Privacy of Student Information

1. the right of parents to inspect, upon request, a survey created by a third party before the survey is

administered or distributed by a school to students.

2. arrangements to protect student privacy in the

event of the administration of a survey to students, including the right of parents to inspect,

upon request, the survey, if the survey contains

one or more of the same eight items of information noted above (see page 15).

3. the right of parents to inspect, upon request, any

instructional material used as part of the educational curriculum for students.

4. the administration of physical examinations or

screenings that the school may administer to

students.

5. the collection, disclosure, or use of personal information collected from students for the purpose

of marketing or selling, or otherwise providing

information to others for that purpose. However,

this does not apply to information collected from

students for the exclusive purpose of developing,

evaluating, or providing educational products or

services for or to students or schools, such as:

■ college or other postsecondary education

recruitment, or military recruitment;

■ book clubs, magazines, and programs providing access to low-cost literacy products;

■ curriculum and instructional materials used by

elementary and secondary schools;

■ tests and assessments used by schools to provide cognitive, evaluative, diagnostic, clinical,

aptitude, or achievement information about

students;

■ the sale by students of products or services to

raise funds for school-related or educationrelated activities; and

■ student recognition programs.

6. the right of parents to inspect, upon request, any

instrument used in the collection of information,

as described in number 5.

• Local education agencies must “directly” notify parents of these policies and, at a minimum, provide the

notice at least annually, at the beginning of the school

year. Parents should be notified within a reasonable

period of time should any substantive change be

made to the policies.

• In the notification, the local education agency must

offer an opportunity for parents to opt out of (remove

their child from) participation in:

■ activities involving the collection, disclosure, or

use of personal information collected from students for the purpose of marketing or selling that

information, or otherwise providing that information to others for that purpose;

■ the administration of any survey containing one

or more of the above-described eight items of

information; and

■ any nonemergency, invasive physical examination

or screening that is: 1) required as a condition of

attendance; 2) administered by the school and

scheduled by the school in advance; and 3) not

necessary to protect the immediate health and

safety of the student, or other students.

• In the notification, the local education agency must

notify parents of the specific or approximate dates

during the school year when these activities are

scheduled.

• This law is not intended to preempt applicable provisions of state law that require parental notification.

• This law does not apply to any physical examination or

screening that is permitted or required by state law,

including such examinations or screenings permitted

without parental notification.

• The requirements of PPRA do not apply to a survey

administered to a student in accordance with the

Individuals with Disabilities Education Act (IDEA).

• These requirements do not supersede any of the

requirements of FERPA.

• The rights provided to parents under PPRA transfer

from the parent to the student when the student

turns 18 years old or is an emancipated minor under

applicable state law. The law applies to local education agencies, but does not apply to postsecondary

institutions.

• A state education agency or local education agency

may use funds provided under Part A of Title V of the

Elementary and Secondary Education Act (ESEA) to

enhance parental involvement in areas affecting the

in-school privacy of students.
The Family Policy Compliance Office (FPCO) of the U.S.

Department of Education interprets FERPA and PPRA. The

office also responds to complaints about interpreting or

applying the laws. Any conflicts between PPRA and state

laws or local policies should be forwarded for adjudication to the FPCO within 45 days after the conflict was

observed.

D. FERPA and Special Education

Records

D1. IDEA protects the privacy of students

who are receiving special education 

services

In addition to the requirements of FERPA, the Individuals

with Disabilities Education Act (IDEA) provides additional

privacy protections for students who are receiving special

education and related services. The privacy protections

under Part B of the IDEA are found at 34 CFR

300.560–300.577.

Part B of the IDEA incorporates and cross-references

FERPA. For example, under Part B, the term “education

records” means the type of records covered by FERPA as

implemented by its regulations in 34 CFR Part 99. Under

§ 99.3 of FERPA, “education records” is broadly defined

to mean those records that are related to a student and

are maintained by an education agency or institution. Part

C (34 CFR 303.460) permits states to adopt or develop

policies that the states will follow to ensure the confidentiality of personally identifiable information. However,

these policies and procedures under Part C must meet the

Part B requirements of 34 CFR 300.560–300.576.

In addition to the FERPA provisions and IDEA-specific provisions that restate the FERPA requirements, the IDEA regulations also include some additional protections tailored

to special confidentiality concerns for children with disabilities and their families. Public agencies must inform

parents of children with disabilities when information is

no longer needed and, except for certain permanent

record information, that information must be destroyed 

at the request of the parents (34 CFR 300.573). If a state

transfers the IDEA rights of parents to children at the age

of majority, the parents’ rights under the IDEA regarding

educational records also transfer, but the public agency

must provide any notice required under the due process

procedures of the IDEA to both the student and the parent (34 CFR 300.574). The state education agency must

give public notice about the collection of personally identifiable information in the state and a summary of the

policies and procedures that public agencies must follow

regarding storage, disclosure to third parties, and retention and destruction of personally identifiable information (34 CFR 300.561). Each public agency must have

one official who is responsible for ensuring the confidentiality of any personally identifiable information, must

train all persons who are collecting or using personally

identifiable information regarding the state’s policies

about confidentiality and FERPA, and must maintain for

public inspection a current listing of the names and positions of individuals within the agency who have access to

personally identifiable information (34 CFR 300.572).

D2. FERPA provisions apply to all students

receiving special education services

The provisions of FERPA apply to all students receiving

special education and related services under the IDEA. In

addition, FERPA serves as the foundation for the additional confidentiality provisions of Part B of the IDEA at 34

CFR 300.560–300.577. Moreover, Congress has stressed

that the FERPA provisions apply under the IDEA. The

Senate and House Committee Report on the 1997

Amendments of the IDEA state that “nothing in this bill

shall supersede any parental access rights under the

Family Educational Rights and Privacy Act of 1974 or

foreclose access to information otherwise available to

parties” [S. Rep. No. 105–17, p. 27 (1997); H. Rep. No.

105–95, p. 107 (1997)].

D3. OSEP and FPCO work closely to resolve

possible conflicts in applicable legislation

The Office of Special Education Programs (OSEP) and

FPCO, both of the U.S. Department of Education, have

worked together to ensure that the provisions of the two

statutes are interpreted without conflict. In the past when

issues arose and there appeared to be a possible conflict

between the two statutes, the two offices have worked

together to ensure that the privacy rights of parents and

students receive full protection under FERPA and the

IDEA, while ensuring that the other requirements of the

IDEA are met.

17

Section 2: Summary of Key Federal Laws
• Information about students certified eligible for free

and reduced-price school meals is covered by confidentiality restrictions administered by the U.S.

Department of Agriculture.

• Records of drug and alcohol prevention and treatment

services for students are covered by confidentiality

restrictions administered by the U.S. Department of

Health and Human Services.

• Some laws establish minors’ rights to seek treatment 

for certain health and mental health conditions, including sexually transmitted diseases, HIV testing and treatment, pregnancy, and mental health counseling.

• Some state laws protect records pertaining to HIV status, medical records, child abuse, privileged communications, and state-specific records retention and

destruction regulations.

Confidentiality issues may arise in schools in cases where

FERPA is not the broadest protection or where the application of FERPA may be unclear. As a result, school personnel must develop an understanding of the principles

underlying legal statutes and regulations and make every

effort to maintain the privacy of any information they

receive in the course of providing services. School officials

increasingly have access to sensitive health and family

information.

When uncertainty occurs about when and with whom

information should be shared, individuals in schools

should act with caution and understand that their fundamental obligation is to maintain confidentiality. School

personnel should never share with another individual—

even a professional—more than is necessary to benefit

the student. Legal counsel and school officials are available to interpret matters where privacy issues are

involved. Teachers, paraprofessionals, and principals

should not hesitate to consult these individuals when

they are uncertain about their obligations or responsibilities. The references at the end of this section contain

additional contacts for guidance related to the information presented here.

Individual student records held by schools or education

agencies are primarily education records and are therefore subject to FERPA regulations, even when other

statutes also may apply. If officials perceive a conflict

between FERPA and any state or other federal statutes or

regulations, they should seek counsel from appropriate

legal authorities to identify the issues involved and to

18

Forum Guide to Protecting the Privacy of Student Information

D4. IDEA privacy protections apply to 

private schools under special 

circumstances

While the IDEA does not directly apply to private schools,

the law does apply to all students with disabilities who

are placed in or referred to a private school or facility by

a public agency as a means of providing a free appropriate public education. In this situation, the records of

such students are protected by FERPA and the placing

public school district is responsible for complying with

the requirements of FERPA and the IDEA relative to these

students’ records.

The IDEA also applies to the special education and related

services that a public agency provides to students with

disabilities who are enrolled by their parent in a private

school or facility and who have been chosen by the public agency to receive certain special education and related

services. In these situations, the education records of such

students that are collected, maintained, or used by the

public agency are subject to FERPA and the IDEA, and the

public agency is responsible for complying with the

requirements of FERPA and the IDEA relative to these

records.

In addition, the child find provisions of the IDEA—provisions that require states and school districts to identify,

locate, and evaluate children who may have disabilities

and be in need of special education—apply to both public and private school children. The provisions of FERPA

and the IDEA apply to education records of public agencies resulting from child find activities.

E. Other Federal Laws Affecting

Information Privacy in

Schools

Student records may be protected simultaneously by laws

administered by the U.S. Department of Education, as well

as by other state and federal agencies. FERPA establishes

a high level of privacy protection, but statutes administered by agencies within the U.S. Departments of

Agriculture, Health and Human Services, and Justice also

protect records privacy and may apply to the records of

students in schools. Professional standards of ethical practice, under which school doctors and nurses, psychologists, and other professionals operate, may also establish

privacy restrictions. Following are some examples:
19

establish policies that accurately reflect applicable legal

statutes. Officials should also contact the FPCO in the

Department of Education regarding any apparent conflicts between FERPA and other federal or state laws.

The Children’s Online Privacy Protection Act of 1998

(COPPA) also has an impact on student privacy. Teachers

are increasingly using the Internet as an instructional

method to enhance student learning. Effective April

2000, certain web sites must obtain parental consent

before collecting personal information from children

under age 13. The main goal of the Act is to protect the

privacy of children using the Internet. The privacy notice 

of these web sites must state that the parent can review

and have deleted their child’s personal information, and

must inform users how the information will be used and

whether personal information is disclosed to third parties. Consent is verified through print forms, credit cards,

digital signature, e-mail accompanied by a pass code,

and so on.

E1. NSLA safeguards the confidentiality of

students receiving free and reduced-price

school meals

The Richard B. Russell National School Lunch Act (NSLA),

which has stricter privacy provisions than FERPA, restricts

who may have access to records on students who are eligible for free and reduced-price meals. This includes student and household information obtained from the free

and reduced-price eligibility process and the student’s

(free or reduced-price eligibility) status. Individuals who

may be permitted access to this information under FERPA

may be denied access under the more restrictive provisions of NSLA. Refer to exhibits 2–5 through 2–9 for

guidance concerning the allowable use of free and

reduced-price eligibility data.

The National School Lunch Program, administered by the

U.S. Department of Agriculture, operates in most elementary and secondary schools. Many of these schools

also participate in the School Breakfast Program. Any

child at a participating school may purchase a meal under

the lunch and/or breakfast program. However, students

from households with incomes at or below 130 percent

of the federal poverty level are eligible for free school

meals, and children from households with incomes

between 130 percent and 185 percent of the federal

poverty level are eligible for reduced-price school meals.

For many schools and school districts, information from

the lunch program is likely to be the best and maybe the

only source of data available to schools on “economically

disadvantaged” students.

The NSLA strictly limits how school districts may use individual student and household information obtained as

part of the free and reduced-price school meals eligibility

process once students are identified to receive program

services. The NSLA also includes civil and criminal penalties for unauthorized disclosures and improper uses of

students’ school lunch eligibility information.

School officials may obtain parental consent to use students’ free and reduced-price meal eligibility information

for a purpose other than determining the households’ eligibility for free and reduced-price meals for their children.

However, the NSLA specifies that persons “directly” connected to the administration or enforcement of certain

programs or activities are permitted access to children’s

free and reduced-price meal eligibility information without parental consent. Additionally, the statute specifies

that some of these programs or activities may have access

to students’ eligibility status only (whether they are eligible for free meals or reduced-price meals), while other

individuals and programs may have access to all eligibility

information (all information from the households’ free

and reduced-price school meal application). Exhibits 2–5

to 2–9 provide the programs and activities that may be

permitted access to and use of students’ free and

reduced-price meal eligibility information, the amount of

information that may disclosed, and whether parental

notification and consent are required. For example, under

the NSLA, federal and state education programs are eligible recipients of students’ free and reduced-price eligibility status. Although a program or individual may be

authorized under the NSLA to receive free and reducedprice eligibility information, there must be a legitimate

“need to know” to provide a service or carry out an

authorized activity. Whenever possible, aggregate data

should be used rather than personally identifiable data.

Additionally, the disclosure of students’ school meal eligibility information should be made available only to a limited number of individuals. The agency responsible for

making the free and reduced-price meal eligibility determination makes the decision on whether or not to disclose students’ eligibility information. This agency will be

the school food authority or school administration.

Section 2: Summary of Key Federal Laws
Mental Health Services Administration issued a joint opinion in 1990 that suggests potential solutions to this conflict. One solution requires students to consent to parent

access to records as a condition of receiving diagnostic,

treatment, or referral services; a second solution limits the

information kept in school records, recognizing that parents may have access to them. Both solutions are imperfect, however, and school officials are advised to seek

information and advice about potential confidentiality

conflicts from the FPCO.

E3. HIPAA protects the confidentiality of 

personal health information and access

of health records

While education records are protected under FERPA, individual health information is protected under the Health

Insurance Portability and Accountability Act (HIPAA) of

1996. This mandate establishes federal standards for the

privacy of individually identifiable health information. The

Privacy Rule of the law:

• gives patients more control over their health information;

• sets boundaries on the use and release of health

records;

• establishes appropriate safeguards that health care

providers and others must achieve to protect the privacy of health information;

• holds violators accountable, with civil and criminal

penalties that can be imposed if they violate patients’

privacy rights; and

• strikes a balance when public responsibility supports

disclosure of some forms of data—for example, to

protect public health.

HIPAA affords patients rights of access to their own medical records, as well as the right to examine and obtain a

copy of their own health records and request corrections.

It is important to note that there is a broad exemption in

HIPAA’s Privacy Rule that excludes health information contained in education records as defined in FERPA. In other

words, any health information that is maintained by an

education agency or institution is subject to FERPA access

and disclosure rules, regardless of whether the information was created and used by health professionals.

20

Forum Guide to Protecting the Privacy of Student Information

If an agency’s database includes (free and reduced-price

eligibility) information that is personally identifiable, database managers must impose controls on the disclosure of

that information so that only eligible recipients have

access to students’ school meal eligibility information.

The Food and Nutrition Service of the U.S. Department of

Agriculture has issued several memoranda on limited disclosure of children’s free and reduced-price meal or free

milk eligibility information. (See exhibits 2–5 and 2–6).

School officials may contact the district’s food service

director or the state education office responsible for the

administration of the school nutrition programs in their

state for further information or for a copy of the Eligibility

Guidance for School Meals Manual (August 2001), which

includes a section on the confidentiality of students’ free

and reduced-price meal information.

E2. The Drug and Alcohol Patient Records

Confidentiality Law protects drug 

prevention and treatment records

Federal confidentiality laws and regulations prohibit the

disclosure of information about students who apply for

or receive alcohol or drug abuse treatment services. The

federal Drug and Alcohol Patient Records Confidentiality

Law (42 CFR) is administered by the Substance Abuse

and Mental Health Services Administration of the U.S.

Department of Health and Human Services. The

Department of Health and Human Services confidentiality regulations apply to records of any patient, even a

minor student in school, who receives treatment from a

federally assisted program. Under the law, patients

include students who receive counseling because they are

children of alcoholics or drug abusers.

The confidentiality rules, known as 42 CFR, apply to

assessment, diagnosis, counseling, group counseling,

treatment, or referral for treatment in most programs in

which students participate, including programs sponsored by public and many private schools. They generally

forbid the release of any information without a patient’s

consent, even when the patient is a student in school and

under 18 years of age.

The 42 CFR restrictions may conflict with the obligations

of school-based programs to provide parent access to the

education records of their student. However, the U.S.

Department of Education and the Substance Abuse and
21

Under HIPAA, there are three different rules that apply to

covered entities such as medical providers and hospitals.

The three rules apply to certain entities if they meet the

definition of covered entity. “Covered entities” are entities that are health plans, health care clearinghouses, or

health care providers that transmit health information in

electronic form in connection with a transaction for

which the Secretary of Health and Human Services has

adopted a standard (covered transaction).

Even if a state lead agency under Part C is a “covered

entity” under HIPAA, its individually identifiable health

information may not be subject to the Privacy Rule if

those records are covered by FERPA, 20 USC § 1232(g)

(which is administered by the U.S. Department of

Education). Whether the state lead agency’s individually

identifiable health information is subject to the Privacy

Rule depends on whether the information is an education record under the FERPA, 20 USC § 1232(g). In short,

records relating to Part C services for the child are exempt

from the Privacy Rule because HIPAA’s Privacy Rule applies

only to information that is “protected health information” (45 CFR 160.103). Under the Privacy Rule, education records covered by FERPA are excluded from the

definition of “protected health information.”

The U.S. Department of Health and Human Services 

(DHHS) establishes national standards for electronic

health care transactions and national identifiers for

providers, health plans, and employers. The standards set

forth in HIPAA also address the security and privacy of

health data. The main objective is to improve the efficiency and effectiveness of the nation’s health care system by encouraging the widespread use of electronic

data interchange in health care. More information about

these requirements can be found at the web sites of

Centers for Medicare and Medicaid Services (cms.hhs.gov

/hipaa) and Office for Civil Rights (www.hhs.gov/hipaa).”

E4. The Paperwork Reduction Acts

monitor the paperwork burden

The federal government monitors the paperwork burden

of federal legislation through the Paperwork Reduction

Acts of 1980 and 1995, which authorize the Office of

Management and Budget (OMB) in the Executive Office

of the President to restrict the information that agencies

may collect from the public. Federal agencies and noneducation agencies receiving federal funds must obtain

OMB clearance authorizing each approved data collection instrument or form. An approved information collection form is assigned a clearance number and an

expiration date to confirm that it is authorized. Approved

federal data collections must explain the data collection

purpose prominently on the form, whether the data collection is mandated or voluntary, and the benefit(s) to be

obtained from the data collection.

The clearance process also requires that plans for data

collection stipulate how the data are to be used, along

with provisions for ensuring the confidentiality of any

personal data collected. OMB clearance is not required

for the clearance of state or local forms, however. OMB

clearance ensures that requests for information from student records meet the requirements of FERPA.

E5. The Privacy Act governs the use of social

security numbers

Section 7(a) of the Privacy Act of 1974 addresses the use

of social security numbers by federal, state, or local governments. It states that it is:

...unlawful for any federal, state, or local government agency to deny to any individual any right,

benefit, or privilege provided by law because of

such individual’s refusal to disclose his social security

account number...

When government agencies collect social security numbers for reasons other than those allowed in the original

law, they must specify how the numbers will be used and

the limits of their use. Requests for social security numbers must be accompanied by the following notice:

Any federal, state, or local government agency

which requests an individual to disclose his social

security account number shall inform that individual

whether that disclosure is mandatory or voluntary,

by what statutory or other authority such number is

solicited, and what uses will be made of it.

State and local education agencies can minimize challenges to their use of social security numbers for student

records identification by creating alternative identification

numbers for students whose parents object to using

social security numbers for identification.

Section 2: Summary of Key Federal Laws
Room 509F, HHH Building

Washington, DC 20201

(800) 368–1019 (toll-free hotline)

OCRMail@hhs.gov (e-mail)

www.hhs.gov/ocr/hipaa (web site)

Other national groups have organized to monitor and

interpret privacy implications of federal laws about education, health, and social services for children. The

American School Health Association, in collaboration

with the National Association of School Nurses and the

National Association of State School Nurse Consultants,

published a document in 2000 that is a counterpart of

these Privacy Guidelines in the context of school health

records. The document, entitled Guidelines for Protecting

Confidential Student Health Information, provides a

wealth of recommendations specifically concerned with

navigating a course through conflict obligations. They

can be reached at:

American School Health Association

7263 State Route 43

P.O. Box 708

Kent, OH 44240

(330) 678–1601 (phone)

www.ashaweb.org (web site)

The Council of School Attorneys, housed in the National

School Boards Association, is a membership organization

of affiliate state councils, consisting of over 3,000 attorneys nationwide, who work to improve the practice of

school law and prevent lawsuits against public schools.

They can be reached at:

Council of School Attorneys

c/o National School Boards Association

1680 Duke Street

Alexandria, VA 22314 

(703) 838–6722 (phone)

www.nsba.org (web site)

COMMONLY ASKED QUESTIONS

Q. What agencies are subject to federal laws on the privacy of education records?

A. Education agencies and institutions that collect and

maintain education records are subject to federal privacy laws if they receive funds from the U.S.

