The following are my notes from The Privacy of Student Information: A Resource for Schools document from the National Forum on Education Statistics.

1. As an employee of a school or other education institution, you may sometimes access individual student records while performing your official duties. Under the Family Educational Rights and Privacy Act (FERPA), you are legally and ethically obliged to safeguard the confidentiality of any information they contain.
2. The school district is responsible for ensuring that all parents and eligible students are afforded all the rights provided them by FERPA.
3. FERPA is a federal law that protects privacy interests of parents and students in student education records.
4. This guide defines terms such as “education records” and “directory information”; and offers guidance for developing appropriate privacy policies and information disclosure procedures related to military recruiting, parental rights and annual notification, videotaping, online information, media releases, surveillance cameras, and confidentiality concerns related specifically to health-related information.
5. The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy interests of students. It affords parents the right to access and amend their children’s education records, and gives them some control over the disclosure of the information in these records. FERPA generally prevents an education agency or institution from sharing student records, or personally identifiable information in these records, without the written consent of a parent. A “parent” is defined as a natural or adoptive parent, a legal guardian, or an individual acting as a parent in the absence of the parent or guardian. When students reach the age of 18, or attend a postsecondary institution at any age, they are considered “eligible students” and all of the rights afforded by FERPA transfer from the parents to the students. (34 CFR § 99.3)
6. FERPA does allow the disclosure of student data without parental consent under certain, specified conditions. For example, schools may reveal information from student records to school officials with a legitimate educational interest in the information.
7. employees of a school and education institution…are legally and ethically obliged to safeguard their confidentiality.
8. The term “education records” is defined as all records, files, documents and other materials containing information directly related to a student; and are maintained by the education agency or institution or by a person acting for such agency or institution (34 CFR § 99.3). This includes all records regardless of medium, including, but not limited to, handwriting, videotape or audiotape, electronic or computer files, film, print, microfilm, and microfiche.
9. For PreK–12 students, health records maintained by an education agency or institution subject to FERPA, including immunization records and school nurse records, generally would be also considered “education records” and subject to FERPA because they are:
   directly related to the student;
   maintained by an education agency or institution, or a party acting for the agency or institution; and
   not excluded from the definition of education records as treatment or sole-possession records, or on some other basis. (See Health Records: FERPA and HIPAA.)
10. Personal notes made by teachers or other staff, on the other hand, are not considered education records if they are:
    kept in the sole possession of the maker;
    not accessible or revealed to any other person except a temporary substitute, and
    used only as a memory aid.
    Records created and maintained by a law enforcement unit for law enforcement purposes are also excluded.
11. If a school system discloses directory information, it must give “public notice” of this policy and explain what is included in such information. FERPA does not define “public notice,” and the means of notification is left up to the school.
12. Directory information…may include the student’s name, address, telephone number, date and place of birth, honors and awards, and dates of attendance.
13. While school systems designate varying types of information as directory information, most include a student’s name, family members’ names, home address, and school activities. The height and weight of athletes may also be included.
    School systems should give careful consideration to designating data as “directory information” because once this designation is given; school officials may distribute the information to anyone who requests it—in or outside the school.
14. School systems that disclose directory information must give “public notice” of this policy and explain what is included in such information; the notice must also indicate that parents may refuse to allow the school to designate any, or all, of their child’s record as directory information. Several ways public notice can be given include: a notice in the registration package sent home to parents, a notice in the local newspaper, a notice in the school handbook distributed each year, or a posting on the school system’s website.
15. FERPA requires the public notice to specify how much time parents have to tell the school or school system what, if any directory information they do not wish released.
16. FERPA regulations require that local education agencies give annual notification to parents and eligible students of their rights under FERPA (34 CFR § 99.7).
17. parents understand that they have the right to:
    inspect and review their child’s record;
    seek to amend the record if they believe it to be inaccurate;
    consent (or not) to disclosures of personally identifiable information; and
    file a complaint with the U.S. Department of Education concerning the district’s failures to comply with FERPA.
18. If the education record includes information about other students, that information must be removed prior to disclosure so that parents do not have access to any other child’s records. (34 CFR § 99.12)
19. When parents (or eligible students) request to review their records, the education institution must respond within 45 days, even if these records are kept by an outside party acting for the school. During these 45 days, the education institution cannot destroy any of the requested records.
20. FERPA allows disclosure, without consent, to the following parties or under the following conditions:
    *School officials with a “legitimate educational interest” may access student records under FERPA.
    *Schools that submit a records request or in which a student has enrolled are eligible to receive information from that student’s education records.
    *Audit/evaluation purposes…the exception refers to federal, state, and local education agencies that must collect data or student information to audit, evaluate, or enforce educational programs.
