: In 2001, the Florida Department of Education disseminated the document, “Family Educational
Rights and Privacy Act (FERPA),” adapted with permission from the “Family Educational Rights and Privacy
Act (FERPA): NAPSA Notes.” The document provided an overview of FERPA and answered a number of
frequently asked questions.
Since publication of the above document, school district representatives have identified additional questions
and issues regarding FERPA, including the relationship between FERPA and the Health Insurance Portability
and Privacy Act (HIPAA). The purpose of this Technical Assistance Paper (TAP) is to provide information to
educators, agency personnel, and families about FERPA, including both federal and state requirements.
Questions and answers about HIPAA, especially as related to FERPA, are included in this revised TAP.
Throughout the TAP, citations are provided for applicable federal and state law.
A-1. Overview.............................................................................................................. 1
A-2. Legal Reference ................................................................................................... 1
A-3. Purpose................................................................................................................. 2
B-1. To which educational agencies or institutions do the FERPA regulations
apply?................................................................................................................... 2
B-2. Do FERPA regulations apply to charter schools?................................................ 2
C-1. What definitions apply to the FERPA regulations?............................................. 2
notification? ......................................................................................................... 6
education records? ............................................................................................... 7
upon request? ....................................................................................................... 7
F-10. Are there any special provisions regarding the right to inspect records that
F-11. What are the rights of parents or guardians concerning the records of their
Education Programs? ........................................................................................... 9
F-12. If a student attends a private school on a McKay Scholarship, does FERPA
F-13. If a student has not reached age 18 but is dual-enrolled at a postsecondary
F-14. If a student who has graduated from high school has not yet reached age 18
the student? ........................................................................................................ 10
G-1. What is the time frame within which districts must comply with a request for
education records? ............................................................................................. 10
G-2. May an educational agency or institution charge a fee for copies of education
records?.............................................................................................................. 10
G-3. What are the procedures for amending education records? ............................... 11
G-4. Under what conditions is prior consent not required to disclose information in
education records? ............................................................................................. 11
G-5. Under what conditions is prior consent required to disclose information in
education records? ............................................................................................. 12
G-6. Is prior consent for disclosure required when the school board is conducting an
expulsion hearing? ............................................................................................. 12
G-7. What conditions apply to disclosure of information to the juvenile justice
system?............................................................................................................... 13
G-8. What record-keeping requirements exist concerning requests and disclosures?13
G-9. What limitations apply to the redisclosure of information?............................... 13
G-10. What conditions apply to disclosure of information to other educational
G-11. What conditions apply to disclosure of information for federal or state program
purposes?............................................................................................................ 14
G-12. What conditions apply to disclosure of information in health or safety
emergencies?...................................................................................................... 15
G-13. What conditions apply to disclosing directory information?............................. 15
G-14. What are the enforcement procedures for FERPA?........................................... 15
G-15. What conditions apply to state auditors’ access to education records? ............. 16
G-16. What conditions apply to contractors’ and consultants’ access to education
records?.............................................................................................................. 16
G-17. What obligations do educational agencies have with regard to teachers’ and
G-18. May records or information from records that have been de-identified be
G-19. What procedure must be used to properly identify a party to whom it discloses
G-20. Do military recruiters have access to student information?............................... 17
G-21. Are peer-graded papers a violation of FERPA? ................................................ 17
G-22. What does a model notice of rights look like? .................................................. 17
H-1. What is HIPAA? ................................................................................................ 17
H-2. How does HIPAA define “protected health information”? ............................... 17
H-3. What are the requirements of HIPAA’s Privacy Rule? ..................................... 18
H-4. How are health records of youth under the jurisdiction of the Department of
H-5. How do HIPAA and FERPA apply to student health records? ......................... 18
H-6. How does HIPAA apply to students’ education records?.................................. 19
regarding FERPA?............................................................................................. 19
Rights and Privacy Act (FERPA). FERPA, also known as the Buckley
guardians of minor students certain rights, primarily access and confidentiality,
1 (20 U.S. Code [U.S.C.] 1232g).
agencies maintain about students.
records. These rights transfer to the student when the student turns 18 years old or
attends a postsecondary institution. At this time, the student is designated as an
“eligible student” and holds the same rights as his or her parent held with respect
to education records.
This and other United States “privacy” laws ensure that information about citizens
collected by schools and government agencies can be released by consent or only
for specific and legally defined purposes. Since enacting FERPA in 1974,
law, refining and clarifying family rights and agency responsibilities to protect
those rights.
The legal statute citation for FERPA can be found in the U.S. Code (20 U.S.C.