Department of Education. If information derives from

an education record or is maintained in the record, federal as well as state and local privacy rules apply. See

section 2A.

22

Forum Guide to Protecting the Privacy of Student Information

F. Resources for Interpreting

Federal Laws That Protect the

Privacy of Education Records

A number of private and public agencies monitor federal

activity on privacy and confidentiality issues. The contact

information provided below is accurate as of the date of

this publication:

Several federal offices can respond to questions. First, the

U.S. Department of Education can assist in interpreting

FERPA and PPRA, and respond to complaints, on a caseby-case basis, about the interpretation or application of

these laws through the:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue SW

Washington, DC 20202–5901

(202) 260–3887 (phone)

(202) 260–9001 (fax)

FERPA@ed.gov (e-mail)

www.ed.gov/policy/gen/guid/fpco (web site)

The Office of Management and Budget's Office of

Information and Regulatory Affairs (OIRA) oversees the

implementation of other federal privacy laws, such as the

Privacy Act, and coordinates regulatory review, paperwork reduction, statistical policy and information policy in

the federal government. The web site of OIRA is at

http://www.whitehouse.gov/omb/inforeg/regpol.html.

The Centers for Medicare and Medicaid Services of the

U.S. Department of Health and Human Services address

inquiries about HIPAA’s Administrative Simplification provisions, including electronic transactions and code sets,

security, unique identifiers, and privacy. They can be

reached at:

Centers for Medicare and Medicaid Services

7500 Security Boulevard

Baltimore MD 21244–1850

(866) 282–0659 (toll-free hotline)

askhipaa@cms.hhs.gov (e-mail)

cms.hhs.gov/hipaa (web site)

The Office for Civil Rights of the U.S. Department of

Health and Human Services addresses inquiries about

HIPAA’s Privacy Rule. They can be reached at:

Office for Civil Rights

U.S. Department of Health and Human Services

200 Independence Avenue SW
23

Q. Do privacy assurances differ across federal education

programs?

A. Privacy components of laws are administered by federal agencies other than the U.S. Department of

Education, and these may be applicable to programs

directed in schools. However, the Family Educational

Rights and Privacy Act (FERPA) is a comprehensive law

that applies broadly to information collected in public

agencies or schools that receive federal education

funds. Thus, FERPA applies to information collected

and maintained by most public elementary, secondary,

and postsecondary education institutions and by some

private institutions in this country. See section 2A.

Q. Are individuals liable for penalties if they do not

adhere to the requirements of FERPA?

A. No, not typically. Institutions receiving funds from the

U.S. Department of Education are legally responsible

for complying with these laws and could be in jeopardy of losing federal education dollars if they are

found to have a policy or practice of violating FERPA.

Individual liability would depend on state laws and

local policies. See section 2, A1.

Q. What do state and local education agency personnel

need to know about federal privacy laws pertaining to

education records?

A. Strong federal laws protect the privacy of education

records in schools. Individuals who work with education records in agencies or schools are responsible for

knowing the privacy regulations that apply to their

work. Agency administrators need to understand federal and state laws, as well as local policies, that 

govern parental access to records and restrict inappropriate disclosure of information about students and

their families. See section 2, A and B.

Q. About which federal student privacy laws do school

district or state education agency administrators need

to be informed?

A. FERPA and the Protection of Pupil Rights Amendment

(PPRA) are the two major laws governing the protection of education records and student and family privacy. The other key laws with specific federal

regulatory requirements pertaining to schools are the

National School Lunch Act and the Individuals with

Disabilities Education Act. See section 2, B–E.

Q. Does FERPA prohibit education agencies and institutions from matching data on students with data from

other agencies?

A. FERPA generally prohibits the disclosure of personally

identifiable information from students’ education

records to other federal and state agencies, without

the consent of the parent or eligible student.

However, FERPA does not prohibit an education

agency or institution from receiving information from

outside entities and conducting the data matching

internally. While the education agency or institution

may conduct internal matches, it may only disclose the

results of the match in aggregate form, even to the

agency that provided information for the match.

Q. What are the responsibilities of state education agencies for providing parents or eligible students access to

education records?

A. A state education agency must provide parents and

eligible students with access to education records that

the agency maintains. Although these agencies are

not required to establish a written policy, they are obligated to honor rights of access and to restrict disclosure of information except to authorized individuals.

See section 2, B6.

Q. How does the No Child Left Behind Act affect FERPA

and PPRA?

A. The No Child Left Behind Act impacts FERPA in the following areas: the transfer of school disciplinary

records, armed forces recruiter access to students and

student recruiting information, student privacy, survey

information, parental access to information, and

administration of certain physical examinations to

minors. For more detailed information, please see the

Fact Sheet: Family Educational Rights and Privacy Act

of 1974 (exhibit 2–1).

Q. What recent court cases address privacy issues?

A. On February 19, 2002, the U.S. Supreme Court ruled

in Owasso ISD v. Falvo that peer grading does not violate FERPA. The Department of Education is currently

reviewing the Court’s ruling and may issue additional

guidance or regulations to further clarify the scope of

the term “education records.”

On June 20, 2002, the U.S. Supreme Court ruled in

the case of Gonzaga University v. John Doe. The Court

ruled that students and parents may not sue for damages under 42 USC § 1983 to enforce provisions of

FERPA.

Section 2: Summary of Key Federal Laws
24

Forum Guide to Protecting the Privacy of Student Information

Fact Sheet:

Family Educational Rights and Privacy Act of 1974

The Family Educational Rights and Privacy Act (FERPA) (20 USC § 1232g; 34 CFR Part 99) is a federal law that protects

the privacy of student education records. The law applies to all schools that receive funds under an applicable program

of the U.S. Department of Education.

FERPA gives parents certain rights with respect to their children’s education records. These rights transfer to the student

when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights

have transferred are “eligible students.” The provisions of FERPA are as follows:

• Parents or eligible students have the right to inspect and review the student’s education records maintained by the

school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.

• Parents or eligible students have the right to request that a school correct records that they believe to be inaccurate

or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a

formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student

has the right to place a statement with the record setting forth his or her view about the contested information.

• Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. However, FERPA allows schools to disclose those records, without consent,

to the following parties or under the following conditions (34 CFR § 99.31):

■ school officials with a legitimate educational interest;

■ other schools to which a student is transferring;

■ specified officials for audit or evaluation purposes;

■ appropriate parties in connection with financial aid to a student;

■ organizations conducting certain studies for or on behalf of the school;

■ accrediting organizations;

■ to comply with a judicial order or lawfully issued subpoena;

■ appropriate officials in cases of health and safety emergencies; and

■ state and local authorities, within a juvenile justice system, pursuant to specific state law.

Schools may disclose, without consent, “directory” information, such as a student’s name, address, telephone number,

date and place of birth, honors and awards, and dates of attendance. However, schools must tell parents and eligible

students about directory information and allow parents and eligible students a reasonable amount of time to request

that the school not disclose directory information about them. Schools must notify parents and eligible students annually of their rights under FERPA. The actual means of notification (e.g., special letter, inclusion in a PTA bulletin, student

handbook, or newspaper article) is left to the discretion of each school.

For additional information or technical assistance, call (202) 260–3887 (voice). Individuals who use TDD may call the

Federal Information Relay Service at 1–800–877–8339. Or write to the following address:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue SW

Washington, DC 20202–5901

Exhibit 2–1
25

Fact Sheet:

Protection of Pupil Rights Amendment

The Protection of Pupil Rights Amendment (PPRA) (20 USC § 1232h; 34 CFR Part 98) applies to education agencies and

institutions that receive funding from the U.S. Department of Education. PPRA is intended to protect the rights of parents and students in the following two ways:

• It seeks to ensure that schools and contractors make instructional materials available for inspection by parents if

those materials will be used in connection with a Department of Education-funded survey, analysis, or evaluation in

which their children participate.

• It seeks to ensure that schools and contractors obtain written parental consent before minor students are required

to participate in any Department of Education-funded survey, analysis, or evaluation that reveals information concerning:

■ political affiliations;

■ mental and psychological problems potentially embarrassing to the student and his/her family;

■ sexual behavior and attitudes;

■ illegal, antisocial, self-incriminating, and demeaning behavior;

■ critical appraisals of other individuals with whom respondents have close family relationships;

■ legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers;

■ religious practices, affiliations, or beliefs of the student or student’s parent; and

■ income (other than that required by law to determine eligibility for participation in a program or for receiving

financial assistance under such program).

For surveys not funded by the Department of Education, schools must notify parents and provide them with an opportunity to review the survey and opt their child out of participation. In addition, schools must work with parents to

develop local policies regarding arrangements to protect student privacy relative to surveys, the administration of physical examinations or screenings, and the collection, disclosure, or use of personal information collected from students

for marketing purposes.

Parents or students who believe their rights under PPRA may have been violated may file a complaint with the

Department of Education by writing the Family Policy Compliance Office. Complaints must contain specific allegations

of fact giving reasonable cause to believe that a violation of PPRA occurred.

For additional information or technical assistance, call (202) 260–3887 (voice). Individuals who use TDD may call the

Federal Information Relay Service at 1–800–877–8339. Or write to the following address:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue SW

Washington, DC 20202–5901

Exhibit 2–2

Section 2: Summary of Key Federal Laws
26

Forum Guide to Protecting the Privacy of Student Information

Access to High School Students 

and Information on Students by Military Recruiters

Questions and Answers

(October 9, 2002)

Q. What are the recent changes made by Congress concerning military recruitment of high school students?

A. Congress has passed two major pieces of legislation that generally require local education agencies receiving assistance under the Elementary and Secondary Education Act of 1965 (ESEA)3 to give military recruiters the same access

to secondary school students as they provide to postsecondary institutions or prospective employers. Local education agencies are also generally required to provide students’ names, addresses, and telephone listings to military

recruiters, when requested.

Q. Where are these statutory requirements found?

A. These requirements are contained in § 9528 of the ESEA (20 USC § 7908), as amended by the No Child Left Behind

Act of 2001 (P.L. No. 107–110), the education bill Congress recently passed. These requirements are also contained

in 10 USC § 503, as amended by § 544 of the National Defense Authorization Act for Fiscal Year 2002 (P.L. No.

107–107), the legislation that provides funding for the nation’s armed forces in fiscal year 2002.

Q. What is the effective date for these military recruiter access requirements?

A. While there are differences in the effective date provisions for 10 USC § 503 and § 9528 of the ESEA, both provisions apply to all local education agencies receiving ESEA funds by July 1, 2002.

Q. What are the requirements of § 9528 of the ESEA?

A. Each local education agency that receives funds under the ESEA must comply with a request by a military recruiter

or an institution of higher education for secondary students’ names, addresses, and telephone numbers, unless a

parent has “opted out” of providing such information. (See below for additional information.)

Section 9528 also requires local education agencies that receive funds under the ESEA to provide military recruiters

the same access to secondary school students as they generally provide to postsecondary institutions or prospective

employers. For example, if the school has a policy of allowing postsecondary institutions or prospective employers

to come on school property to provide information to students about educational or professional opportunities, it

must afford the same access to military recruiters.

Q. Under § 9528 of the ESEA, what notification must local education agencies provide to parents before disclosing

names, addresses, and telephone numbers of secondary students to military recruiters and officials of institutions of

higher education?

A. Under FERPA, a local education agency must provide notice to parents of the types of student information that it

releases publicly. This type of student information, commonly referred to as “directory information,” includes such

items as names, addresses, and telephone numbers and is information generally not considered harmful or an invasion of privacy if disclosed. The notice must include an explanation of a parent’s right to request that the information not be disclosed without prior written consent. Additionally, § 9528 requires that parents be notified that the

school routinely discloses names, addresses, and telephone numbers to military recruiters upon request, subject to

a parent’s request not to disclose such information without written consent. A single notice provided through a mailing, student handbook, or other method that is reasonably calculated to inform parents of the above information is

sufficient to satisfy the parental notification requirements of both FERPA and § 9528. The notification must advise

the parent of how to opt out of the public, nonconsensual disclosure of directory information and the method and

timeline within which to do so.

Exhibit 2–3

3

If the LEA receives funds under the ESEA, all the secondary schools in that LEA are subject to the requirements in these laws.
27

Q. If a local education agency has not provided notice relating to “directory information,” may it release a student’s

name, address, and telephone number when requested by a military recruiter?

A. As noted above, a local education agency may provide a single notice regarding both directory information and

information disclosed to military recruiters. If the agency does not disclose “directory information” under FERPA, then

it must still provide military recruiters access to secondary students’ names, addresses, and telephone listings. In addition, the local education agency must notify parents that they may opt out of this disclosure. In other words, a local

education agency that does not disclose “directory information” must nonetheless provide a notice that it discloses

information to military recruiters. The notice must be reasonably calculated to inform parents.

Q. If a parent opts out of the public, nonconsensual disclosure of directory information (or any subset of such information), must the three data elements be released to military recruiters upon their request?

A. If a parent opts out of providing directory information to third parties, the opt-out relating to name, address, or telephone number applies to requests from military recruiters as well. For example, if the opt-out states that telephone

numbers will not be disclosed to the public, schools may not disclose telephone numbers to military recruiters.

Q. If the school does not list one or more of the three data elements (e.g., telephone number) among its directory information, may it release that information to military recruiters?

A. If a school does not designate one or more of the three items as “directory information” under FERPA, it still must

provide all three items to military recruiters upon request. Also, in that case, the school would have to send a separate notice to parents about the missing “directory information” item(s), noting an opportunity to opt out of disclosure of the information to military recruiters. An easier method, of course, would be for the school to designate all

three items—name, address, and telephone listing—as “directory information.”

Q. How are the requirements under § 9528 of the ESEA enforced?

A. Schools that do not comply with § 9528 of the ESEA could jeopardize their receipt of ESEA funds.

Q. How does § 544 of the National Defense Authorization Act for Fiscal Year 2002 amend the former requirements

under 10 USC § 503?

A. Section 544 of the National Defense Authorization Act for Fiscal Year 2002 revises Title 10, Section 503(c) in several

important ways. First, the recruiting provisions now apply only to local education agencies (including private secondary schools) that receive funds under the ESEA. Second, these provisions now require access by military recruiters to

students, under certain conditions, and to secondary school students’ names, addresses, and telephone listings.

Third, as discussed earlier, they require local education agencies to notify parents of their right to opt out of the disclosure of their children’s names, addresses, and telephone numbers, and to comply with any such requests from

parents or students.

Q. How are these requirements under 10 USC § 503 enforced?

A. In addition to the potential for loss of funds under ESEA noted above for failure to comply with § 9528 of the ESEA,

a local education agency that denies a military recruiter access to the requested information on students after July

1, 2002, will be subject to specific interventions under 10 USC § 503.

In this regard, the law requires that a senior military officer (e.g., Colonel or Navy Captain) visit the local education

agency within 120 days. If the access problem is not resolved with the local education agency, the Department of

Defense must notify the state governor within 60 days. Problems still unresolved after 1 year are reported to

Congress if the Secretary of Defense determines that the local education agency denied recruiting access to at least

two of the armed forces (Army, Navy, Marine Corps, etc.). The expectation is that public officials will work with the

local education agency to resolve the problem.

Section 2: Summary of Key Federal Laws
28

Forum Guide to Protecting the Privacy of Student Information

Additionally, the Department of Defense has developed a national high school database to document recruiter

access. Presently, 95 percent of the nation’s 22,000 secondary schools provide a degree of access to military

recruiters that is consistent with current law.

Q. Are private schools subject to the military recruiter requirements?

A. Private secondary schools that receive funds under the ESEA are subject to 10 USC § 503. However, private schools

that maintain a religious objection to service in the Armed Forces that is verifiable through the corporate or other

organizational documents or materials of that school are not required to comply with this law.

Q. Where can I get more information on the requirements of 10 USC § 503?

A. The Office of the Secretary of Defense may be contacted for copies of the statute, or questions relating to it. Please

contact the Accession Policy Directorate as follows:

Director, Accession Policy

4000 Defense Pentagon

Washington, DC 20301–4000

Telephone: (703) 695–5529

Q. Where can I get more information on the requirements of § 9528 of the ESEA?

A. The Family Policy Compliance Office (FPCO) in the Department of Education administers FERPA as well as § 9528 of

the ESEA, as amended by the No Child Left Behind Act of 2001. School officials with questions on this guidance, or

FERPA, may contact the FPCO at FERPA@ed.gov or write to the FPCO as follows:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue SW

Washington, DC 20202–5901

Telephone: (202) 260–3887

Fax: (202) 260–9001

www.ed.gov/policy/gen/guid/fpco

A model “directory information” notification for use by local education agencies incorporating the changes under 

§ 9528 of the ESEA and 10 USC § 503 notification may be obtained from the FPCO’s web site (www.ed.gov/policy/

gen/guid/fpco).
29

Model Notification

of Rights Under FERPA

for Elementary and Secondary Schools

The Family Educational Rights and Privacy Act (FERPA) affords parents and students over 18 years of age (“eligible students”) certain rights with respect to students’ education records. These rights are:

1. The right to inspect and review the student’s education records within 45 days of the day the school receives a

request for access. Parents or eligible students should submit to the school principal [or appropriate school official]

a written request that identifies the record(s) they wish to inspect. The school official will make arrangements for

access and notify the parent or eligible student of the time and place where the records may be inspected.

2. The right to request the amendment of the student’s education record that the parent or eligible student believes is

inaccurate or misleading. Parents or eligible students may ask the school to amend a record that they believe is inaccurate or misleading. They should write the school principal [or appropriate official], clearly identify the part of the

record they want changed, and specify why it is inaccurate or misleading. If the school decides not to amend the

record as requested by the parent or eligible student, the school will notify the parent or eligible student of the decision and advise them of their right to a hearing regarding the request for amendment. Additional information

regarding the hearing procedures will be provided to the parent or eligible student when notified of the right to a

hearing.

3. The right to consent to disclosures of personally identifiable information contained in the student’s education

records, except to the extent that FERPA authorizes disclosure without consent. One exception, which permits disclosure without consent, is disclosure to school officials with legitimate educational interests. A school official is a

person employed by the school as an administrator, supervisor, instructor, or support staff member (including health

or medical staff and law enforcement unit personnel); a person serving on the school board; a person or company

with whom the school has contracted to perform a special task (such as an attorney, auditor, medical consultant, or

therapist); or a parent or student serving on an official committee, such as a disciplinary or grievance committee, or

assisting another school official in performing his or her tasks. A school official has a legitimate educational interest

if the official needs to review an education record in order to fulfill his or her professional responsibility. Upon request,

the school discloses education records without consent to officials of another school district in which a student seeks

or intends to enroll.

[NOTE: FERPA requires a school district to make a reasonable attempt to notify the parent or eligible student of the

records request unless it states in its annual notification that it intends to forward records on request.]

4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the school to comply with the requirements of FERPA. The name and address of the office that administers FERPA is:

Family Policy Compliance Office

U.S. Department of Education

400 Maryland Avenue SW

Washington, DC 20202–5901

[NOTE: In addition, an institution may want to include its directory information public notice, as required by § 99.37

of the regulations, with its annual notification of rights under FERPA.]

Exhibit 2–4

Section 2: Summary of Key Federal Laws
30

Forum Guide to Protecting the Privacy of Student Information

USDA Memorandum

Concerning Limited Disclosure

of Children’s Free and Reduced Price Meal

or Free Milk Eligibility Information

Date: December 7, 1998

To: State Agencies

Child Nutrition Programs

All States

The Healthy Meals for Healthy Americans Act of 1994, P.L. 103-448, amended Section 9(b)(2)(C) of the National School

Lunch Act (NSLA) (42 USC 1751(b)(2)(C)) to allow, without consent, limited disclosure of information about free and

reduced price meal or free milk eligibility. The disclosure limitations apply to all the Child Nutrition Programs. The statute

also specifies a fine of not more than $1,000 or imprisonment of not more than 1 year, or both, for unauthorized disclosures of free and reduced price meal or free milk eligibility information.

Prior to issuance of a final rule, we are authorizing determining agencies to disclose free and reduced price meal or free

milk eligibility information to the extent authorized in the statute. For purposes of this memorandum, a “determining

agency” means the State agency, school food authority, school (including a private school or charter school), child care

institution, or Summer Food Service Program sponsor that makes the free and reduced price meal or free milk eligibility determination.

Disclosure of eligibility information about participants beyond that authorized by the statute is permitted only with consent. The entity receiving the information from the determining agency, hereafter termed the “receiving entity,” may

use the information only for the purpose authorized and may not share the information further. In no case are determining agencies required to disclose eligibility information. Providing aggregate information that does not identify individuals continues to be permitted without consent.

The issues of privacy and confidentiality of personal data are complicated as well as sensitive. Therefore, prior to developing State and local disclosure policies, we recommend that determining agencies discuss the disclosure provisions

with their legal counsel. At a minimum, determining agencies that decide to disclose information that identifies individuals must follow these guidelines. These guidelines apply to eligibility information regardless of the manner in which

the information is maintained including, but not limited to, print, tape, microfilm, microfiche, and electronic communication. Additionally, State agencies no longer need to send requests for disclosures to USDA’s Food and Nutrition Service

(FNS) for approval.

