Balancing Student 

Privacy and School 

Safety: A Guide 

to the Family 

Educational Rights 

and Privacy Act 

for Colleges 

and Universities

•	 A school official may generally share with a parent

information that is based on that official’s personal

knowledge or observation of the student.

FERPA and Student Health 

Information

Postsecondary institutionsthat provide health or

medicalservicesto students may share student

medical treatment records with parents under the

circumstances described above. While these records

may otherwise be governed by the Health Insurance 

Portability and Accountability Act of 1996 (HIPAA),

the HIPAA Privacy Rule excludesstudent medical

treatment records and other records protected

by FERPA. The Department plansto issue further

guidance on the interplay between FERPA and HIPAA.

FERPA and Student and 

Exchange Visitor Information 

System (SEVIS)

FERPA permits institutions to comply with

information requests from the Department of

Homeland Security (DHS) and its Immigration and

Customs Enforcement Bureau (ICE) in order to

comply with the requirements of SEVIS. Officials

who have specific questions about this and other

matters involving international students should

contact the U.S. Department of Education’s Family

Policy Compliance Office.

Transfer of Education Records 

Finally, FERPA permits school officials to disclose

any and all education records, including disciplinary

records, to another institution at which the student

seeks or intends to enroll. While student consent

is not required for transferring education records,

the institution’s annual FERPA notification should

indicate that such disclosures are made. In the

absence of information about disclosures in the

annual FERPA notification, school officials must

make a reasonable attempt to notify the student

about the disclosure, unless the student initiates

the disclosure. Additionally, upon request, the

institution must provide a copy of the information

disclosed and an opportunity for a hearing. 

See 34 CFR § 99.31(a)(2) and § 99.34(a).

Contact Information

For further information about FERPA, please

contact the Family Policy Compliance Office or

visit its Web site.

Family Policy Compliance Office

	 U.S. Department of Education

	 400 Maryland Ave. S.W.

	 Washington, DC 20202-5920	

	 202-260-3887

For quick, informal responses to routine 

questions about FERPA, school officials may

e-mail the Family Policy Compliance Office at

FERPA@ED.Gov.

For inquiries about FERPA compliance training,

contact FERPA.Client@ED.Gov.

Additional information and guidance may be

found at FPCO’s Web site at: http://www.ed.gov

/policy/gen/guid/fpco/index.html.
Postsecondary officials are regularly asked to balance

the interests ofsafety and privacy for individual

students. While the Family Educational Rights and 

Privacy Act (FERPA) generally requiresinstitutions

to ask for written consent before disclosing a

student’s personally identifiable information, it also

allows colleges and universitiesto take key steps

to maintain campussafety. Understanding the

law empowersschool officialsto act decisively and

quickly when issues arise. 

Health or Safety Emergency 

In an emergency, FERPA permitsschool officialsto

disclose withoutstudent consent education records,

including personally identifiable information from

those records, to protect the health orsafety of

students or other individuals. Atsuch times, records

and information may be released to appropriate

partiessuch aslaw enforcement officials, public

health officials, and trained medical personnel. See 

34 CFR § 99.31(a)(10) and § 99.36. This exception to

FERPA’s general consent rule islimited to the period

of the emergency and generally does not allow for a

blanket release of personally identifiable information

from a student’s education records. In addition, the

Department interprets FERPA to permit institutions

to disclose information from education recordsto

parentsif a health orsafety emergency involvestheir

son or daughter.

Disciplinary Records

While student disciplinary records are protected as

education records under FERPA, there are certain

circumstancesin which disciplinary records may

be disclosed without the student’s consent. A

postsecondary institution may disclose to an alleged

victim of any crime of violence or non-forcible sex

offense the final results of a disciplinary proceeding

conducted by the institution against the alleged

perpetrator of that crime, regardless of whether the

institution concluded a violation was committed. 

An institution may disclose to anyone—not just the

victim—the final results of a disciplinary proceeding,

if it determinesthat the student is an alleged

Law Enforcement Unit Records

Many colleges and universities have their own law

enforcement unitsto monitorsafety and security in

and around campus. Institutionsthat do not have

specific law enforcement units may designate a

particular office orschool official to be responsible

for referring potential or alleged violations of law to

local police authorities. Investigative reports and

other records created and maintained by these law

enforcement units are not considered education

recordssubject to FERPA. Accordingly, institutions

may disclose information from law enforcement

unit recordsto anyone, including outside law

enforcement authorities, withoutstudent consent. 

See 34 CFR § 99.8.

perpetrator of a crime of violence or non-forcible

sex offense, and with respect to the allegation made

against him or her, the student has committed a

violation of the institution’srules or policies. See 34

CFR §§ 99.31(a)(13) and (14). 

The Clery Act

The Jeanne Clery Disclosure of Campus Security 

Policy and Campus Crime Statistics Act requires

postsecondary institutions to provide timely

warnings of crimes that represent a threat to the

safety of students or employees and to make public

their campus security policies. It also requires that

crime data be collected, reported, and disseminated

to the campus community and to the Department

annually. The Clery Act is intended to provide

students and their families with accurate, complete,

and timely information about safety on campuses

so that they can make informed decisions. Such

disclosures are permitted under FERPA. The

following Web site provides more information about

these and other provisions about campus safety:

http://www.ed.gov/admins/lead /safety/campus.

html. 

While an institution has flexibility in deciding how

to carry outsafety functions, it must also indicate

in its policy or in information provided to students

which office orschool officialserves asthe college or

university’s“law enforcement unit.” (The institution’s

notification to students of their rights under FERPA 

can include this designation. As an example, the

Department has posted a model notification on its

Web site at http://www.ed.gov/policy/gen/guid

/fpco/ferpa/ps-officials.html.)

Law enforcement unit officials who are employed

by the college or university should be designated in

the institution’s FERPA notification as“school officials”

with a“legitimate educational interest.” Assuch,

they may be given accessto personally identifiable

information from students’education records. The

institution’slaw enforcement unit officials must

protect the privacy of education recordsit receives

and may disclose them only in compliance with

FERPA. For that reason, it is advisable that law

enforcement unit records be maintained separately

from education records.

Disclosure to Parents

When a student turns 18 years old or enters a

postsecondary institution at any age, all rights

afforded to parents under FERPA transfer to the

student. However, FERPA also provides waysin which

schools may share information with parents without

the student’s consent. For example:

•	 Schools may disclose education recordsto parentsif

the student is a dependent for income tax purposes. 

•	 Schools may disclose education recordsto parents

if a health orsafety emergency involvestheirson

or daughter. 

•	 Schools may inform parentsif the student who

is under age 21 has violated any law or its policy

concerning the use or possession of alcohol or a

controlled substance.