    *Information required to determine student eligibility for financial aid, the amount of aid to award, and the conditions under which aid is to be granted may be disclosed under this category; access to information needed to enforce those terms and conditions is also allowed.
    *The purpose of the study conducted for, or on behalf of, a school has to be to: develop, validate, or administer predictive tests; administer student aid programs; or improve instruction. Even if these conditions are met, the school may only disclose information if: the study methodology does not permit the personal identification of parents and students by anyone other than the researchers and their representatives; the information is not used for any purpose other than to complete the study; and the information is destroyed when it is no longer needed for the stated purposes of the study.
    *Disclosure of personal information is permitted to an accrediting organization if it is needed to carry out the accreditation.
    *Schools must release information requested by a judicial order or legal subpoena. However, the school must make a reasonable effort to notify the parent (or eligible student) in advance of compliance, unless the court or other issuing agency has ordered that the contents of the subpoena not be disclosed, or that the protected education records not be included.
    *Disclosure to appropriate officials is valid if the information contained in the education record is necessary to protect the health or safety of the student or other individuals.
    *If state law permits, schools may release information to state and local juvenile justice authorities after receiving written certification that the information will not be disclosed to any other agency, organization, or third party without the parent’s permission, except as allowed in state law.
21. While FERPA does not require schools to transfer education records to third parties, it does permits their transfer to another school if a student seeks or intends to enroll in that school; as part of the education records, disciplinary records would therefore be included in the transfer.
22. According to the preamble to the December 2000 final rules, “the educational institution or agency that employs a school nurse is subject to our (HIPAA) regulation if the school nurse or the school engages in a HIPAA transaction.” HIPAA transactions are defined in the Code of Federal Regulations (CFR) as “the transmission of information between two parties to carry out financial or administrative activities related to health care,” including submitting claims. However, consent must still be secured under FERPA before the records are disclosed.
23. Nothing in FERPA prohibits a school from disclosing information in aggregate, or in another form that is not personally identifiable. Personally identifiable information includes:
    the student’s name;
    the name of the student’s parent or other family member;
    the address of the student or student’s family;
    a personal identifier, such as the student’s social security number or student number;
    a list of personal characteristics that would make the student’s identity easily traceable; or
    other information that would make the student’s identity easily traceable.
24. In circumstances that may lead to the identification of an individual, the disclosing education agency or institution must ensure that student-level information is not personally identifiable by removing the student’s name and ID number, as well as any “personal characteristics” and “other information that would make the student’s identity easily traceable.”
25. The required consent form should specify:
    the records that may be disclosed;
    the purpose of the disclosure; and
    the identify of the party or class of parties to whom the disclosure may be made.
26. Upon request, and after notifying parents, schools must release to military recruiters the name, address, and telephone numbers of high school juniors and seniors.
27. Today’s information portability makes performing many school-related tasks more convenient; however, it also increases the risk of unauthorized access to protected information. As school administrators, teachers, and support staff find new ways to store and access student records, they must still ensure the information’s confidentiality and privacy.
28. For example, if an administrator misplaces a handheld computer, any personally identifiable information it contains becomes potentially available to anyone who finds the device. Teachers carrying grade files home on a flash drive or storing other personally identifiable student information on home computers, create the risk of unauthorized access to protected education records. Likewise, education records transferred through electronic mail could potentially be intercepted by unauthorized individuals. Since such situations occur daily in schools across the country, local education agencies must take precautions to guard against the unintentional release or unauthorized disclosure of education records.
29. School systems should have a surveillance camera policy outlining the rights and responsibilities of students, teachers, administrators, and other school staff. As a best practice, the policy should include the following:
    a clear statement of appropriate reasons for using surveillance cameras;
    the role and responsibilities of individuals with access to the cameras;
    who will have access to any footage;
    how long will any footage be kept and how will it be destroyed; and
    a consent provision.
30. As soon as school officials use surveillance camera videos for discipline purposes, however, the tapes become education records and are subject to FERPA requirements.
31. When created and kept by the school or education agency, videotapes or photographs directly related to a specific student are considered part of that student’s education records and, therefore, subject to FERPA. For instance, if the tape captured an altercation, it would be included in the involved students’ education record, and the school has to obtain consent before publishing or disclosing its contents to unauthorized individuals. However, authorization would be needed only for the students actually involved in the altercation; other students in the video would be considered “set dressing” (not relevant to the incident) and not covered.
32. Posting information is considered “disclosure” and must, therefore, comply with FERPA guidelines. Even without FERPA, school officials should consider safety concerns and exercise caution when displaying information (such as identifiable pictures) about students on the Internet, even if the information is designated as directory information. Including parents in any decisions about how much student information is appropriate might be a good practice, especially for younger students.

Subscribe to Around the Corner-MGuhlin.org

Everything posted on Miguel Guhlin’s blogs/wikis are his personal opinion and do not necessarily represent the views of his employer(s) or its clients. Read Full Disclosure