I. What information may be disclosed permissibly without consent?

(The term “persons directly connected” in this section includes Federal, State, and local program operators responsible

for program administration or program compliance and their contractors.)

A. Disclosing names and eligibility status in accordance with the NSLA. Determining agencies may disclose,

without consent, participants’ names and eligibility status (whether they are eligible for free meals or free milk or

reduced price meals) to persons directly connected with the administration or enforcement of the following programs:

■ Federal education programs, such as Title I and the National Assessment of Educational Progress; and

State health or State education programs, provided the programs are administered by a State agency or a local

education agency.

Exhibit 2–5
31

■ Representatives of State or local education agencies evaluating the results and compliance with student assessment programs would be covered only to the extent that the assessment program was established at the State,

not local, level.

■ Federal, State, or local means-tested nutrition programs with eligibility standards comparable to the NSLA (i.e.,

food assistance programs to households with incomes at or below 185 percent of the Federal poverty level, such

as the Food Stamp Program or a State or local nutrition program).

B. Disclosing all eligibility information in accordance with the NSLA. In addition to names and eligibility status,

determining agencies may disclose, without consent, all eligibility information obtained through the free and reduced

price meal or free milk eligibility process (including all information on the application or obtained through direct certification or verification) to the following:

■ Persons directly connected with the administration or enforcement of the programs authorized under the NSLA

or Child Nutrition Act of 1966 (CNA) (42 USC 1771). This includes the National School Lunch Program, School

Breakfast Program, Special Milk Program, Child and Adult Care Food Program (CACFP), Summer Food Service

Program, and the Special Supplemental Nutrition Program for Women, Infants and Children (WIC). This means

that program eligibility information collected for any one of the Child Nutrition Programs may be shared with

another Child Nutrition Program, even if the programs are sponsored by different entities. For example, a public school may disclose information from children’s free and reduced price school meal applications, without

parental consent, to a Summer Food Service Program administered by Parks and Recreation.

■ The Comptroller General of the United States for purposes of audit and examination.

■ Federal, State, or local law enforcement officials investigating alleged violations of any of the programs under

the NSLA and CNA or investigating violations of any of the programs authorized to have access to names and

eligibility status discussed in paragraph A above.

C. Recommendation for notifying households of potential disclosures. While not a requirement, we recommend that determining agencies inform households if they plan to disclose or use eligibility information outside the

originating program. The notice of potential disclosure may be in the notice/letter to households that accompanies the

free and reduced price meal or free milk application, on the application, or, for participants directly certified, in the document informing households of the participants’ eligibility through direct certification. The notification should state that

the participants’ names, eligibility status, and other information provided on the application or obtained through direct

certification or verification may be disclosed to certain other Federal, State, or local agencies as authorized by the NSLA.

A list of the specific programs is not necessary.

II. What types of disclosures require consent?

A. Disclosing eligibility information to individuals and programs not authorized under the NSLA. The disclosure of participants’ names and any eligibility information that identifies them individually to programs or individuals

not specifically authorized by the NSLA requires written consent. Some programs that may request names and eligibility information for which consent prior to disclosure is required include:

■ Federal health programs, such as Medicaid or the Children’s Health Insurance Program (CHIP);

■ local health and local education programs and other local level activities. For example, the disclosure of children’s

eligibility for free and reduced price meals to determine children’s eligibility for free text books or reduced fees

for summer school requires consent when these are local initiatives and not State programs; and

■ any other Federal, State, or local program or individual not included in the statute.

Section 2: Summary of Key Federal Laws
32

Forum Guide to Protecting the Privacy of Student Information

B. Disclosing information that goes beyond that allowed under the NSLA. The disclosure of information other

than names and eligibility status to the programs authorized only to receive participants’ names and eligibility status also

requires written consent. For example, determining agencies may disclose names and eligibility status to a Federal education program, but if the program requests family size, determining agencies must obtain consent prior to disclosure.

III. What are the requirements for consent statements?

The consent statement must be in writing. It may be obtained at the time of application, such as on a multi-use application, or at a later time. The consent statement must conform to the following requirements:

■ The consent statement must identify the information that will be shared and how the information will be used.

■ The consent statement must be signed and dated. In the case of a child participant, the consent statement must

be signed by the parent or guardian of the applicant household, even though the application for free and

reduced price meals or free milk may be signed by any adult household member. For adult participants in the

CACFP, the adult participant must sign the consent statement unless a guardian has been appointed.

■ The consent statement must state that failing to sign the consent statement will not affect eligibility or participation for the program and that the information will not be shared by the receiving program with any other

entity or program.

■ The parent/guardian/adult must be able to limit consent to only those programs with which he or she wishes

to share information. For example, the consent statement could use a check-off system under which the applicant would check or initial a box to indicate that he or she wants to have information disclosed to determine

eligibility for benefits from a particular program.

IV. What are the requirements for disclosure of social security numbers?

When disclosing or using the social security number provided by the household on the application for any purpose other

than the program for which the number was collected, the determining agency must modify the notice required by the

Privacy Act of 1974 concerning the potential uses of the social security number. The notice must inform households of

the additional intended uses of the number.

V. Are agreements required?

Prior to disclosing or using any information for purposes other than the program for which the information was

obtained, we recommend that the determining agency enter into a written agreement with the entity requesting the

information. We suggest that the agreement be signed by both the determining agency and receiving entity, identify

the entity receiving the information, describe the information to be disclosed and how it will be used, describe how the

information will be protected from unauthorized uses and disclosures, and describe the penalties for unauthorized disclosure.

At a minimum, the receiving entity must be informed in writing that eligibility information may only be used for the

purpose for which the disclosure was made, that further use or disclosure to other parties is prohibited, and that a violation of this provision may result in a fine of not more than $1,000 or imprisonment of not more than 1 year, or both.

An agreement is not needed for Federal, State, or local agencies evaluating or reviewing Child Nutrition Program operations. Similarly, an agreement is not necessary for disclosures to the Comptroller General. These activities are part of

routine Child Nutrition Program operations and enforcement.
33

VI. Are there any penalties for improper disclosure?

The NSLA establishes a fine of not more than $1,000 or imprisonment of not more than 1 year, or both, for publishing, divulging, disclosing, or making known in any manner or extent not authorized by Federal law, any eligibility information. This includes the disclosure of eligibility information by one entity authorized under the NSLA to receive the

information to any other entity, even if that entity would otherwise be authorized to receive the information directly

from the determining agency.

These guidelines are subject to change pending issuance of a final rule.

[SIGNED]

STANLEY C. GARNETT

Director

Child Nutrition Division

Section 2: Summary of Key Federal Laws
34

Forum Guide to Protecting the Privacy of Student Information

USDA Memorandum Concerning Limited Disclosure

of Children’s Free and Reduced Price Meal

or Free Milk Eligibility Information

in the State Medicaid Program

and the State Children’s Health Insurance Program

Date: July 6, 2000

To: State Agencies

Child Nutrition Programs

All States

This memorandum addresses disclosure of children’s free and reduced price eligibility information for the State Medicaid

Program (State Medicaid) and the State Children’s Health Insurance Program (SCHIP). The Agricultural Risk Protection

Act of 2000, enacted on June 20, 2000, amended the National School Lunch Act (NSLA) (42 USC 1751(b)(2)(C)) to add

State Medicaid under title XIX of the Social Security Act (42 USC 1396 et. seq.) and the SCHIP under title XXI of that

Act (42 USC 1397aa et seq.) to programs in Section 9(b)(2)(C) of the NSLA that are authorized limited access to children’s free and reduced price meal or free milk eligibility information. A memorandum issued on December 7, 1998,

“Limited Disclosure of Children’s Free and Reduced Price Meal or Free Milk Eligibility Information (SP 99-3); (CACFP 99-

2),” addresses disclosure of free and reduced price meal or free milk eligibility information to other programs and entities. The issues of privacy and confidentiality of personal data are complicated as well as sensitive.

Therefore, prior to developing State and local disclosure policies, we recommend that determining agencies discuss the

disclosure provisions with their legal counsel. At a minimum, determining agencies that decide to disclose information

that identifies individuals must follow these guidelines. These guidelines apply to eligibility information regardless of the

manner in which the information is maintained including, but not limited to, print, tape, microfilm, microfiche, and electronic communication.

For purposes of this memorandum, a “determining agency” means the State agency, school food authority, school

(including a private school or charter school), child care institution, or Summer Food Service Program sponsor that

makes the free and reduced price meal or free milk eligibility determination.

Disclosure of Children’s Eligibility Information for Health Insurance Programs

Is disclosure of children’s free and reduced price meal or free milk eligibility information for State Medicaid

and SCHIP required?

Schools and institutions (determining agencies) may disclose free and reduced price meal or free milk eligibility information to identify and enroll eligible children in State Medicaid or SCHIP, provided the determining agency’s State

agency and determining agency elect to do so. Determining agencies are not required to disclose eligibility information.

However, we encourage cooperation with State and local administrators of State Medicaid and SCHIP because studies

show that many children eligible for free and reduced price meals and free milk do not have health insurance.

What information may be disclosed for use by State Medicaid and SCHIP and what health agencies or health

insurance programs are eligible to receive the information?

Determining agencies may disclose names, eligibility status (whether they are eligible to receive free meals or free milk

or reduced price meals), and any other eligibility information obtained through the free and reduced price meal and

free milk eligibility process (including all information on the application or obtained through direct certification or verification) to persons directly connected with the administration of State Medicaid and/or SCHIP.

Exhibit 2–6
35

Who are “persons directly connected” with the administration of State Medicaid and SCHIP?

Persons directly connected with the administration of State Medicaid and SCHIP for purposes of disclosure of free and

reduced price meal and free milk eligibility information are State employees and persons authorized under Federal and

State Medicaid and SCHIP requirements to carry out initial processing of applications or to make eligibility determinations. Check with your State Medicaid/SCHIP coordinator to determine the persons or entities in your State authorized

to enroll children in Medicaid and SCHIP.

Are there restrictions on how children’s free and reduced price eligibility information may be used by State

Medicaid and SCHIP?

State Medicaid and SCHIP agencies and health insurance program operators receiving children’s free and reduced price

meal or free milk eligibility information may only use that information to enroll children in State Medicaid or SCHIP. The

State Medicaid or SCHIP enrollment process may include seeking to identify and identifying children from low income

households who are potentially eligible for State Medicaid or SCHIP for the purpose of enrolling them in State Medicaid

or SCHIP.

Must households be notified that their free and reduced price meal or free milk eligibility information may

be disclosed?

For any disclosures to State Medicaid and/or SCHIP, parents/guardians must be notified of the potential disclosure and

given the opportunity to elect not to have their children’s information disclosed. The notification must inform the parents/guardians that they are not required to consent to the disclosure, that the information will be used to enroll children in a health insurance program, and that their decision will not affect their children’s eligibility for free and reduced

price meals or free milk. The notification may be included in the letter/notice to parents/guardians that accompanies the

free and reduced price meal or free milk application, on the application itself, or in a separate notice provided to parents/guardians. The notice must be given prior to the disclosure and parents/guardians should be given a reasonable

time limit to respond. For children who are determined eligible though direct certification, the notice of potential disclosure may be in the document informing parents/guardians of their children’s eligibility for free meals through direct

certification.

Should we have an agreement with State Medicaid and/or SCHIP?

The determining agency must have a written agreement with the State or local agency or agencies administering State

Medicaid and/or SCHIP prior to disclosing children’s free and reduced price meal or free milk eligibility information. At

a minimum, the agreement must identify the health insurance program or health agency receiving children’s eligibility

information; describe the information that will be disclosed and specify that the information must only be used to seek

to enroll children in State Medicaid or SCHIP; describe how the information will be protected from unauthorized uses

and disclosures; describe the penalties for unauthorized disclosure; and be signed by both the determining agency and

the State Medicaid/SCHIP program or agency receiving the children’s eligibility information.

What are the requirements for disclosure of social security numbers?

When disclosing or using the social security number provided by the household on the application for any purpose other

than the program for which the number was collected, the determining agency must modify the notice required by the

Privacy Act of 1974 concerning the potential uses of the social security number. The notice must inform households of

the additional intended uses of the number.

Are there any penalties for improper disclosure?

The NSLA establishes a fine of not more than $1,000 or imprisonment of not more than 1 year, or both, for publishing, divulging, disclosing, or making known in any manner or extent not authorized by Federal law, any eligibility information. This includes the disclosure of eligibility information by one entity authorized under the statute to receive the

information to any other entity, even if that entity would otherwise be authorized to receive the information directly

from the determining agency.

Section 2: Summary of Key Federal Laws
36

Forum Guide to Protecting the Privacy of Student Information

These guidelines are effective Oct. 1, 2000, and are subject to change pending issuance of a final rule addressing the

disclosure provisions for State Medicaid and SCHIP.

[SIGNED]

STANLEY C. GARNETT

Director

Child Nutrition Division
Child Nutrition Programs under the National

School Lunch Act (NSLA) or Child Nutrition Act

(CNA)

Federal/State or local means-tested nutrition

programs with eligibility standards comparable

to the National School Lunch Program

Federal education programs

State education programs administered by a

State agency or local education agency

Local education programs

Medicaid or the State Children’s Health

Insurance Program (SCHIP), administered by a

State or local agency authorized under titles

XIX or XXI of the Social Security Act to identify

and enroll eligible children

State health programs other than

Medicaid/SCHIP, administered by a State

agency or local education agency

Federal health programs other than

Medicaid/SCHIP

Local health program

Comptroller General of the United States for

purposes of audit and examination

Federal, State, or local law enforcement officials investigating alleged violations of any of

the programs under the NSLA and CNA or

investigating violations of any of the programs

that are authorized to have access to names

and eligibility status

All eligibility information

Eligibility status only

Eligibility status only

Eligibility status only

U.S. Department of Agriculture/Food and

Nutrition Service

No eligibility information, unless parental consent is obtained

All eligibility information, unless parents elect

not to have information disclosed

Eligibility status only

No eligibility information, unless parental consent is obtained

No eligibility information, unless parental consent is obtained

All eligibility information

All eligibility information

Prior notice and consent not required

Prior notice and consent not required

Prior notice and consent not required

Prior notice and consent not required

Must obtain parental consent

Must give prior notice to parents and opportunity for parents to decline to have their information disclosed

Prior consent not required

Must obtain parental consent

Must obtain parental consent

Prior notice and consent not required

Prior notice and consent not required

37

Exhibit 2–7

A Summary of Disclosure

of School Lunch Information

Section 2: Summary of Key Federal Laws

Information That May be Required Notification

Recipient of Information Disclosed to Recipient and Consent
38

Forum Guide to Protecting the Privacy of Student Information

USDA Guidance 

on Implementing the NCLB Act

The Department of Agriculture and the Department of Education jointly issued a memorandum clarifying the

requirement for disaggregating data under the No Child Left Behind Act (NCLB) and how children’s school lunch

eligibility status may be used for this purpose.

December 17, 2002

Dear Colleague:

As schools across the country begin to implement the No Child Left Behind Act (NCLB), the milestone elementary and

secondary education legislation signed into law by President Bush at the beginning of 2002, a number of school officials have raised questions about the use of student information collected pursuant to the National School Lunch

Program in carrying out provisions of Title I of the Elementary and Secondary Education Act, as reauthorized by NCLB.

The purpose of this letter is to respond to those concerns.

Educators have specifically asked whether it is permissible to use information from the school lunch program in disaggregating student assessment scores, in determining student eligibility for supplemental educational services, and,

under certain circumstances, in prioritizing opportunities for public school choice.

Title I, Part A, of the Elementary and Secondary Education Act

(as reauthorized by the No Child Left Behind Act)

States and local education agencies (LEAs) receiving funding under Title I, Part A, must assess and report on the extent

to which students in schools operating Title I programs are making progress toward meeting State academic proficiency

standards in reading or language arts and in mathematics. Title I now requires States and LEAs to measure and report

publicly on the progress of all students and of students in various population groups, including students who are economically disadvantaged. If assessment results show that any of the groups has not made adequate yearly progress

toward meeting State achievement standards for two consecutive years, the LEA must identify that school as needing

improvement. All students attending the school must be given the opportunity to attend other public schools that have

not been identified as needing improvement, with priority given to the lowest-achieving students from low-income families. In addition, once a school has failed to make adequate yearly progress for three years, the LEA must provide economically disadvantaged students who attend that school the opportunity to obtain supplemental educational services

from a nonprofit, for-profit, or public provider.

For many LEAs, information from the National School Lunch Program is likely to be the best and perhaps the only source

of data available to hold schools accountable for the achievement of “economically disadvantaged” students, and also

to identify students as eligible to receive supplemental educational services or to receive priority for public school choice.

Moreover, in the case of the priority for public school choice and eligibility for supplemental educational services, the

law specifically requires LEAs to use the same data they use for making within-district Title I allocations; historically, most

LEAs use school lunch data for that purpose. After examining these new requirements, State and local officials have

inquired as to whether they may use school lunch data to meet these requirements while remaining in compliance with

the student privacy provisions of the National School Lunch Act.

National School Lunch Act

Section 9 of the Richard B. Russell National School Lunch Act (NSLA) establishes requirements and limitations regarding

the release of information about children certified for free and reduced price meals provided under the National School

Lunch Program. The NSLA allows school officials responsible for determining free and reduced price meal eligibility to

Exhibit 2–8
39

disclose aggregate information about children certified for free and reduced price school meals. Additionally, the statute

permits determining officials to disclose the names of individual children certified for free and reduced price school

meals and the child’s eligibility status (whether certified for free meals or reduced price meals) to persons directly connected with the administration or enforcement of a Federal or State education program. This information may be disclosed without parental consent.

Because Title I is a Federal education program, determining officials may disclose a child’s eligibility status to persons

directly connected with, and who have a need to know, a child’s free and reduced price meal eligibility status in order

to administer and enforce the new Title I requirements. The statute, however, does not allow the disclosure of any other

information obtained from the free and reduced price school meal application or obtained through direct certification.

School officials must keep in mind that the intent of the confidentiality provisions in the NSLA is to limit the disclosure

of a child’s eligibility status to those who have a “need to know” for proper administration and enforcement of a Federal

education program. As such, we expect schools to establish procedures that limit access to a child’s eligibility status to

as few individuals as possible.

We urge school officials, prior to their disclosing information on the school lunch program eligibility of individual students, to enter into a memorandum of understanding or other agreement to which all involved parties (including both

school lunch administrators and educational officials) would adhere. This agreement would specify the names of the

individuals who would have access to the information, how the information would be used in implementing Title I

requirements, and how the information would be protected from unauthorized uses and third-party disclosures, and

would include a statement of the penalties for misuse of the information.

Other Provisions

We also note that NCLB did not alter other provisions of Title I under which school officials have historically made use

of National School Lunch Program data. LEAs are still required to rank, annually, their school attendance areas, by percentage of students from low-income families, in order to determine school eligibility and to make Title I within-district

allocations based on the number of poor children in each school attendance area. They must also determine the amount

of funds available to provide services to eligible private school students within the district, again using data on students

who are from low-income families. Many LEAs have, for many years, used National School Lunch Program data in making these calculations, which do not involve the release of information on the school lunch eligibility of individual students. They may continue to do so under the new law, while respecting the limitations on the public release of those

data described above.

We hope the above information clarifies what we know has been a matter of great concern in States and school districts. If you desire more detailed information about public school choice and supplemental educational services, it can

be found at http://www.ed.gov/offices/OESE/asst.html.

We will also be providing guidance on Provisions 2 and 3 of the National School Lunch Program and the impact of NCLB

on those provisions in the near future.

If we can be of further assistance, please contact one of our offices.

Sincerely,

[Signed] [Signed]

Eric M. Bost Susan B. Neuman

Under Secretary Assistant Secretary for

Food, Nutrition, and Consumer Services Elementary and Secondary Education

U.S. Department of Agriculture U.S. Department of Education

Section 2: Summary of Key Federal Laws
40

Forum Guide to Protecting the Privacy of Student Information

Exhibit 2–9

USDA Guidance on Implementing the NCLB Act

in Provision 2 and 3 Schools

This joint memorandum between the Department of Agriculture and the Department of Education provides guidance on the implementation of the new requirements of Title I of the Elementary and Secondary Education Act,

authorized by the NCLB Act for schools that operate school lunch programs under Provisions 2 and 3 of the National

School Lunch Program.

Feb. 20, 2003

Dear Colleague:

This is a follow-up to our letter of December 17, 2002, in which we promised to provide guidance on the implementation of the new requirements of Title I of the Elementary and Secondary Education Act (ESEA), as reauthorized by the

No Child Left Behind Act (NCLB), for schools that operate school lunch programs under Provision 2 and Provision 3 of

the National School Lunch Program.

As noted in our earlier letter, States and local education agencies (LEAs) receiving funding under Title I, Part A, of the

ESEA must assess and report annually on the extent to which students in schools operating Title I programs are making progress toward meeting State academic proficiency standards in reading or language arts and in mathematics.

States and LEAs must also measure and report publicly on the progress of all students, and of students in various population groups, including students who are economically disadvantaged. If assessment results show that any of the

groups has not made adequate yearly progress toward meeting State achievement standards for two consecutive years,

the LEA must identify that school as needing improvement. All students attending the school must be given the opportunity to attend other public schools that have not been identified as needing improvement, with priority given to the

lowest-achieving students from low-income families. Once a school has failed to make adequate yearly progress for

three years, the LEA must provide economically disadvantaged students who attend that school the opportunity to

obtain supplemental educational services from a non-profit, for-profit, or public provider.

For many LEAs, information from the National School Lunch Program is likely to be the best, and perhaps the only,

source of data available to hold schools accountable for the achievement of “economically disadvantaged” students,

and also to identify students as eligible to receive supplemental educational services or to receive priority for public

school choice. Moreover, in the case of the priority for public school choice and eligibility for supplemental educational

services, the law specifically requires LEAs to use the same data they use for making within-district Title I allocations;

historically, most LEAs use school lunch data for that purpose. As we outlined in our original letter, school lunch data

may be used for these purposes. However, using school lunch data in schools that have implemented Provision 2 or 3

of the school lunch program poses issues that require further explanation, because these schools do not determine free

and reduced price lunch eligibility on an annual basis.

The National School Lunch Act allows schools that offer students lunches at no charge, regardless of individual students’

economic status, to certify students as eligible for free and reduced price lunches once every four years and longer under

certain conditions. These alternatives to the traditional requirements for annual certification, known as “Provision 2”

and “Provision 3,” reduce local paperwork and administrative burden. The school lunch regulations prohibit schools

that make use of these alternatives from collecting eligibility data and certifying students on an annual basis for other

purposes. This prohibition has raised issues about how such schools can obtain the data they need to disaggregate Title

I assessment data, identify students as eligible for supplemental educational services, and determine which students

receive priority for public school choice, all of which Title I requires be done annually.
41

We have determined that, for purposes of disaggregating assessment data and for identifying students as “economically disadvantaged” in implementing supplemental educational services and the priority for public school choice,

school officials may deem all students in Provision 2 and 3 schools as “economically disadvantaged.” In addition, LEA

officials may assume that a Provision 2 or 3 school has the same percentage of students eligible for free and reduced

price lunches as the school had in the most recent year for which the school collected that information for determining the eligibility and Title I allocation of the school.

We hope this guidance clarifies this issue. For more detailed information about public school choice and supplemental

educational services, please see http://www.ed.gov/offices/OESE/asst.html.

If we can be of further assistance, please contact one of our offices.

Sincerely,

[Signed] [Signed]

Eric M. Bost Eugene W. Hickok

Under Secretary Under Secretary

Food, Nutrition, and Consumer Services U.S. Department of Education

U.S. Department of Agriculture

Section 2: Summary of Key Federal Laws
42

Forum Guide to Protecting the Privacy of Student Information

Figure 2–1

A Brief Review of Federal Laws 

Protecting the Privacy of Education Records

Family Educational

Rights and Privacy

Act (FERPA)

Protection of Pupil

Rights

Amendment

(PPRA)

No Child Left

Behind Act

Individuals with

Disabilities

Education Act

(IDEA)

National School

Lunch Act

Patriot Act

Children’s Online

Privacy Protection

Act

Health Insurance

Portability and

Accountability Act

Family Policy

Compliance Office

Family Policy

Compliance Office

Family Policy

Compliance Office

(to administer

aspects related to

records privacy)

Office of Special

Education

Programs

U.S. Department

of Agriculture/

Food and

Nutrition Service

Office for Civil

Rights of U.S.

Department of

Health and

Human Services

Parents and 

eligible students

Parents

Parents and 

eligible students

Parents and 

students who

have reached the

age of majority

under state law

Custodial parents

U.S. Attorney

General or

designee

Parents of children

ages 13 and

younger

Patients

All education

records as defined

in the law

Surveys containing

certain questions

and data elements

as defined in the

law

Strengthen FERPA

All education

records as defined

in FERPA

Name and eligibility status of students who are

eligible for free

meals or free milk

or reduced price

meals

Any education

records, in order

to comply with a

“lawfully issued

subpoena or court

order”

Not education

records; web sites

need to obtain

consent from parents prior to collecting, using, and

disclosing information about the

children

Privacy Rule does

not apply to

records protected

by FERPA and

IDEA

Local education

agency to notify

annually

Local education

agency to notify

and obtain consent prior to the

survey

Used to notify

state and local

education agencies annually of

FERPA and PPRA

requirements

Local education

agencies to notify

annually

Required for some

disclosure

Privacy notice on

web sites

Health care

providers must

provide Notice of

Privacy Practices

Recordation

requirements

Court or ex parte

orders may

require the institution not to disclose to anyone

the existence and

contents of the

orders or the institution’s response

Report disclosure

to third party

required

Required with

exceptions

Required for specific questions and

data elements;

provide options to

opt out of survey

Required under

FERPA and PPRA

Required with

exception

Required for some

disclosure

Student or

parental 

consensus not

required

Parental consent

By patient

Contents of Requirement

Federal Federal Right Education Notification Prior of Recording

Law Agency Afforded to Records Requirement Consent Release
43

OVERVIEW 

School systems must have information about their

students if they are to make appropriate decisions

about educational and support programs. From the

time a child enters school, records begin to follow

the student. Besides the information provided by

the student or parent, such as basic enrollment and

immunization status, school staff create a record to

describe the student’s educational program,

extracurricular activities, and other relevant experiences. Deciding what data to gather along the

record requires careful consideration of what information is needed by the school system and how

best to collect it.

However, many parents are concerned about

releasing personal information to a stranger, and

wonder just how many people will see the

responses. Parents also are concerned when their

children release information about themselves

unintentionally and without understanding the

consequences. In addition, school systems should

take into consideration the concerns of students

and their families. It is important to adhere to the

principles set forth in this section irrespective of

who collects the data or how and why the data are

collected.

GOALS 

✓ Outline the issues related to records privacy during the data collection process

✓ Recommend policies and procedures to safeguard records privacy during this process

KEY POINTS 

• Data collectors must justify the need for every

item of information included in an individual

education record.

• Maintaining data efficiently allows data to be

used for multiple purposes. However, data collectors must justify all uses under existing policies and inform data providers of these uses.

• Data collectors should consult state and local

laws, policies of school boards, and professional

ethics in deciding what information to collect

and maintain about students.

• Data providers should be informed about why

the information is collected and if providing

such information is mandatory.

• Data collectors should demonstrate that the

data produced will be of sufficient value, applicability, and usefulness to justify the cost and

burden of collecting them.

• When data collectors choose data elements and

the procedures to collect them, they should

consider the quality of the data.

• Data collectors should derive unique identification codes by a variety of methods (e.g., assigning sequential numbers or adopting algorithms

to generate codes using selected characteristics).

• Using social security numbers may be helpful to

agencies or schools in maintaining appropriate

and accurate information about students.

However, they are considered part of education

records, and school officials must protect them

from illegal access and unauthorized release.

• In addition to federal and state requirements,

agencies or schools should establish policies to

determine the length of time each type of data

is maintained and how data will be expunged or

replaced.

SECTION 3

Protecting the Privacy of Individuals 

During the Data Collection Process
A. Determining the Agency’s

Student Data Needs and Uses

Usually, data are collected because they are:

• used to aid in the placement of students;

• used to determine student progress and student

needs;

• required by laws or regulations;

• used to promote the efficiency and effectiveness of

the agency; and

• needed for accountability and funding decisions.

Other data about individual students are collected to

determine their progress, place them into appropriate

learning experiences, and otherwise assist the school in

meeting the needs of the students. Still other types of

data are collected to promote the efficiency and effectiveness of the agency and are justified under school board

or state board of education policy.

When data about students are aggregated, information

may be used for program accountability and funding

decisions. Each piece of information included in an education record should represent a clear and important

need for obtaining and recording that information.

Schools, school districts, and state education agencies

may need student data for the following major administrative purposes:

Instruction—Teachers and other staff members also

need student-level information to ensure that students receive appropriate instruction and services. For

example, teachers need to know how to contact parents, and they need information about a student’s previous educational experiences and special needs to

help plan instruction. Counselors need to know what

courses students have taken in order to plan their educational programs. Personally identifiable data, thus,

are needed for instructional decisions.

Accountability—Answering the questions of parents, policymakers, and other participants in the education enterprise about students’ accomplishments

and the effectiveness of schools has become an

important function of data collected by schools.

Reporting functions generally do not require personally identifiable data. However, some personally iden44

Forum Guide to Protecting the Privacy of Student Information

tifiable data are needed in order to carry out longitudinal analyses that may be crucial in assessing a program’s effectiveness.

Management—Schools, districts, and state education agencies use data about students to assist in the

planning and scheduling of educational programs and

the distribution of resources (e.g., fiscal, staffing, and

materials). Management functions generally do not

require personally identifiable information.

Research and Evaluation—Schools, as well as local,

state, and federal education agencies, conduct analyses of program effectiveness, the success of subgroups

of students, and changes in achievement over time to

identify effective instructional strategies and to promote school improvement activities. These data may

or may not be personally identifiable.

Operations—Schools and districts need data to ensure

the efficiency of their day-to-day functioning. For example, schools must maintain attendance records, handle

students’ health problems, and operate transportation

and food service programs. Personally identifiable data

are needed for such operations.

Efficient maintenance of data about individual students

allows data needed for one purpose to be used for other

appropriate purposes. However, the uses must be justified under existing policies, and data providers should be

informed of these uses. For example, information about

a student’s home language collected for required aggregate federal reporting could also be used in the evaluation of a school’s language programs. In these instances,

personally identifiable information that is used for the

analyses cannot be publicly released without written

approval from the parents.

B. Justifying Data Collection

In general, schools and education agencies are not

restricted in what they may request about students; this

is determined by state laws and regulations, and the policies of the school, district, or state education agency.

However, federal law (i.e., the Protection of Pupil Rights

Amendment [PPRA]) does specify several types of questions that cannot be asked without prior consent of the

parents. (See section 2C for a detailed discussion.) A

good practice is to collect and maintain in the education
Data collectors should be prepared to openly and thoroughly respond to hard questions raised by parents and

privacy advocates.

A second issue that can affect data integrity and accuracy

is the design of the data collection activity and the training provided to data collectors. Training is important for

all staff who might be involved in collecting student information, regardless of the purposes. Such staff may

include teachers, school secretaries, school nurses, guidance counselors, principals, and evaluators. Areas that

should be included in staff training are:

• the distinction between collecting data that are

mandatory and those that are voluntary, and the

options of the student or parent regarding provision of

the data;

• the ethical and legal responsibilities of staff to prevent

unauthorized use or disclosure of data; and

• the ways staff can obtain explanations or other help

while collecting the data.

The training could focus on how the questions or

requests for information may be stated by the staff person to ensure that the request is clear and the data can

be collected consistently from all individuals. For instance,

it is important for data collection procedures to ensure

that parents and students have the opportunity to provide accurate answers regardless of their language, cultural, or educational backgrounds. Staff should be

sensitive to and respectful of respondents’ privacy and

their possible reluctance to answer a question. The information belongs to the individual; school personnel are

just “borrowing” it.

D. Protecting Unique

Identification Codes

Using unique identification codes would:

• allow the records to follow the correct students when

they move within the state; and

• provide the flexibility of merging data from different

files to promote efficiency without threatening privacy.

Some state education agencies assign a set of sequential

identification numbers for schools or school districts to

use so that the identification number of a student is

records only those data for which a clear and specific purpose has been identified.

In deciding what data can be requested from individuals,

first consider several important and practical factors. Data

collection can be a burden on the data providers if too

many questions are asked or the completion of the form

is too time-consuming. If the way in which questions are

asked makes it unclear what information is requested,

the accuracy of the data may be undermined. An important rule of thumb in data collection is that the data need

should outweigh data burden and collection problems.

Justification for data collection could include what methods will be used to guard against nonresponse, inaccuracy, privacy intrusion, and infringement of information

security.

C. Ensuring Data Integrity and

Accuracy

Data collectors may promote data integrity and

accuracy by:

• making sure data providers understand the importance of the data; and

• designing the data collection activity and training survey staff to respect the dignity of the respondents.

An important consideration in choosing data elements

and the procedures to collect data is the quality of the

data that will be received. Data integrity means that the

information provided is complete and unchanging; data

accuracy means that the information is correct.

Two issues are important in ensuring data integrity and

accuracy. The first is the degree to which the data

provider (usually the student or parent) supports the data

collection. It is important for students and their parents to

know if the data being requested are required by law or

for the purposes of ensuring that certain services can be

received by the child. It is important for parents to understand when failure to provide accurate and complete

data may result in the denial of benefits (e.g., immunization records required to enroll a child in school). For most

data elements or data collection forms, school officials

should inform students and their parents why the data

are important and how they will and will not be used.

Written assurances of data confidentiality often alleviate

concerns and elicit more cooperation, but not in all cases.

45

Section 3: Protecting the Privacy of Individuals During the Data Collection Process
York, Massachusetts, and California) (Clements and

Ligon 2001; Ligon 1997).4 Since social security numbers

are used to maintain confidential information by other

agencies outside the education system, it is crucial to

ensure that no one gets illegal access to the numbers.

Security is far more important with social security numbers than locally assigned identifiers, because the identity

of a person is easily revealed with his or her social security number. For example, the printing or display of social

security numbers on education documents demands a

higher degree of diligence from everyone handling those

documents. In fact, some state laws prevent the display

of social security numbers on student records. Many state

and local education agencies establishing a unique student identifier system rely not on social security numbers,

but on an alternate, system-generated number using,

without exposing, such personal characteristics as name

and date of birth. Social security numbers, if maintained,

are thus kept as an additional item for accuracy checks,

but not as an identifier. Their uses are restricted to very

limited purposes. In states using social security numbers,

an attorney general’s opinion, legislative authority, or

state board of education authority is typically secured

first.

E. Determining the Longevity of

Records

Many states have legal requirements defining how long

education records must or may be kept. There may also be

federal requirements for how long some data should be

maintained. School districts should have more specific

policies noting exactly which data to store and how long

data should be maintained. For instance, transcript information for high school completers is often kept active for

a fixed length of time, such as 5 to 10 years. With information technology, storage space is no longer as significant a problem, and student transcripts may be kept

active even longer. Two recommended components to

include in a school or district data policy are a listing of

what data elements are included in the school transcript

or record (sent with students when they move) and a time

period for how long these records will be maintained.

unique within the state. It is a good practice that school

districts provide to each student a system-generated

number that contains no imbedded information.

Many educators and social service providers inquire about

the use of social security numbers. The social security

number has the advantage of being unique to students

and does not change when they move to another city or

state. Using the social security number can make it easier

for schools to locate the appropriate transcript or student

information when they receive a request. The numbers

can be used to share information or conduct studies

across agencies only with prior written consent, as

required by FERPA. Some states exchange information

about families across agencies to determine eligibility for

services. For example, with prior consent from parents

several states use social security numbers and other family information to link across Temporary Assistance for

Needy Families and other public assistance files to establish a student’s eligibility for the additional support and

services, to count the number of economically disadvantaged students that qualify a campus for Title I funding,

and to establish a student’s eligibility for vocational and

job training programs.

In general, schools, school districts, and state education

agencies cannot release the social security numbers of

students because this is considered personal information

and is part of the education records under FERPA. While

federal law limits the use and release of social security

numbers, it does not prohibit schools from asking for the

number. Specifically, schools can ask for a child’s social

security number but cannot require it, and schools must

inform parents that they do not have to provide the social

security number. Schools also cannot deny any right, privilege, or benefit to students or their parents who refuse

to disclose a social security number. Schools that use

social security numbers should be prepared to issue an

alternative code in case of such refusal. In addition, it is

important for school officials to be aware that it is difficult and time consuming to check the accuracy of the

social security numbers given. For example, some parents

may not recall the social security number for their child or

may give a wrong number. For these reasons, social security numbers would mostly be used as an attribute for

checking against duplicate records, rather than as an

identification code.

More thorough discussions of the use of social security

numbers versus other identifiers can be found in papers

prepared for several state education agencies (e.g., New

46

Forum Guide to Protecting the Privacy of Student Information

4

Clements, Barbara, and Glynn Ligon, Designing and Implementing a

System for Assigning Student Identifiers in New York, Evaluation

Software Publishing, Inc., Austin, Texas, April 2001. This paper and

similar studies for Massachusetts and California can be found at the

website: [www.evalsoft.com].
age 13. The rule requires operators of web sites or

online services directed to children or which children

might use to post prominent links on their web sites

to a notice of privacy. This notice: 1) explains how the

web site collects, uses, and/or discloses personal information from children; 2) notifies parents that they

wish to collect information from their children and

obtain parental consent prior to collecting, using,

and/or disclosing such information; 3) assures parents

that no more personal information is collected than is

needed for the children’s participation in online activities; 4) allows parents the opportunity to review or

have their children’s information deleted from the

operator’s databases; and 5) establishes procedures to

protect the confidentiality, security, and integrity of

personal information they collect from the children.

Q. How responsible am I for the accuracy of the student

data I receive?

A. In general, data collectors are more ethically than

legally responsible. You can promote the accuracy and

integrity of the data in several ways. See section 3D.

Q. When can I destroy student records? When not?

A. Agencies or schools may establish their own policies,

based on federal and state legal requirements, to

determine the length of time records or portions of

records are kept. See section 3E. However, schools

may not destroy a record if there is a pending request

to review it. See section 5.

Q. Can I use social security numbers to identify education

records?

A. Yes, you may use social security numbers if your state

law does not prohibit it. However, you may not require

students to provide them. It is important for you to

inform students or parents if agencies or schools

intend to use these numbers. See section 3F.

47

Other types of data (e.g., after-school care arrangements

or extracurricular activities) may not be needed after a

certain period of time (e.g., 1 year or after a student has

left the school. It is a good idea to include in a written

data policy an indication of which data elements will be

expunged from education records and when they will be

deleted. Finally, there are some data that a school or

agency may want to expunge to protect the student.

Disciplinary actions are an example; state law or local policy usually governs these cases.

COMMONLY ASKED QUESTIONS

Q. How do I decide what information to collect about a

student?

A. Check state and local laws and regulations as well as

school board policies for the types of information

required to collect. Other than these requirements,

agency or school staff should carefully consider the

needs for the information against the costs and burden of collecting it. See sections 3A and 3B.

Q. Must I have permission from the parents to give an

achievement test to a student?

A. Permission from parents is not usually needed for

achievement testing unless state or local policies

related to obtaining parental permission already exist

or if the test contains questions from one of the eight

areas listed in PPRA. In general, schools should inform

parents of the purposes and uses of testing and

whether it is mandatory. See section 3B; also see discussion of the Protection of Pupil Rights Amendment

(PPRA) in section 2C.

Q. How is information collected from students on the

Internet protected?

A. In April 2000, the Children’s Online Privacy Protection

Act of 1998 was passed. This law governs the online

collection of personal information from children under

Section 3: Protecting the Privacy of Individuals During the Data Collection Process

REFERENCES

Clements, B., and Ligon, G. (2001). Designing and Implementing a System for Assigning Student Identifiers in New

York. Austin, TX: Evaluation Software Publishing, Inc.

Ligon, G. (1997). Designing and Implementing a System for Assigning Student Identifiers. Austin, TX: Evaluation Software

Publishing, Inc.

National Forum on Education Statistics. (1994). Education Data Confidentiality: Two Studies. Issues in Education Data

Confidentiality and Access, and Compilation of Statutes, Laws, and Regulations Related to the Confidentiality of

Education Data (NCES 94–635). Washington, DC: U.S. Government Printing Office.

49

OVERVIEW 

Many school administrators are concerned with

breakdowns in the security of their records systems.

One administrator might agonize about the file cabinet key being stolen from the school secretary’s

desk when he or she is at lunch. Another might

worry about students breaking into the automated

management information system to change their

grades. Still another might cringe at the thought of

certain student information being released to the

media. These situations could happen anywhere, in

public or private schools, school districts, intermediate service units, or state agencies, regardless of the

sophistication of the records systems.

The No Child Left Behind (NCLB) Act has heightened the involvement of state education agencies

in providing data, thus increasing their responsibilities in maintaining individual student data and

safeguarding their privacy. Maintaining the privacy

of personally identifiable data about students

requires clear policies to restrict who has access to

data and how the data are used. This section

describes some of the considerations in deciding

who can review and use student data, what are

legitimate uses of data, and what security will be

needed to protect against inappropriate access.

GOALS 

✓ Discuss how to consider providing access and use

✓ Determine “legitimate educational interest”

✓ Discuss how to protect against inappropriate

access

KEY POINTS 

• An official designated as the data steward should

be responsible for keeping individual records safe

and intact from accidents, unauthorized access,

theft, changes, or unintentional release.

• A security risk assessment is important to identify the assets of an agency, potential threats to

those assets, vulnerable points in an agency,

probabilities of threats striking a vulnerable

point, and cost estimates of losses should a

potential threat be realized.

• It is more practical to establish criteria for determining broad categories of positions than to list

exactly who or what individual positions are

considered to be “school officials.”

• While agencies or schools may establish a policy

to determine what constitutes “legitimate educational interest,” the decision also may be

made on a case-by-case basis.

• It is important to train all staff in information

security as soon as they are hired. They should

know what is considered appropriate and inappropriate access to data and use of the information within the records.

• Existing professional standards are invaluable

resources to support policymaking and training.

• It is important to determine each time whether

the staff assigned to conduct the research are

trained and authorized to access the data. An

alternative approach is to sidestep the question

of security by creating a research file deleting

the students’ identifying information.

SECTION 4

Securing the Privacy of Data

Maintained and Used Within an Agency
• Equally important are detailed procedures for records

retention and disposal, as determined by an agency’s

needs and legal requirements. Inappropriate disposal

methods also threaten the privacy of the records.

A. Management Responsibilities

A1. Assign a data steward

As part of the overall effort to ensure the quality of data

maintained at an agency, it is important to identify a data

steward who will serve as the primary contact for such

purpose. This person is abreast of the latest federal and

state requirements in maintaining the privacy of student

records, and is knowledgeable about the data collection

activities within his or her agency. He or she is involved in

policymaking and possesses good communication skills.

The data steward monitors the activities of other staff

who work with the data collection activities and plans

periodic reviews of the data collection process to ensure

that data quality requirements are being met. More

importantly, this person ensures that data are made available to all persons who have a need to know, including

agency staff and other personnel, and are protected from

unauthorized access and unintentional release.

Regardless of the position, a person with responsibility for

the confidentiality of education records (e.g., the data

steward or the records manager who works closely with

him or her) has serious responsibilities for ensuring that all

who work with the data will help him or her in guarding

the privacy of education records. In addition, the records

manager should ensure that the equipment and procedures will protect the security of the records. The manager should develop and enforce a written policy that

describes what data are maintained and what procedures

are in place to ensure that access to personally identifiable data is restricted to those persons with a legitimate educational interest as defined by the system.

A2. Conduct a security risk assessment

Security risks can be found in different components of the

systems: hardware, operating systems, software, networks, databases, and people from both inside and outside the agency. A risk assessment identifies the assets of

an agency, potential threats to those assets, vulnerable

points in an agency, probabilities of threats striking a vulnerable point, and cost estimates of losses should a poten50

Forum Guide to Protecting the Privacy of Student Information

tial threat be realized. Security threats can come from both

inside and outside an agency. Hacking, unauthorized

copying, user error, programming errors, lost encryption

keys, lost documentation, computer viruses, flood, and

rain or water damage are just a few examples of security

threats. The risk assessment will assist an agency in its

effort to develop countermeasures against perceived

threats. Chapter 2 of Safeguarding Your Technology:

Practical Guidelines for Electronic Education Information

Security (National Forum on Education Statistics 1998)

provides step-by-step procedures and a checklist for a

security assessment. Another publication, Weaving a

Secure Web Around Education: A Guide to Technology

Standards and Security (National Forum on Education

Statistics 2003), also discusses the security assessment in a

web environment. These two documents provide further

guidelines for maintaining a secure electronic and network environment that protects sensitive information.

Once risks are identified, the agency may select equipment that has the appropriate mechanical configuration,

provides access to authorized users, and has software

that restricts access to authorized persons only. Among

the procedures used to ensure the privacy and security of

computer records are password protection applications

that restrict access to data elements and files, frequent

password changes to guard against break-ins, and the

use of encryption. Exhibit 4–1 contains basic information

about securing automated records.

A3. Develop written policies and 

procedures

To carry out these management responsibilities, the

records manager has to know who is authorized to see

and modify personally identifiable student data. A written

policy can define the appropriate school officials and

what constitutes a legitimate educational interest. This

policy states who is allowed to change data and what

procedures are needed to ensure that all records are

updated when changes are made.

Management has a responsibility to inform staff members of their rights and responsibilities with regard to student data. One commonly used procedure is to have

persons granted access to personally identifiable data

sign an oath of nondisclosure. This agreement should list

all types of information that must be kept confidential

and forbid staff from discussing security aspects of the

data system, such as a locked filing cabinet or a com-
puter, with unauthorized individuals. The acknowledgment of specific legal penalties required by law should be

included in this oath. While this may seem extreme, it can

help to ensure that staff members know exactly what the

requirements and their responsibilities are.

Written policies also could cover the current legal restrictions for disclosure or nondisclosure. For example, the

Patriot Act of 2001 allows disclosure under certain conditions, while the National Defense Authorization Act allows

military recruiters to obtain directory information of secondary school students. Procedures should be updated

periodically to reflect recent changes in federal and state

laws. See section 2 for a discussion of these recent

changes. The web site of the Family Policy Compliance

Office also contains updated information about changes

in federal requirements.

Sample policies can be found in Weaving a Secure Web

(mentioned above). These include an acceptable-use policy, technology resource use agreement, electronic mail

policy, dial-in access policy, password policy, and web

contents accessibility. These samples can be adapted to

state or district use, and are the integral parts of the overall policy.

B. Defining “Legitimate

Educational Interests”

The Family Educational Rights and Privacy Act (FERPA)

makes it clear that “school officials with legitimate educational interests” may be given access to personally

identifiable information about students. However the law

does not say specifically who those persons are, nor does

it stipulate how to determine the limits of a legitimate

educational interest, although the U.S. Department of

Education could rule, as a matter of law, that a school

official did not have “legitimate educational interest” in

accessing information contained in education records.

Agencies or schools maintaining personally identifiable

data about students should have written criteria for

determining which school officials have a legitimate educational interest in specific education records because this

must be included in the annual notification to parents, as

specified in FERPA. Agencies or schools could make broad

decisions based on legal requirements and good practices. The intent to follow this practice should be stated

in the school’s or agency’s written policy and must be

51

included in the annual notification of rights under FERPA.

The Family Policy Compliance Office has a model notification that contains sample language.

In determining the school officials who might need

access to education records, it is more practical to establish broad position criteria than to list exactly who, or

what individual positions, qualify. General criteria such as

the following might be useful:

• a person employed by the agency or school in an

administrative, counseling, supervisory, academic, student support services, or research position, or a support person to these positions; or

• a person employed by or under contract to the agency

or school to perform a special task.

Identifying a person as a “school official” does not automatically grant him or her unlimited access to education

records. The existence of a legitimate educational interest

may need to be determined on a case-by-case basis. A

sample policy statement of what constitutes legitimate

educational interest might include substantiation such as

the following:

• The information requested is necessary for that official

to perform appropriate tasks that are specified in his

or her position description or by a contract agreement.

• The information is to be used within the context of

official agency or school business and not for purposes

extraneous to the official’s areas of responsibility or to

the agency or school.

• The information is relevant to the accomplishment of

some task or to a determination about the student.

• The information is to be used consistently with the

purposes for which the data are maintained.

Having access to education records or the information

within the records does not constitute authority to share

this information with anyone not given access through

the written policy. This is particularly critical if the data are

to be used away from the agency or school by contractors or consultants. See section 6 for more information

on releasing information outside an agency.

After the policy defines school officials with a legitimate

educational interest, a list of authorized positions or persons and records or specific data elements to which they

may have access could be created. This is particularly

important if the system is automated.

Section 4: Securing the Privacy of Data Maintained and Used Within an Agency
52

Forum Guide to Protecting the Privacy of Student Information

The records manager decides the legitimacy of each

request for information. If there is any doubt or question

regarding the request or the legitimate educational interest, the records manager should not disclose the information without the approval or concurrence of the

appropriate agency or school officials or written permission from the student or parent.

C. Training Agency Staff

Training all agency staff, even those who do not have

access to individual education records, is important to

ensure that education records are handled correctly.

Training could include:

• What is the appropriate and inappropriate access and

use of data or information contained in the education

records. (For instance, a staff member may have a legitimate access right to a student’s education record for

making placement decisions. That same staff member

may not have a right to view the records of other students for whom he or she does not have responsibilities. Persons who are not authorized to see personally

identifiable data should be informed why they are

denied access if they are in positions where they must

work with students.)

• How to ask questions when access decisions need to

be made.

• How to handle problems when there are misunderstandings.

• Exactly what is expected in each data collection document and any other important procedural details.

• How to protect information while it is being collected

or used. (For instance, staff should not leave education

record files opened on their desks or showing on their

computers when they step away from their desks.)

• What are the key aspects of information security, such

as physical network security, software security, and

user access security.

It is important to extend the training to nonemployees,

such as school volunteers and contractors who are hired

by the agency. Also, training materials should be updated

periodically to reflect recent changes in federal and state

requirements. Any special requirements related to specific

data collection documents or procedures should be

included.

D. Professional Ethical Standards

The use and misuse of student data are covered to some

extent by professional ethical standards. Several documents should be reviewed and considered in this area.

However, professional ethical standards may not conflict

with the requirements under FERPA that state that parents must be provided access to their children’s education

records. See the references at the end of this section.

Particularly relevant sets of ethical standards include:

• Ethical Standards for School Counselors (American

School Counselor Association 1992)

• Ethics and Law for School Psychologists (Jacob-Timm

and Hartshorne 1994)

• Standards for Educational and Psychological Tests, produced jointly by the American Educational Research

Association, American Psychological Association, and

National Council on Measurement in Education. This

document specifically addresses the use of test results.

Also, a good resource is The Program Evaluation

Standards, published by the Joint Committee on

Standards for Educational Evaluation (1994). These

standards describe ethics related to respecting and protecting the rights and welfare of human subjects.

• Guidelines for Protecting Confidential Student Health

Information, published by the American School Health

Association (2000), in collaboration with the National

Association of School Nurses and the National

Association of State School Nurse Consultants, provides a wealth of recommendations specifically concerned with navigating a course through conflict

obligations.

E. Research Use Within an

Agency

Sometimes the records manager will receive requests for

research using education records, such as comparisons of

the test scores of students in different programs. District

policy or procedures should specify the steps in making

and acting on such requests. The records manager may

elect to have staff complete the analysis or contract with

consultants to do the analysis. If a staff member conducts

the analysis, it is important to determine if he or she is

authorized to have access to personally identifiable stu-
dent data. If not, the records manager may create a file

containing the needed data without the students’ identifying information. This is a good way to protect confidentiality while allowing data to be used by contractors

or outside researchers as well. The release of student data

outside of the agency is discussed in more detail in section 6.

F. Data Disposal

Retaining data beyond its useful life exposes an agency to

unnecessary privacy risks. The written policies of records

maintenance should include detailed procedures for

records retention and disposal, as determined by an

agency’s needs and legal requirements. Inappropriate disposal methods also threaten the privacy of the records.

For example, records should not simply be erased or

media reformatted. They should be overwritten with random binary codes. In addition, when an agency upgrades

its networks and systems, data contained in the original

systems could be exposed if the tapes, disks, and hard

drives are not cleaned properly. Even if a vendor replaces

a hard drive, the old one must be returned so it can be

checked to ensure that it was properly cleaned.

COMMONLY ASKED QUESTIONS

Q. If a student’s record is corrected at the district level,

must the district inform other holders of that record?

A. Yes. This is a major part of the importance of a written policy regarding what data are maintained and

where they are kept. Also see section 5 for changes

made to education records as requested by parents.

Q. What should I do when elected officials or others with

authority over me want to see individual education

records?

A. Unless authorized by law, the same rules of access

apply to elected officials as to anyone else outside an

agency. When you establish policies and procedures on

access, the records manager or designated official

would have the authority to deny unauthorized access.

You can instruct all other staff members to refer

requests to the designated official or records manager.

See sections 4A, B, and E.

53

Q. Is it permissible to use information from the school

lunch program in disaggregating student assessment

scores; in determining student eligibility for supplemental educational services, such as tutoring; and in

prioritizing opportunities for school choice to meet No

Child Left Behind (NCLB) requirements?

A. The National School Lunch Act (NSLA) permits the disclosure of children’s free or reduced-price school lunch

eligibility status to individuals directly connected with

the administration or enforcement of federal and state

education programs. Because Title I is a federal education program, individuals who are directly connected

with, and who have a need to know, a child’s eligibility status to administer and enforce Title I requirements

under NCLB may have access to the information.

However, as with all confidential information, access

should be limited to as few individuals as possible. For

example, teachers may be provided a list of students

who need supplemental tutoring. The teachers do not

need to know that students on the list are certified eligible for free and reduced-price school meals.

Q. Does everyone in an agency have access rights to student records?

A. No. See section 4B for specific guidance.

Q. Do contractors or vendors for an agency have access

rights to student records?

A. Contractors or vendors acting on behalf of the agency

or school to perform specified duties that the agency

or school is authorized to perform may be allowed

access to those records they need to perform such

duties. You should consider this kind of access on a

case-by-case basis. Staff from organizations who have

access to individual data should be trained in their

responsibilities to keep the data confidential. See sections 4B and E.

Q. Who can do filing, typing, and data entry of education

records?

A. Agencies or schools may assign these duties to qualified staff members. However, it is important to provide training as soon as you hire both permanent and

temporary staff. The training should include the access

rights as well as the responsibilities for safeguarding

the confidentiality of data to which they have access.

See section 4C.

Section 4: Securing the Privacy of Data Maintained and Used Within an Agency
54

Forum Guide to Protecting the Privacy of Student Information

Q. What policies should a school district, regional office,

and state education agency have in effect?

A. In addition to the policies required by federal or state

laws, you should also establish policies that cover how

and what data to collect; how, where, and how long

data are maintained; on what criteria individuals

within and outside the agency may be given access to

these data; and how students and parents may review

and request amendments to the education records.

See sections 3 to 6.
Some Ways to Promote Secure Maintenance

of Automated Student Records5

✓ Document the date and reason for collecting information for each form and each data element, so that files may be

kept current and not used for unintended or inappropriate purposes.

✓ System security is a complex enterprise that is best left to professionals rather than to school faculty or technology

staff. However, when resources dictate the use of teachers/technology coordinators to implement security, the provision of adequate professional development and written policies is critical.

✓ Identify education record files and data elements within the files as restricted (confidential) or unrestricted (e.g., directory information).

✓ Develop a filing system for records, so that they can be retrieved easily and accurately when needed. The practice

will minimize the possibility of misplacing confidential information and thereby allowing unauthorized access. This is

true for either automated or paper-record systems.

✓ Maintain complete and well-documented records on all changes and additions to files. Keep a list of changes and

additions, note who made them, and note when they were made.

✓ Application and operating system software can be protected by using passwords and by eliminating access to those

who have no need to use particular software. Passwords also can be used to limit access to parts of student files or

to specific data elements. Systems operators should monitor access closely through a recordkeeping system. In addition, they should require users to change their passwords frequently; at a minimum, every 3 months.

✓ Where possible, a warning statement should appear on the computer screen before access is permitted. This statement should stay on the screen for at least 10 seconds to ensure that it is readable. It should be worded to convey

the following message: “Unauthorized access to personally identifiable information is a violation of federal (and/or

state) law and will result in (prosecution or a maximum fine of $____ and/or imprisonment of up to ___ years, where

applicable).” Users should be prompted to select whether to proceed. If it is not feasible for this statement to appear

on the screen of the computer, it should be typed and attached to the monitor in a prominent location.

✓ The transmission of data from one agency to another creates additional security risks that can be minimized through

the use of standardized protocols, various encryption technologies, and digital signatures. When encryption and

decryption are used to ensure security of data, the algorithm required to encrypt and decrypt must receive the same

protection as the data. When not in use, it must be secured at all times. Refer to Weaving a Secure Web Around

Education: A Guide to Technology Standards and Security (National Forum on Education Statistics 2003) for guidelines in securing hardware, operating systems, applications, and the network.

✓ Extreme care should be exercised to ensure that the data are not inadvertently made available through use of networking technology. For example, password protection of access to the data file should be required in addition to

access to the computer.

✓ Ensure that people involved in coding, entering, and processing the information have the necessary training and

background to perform their tasks accurately and maintain strict confidentiality, and that they understand the criteria, context, penalties, and other considerations.

✓ Avoid making excessive copies of back-up records. If back-up copies are made, label documents as “original” or

“copy.”

Exhibit 4–1

55

Section 4: Securing the Privacy of Data Maintained and Used Within an Agency

5

Included in this checklist are basic considerations for maintaining automated student records. Readers should refer to two documents that provide further guidelines in this area: Safeguarding Your Technology: Practical Guidelines for Electronic Education Information Security (1998) and

Weaving a Secure Web Around Education: A Guide to Technology Standards and Security (2003).
56

Forum Guide to Protecting the Privacy of Student Information

REFERENCES

American Psychological Association. (1999). Standards for Educational and Psychological Testing. Washington, DC:

Author.

American Psychological Association. (1992). American Psychologist, 47(12). Washington, DC: Author.

American Psychological Association. (1987). Casebook on Ethical Principles of Psychologists. Washington, DC: Author.

American School Counselor Association. (1992). Ethical Standards for School Counselors. Alexandria, VA: Author.

American School Health Association. (2000). Guidelines for Protecting Confidential Student Health Information. Kent,

OH: Author.

Jacob-Timm, S., and Hartshorne, T. (1994). Ethics and Law for School Psychologists. (2nd ed.). Brandon, VT: Clinical

Psychology Publishing Company, Inc.

Joint Committee on Standards for Educational Evaluation. (1994). The Program Evaluation Standards: How to Assess

Evaluations of Educational Programs. (2nd ed.). Thousand Oaks, CA: Sage Publications, Inc.

Mason, R.O., Mason, F.M., and Culnan, M.J. (1995). Ethics of Information Management. Thousand Oaks, CA: Sage

Publications, Inc.

National Forum on Education Statistics. (2003). Weaving a Secure Web Around Education: A Guide to Technology

Standards and Security (NCES 2003–381). U.S. Department of Education. Washington, DC: National Center for

Education Statistics.

National Forum on Education Statistics. (1998). Safeguarding Your Technology: Practical Guidelines for Electronic

Education Information Security (NCES 98–297). U.S. Department of Education. Washington, DC: National Center

for Education Statistics.
57

OVERVIEW 

Sometimes parents worry about what information

is kept about their children, and whether the information is correct. To protect the privacy of students

and their families, the Family Educational Rights

and Privacy Act (FERPA) grants parents the right to

review, amend, and challenge the contents of their

child’s education record. Section 2 includes a discussion of FERPA’s requirements; this section provides additional suggestions to implement and

facilitate the process.

GOALS 

✓ To review parents’ rights of access to their child’s

records

✓ To provide practical tips for implementing stepby-step procedures that allow parents access to

their child’s records

KEY POINTS 

• Parents should be informed of their rights under

FERPA, although the actual means of notification is the decision of the agency or school.

• It is important for an agency or school to prepare written procedures for handling record

requests.

SECTION 5

Providing Parents Access 

to Their Child’s Records

• A designated official should manage the review

process. This official can verify the identification

of the parents, explain the laws, help parents

understand the record, and refer parents to

appropriate resources.

• The agency or school should verify the authenticity of requests and comply within 45 days.

• Agencies or schools may, but are not required

to, provide copies of the records.

• If it is not feasible for the parents to review the

records because of distance, the school should

provide a copy of the record.

• While agencies or schools are not allowed to

charge for the search and retrieval of records,

they may charge for copying time and postage.

• Written procedures can guide parents through

the process of challenging their child’s record.

The school or district may provide a form to

streamline the process.

• Parents should be notified as soon as a hearing

is scheduled. The hearing may be presided over

by an agency or school official, if this person is

considered a third party.

• Evidence presented in the hearing should be

documented. The decision should be based

solely on the evidence presented at the hearing.

• It is important to follow through the decision of

the hearing.
58

Forum Guide to Protecting the Privacy of Student Information

A. Notifying Parents of Their

Rights

Schools or districts are required to make public notification

of parents’ rights under this law. See Exhibit 5–1 for a

model notification. The 1994 amendments of FERPA

require districts to “effectively inform” parents and eligible

students. The notification therefore needs to be carried

out in such a way that parents and students actually

receive notice. However, the actual means of notification

(e.g., a special letter, a newsletter article, a bulletin from

the parent-teachers’ association, or inclusion in a student

handbook) is the decision of each school or district. In

addition, it is advisable to attempt to notify parents who

have a primary or home language other than English. For

instance, the notification may be translated into different

languages or interpreters may provide the information to

parents when they are registering their child at the school.

B. Providing Access to Individual

Records

FERPA allows parents to inspect and review their own

child’s education record. Exhibit 2–1 includes a Fact Sheet

of FERPA describing the federal requirements in this

aspect. Either of the natural parents, regardless of the

custody assignments, has the rights granted under

FERPA. See exhibit 5–1 for clarifications of this aspect.

Some states have established laws with provisions regarding access of education records. It is also advisable to

check for possible state laws that define “parents.”

An agency or school may choose to promptly honor a

parent’s standing request for access. While prompt

responses are best, agency or school staff should not

omit the procedure of verifying the authenticity of the

request. Hence, it is important that agencies or schools

establish internal management procedures related to

handling requests from parents to review their child’s

record. These procedures should describe clearly all steps

and necessary forms, and designate the official who handles all requests. This will not only avoid confusion among

staff at agency or school offices, but will also facilitate the

response process.

FERPA specifies that the following are not part of an education record and thus are not subject to the parent

access rule of FERPA:

• instructional, supervisory, and administrative information about personnel;

• records maintained by a law enforcement unit;

• records on a student who is 18 or older, or who is

attending an institution of postsecondary education;

and

• records that are maintained by a physician, psychiatrist, or other professional or paraprofessional, and the

records that are made in connection with treatment.

C. Handling a Parent’s Request

It is advisable to establish in a district’s student records

policy procedures for responding to requests to review

individual records. The following could be considered in

the procedures:

• Written request: Parents should be asked to submit a

written request to review their child’s education record

using a request form developed by the district. See

exhibit 5–2 for a sample form. The form should

explain the relevant federal and state laws, describe

the access procedures, and identify the official designated by the agency or school to handle the request.

This form should be made available at school offices,

although requests should be directed to the district

office.

• Referral to central office: Since teachers and other

school-based professionals have the most frequent

contact with parents, these professionals often receive

informal requests for information about a student. If

the scope of these requests is beyond the day-to-day

communication about a student and the information

can be found only in the education record, teachers

should refer requesters to the appropriate school or

district office. This would ensure that all requests are

handled appropriately and uniformly.

• Verification of request: Upon receipt of a written

request, the requester’s identification should be verified as soon as possible. Staff should check the education record and determine if there is no apparent

reason, such as a legally binding document, to believe

the person may not have the rights of access to the

student’s record. Additional procedures may be added

to verify the authenticity of the request. For instance,

staff may call the parents using the telephone number

listed in the school’s records to verify if they have actually made the request.
Since, according to FERPA, an agency or school must

comply with requests to review a record within 45 days

or less from the date of receipt of the request, school officials should make arrangements for access as promptly as

possible. FERPA specifies that a school or district may not

destroy the record for a student if a request for access to

that record is pending. It is also advisable to determine if

state laws require a quicker response (i.e., less than 45

days).

FERPA also indicates that no funds will be made available

under any program to any agency or institution that has

a policy of denying or preventing parents of students

from reviewing the education records of their children. If

any material or document in the education record of a

student includes information on more than one student,

the student’s parents have the right to review records pertaining only to their child.

D. Managing the Review

After verifying the legitimacy of a request, the school or

agency should notify the parent of the time and place to

inspect the record. See the sample notice in exhibit 5–3.

A school or district staff member may be designated for

managing the review. The role of this staff member might

include:

• explaining the laws and regulations that safeguard the

confidentiality of the information;

• verifying the identification of the requester (through

the use of an identification with the bearer’s photograph);

• staying with the parent during the review to make

sure the parent understands the contents of the

record;

• making sure the complete record is returned after the

review;

• answering questions about the policies and procedures regarding the review; and

• referring the parent to the appropriate resources if a

parent has further questions about the contents of the

record.

At the end of the review, the parents may be asked to

sign a form, such as the one in exhibit 5–3, indicating

that they have reviewed the record.

Parents may bring another person (e.g., an interpreter, a

trusted friend, or an attorney) to review the record. The

staff member managing the review should:

• explain the laws and regulations that safeguard the

confidentiality of the education records, and the

penalties to the agency or school of unauthorized disclosure;

• ask the parent to sign and date a consent form, such

as the one in exhibit 5–4, to allow the accompanying

person access to the record; and

• ask the accompanying person to sign an affidavit of

nondisclosure, such as the one in exhibit 5–4.

E. Providing Copies or Charging

a Fee

FERPA does not require agencies or schools to provide

copies of education records unless there are reasons (e.g.,

great distance, illness, disability, or a lack of building

accessibility) that make it impossible for parents or eligible students to inspect the records in person. A school

district may establish in its policy the circumstances under

which copies of education records will be provided.

As established in FERPA, the agency or school may not

charge for search and retrieval of the records. However, it

may charge for copies, copying time, and postage. Fees

for copies of records, including transcripts, should be

established in the school or district policy and publicized

as needed. However, the fee imposed should not serve to

deter parents from reviewing their child’s record. The

agency or school also may allow the parent who is

reviewing the records to make copies of parts of the

records. If so, it is permissible to charge the parent for

photocopying costs.

F. Handling Challenges to

Record Contents

FERPA also provides parents, custodial or noncustodial,

and eligible students the right to request that a school

correct or amend records believed to be inaccurate, misleading, or in violation of a student’s rights. If the school

decides not to amend the record, the parent or eligible

student has the right to place a statement with the record

commenting on the contested information.

59

Section 5: Providing Parents Access to Their Child’s Records
A school district should develop a written description of

the procedures to notify parents and eligible students of

their rights to challenge record contents and guide them

through the process. The parents must identify the part

of the record they want to change, and specify why they

believe it to be inaccurate, misleading, or in violation of

the student’s rights. The parents should make a written

request to amend the record. The school or district may

provide a form for this purpose, such as the one in

exhibit 5–5.

The school or district may decide whether the request is

valid. If the school or district can verify that the contents

in question are in error, the record should be amended as

soon as possible and the parent notified of the changes

in writing. Exhibit 5–6 contains a sample form for this

process.

G. Managing the Hearing

Procedures

A school or district may decide not to make the requested

correction. If so, school officials should notify the parents

of the decision and advise parents of their right to a hearing to challenge the information believed to be inaccurate, misleading, or in violation of the student’s rights.

Exhibit 5–7 contains a sample form for this process. The

parents should be asked to inform the school or district if

they would like to schedule a hearing to challenge the

record.

The school or district should notify the parents, as soon

as feasible but in advance of the date, location, and time

of the hearing. The hearing must be presided over by

someone who is considered a disinterested third party;

this person may be a school or district employee. The parents must be allowed to present evidence relevant to the

issues raised in the original request to amend the record.

The parents may be assisted by other individuals such as

an attorney.

When a decision is made about challenged content, the

school or district needs to document the evidence presented in the hearing and reasons for the decision. The

decision has to be based solely on the evidence presented

in the hearing.

If the decision of the hearing is that the challenged information is not inaccurate, not misleading, or not in violation of the student’s rights, the school or district must

notify the parent. This notification informs the parents

that they have a right to place in the record: 1) a statement commenting on the challenged information, or 2)

a statement setting forth reasons for disagreeing with the

decision that the record will not be changed. This statement will accompany the record when it is transferred to

another entity in the future.

If the decision is that the challenged information is inaccurate, misleading, or in violation of the student’s rights,

the record must be appropriately amended. The school or

district must notify the parent, in writing, that the record

has been amended. If the information is maintained in

portions of the record located in more than one place in

the school or district, then information in all locations

need to be corrected.

COMMONLY ASKED QUESTIONS

Q. Can students review their own records?

A. FERPA permits schools to afford minor students rights

in addition to those given to parents. In addition, once

a student is 18 years old, the rights under FERPA transfer from the parents to the student. If a person is

granted the legal status of an emancipated minor, that

individual has access to his or her own record, but

under FERPA, this does not remove the parents’ rights

unless action is taken by a court to do so. Most states

define an emancipated minor as a minor who has the

power and capacity of an adult. When the student

attends a postsecondary institution, even if he or she

is under 18 years of age, the student may review the

record in the postsecondary institution.

Q. Besides the annual notification of FERPA rights, what

else does a school or district need to do annually?

A. Schools or districts need to tell parents at the beginning of the school year if policies change, and give

parents a chance to opt out of having their student’s

directory information released. See section 6B for a

discussion of releasing directory information. In addition, the Protection of Pupil Rights Amendment

(PPRA) requires that school districts or schools annually

60

Forum Guide to Protecting the Privacy of Student Information
notify parents of their rights under PPRA and of the

school’s policies regarding obtaining consent or allowing parents to opt their child out of participating in

certain school activities (such as a survey containing

information about religion, mental problems, etc.).

Activities requiring notification and provision to opt

out of participation are those involving the collection,

disclosure, or uses of personal information from students to market or sell that information and any nonemergency, invasive physical examination or screening

that is required as a condition of attendance. See section 2C for a detailed discussion of this aspect.

Q. How do I respond speedily to requests for reviewing

student records?

A. If you establish written procedures and provide appropriate forms, you can facilitate the reviewing process

and forestall frustrating delays. See section 5B.

Q. Should I authenticate requests for student information? How far do my responsibilities extend?

A. The agencies or schools releasing information are

responsible for verifying the authenticity of a request.

However, you will need to make a judgment call as to

what precautions are sufficient. You can reduce ambiguity by creating a written policy with verification procedures. See sections 5C and D for suggestions.

Q. Can I discuss the education record of a student in

front of someone the parent has brought along, such

as a language interpreter or friend who sits in when I

let the parent review the record?

A. Yes, you may discuss the record if the parent signs a

consent form. See section 5D.

Q. Do I have to provide copies of an education record

when the parents request to see it?

A. The agency or school may choose to provide copies,

although this is required only when it is not feasible

for the parent to review the record because of distance, illness, disability, or a lack of building accessibility. See section 5E.

61

Q. Must I allow a parent to make a copy of an education

record?

A. No, you do not have to allow a parent to make a copy

unless a failure to do so would prevent the parent

from inspecting and reviewing the records. The

agency or school can charge for the copies. See section 5E.

Q. Do noncustodial parents have access rights to student

records?

A. Parents, custodial and noncustodial, as well as legal

guardians have access to student information unless

the agency or school has evidence of a court order or

state law revoking these rights. Parent rights extend to

surrogate parents of children with disabilities. See

exhibit 5–1 for the pamphlet, “Rights of NonCustodial Parents,” developed by the Family Policy

Compliance Office of the U.S. Department of

Education.

Q. What do I do if a noncustodial parent requests to

amend an education record?

A. You would follow the same procedures as you would

for amending records for custodial parents. See

exhibit 5–1.

Q. Must I give my notes on a student to his or her parent?

A. Notes created by teachers or counselors as memory

aids and not shared with anyone else except a temporary substitute are not considered education records

by FERPA. Once notes are shared with other officials,

they become education records. Teachers may choose

not to give their notes to parents. See section 2 for the

definition of an education record.

Q. What are the access rights of emancipated minors?

A. While FERPA does not specifically speak to emancipated minors, the Family Policy Compliance Office has

ruled in specific cases that an emancipated minor

under state law should be provided access and other

rights under FERPA, but that unless a court rules so,

the parents’ FERPA rights are not revoked.

Section 5: Providing Parents Access to Their Child’s Records
62

Forum Guide to Protecting the Privacy of Student Information

Rights of Noncustodial Parents

in the Family Educational Rights 

and Privacy Act of 19746

The Family Educational Rights and Privacy Act (FERPA) sets out requirements designed to protect the privacy of parents

and students. In brief, the law requires a school district to: 1) provide a parent access to the records that are directly

related to the student; 2) provide a parent an opportunity to seek correction of the record he or she believes to be inaccurate or misleading; and 3) with some exceptions, obtain the written permission of a parent before disclosing information contained in the student’s education record.

The definition of parent is found in the FERPA implementing regulation under 34 CFR 99.3.

“Parent” means a parent of a student and includes a natural parent, a guardian, or an individual acting as a

parent in the absence of a parent or a guardian.

Section 99.4 gives an example of the rights of parents.

An educational agency or institution shall give full rights under the Act to either parent, unless the agency

or institution has been provided with evidence that there is a court order, State statute, or legally binding

document relating to such matters as divorce, separation, or custody, that specifically revokes these rights.

This means that, in the case of divorce or separation, a school district must provide access to both natural parents, custodial and noncustodial, unless there is a legally binding document that specifically removes that parent’s FERPA rights.

In this context, a legally binding document is a court order or other legal paper that prohibits access to the education

record, or removes the parent’s rights to have knowledge about his or her child’s education.

Custody or other residential arrangements for a child do not, by themselves, affect the FERPA rights of the child’s parents. One can best understand the FERPA position on parents’ rights by separating the concept of custody from the

concept of rights that FERPA gives parents. Custody, as a legal concept, establishes where a child will live, and often,

the duties of the person(s) with whom the child lives. FERPA, on the other hand, simply establishes the parents’ right

of access to and control of the education record related to the child.

Here are the answers to questions frequently asked about the rights of noncustodial parents.

1. Does FERPA require a school to keep a parent informed of the child’s progress even though the parent is

divorced and living some distance from the child?

No. FERPA does not require schools to inform parents of student progress whether the parents are divorced or not.

2. Does FERPA require a school to provide a parent copies of the record?

Generally, a school is not required to provide parents copies of the record. However, if the distance is great enough

to make it impractical for a parent to visit the school to review the record, the school must make copies of the record

and send them to the parent when that parent requests access to the record.

3. May a school charge for copies of records?

Yes. A school may charge a reasonable fee for copying.

4. Does the noncustodial parent have the right to be informed of and to attend teacher conferences?

FERPA does not address conferences for the purpose of discussing student performance. Thus, a school has no obligation under this law to arrange a conference to accommodate the noncustodial parent. However, if records of

conferences are maintained, the noncustodial parent has the right to see those records.

Exhibit 5–1

6

The pamphlet was developed by the Family Policy Compliance Office of the U.S. Department of Education.
63

5. Must the school notify the noncustodial parent of his/her FERPA rights?

No. The school would be considered in compliance with the law if it notifies only the parent who has custody of the

child.

6. Must the school provide the noncustodial parent the same general notices it provides the custodial parent?

No. General notices, lunch menus, PTA information, announcement of teacher conferences, school pictures, and other

similar information are not “education records” as defined by FERPA. Therefore, schools are not legally required to

provide them.

7. Is the school required to honor a parent’s “standing request” for access or copies?

No. FERPA does not require a school to honor a standing request, but the school may do so if it wishes. If parents

wish to obtain information from their child’s record on a regular basis, they should submit requests periodically. The

school must respond to each request within 45 days.

8. How can a noncustodial parent get access to records?

Any parent may ask the school for the opportunity to review the record, either by going to where the records are

kept or by requesting copies. The school may ask the parent for some identification.

9. Can the parent with custody prevent the noncustodial parent from exercising his or her FERPA rights?

No. FERPA rights are given to both parents. The school may assume that a parent has these rights unless it has evidence to the contrary. The school does not need the permission of the custodial parent to give access to the noncustodial parent.

Section 5: Providing Parents Access to Their Child’s Records
Sample Request 

to Review an Education Record

Date:_______________________________

To: [Name of Designated Official]

From: [Name of Parent]

[Address and Phone Number]

Under the provisions of the Family Educational Rights and Privacy Act and [insert applicable state/local laws and regulations], I wish to inspect the following education record:

____________________________________________________________________________________________________

____________________________________________________________________________________________________

____________________________________________________________________________________________________

of [Name of Student]:____________________________________

School at Which Student Is Enrolled:________________________________

Requester(s)’ Relationship to Student:_______________________________

I do __/do not ___ desire a copy of such records. I understand that a reasonable fee will be charged for the copies.

[Insert fee schedule if available]

Signature:______________________________________

For Official Use Only

Date Received:_______________

Date Request Verified:___________________ Verified by:______________

Approved: ___ Disapproved: ____ Reason(s) for disapproval:________________________________________

Signature of Official Approving/Disapproving Request:______________________________________________

Date:___________ Date Notification Sent:___________________________

64

Forum Guide to Protecting the Privacy of Student Information

Exhibit 5–2
65

Sample Notification 

to Review an Education Record

Date: _________________

To: [Name of Parent(s)]

From: [Name of Designated Official]

Your request for review of your/your child’s record was received on [insert date]. The request was approved.

______ The record will be available at the following office for review on [insert date]:

[Name and address of office, including room number and contact person]

______ As you requested, copies of the record will be mailed to you upon receipt of the copying fee:_______

Please forward your check, made payable to [appropriate agency], to [address of agency].

Please contact [insert name] of [insert office] at [insert telephone number] should you have questions regarding this

notice.

Signature of Designated Official:__________________________________________

For Use on Date of Review:

______ I have reviewed and/or have been informed of the contents of the requested education record on [insert date]

and am satisfied with its accuracy and completeness.

______ I have reviewed and/or have been informed of the contents of the requested education record on [insert date].

I am aware that I have the right to request an amendment of all or part of the record if I am not satisfied with

its accuracy and completeness. I also have received a request form for this purpose.

Signature of Parent(s):___________________________________________________

Signature of Staff Managing the Review:___________________________________

For Use in Copying/Mailing of Record:

Date Fee Received:_________ Amount Received:_________

Check No:________________ Staff Initials:______________

Date Copies Mailed:________ Staff Initials:______________

Exhibit 5–3

Section 5: Providing Parents Access to Their Child’s Records
66

Forum Guide to Protecting the Privacy of Student Information

Exhibit 5–4

Sample Consent Form

to Allow Accompanying Person to Review Record

(For Use by Parent or Eligible Student to Grant Consent)

I hereby grant permission for [name of person] ___________________________ to accompany me today during my

review of my/my child’s education records. I understand that in doing so, the information maintained in the education

records, otherwise protected by the Family Educational Rights and Privacy Act (FERPA) [and state laws, if applicable],

may be disclosed with my consent to the above individual.

Signature:____________________________________

Name:_______________________________________

Date:________________________________________

For Use by Accompanying Person as Affidavit of Nondisclosure

In accompanying the above-signed parent/guardian on this date during his/her review of the education records of:

___________________________________, I will be given access to confidential information maintained in the records

of the named student. I understand that this information is protected under FERPA [and state laws, where applicable].

I hereby acknowledge that I fully understand that the intentional release by me of this information to any unauthorized

person could subject me to [penalties, where applicable] imposed by FERPA [and state laws].

Signature:____________________________________

Name:_______________________________________

Date:________________________________________

For Official Use Only

Staff Initials:__________________________________Date:_______________________________________
67

Sample Request 

to Amend an Education Record

To: [Name of Designated Official]

From: [Name of Parent(s)]

I have reviewed my child’s education record and believe it contains information that is inaccurate, misleading, or in violation of my child’s rights. Please amend the record as follows:

Current Record: To be Changed to:

____________________________________________ ____________________________________________

____________________________________________ ____________________________________________

____________________________________________ ____________________________________________

____________________________________________ ____________________________________________

____________________________________________ ____________________________________________

Signature:___________________________________

Address:_____________________________________________________________________________________

For Official Use Only

Date of Hearing Scheduled:____________________ Location:__________________________________

Date of Notification Sent:______________________

Signature of Official Approving/Denying Request:__________________________________

Exhibit 5–5

Section 5: Providing Parents Access to Their Child’s Records
68

Forum Guide to Protecting the Privacy of Student Information

Sample Notification

for Approval/Disapproval

of Request for Amendment

Date: ______________________

From: [Name of Designated Official]

To: [Name of Parent(s)]

Your request for amendment of the education record of your child, ________________________, was received and

reviewed.

______ The request was approved and necessary changes were made to the specified record as requested.

______ The request was denied because _________________________________________________.

However, you are entitled to a hearing concerning your request. If you decide to request a hearing, please

notify the following office within [number of days as specified by state or local policies].

[Name of Contact Person]

[Address and Telephone Number]

Signature:__________________________________

Exhibit 5–6
69

Exhibit 5–7

Sample Notification

for a Hearing of Request for Amendment

To: [Name of Parent(s)]

From: [Name of Designated Official]

Date: [Date]

We have received your request to schedule a hearing for the purpose of challenging the contents of the education

records of your child, [name of student]. A hearing is hereby scheduled as follows:

______ The hearing is scheduled at:

[Date]

[Time]

[Location/Office]

[Address]

If you cannot be present on the above date, please contact my office as soon as possible to establish a mutually convenient date.

______ The hearing is rescheduled at:

[Date]

[Time]

[Location/Office]

[Address]

You shall have a full and fair opportunity to present evidence relevant to the issues you have raised regarding your child’s

education records. You also may be assisted or represented by individuals of your choice, including an attorney. The

decision will be based exclusively on the evidence presented at the hearing.

Please do not hesitate to contact me if you have any questions.

__________________________________

[Signature]

[Name, Title]

[Office]

[Address]

[Phone Number]

Section 5: Providing Parents Access to Their Child’s Records

71

OVERVIEW 

Managers of education records at the state, local, or

school level receive numerous requests for information. Requests could come from the news media,

businesses, relatives, agency staff, law enforcement

units, attorneys, private investigators, the governor’s or legislators’ offices, or researchers.

This section supplements section 2 of this document, which discusses the federal laws that govern

the release of education records. Many states have

laws or statutes that further restrict the release of

these records. School, district, or state education

agency staff should contact their agencies’ legal

counsel or counsel assigned to their agency by the

state attorney general’s office for legal opinions

about confidentiality requirements and recommended procedures. This section outlines some

general guidelines for deciding whether to release

information.

GOALS 

✓ Distinguish between different types of information and discuss the release procedures of each

of them

✓ Recommend ways to safeguard information

that is released outside of the agency

✓ Discuss the benefits and risks of sharing information with other agencies and suggest ways

to ensure the privacy of individual records during the process

✓ Discuss electronic options of transferring data in

a secure way

KEY POINTS 

• Personally identifiable data are those that contain information that would make the student’s

identity easily recognized. Release of this type of

data is subject to established policy in the school

district, as well as state and federal laws.

• State and local laws may specify what types of

information are considered directory information, which may be released without prior consent. However, parents must be informed of

what is considered directory information and

given the opportunity to withhold its release.

• Nondirectory information can be released with

written consent from the parent. The consent

should specify the information that may be

released, the purpose of the release, and the

recipient.

• Examples of those to whom information from

education records may be released without

seeking consent from parents include authorized representatives from state and local education agencies, and health or safety personnel in

case of an emergency.

• Requests from researchers should be handled

on a case-by-case basis. Schools or districts

should establish a set of criteria, application procedures, and written guidelines for making the

decision.

• Many agencies are developing strategies that

establish the kinds of privacy standards and

procedures that would ensure the confidentiality of information while allowing restricted use

of information for specific and pre-approved

purposes.

SECTION 6

Releasing Information 

Outside an Agency
72

Forum Guide to Protecting the Privacy of Student Information

• Interagency sharing of information from students’ education records generally requires a signed consent by

parents or eligible students, regardless of whether the

records originate in schools, health centers, or employment or social service agencies.

• As a final security control, a designated official should

review the compiled data and verify that local procedures have been followed before approving the

release.

• Recipients should be required to sign an affidavit that

they will not release any personally identifiable information received.

• It is important to document data release whether or

not prior consent was required. This information

should remain in the record as long as the record is

maintained.

• Agencies should establish policies to cover instances in

which information may be released through electronic

means. A variety of methods can be used to safeguard

the data, including encryption and passwords, and

careful logging of a transfer.

A. Types of Information Release

A1. Releasing nonpersonally identifiable

information

When a district or school staff member receives an information request, the first question he or she needs to consider is what type of information is being requested.

Generally, an information request about one or more

individuals can be categorized as nonpersonally identifiable information or personally identifiable information.

Nonpersonally identifiable data do not reveal specific

information about a particular individual. They usually

describe a group of persons (e.g., the aggregate number

of students participating in extracurricular activities) without identifying any one student. Or they consist of individual records stripped of any information that would

make it possible to identify the person described.

Release of nonpersonally identifiable data is generally

allowed. A district or school may determine how this type

of information is released. It is advisable to designate

appropriate officials within the agency to review the compiled data, making sure that no single individual can be

identified by a combination of several pieces of nonpersonally identifiable information.

For example, the release of school-level enrollment

counts does not constitute releasing of personally identifiable information. However, enrollments by race or other

demographic categories against various performance

measures are clearly subject to cell suppression, if the cell

size is low. Small cell sizes allow an audience to discern

personally identifiable information about an individual. It

is good practice for state and local education agencies to

develop cell suppression guidelines regarding the release

of aggregate data, in order to avoid the inadvertent violation of the confidentiality rights of students.

In planning and producing analyses and tabulations, the

general rule is that there should be no cell (or category)

published in which there are fewer than three respondents, or in which personal information could be

obtained by subtraction or other simple mathematical

manipulations. However, this should be adjusted based

on the factors unique to the district or school, such as the

size of the school or community population. It is important not to allow information to be disclosed through

subsequent cross-tabulation of the same data with other

variables.

An associated issue is whether or not a statistic is based

upon a sufficient number of observations to be reliable as

a measure of what it is intended to measure. Even if individual identities are adequately masked, the value of a

cell may need to be suppressed because the value fails to

meet reasonable criteria for reliability. In a paper entitled

“Why a Small n Is Surrounded by Confidentiality:

Ensuring Confidentiality and Reliability in Microdatabases

and Summary Tables,” Ligon, Clements, and Paredes

(2000) suggest useful solutions for protecting an individual’s confidential information and describe the conditions

under which statistics should be suppressed because the

contents are based upon too few individuals to be reliable. The paper also includes a checklist to ensure the

confidentiality of individuals when releasing statistics.

A2. Releasing personally identifiable

information

Personally identifiable data may or may not identify a person directly, but may contain information that would

make a student’s identity easily recognized. This information is more sensitive than grouped information or sum-
information, as well as federal regulations that relate to

the release of this information.

Agency or school staff should refer to federal, state, and

local laws and regulations about the types of data that

may be released without consent of the parents. Besides

those specified in FERPA, the U.S. Congress recently

passed a provision in the No Child Left Behind (NCLB) Act

that allows the disclosure of directory-type information

(students’ names, addresses, and telephone listings) to

military recruiters. State and local laws may specify data

items considered directory information. Section 2B

includes the types of items that are typically considered

directory information by local policies.

As required by FERPA, annual notification should be given

to allow parents to request that all or portions of directory information not be released. Exhibit 6–1 contains a

sample notification form. Upon receipt of an information

request, district or school staff need to verify that there is

an appropriate prior consent to release that piece of

information about the student(s).

C. Release With Prior Consent

When individual information not authorized by FERPA or

other federal laws such as the National School Lunch Act

(NSLA) is requested by a third party (e.g., a relative, family lawyer, or news reporter), the requester should be

required to present written consent from the parent. If

information requested from the record is not considered

directory information but is personally identifiable, it can

be released if the parent provides a written, signed, and

dated consent document. The document must:

• specify the information that may be released;

• state the purpose of the release; and

• identify the individuals or entities to whom the release

may be made.

Staff members processing the request need to authenticate the request. The parent could be contacted for verification if there is any question or doubt about its

authenticity.

Unless otherwise allowed by federal or state law, or local

policies, agency or school staff should not assume that if

parents openly discuss information included in their

marized data and therefore requires more attention and

care before release. Personally identifiable information,

including the identifying data listed below, must be maintained in education records that are protected with

appropriate security. It is important that state or local

education agencies establish policies that define personally identifiable information and list specific examples.

This will avoid confusion when actual information

requests are handled.

Personally identifiable data often are unique to an individual, alone or in combination with other data, such as:

• a person’s name;

• the names of the student’s parents or other family

members;

• the address of the student’s parents or other family

members;

• the telephone number of a person;

• a photograph of a person;

• an identifier, such as a person’s social security number

or an identification number assigned by the school;

• a list of characteristics (e.g., apparent disability, birthmark, race or ethnicity) that would make the person’s

identity easily traceable; and

• other information that would make the person’s identity easily traceable.

Some types of identifying data may be defined as part of

the directory information in a district’s education records

policy. Staff should check with the policy for the proper

release of this type of information. Section 6B discusses

directory information and its proper release.

B. Release of Directory

Information

If information requests are related to personally identifiable student information to be obtained from the education records, the first question a school official should ask

is whether the request is for directory information as

defined in the district’s education records policies. The

release of directory information is governed by specific

disclosure rules under FERPA that are different from education records in general. Section 2 of this document contains definitions of education records and directory

73

Section 6: Releasing Information Outside an Agency
child’s education records, the parents are giving

“implied” consent for staff to release that information.

Written consent for agency or school release from the

parent is required by FERPA.

D. Release Without Prior

Consent

In some circumstances, without prior written consent

from the parent, personally identifiable information may

be released to particular individuals or entities outside the

agency or school. Such release must be allowed by an

established policy. Agency or school staff should be familiar with federal and state laws as well as local policies

established in this regard. They should also understand

that they are not required to release information unless

otherwise specified by these laws or policies, but are given

the option to do so. Section 2 lists these outside individuals or entities to whom student records may be released.

Examples of these individuals include designated, authorized representatives from state and local education agencies, and health or safety personnel in case of an

emergency. Exhibit 6–2 includes a form that an agency or

school could use to monitor this type of release.

Within the agency or school, education records may be

released and used by personnel who are considered to

have a legitimate educational interest or need-to-know

without prior written consent of the parent. Section 4

contains guidelines regarding this type of release.

Examples of personnel who may have authorized access

to the student records include research and evaluation

directors and service providers or coordinators of special

programs in which the students participate.

The NSLA allows the release of free- and reduced-price

school meal eligibility without the consent of the parent

for certain purposes. (See section 2.) Agencies or schools

should establish written guidelines to permit such release.

E. Release to Researchers

In some cases, researchers who are not employed by the

agency or school may be authorized to conduct data processing or research and evaluation studies through contractual arrangements. If these efforts are initiated by and

performed on behalf of the agency or school, researchers

may be considered school officials who have a legitimate

educational interest. These situations were discussed in

section 4. However, researchers outside the agency or

school often request individual information (which may

or may not be personally identifiable) for their own

research agendas. More often than not, the requested

information includes more than one data item from the

education records or student database. These requests

should be handled on a case-by-case basis. The written

agency or school policy should include criteria for considering such requests, such as:

• perceived benefits of the research;

• potential invasion of students’ privacy;

• reputation of the requester; or

• availability of staff to monitor the process of the

release and the research activities.

The NCES Statistical Standards, last updated by the

National Center for Education Statistics (NCES) in

September 2002, includes a section on maintaining confidentiality during data processing. This section includes

the standards and procedures to which NCES staff and

contractors must adhere in order to protect the confidentiality of personally identifiable information. State and district officials may consider these standards in developing

their own procedures and requirements. Exhibit 6–3

includes these standards.

In general, the release of data to researchers outside the

agency should be considered as a loan of data (i.e., recipients do not have ownership of the data). Agencies or

schools could request that these data be returned or

copies destroyed when the researchers complete their

work.

Before considering these data requests, agencies should

establish written guidelines and procedures to allow the

on-site access or off-site loan of personally identifiable

data by appropriate individuals or organizations. Last

updated in 2000, NCES published a manual called

Restricted-Use Data Procedures Manual to ensure the

implementation of proper procedures before releasing

any of its data sets. The following items, adapted from

this manual, could be included in an agency’s policies and

procedures regarding the loan of data:

• description of all federal and state laws and regulations governing access to the data and penalties for

violation;

• procedures to request access to or loan of data and

name of the official designated to handle the request;

74

Forum Guide to Protecting the Privacy of Student Information
• criteria for accepting or denying requests;

• minimum expected security requirements;

• allowance for unannounced, unscheduled inspections

of the data user’s site;

• agency review of publications to verify that disclosure

procedures have been followed; and

• other relevant requirements.

Organizations that intend to obtain access to personally

identifiable data could be required to submit a formal

written application on the organization’s letterhead that

would include:

• the type of data (with specific items listed) requested;

• reasons for requesting the data;

• a description of how the data will be used and analyzed;

• a description of how analyses will be presented and

reported;

• names and titles of: 1) the official(s) with the authority to bind the requesting organization to the agreement, 2) the official(s) in charge of the day-to-day

operations involving the use of the data, and 3) the

professional and support staff who conduct the

research and analysis, as well as those who may have

access to the data;

• the estimated amount of time the data are needed;

and

• the desired medium of release (e.g., paper or media

format).

In addition, the organizations requesting access or loan of

data should submit a security plan addressing all applicable security procedures. Those procedures may include:

• Computer security—use and update passwords; implement logon procedures with automatic security data

access shut-down function; assign access security levels; integrate warning statements; prevent external

access to any modems connected to the system while

processing data on a computer; and use additional

procedures to safeguard the data in networked environments. If a one-time complete backup copy of the

data will be needed, the applicant should also explain

the security procedures surrounding the backup copy

of the data, including those backup copies that are created automatically while downloading. NCES goes so

far as to generally exclude networked environments

when licensing external users. Refer to Weaving a

75

Secure Web Around Education: A Guide to Technology

Standards and Security (National Forum on Education

Statistics 2003) for recommendations in this area.

• Physical handling and storage of data—catalogue and

storage with lock and key; minimal allowance and

secured storage of printed copies; and additional

restrictions on copying of data.

• Transportation of data—ideally by a bonded courier

and notice of confidentiality and restricted use, or in

the case of electronic data transfer, proper built-in

security safeguards.

Agencies must proceed with caution before releasing

portions of databases containing individual education

records since these can include personally identifiable

information. Under most cases, the release of database

information with personally identifiable information is

limited by law. In these cases, if a request for individual

records is approved, agency or school staff should extract

only the data approved for release.

Before a data set is released across agencies or to

researchers or research institutions, appropriate agreements must be signed to clearly state that, in the 

minimum:

• all records will remain private;

• conditions of release and re-release are well defined

and limited; and

• penalties for inappropriate records use or release of

records are in place.

Individuals employed by the agencies who are authorized

and who will have access to the individually identifiable

information also could be required to sign an affidavit of

nondisclosure. Exhibit 6–4 contains a sample form.

In most cases, information indicating that an education

record has been released must be documented in the

record and retained there until the education record is

destroyed.

F. Release to Other Service

Agencies

There are increasing needs for education and other service agencies to develop coordinated data systems that

enable them to more effectively and efficiently serve children and their families. Many agencies, such as education, health, social service, and labor agencies, are

Section 6: Releasing Information Outside an Agency
obtaining the consent of participating individuals or

verifying that such consents are unnecessary, because

no confidential or personally identifiable information is

issued at the individual case level.

Education agencies are finding new ways to support services integration for students while they meet their legal

and ethical obligations to restrict the release of information from student records. One way this occurs is for agencies to guide data sharing with well-defined policies for

gaining consent to use records across agencies at the time

that records are initially established. In general, information about students can be released only with the signed

consent of parents or eligible students who have been

told, in language they understand, what information is to

be used across agencies, why, and how that sharing will

occur. The following are strategies for protecting the confidentiality of information used across agencies:

• Obtain legal advice to guide the process—The

legal offices of the agencies can assist with the study

of applicable federal and state laws, as well as establish a memorandum of understanding or an interagency agreement to confirm what data will be

exchanged and how it will be used. They can also help

ensure that agencies maintain records of what information has been shared and the authorization for

sharing it. A thorough knowledge of the rationale

behind federal, state, and local privacy laws, and an

understanding of what the laws allow and disallow,

are the building blocks of widely sought interagency

data coordination.

• Obtain prior written consent from parents or eligible students—Agencies that collaborate for in-take

procedures, direct service, or research should explicitly

spell out procedures for obtaining written consent and

define in advance what data will be shared, how they

are used, and the means of ensuring privacy if they are

released from the originating agency.

• Establish well-defined procedures—These procedures ensure that all parties involved who work with

student records understand confidentiality restrictions

and procedures for handling private, personally identifiable information. These also include adequate training on legal requirements and ethical standards, the

appropriate use of the information, and the strategy

to safeguard the security of the data.

• Implement privacy safeguards—When research

studies are to be conducted, information from several

agencies can be analyzed within the education

76

Forum Guide to Protecting the Privacy of Student Information

seeking means to facilitate the automatic accessibility of

information from student records. Cross-agency partnerships have been developed for streamlining services.

Although they are limited by some practical, political,

technical, and regulatory barriers, service providers and

policy analysts agree that benefits and efficiencies can be

gained from sharing data for at least these three welldefined purposes:

• Providing children with supportive services—

Counselors and health services providers may need

information about an individual’s social, educational,

and health status to diagnose a problem, and develop

and implement a treatment plan. Records kept in

schools (e.g., attendance information, family background, and reports of academic and behavioral

achievements or problems) can contribute critical

information for case planning and management.

Some information may help law enforcement officials

locate youth involved in the juvenile justice system

who may need assistance or who may be a danger to

themselves or those around them.

• Increasing access to social and educational services—Sometimes agencies need to seek out or verify

eligible program participants. Often there are children

in schools whose families may not realize they are eligible for certain assistance (e.g., free or reduced-price

lunch, health services, or welfare services) that is available through school or community agencies. Records

of several service agencies may need to be crosschecked to increase the efficiency of deciding what

services are available and to ensure those services

reach the individuals who need them.

• Conducting policy planning and evaluation studies—Student records that are part of an education

agency’s administrative structure can inform statistical

studies for improving management of services and

evaluating outcomes. A start toward using integrated

electronic records systems for management and outcomes evaluation is occurring in several states. In each

instance, the state’s legislature has encouraged the

development of integrated data systems to strengthen,

evaluate, or manage integrated public services or to

improve access to evaluation and planning information

to support workforce development programs. Such

systems emerge typically following an investment in

consensus-building procedures that include members

of all contributing agencies in planning. No exchange

of information occurs until appropriate memoranda of

agreement are in place, along with procedures for
77

agency, following adequate privacy safeguards, so

that no identifiable information is available to individual researchers or analysts. Data are matched electronically so that personally identifiable information from

several data sources is connected within the computer

and not actually seen. In these cases, personal information is only used to produce aggregate results for

groups and programs.

G. Review Prior to Release

As a final control, an appropriate official could review the

compiled information or data for accuracy and to ensure

that they are within the scope approved for release. This

official also may review the procedures to ensure compliance with all federal, state, and local statutes, rules, and

regulations that apply to the release. Signatures of the

appropriate and authorized persons should be required

for every release.

H. Avoid Misuse of Information

by Nonintended or Secondary

Users

Any organization creating, maintaining, using, or disseminating education records with personally identifiable

data must assess the reliability of the information for its

intended use and must take precautions to prevent misuse of data. When data are released to individuals or

groups outside the agency, the recipients should be

required to sign an affidavit stating that they will use the

data in a way consistent with that described in their

requests, and not to transfer or re-release the data to

another individual or organization. Exhibit 6–5 contains a

sample statement. Although school officials are not liable

for a third party’s misuses of data, it is important to implement and follow proper procedures in good faith to protect the students and their families, as well as the agency

or school.

I. Document the Release

Agencies or schools should maintain records of access,

retrieval, or release of records, including the names of persons retrieving records and the purposes for each release,

and a list of personnel authorized to have access to the

file. They should also maintain a record of user requests

for data that have been denied or only partially fulfilled.

Such information can be used for periodic reviews of

agency confidentiality and data release policies.

Information about releases with or without prior consent

of the parent should remain with the education record as

long as the record is maintained. It is a good practice to

document all access and release. However, documentation

is not required if the request was made by or release was

made to the most common users:

• the parent or eligible student;

• a school official who has been determined to have a

legitimate educational interest;

• a requester with written consent from the parent or

student; or

• a requester seeking directory information only.

J. Ensure the Security of Data in

Electronic Transmission

Particular attention should be given to confidentiality

when data are released through electronic means

because of the increased potential for unauthorized

access. For example, school staff cannot visually check

the photo identification of a facsimile or electronic mail

recipient. It is recommended that policies and procedures

be established to address the issue of data forwarding via

electronic means.

School officials should routinely embed various levels of

encrypted codes into computerized databases. This will

protect the confidentiality of the data, as well as ensure

the integrity and authenticity of the information. Clear

rules and procedures about who can send and who can

receive and use data should be established, as should the

penalties for abuse or misuse of systems. The transmission of data from one agency to another creates additional security risks that can be minimized through the

use of standardized protocols, various encryption technologies, and digital signatures. Refer to Weaving a

Secure Web Around Education: A Guide to Technology

Standards and Security (National Forum on Education

Statistics 2003) for a detailed discussion and technical

specifications of these methods.

It is important for the electronic system to log the transfer of personally identifiable data in a security audit trail

to account for releases of data by and to appropriate individuals. The use of electronic authentication programs

Section 6: Releasing Information Outside an Agency
Q. What penalties apply to the misuse or improper disclosure of confidential information?

A. The penalty for noncompliance with the Family

Educational Rights and Privacy Act (FERPA) and

Protection of Pupil Rights Amendment (PPRA) can be

withdrawal of U.S. Department of Education funds

from the institution or agency that has violated the

law. This applies to schools, school districts, and state

education agencies. The Family Policy Compliance

Office of the U.S. Department of Education, charged

with reviewing and investigating complaints, seeks to

promote voluntary compliance with the law. A third

party who improperly discloses personally identifiable

information from student records can be prohibited

from receiving access to records at the education

agency or institution for at least 5 years. State laws on

privacy may also apply penalties.

Q. What are the liabilities or penalties if an education

agency or institution violates FERPA?

A. An education agency or institution subject to FERPA

may not have a policy or practice of disclosing education records, or nondirectory, personally identifiable

information from education records, without the written consent of the parent or eligible student, except as

allowed by law. If a complaint is received by the

Department of Education alleging a violation of

FERPA, the FPCO investigates the complaint to determine if a violation of FERPA occurred. If a school is

found to be out of compliance with FERPA, the FPCO

works to bring the school into voluntary compliance

with the law. If voluntary compliance is not achieved,

then a school would be in jeopardy of losing federal

education dollars. There is no private cause of action

(right to sue) under FERPA and, in 2002, the U.S.

Supreme Court ruled in Gonzaga University v. John

Doe that students and parents may not sue for damages under 42 USC § 1983 to enforce provisions of

FERPA.

Q. What are the consequences of a third party’s misuse

of education records?

A. School officials must inform third parties receiving

information, as allowed under FERPA, of the requirements concerning redisclosure of information. If a

third party is found to have improperly redisclosed

personally identifiable information from education

records, the school may not allow that third party

access to information for at least 5 years.

can reassure the sending agency or school that the information has reached the appropriate recipient and that no

changes to the contents have been made.

COMMONLY ASKED QUESTIONS

Q. Who (other than parents) must a school official allow

to see an education record of a student?

A. School officials are not required to allow anyone other

than the parents to see the education records of a student; the exceptions allowing the release are circumstances stipulated by federal or state laws, such as

government-required audits, evaluations, or court

orders. See section 6D; also see a detailed discussion

of the federal statutes in section 2B.

Q. Which public officials have access to education records

without consent of a parent?

A. School officials with a “legitimate educational

interest” in the information have access to education

records without specific consent of parents or eligible

students. Policies defining officials who may receive

information without prior consent must be accessible

to parents for review. FERPA also permits other disclosures of information from education records without

consent, usually for educational purposes. For examples, schools may disclose information on students to

state or local educational authorities for audit or evaluation of federal or state supported education programs, or for the enforcement of federal legal

requirements relating to those programs (such as

IDEA). This condition for disclosure without consent

does not generally extend to other state agencies.

Q. If a parent makes information about a student public,

must school officials keep that piece of information

confidential?

A. Yes, school officials should not respond to information

made public by a parent, such as to the media, without consent from the parent. See section 6C.

Q. Must a school official release a student’s record to a

family lawyer?

A. A school official does not have to release a record of

a student to his or her family lawyer, but may do so

upon receipt of a prior written consent from the parent, unless the school is assured that the attorney is

asking on behalf of the parent. See section 6D.

78

Forum Guide to Protecting the Privacy of Student Information
79

Q. Can student records be transmitted electronically, via

the Internet or facsimile?

A. The law requires agencies to prevent the unauthorized

release of personally identifiable information from

education records. Thus, when student records are

transmitted electronically, confidentiality must be protected both by the sender and receiver of information.

Agencies must establish procedures for releasing

information, and they must continually train officials

and clerical staff about their obligation to treat personally identifiable information confidentially.

Various experts in the application of FERPA and the

uses of electronic data exchange consider facsimile

machines to be less secure than the electronic transmission of records. If facsimile machines are to be

used, the institutions involved with the exchange of

student information must establish security procedures that meet the privacy obligations set out in

FERPA. See section 6I.

Section 6: Releasing Information Outside an Agency
80

Forum Guide to Protecting the Privacy of Student Information

Sample Request

to Withhold Release of Directory Information7

To: All Parents School Year:_____________

The items listed below are designated as “directory information” of [name of agency or school] and may be released

for any purpose at the discretion of [name of agency or school]. [Cite state laws and regulations or local policies, where

applicable.] Under the provisions of the Family Educational Rights and Privacy Act of 1974, as amended, you have the

right to withhold the release of any or all of the information listed below.

[Listed below are examples of directory information]

Name of student

Address of student

Telephone number of student

Electronic mail address

Photograph

Date and place of birth

Dates of attendance

Grade level

Participation in officially recognized activities and sports

Weight and height of members of athletic teams

Awards received

Please consider very carefully your decision to withhold any item of “directory information.” Should you decide to

inform [name of agency or school] not to release any or all of the items listed above, any future requests for such information from individuals or entities not affiliated with the [name of agency or school] will be refused. Please indicate

here your request to withhold any or all of the above items:

___________________________________________

If this form is not received in [name of office] prior to [date], it will be assumed that the above information may be

released for the remainder of the current school year. A new form for nonrelease must be completed each [term/semester/year].

Parent’s Name:______________________________ Student’s Name:______________________________

Signature:__________________________________ Date:_______________________________________

Exhibit 6–1

7

Adopted and modified from Association of Collegiate Registrars and Admission Officers, Guidelines for Postsecondary Institutions for

Implementation of the Family Educational Rights and Privacy Act of 1974 as Amended, Revised Edition, 1995.
81

Sample Request

of Nonparent for Access to Education Record

To: [Name of designated official]

From: ______________________________

[Name, title, organization]

I hereby request permission to examine the following part(s):___________________________________________

_______________________________________________________________________________________________

of the official education records of:_________________________________[name of student(s)] at:

_____________________[name of agency or school]. I certify that I am (check one as appropriate):

______ An authorized official of another school system in which the student intends to enroll.

______ An authorized representative of the Comptroller General of the United States.

______ An authorized official of the financial institution to which the student applied to receive financial aid. The purpose of this request is to determine eligibility, amount of aid, conditions of aid award, and enforcement of

award terms and conditions.

______ An authorized official of an accrediting organization. I understand that release is allowed on the conditions

that only appropriate members of my organization view the records and that resulting studies do not identify

any particular student.

______ An authorized representative of the Secretary of the U.S. Department of Education.

[Add other categories as allowed in state or local laws and regulations.]

I agree that no unauthorized person or organization will have access to any records or information obtained through

this request without the written permission of the parents of the student or the student. I understand the maximum

penalties for redisclosure of the record will be [as set forth by federal and state laws and regulations].

Signature:____________________________________ Date:_______________________________________

For Official Use Only:

Request approved/denied by:______________________________________________

Exhibit 6–2

Section 6: Releasing Information Outside an Agency
82

Forum Guide to Protecting the Privacy of Student Information

NCES Statistical Standards

on Maintaining Confidentiality

(National Center for Education Statistics 2002)

1. Staff and contractors must pledge not to release any individually identifiable data, for any purpose, to any person

not sworn to the preservation of confidentiality.

2. All contractors whose activities might involve contact with individually identifiable information must provide NCES

Project Officers with a list of all staff who might have contact with such data; all such staff must have a signed

notarized affidavit of nondisclosure on file at NCES. These affidavits and the staff list must be kept current as staff

members leave and as new staff members are assigned to NCES projects with individually identifiable information.

3. All contractor staff with access to individually identifiable information must only use that information for purposes

associated with the data collection and analysis specified in the contract.

4. Respondents must be told in a cover letter or in instructions that “All responses that relate to or describe identifiable characteristics of individuals may be used only for statistical purposes and may not be disclosed, or used, in

identifiable form for any other purposes, unless otherwise compelled by law.”

5. All materials having individually identifiable data must be kept secure at all times through the use of passwords,

physical separation of individual identity from the rest of the data, and secure data handling and storage.

6. When confidentiality edits (that are performed using perturbation techniques) are used for a data file, they must

be applied to all statistical files derived from that data file.

7. NCES distributes Data Analysis Systems (DAS) that produce tabular estimates from restricted-use files. In this case,

the following conditions must be met:

a. NCES may not release the exact sample size for restricted-use data files that are distributed through a DAS.

b. Only restricted-use data files with Disclosure Review Board (DRB)-approved confidentiality edits may be used to

produce a DAS.

c. A DAS may not publish unweighted edits.

The confidentiality protection required in a DAS is a function of the type of estimate(s) to be produced. For example, a DAS that produces cell counts may require the use of more extensive confidentiality edits.

If a public-use file is released or planned for a data file, any DAS created for that data file must be based on public-use data or restricted-use data that have undergone perturbation disclosure limitation techniques as part of confidentiality edits.

8. For public-use data files, NCES minimizes the possibility of a user matching outliers or unique cases on the file with

external (or auxiliary) data sources. Because public-use files allow direct access to individual records, perturbation

and coarsening disclosure limitation techniques may both be required. The perturbation disclosure limitation techniques by definition include the techniques applied in a confidentiality edit (if one is performed) and may include

additional perturbation disclosure limitation techniques as well.

All public files (i.e., the edited restricted-use files) that contain any potentially individually identifiable information

must undergo a disclosure risk analysis in preparation for release to the public. The steps are as follows:

a. At an early state in designing and conducting this analysis, staff must consult the DRB for guidance on disclosure risk analysis and on the use of NCES disclosure risk software. Any modifications that are necessary as a

result of the analysis must be made, and the entire process must be documented.

b. The documentation of the disclosure risk analysis must be submitted to the DRB. The documentation must

include descriptions of the risk of disclosure of individually identifiable information, age of the data, accessibility of external files, detail and specificity of the data, and reliability and completeness of any external files. The

documentation should also include the results demonstrating the disclosure risk after adjustments to the data.

Exhibit 6–3
83

c. The DRB will review the disclosure risk analysis report and make a recommendation to the Commissioner of

NCES about the file release.

d. The Commissioner then rules on the release of the data file.

9. Inasmuch as confidentiality edits are intended to protect individually identifiable data, files that incorporate the

results of the DRB-approved confidentiality edit plan may be used to produce tables without confidentiality concerns over minimum cell sizes. When this is done:

a. All versions of a data file must reflect the same confidentiality edits. Staff must consult the DRB on the confidentiality plan, data file dissemination plan (restricted, public use, and/or DAS), and disclosure risk analysis plan,

concurrently.

b. Documentation of the confidentiality edit must be included, along with the documentation of the disclosure

risk analysis that is submitted to the DRB.

10. A survey program may decide not to apply confidentiality edits to a restricted-use file. In this situation, when tabulations are produced, any table with a cell with 1 or 2 unweighted cases must be recategorized to insure that each

cell in the table has at least 3 unweighted cases. This restriction also applies to documentation for public-use files.

This rule excludes table cells with zero cases because there are no data to protect in the cell.

Example: A principal salary table by race and years of experience may only have 2 Asian respondents with more

than 20 years of experience. To implement this standard, one possibility would be to either combine the Asian

category with another race group or combine the 20+ years of experience category with the next lower experience category. This process would continue until all cells have either at least 3 unweighted cases or no

unweighted cases.

11. At the discretion of the Commissioner of NCES, data security staff may release individually identifiable data to persons for statistical uses compatible with the purposes for which the data were collected. Persons receiving individually identifiable data from NCES shall execute a restricted-use data license agreement, sign affidavits of

nondisclosure, and meet such other requirements as deemed necessary in accordance with other confidentiality

provisions of the law.

12. Before external data users may gain access to public-use data files, they must agree that they will not use the data

to attempt to identify any individual whose data is in the file. This may be accompanied by using the following

wording:

“WARNING

Under law, public-use data collected and distributed by the National Center for Education Statistics (NCES) may be used

only for statistical purposes.

Any effort to determine the identity of any reported case by public-use data users is prohibited by law. Violations are

subject to Class E felony charges or a fine up to $250,000 and/or a prison term up to 5 years.

NCES does all it can to assure that the identity of data subjects cannot be disclosed. All direct identifiers, as well as any

characteristics that might lead to identification, are omitted or modified in the dataset to protect the true characteristics of individuals. Any intentional identification or disclosure of a person violates the assurances of confidentiality given

to the providers of the information. Therefore, users shall:

• Use the data in this dataset for statistical purposes only.

• Make no use of the identity of any person discovered inadvertently, and advise NCES of any such discovery.

• Not link this dataset with individually identifiable data from other NCES or non-NCES datasets.

To proceed you must signify your agreement to comply with the above-stated statutorily based requirements.”

Section 6: Releasing Information Outside an Agency
84

Forum Guide to Protecting the Privacy of Student Information

Sample Affidavit

of Nondisclosure by Researchers

I, [name of individual], do solemnly [swear or affirm] that when given access to the [title of data to be provided] provided by [name of the agency or school], I shall not:

1. use or reveal any personally identifiable information furnished, acquired, retrieved, or assembled by me or others, under the provisions of [citation of applicable laws] for any purpose other than statistical purposes specified

in the [name of agreement];

2. make any release or publication whereby an individual could be identified or the data furnished by or related to

any particular person can be identified; or

3. permit anyone other than the individuals authorized by [name of the agency or school] to examine the individual reports.

Signature:____________________________________

Name:_______________________________________

Title:________________________________________

Organization:_________________________________

Date:________________________________________

The penalty for unlawful release is [maximum penalties as specified by the applicable laws and provide citations].

Notary Public and Seal:______________________________________________________________________

Exhibit 6–4
85

Exhibit 6–5

Sample Statement

of Nonrelease of Released Information

I understand that upon receipt of the information provided by [name of agency or school] regarding [type of information] about [name of student(s)], the re-release of such information is prohibited by the Family Educational Rights and

Privacy Act of 1974, as amended [and cite state and local laws, where applicable]. I acknowledge that I fully understand

that the intentional release by me of this information to any unauthorized person could subject me to [criminal and civil

penalties, where applicable] imposed by law.

Signature:____________________________________

Name:_______________________________________

Title:________________________________________

Organization:_________________________________

Date:________________________________________

Section 6: Releasing Information Outside an Agency
86

Forum Guide to Protecting the Privacy of Student Information

REFERENCES

Ligon, G., Clements, B.S., and Paredes, V. (April 2000). Why a Small n Is Surrounded by Confidentiality: Ensuring

Confidentiality and Reliability in Microdatabases and Summary Tables. Paper presented at the annual meeting of

the American Educational Research Association, New Orleans, LA. Available: http://www.evalsoft.com.

National Center for Education Statistics. (2000). Restricted Use Data Procedures Manual (http://nces.ed.gov/statprog/

rudman/index.asp). Washington, DC: U.S. Government Printing Office.

National Forum on Education Statistics. (2003). Weaving a Secure Web Around Education: A Guide to Technology

Standards and Security (NCES 2003–381). U.S. Department of Education. Washington, DC: National Center for

Education Statistics.

National Center for Education Statistics. (2002). NCES Statistical Standards (NCES 2003–601). U.S. Department of

Education. Washington, DC: Author.
87

CFR Code of Federal Regulations

CSIS California Student Information Services

COPPA Children’s Online Privacy Protection Act

FERPA Family Educational Rights and Privacy Act

FOIA Freedom of Information Act

FPCO Family Policy Compliance Office

HIPAA Health Insurance Portability and Accountability Act

IDEA Individuals with Disabilities Education Act

IEP individualized education program

NCES National Center for Education Statistics

NII National Information Infrastructure

NSLA National School Lunch Act

NCLB No Child Left Behind Act

OIRA Office of Information and Regulatory Affairs

OMB Office of Management and Budget

PPRA Protection of Pupil Rights Amendment

USC United States Code

List of Acronyms

89

A

Access

to education records 13, 14, 51, 52

to health records 18, 20

Accreditation organizations 14, 24

Affidavit of nondisclosure, 59 

See also Oath of nondisclosure

Agency (see also Education agency or institution) 4

Aggregate data 19

Amend (education records) 12, 13, 29

Audits and evaluations 13, 14, 24

C

Campus Sex Crimes Prevention Act 15

Cell suppression 72

Centers for Medicare and Medicaid Services (of U.S. Department of Health and Human Services) 22

Challenges to record contents 59, 60

Charging a fee (for records) 59

Child find activities 18

Children’s Online Privacy Protection Act 19

Computer Matching and Privacy Protection Act 9

Computer security 75

Confidentiality 3

Conflicts (between FERPA and other federal or state laws) 19

Consent, 29, 31, 32

Parental 13, 15, 19, 25

Consent rules 11

Contractors or vendors (access to student records) 53

Cooperative System vii

Council of School Attorneys 22

Court orders (or subpoenas) 13, 15

Cross-agency partnerships 75

Cross-agency use of information 14

See also Data sharing

89

Index
D

Data integrity and accuracy 45

Data needs and uses 44

Data sharing 14

Data steward 50

Department of Education-funded surveys 25

Destruction of records 14, 17

Development or administration of tests 14

Directory information 11, 12, 24, 27, 73

Disciplinary actions 14

Disciplinary records 10, 11

Disclosure (of information) 3, 13, 14

without consent of parent 14

Drug and Alcohol Patient Records Confidentiality Law 9, 20

Drug and alcohol prevention and treatment services 18

Due process procedures of IDEA (see Individuals with Disabilities Education Act, Due process procedures)

E

Economically disadvantaged students 19

Education agency or institution 4, 14, 15, 22

Education records 2, 3, 10, 11, 14, 17, 18, 23, 58

Electronic data interchange 21

Electronic transmission (of data) 77

Elementary and Secondary Education Act 10, 16

Eligible students 24

Emancipated minors 16, 61

ESEA (see Elementary and Secondary Education Act)

F

Family Educational Rights and Privacy Act 2, 8, 10, 14, 17, 23, 24

Family Policy Compliance Office 9, 12, 17, 22

Federal laws 8

See also individual federal laws (e.g., Family Educational Rights and Privacy Act) 

Federal surveys 15

Fees (for duplicating records) 11

FERPA (see Family Educational Rights and Privacy Act)

Financial aid 14

FOIA (see Freedom of Information Act)

FPCO (see Family Policy Compliance Office)

Free and reduced-price school meals 18, 19

Free or reduced-price meals eligibility 19, 20, 30, 34

Freedom of Information Act 9

Forum Guide to Protecting the Privacy of Student Records

90
91

G

Goals 2000: Educate America Act 15

Gonzaga University v. John Doe 23

Guidelines for Protecting Confidential Student Health Information 22

H

Health Insurance Portability and Accountability Act 9, 20, 21

Part C 21

Privacy rule 20, 21

Health or safety emergency (disclosure of records in the event of) 14

Healthy Meals for Healthy Americans Act 30

Hearing procedures 60

Hearings 13

HIPAA (see Health Insurance Portability and Accountability Act)

I

IASA (see Improving America’s Schools Act)

IDEA (see Individuals with Disabilities Education Act)

Identification codes 11

Improper disclosure 33

Improving America’s Schools Act 10, 14

Individual liability 23

Individually identifiable health information 11, 20, 21

Individuals with Disabilities Education Act, 9, 16, 17, 23

Due process procedures 17

Part B 17

Part C 17

Informed consent 3

Inspect 

Education records 12, 14, 24, 29, 58

Instructional materials 16

Surveys 15

Interagency partnership 14

J

Justifying data collection 44

L

Law enforcement 11

Legitimate educational interest 13, 14, 24, 50, 51, 74, 78

Local education agencies 11

91

Index
M

Matching data 23

Medical and health records 11

Mental health conditions 18

Military recruiters/recruitment 11, 12, 16, 26

Minors’ right to seek treatment 18

Misuse of information 77

N

National Assessment of Educational Progress 30

National Center for Education Statistics 1, 10

National Cooperative Education Statistics System vii

National Defense Authorization Act 12

National School Lunch Act 9, 19, 23, 30, 34, 38, 53

Natural or adoptive parent 13

NCES Statistical Standards 74

NCLB (see No Child Left Behind Act)

Need to know 19, 74

No Child Left Behind Act 4, 10, 11, 12, 15, 23, 38, 40, 53, 73

Noncustodial or foster parent 13, 61, 62

Nonpersonally identifiable information 72

Notes (handwritten or typed) 11

Notification 3, 11, 12, 13, 16, 26, 29, 51, 58, 60, 73

O

Oath of nondisclosure 50

Office for Civil Rights (of U.S. Department of Health and Human Services) 22

Office of Special Education Programs 17

Office of Management and Budget, 21

Clearance (for federal data collections) 21

OMB (see Office of Management and Budget)

Opt out (of information disclosure) 12

OSEP (see Office of Special Education Programs)

Owasso ISD v. Falvo 23

P

Paperwork Reduction Acts 9, 21

Parent or eligible student (granting rights to review records) 4

Parents’ access (to education records) 12

Part B of IDEA (see Individuals with Disabilities Education Act, Part B)

Part C of IDEA (see Individuals with Disabilities Education Act, Part C)

Patriot Act 4, 10, 15, 51

Penalty for noncompliance (with FERPA and PPRA) 78

Personal information 11, 16

Forum Guide to Protecting the Privacy of Student Records

92
93

Personally identifiable information 12, 14, 17, 20, 50, 72

Physical examinations or screenings 16

Physical handling and storage of data 75

Policy for the Protection of Human Subjects 9

PPRA (see Protection of Pupil Rights Amendment)

Privacy 4, 23

Privacy Act 9

Privacy notice 19

Privacy Rule of HIPAA (see Health Insurance Portability and Accountability Act, Privacy Rule)

Private schools 18

Professional standards of ethical practice 18, 52

Protected health information 11

Protection of Pupil Rights Amendment 8–9, 15, 17, 23, 25

Grassley Amendment 15

Hatch Amendment 15

Tiahrt Amendment 15

Providing copies (of records) 59

Public notice 17

R

Records (longevity of) 46

Records manager 50

Records matching 14

Records retention and disposal 53

Redisclosure of records to third parties 14

Release (of data)

documentation of 77

to other service agencies 75

to researchers 74

with prior consent 73

without prior consent 13–14, 74

Research use (of records) within an agency 52

Restricted-Use Data Procedures Manual 74

Review (education records) 12, 13, 15, 24, 29, 58, 59, 60, 61

Richard B. Russell National School Lunch Act (see National School Lunch Act)

S

School districts 10, 11

School officials 13

Security 4

Security risk 50

Security risk assessment 50

Social security numbers 11, 21, 32, 46

Special education and related services 17, 18

Special education programs 14

Special education records 11

Special education students 10

93

Index
State Children’s Health Insurance Program 34

State Medicaid Program 34

State or local education agency or authority 4, 10, 15, 16, 17

See also Education agency or institution

See also Local education agencies

Students under the age of 18 11, 12–13

Surveying of minor students 15

System-generated identification numbers 46

T

Taking college courses (vis-a-vis students’ access to records) 13

Test records 11

Test scores 11

Tests 16

Third parties 13, 73

Title I 30, 39, 40, 53

Training agency staff 52

Transportation of data 75

U

U.S. Department of Health and Human Services 18, 20, 21

Unique identification codes 45

Unique student identifier system 46

V

Verification of request (to review records) 58

Videotapes (as education records) 11

W

Written data policy 46, 50, 51

Forum Guide to Protecting the Privacy of Student Records

94