1232g), which incorporates all amendments to FERPA. FERPA regulations are
found in the Code of Federal Regulations (CFR) for Title 34; Part 99. In Florida,
the intent of FERPA is carried out in section 1002.22, Florida Statutes (F.S.),
Records of Pupils and Adult Students. The most recent amendments to the
http://www.ed.gov/legislation/FedRegister/finrule/2008-4/120908a.pdf.
Schwab, N. C., Ruben, M., Mair, J. A., Gelfman, M. H. B., Bergren, M. D., Mazyck, D., & Hine, B. (2004).
(p. 56). Kent, OH: American School Health Association.
3
b.
“Biometric record,” as used in the definition of personally identifiable
information, means a measure of one or more measurable biological or
behavioral characteristics that can be used for automated recognition of an
individual. Examples include fingerprints; retina and iris patterns; voiceprints;
DNA sequence; facial characteristics; and handwriting. (20 U.S.C. 1232g,
§99.3)
c.
“Dates of attendance” means the period of time during which a student attends
or attended an educational agency or institution. Examples of dates of
attendance include an academic year, a spring semester, or a first quarter. The
term does not include specific daily records of a student’s attendance at an
educational agency or institution.
d.
“Directory information” is information not generally considered harmful or an
invasion of privacy if disclosed. School districts must tell parents and students
about directory information and allow reasonable time to request that the
school not release directory information (Rule 6A-1.0955(6)(j), F.A.C.).
“…Any educational institution making directory information public shall give
public notice of the categories of information that it has designated as
directory information for all students attending the institution and shall allow
a reasonable period of time after the notice has been given for a parent or
student to inform the institution in writing that any or all of the information
designated should not be released” (section 1002.22(3)(d)(14), F.S.).
Directory information items include, but are not limited to: (20 U.S.C. 1232g,
§99.3)
•
Name, address, telephone number (if listed), electronic mail address
•
Date and place of birth
•
Major field of study
•
Participation in officially recognized activities and sports
•
Weight and height of members of athletic teams
•
Dates of attendance
•
Degrees, honors, and awards received (20 U.S.C. 1232g, §99.3)
•
Most recent previous educational agency or institution attended (section
1002.22(2)(b), F.S.)
•
Photograph (20 U.S.C. 1232g, §99.3)
•
Grade level (20 U.S.C. 1232g, §99.3)
•
Enrollment status (e.g., undergraduate or graduate, full-time or part-time)
(20 U.S.C. 1232g, §99.3)
An educational agency or institution may not designate a student’s Social
Security number or other student identification number as directory
information. However, directory information may include a student’s user ID
or other unique identifier used by the student to access or communicate in
electronic systems, but only if the electronic identifier cannot be used to gain
access to education records except when used in conjunction with one or more
factors that authenticate the student’s identity, such as a personal
identification number (PIN), password, or other factor. (§99.3)
4
e.
“Disclosure” means to permit access to or the release, transfer, or other
communication of personally identifiable information contained in education
records by any means, including oral, written, or electronic means, to any
party except the party identified as the party that provided or created the
record. (20 U.S.C. 1232g, §99.3)
f.
“Education records” are those records, files, documents, and other materials
that contain information directly related to a student and are maintained by an
educational agency or institution or by a person acting for such agency or
institution.
The term “education records” does not include: “(1) records of instructional,
supervisory, and administrative personnel and educational personnel ancillary
thereto which are in the sole possession of the maker thereof and which are
not accessible or revealed to any other person except a substitute; (2) records
maintained by a law enforcement unit of the educational agency or institution
that were created by that law enforcement unit for the purpose of law
enforcement; (3) in the case of persons who are employed by an educational
agency or institution but who are not in attendance at such agency or
institution, records made and maintained in the normal course of business
which relate exclusively to such person in that person’s capacity as an
employee and are not available for use for any other purpose; or (4) records on
a student who is eighteen years of age or older, or is attending an institution of
postsecondary education, which are made or maintained by a physician,
psychiatrist, psychologist, or other recognized professional or
paraprofessional acting in his professional or paraprofessional capacity, or
assisting in that capacity, and which are made, maintained, or used only in
connection with the provision of treatment to the student, and are not available
to anyone other than persons providing such treatment, except that such
records can be personally reviewed by a physician or other appropriate
professional of the student’s choice.” (20 U.S.C. 1232g(a)(4)(A))
With respect to former students, the term “education records” excludes
records that are created or received by the educational agency or institution
after an individual is no longer a student in attendance and are not directly
related to the individual’s attendance as a student. (§99.3)
Peer-graded papers that have not been collected and recorded by a teacher are
not considered maintained by an educational agency or institution and,
therefore, are not educational records under FERPA. (§99.3; see also Owasso
Public Schools v. Falvo, 534 U.S. 426 (2007)).
g. “Eligible student” means a student who has reached 18 years of age or is
attending an institution of postsecondary education. (20 U.S.C. 1232g(d),
§99.3)
h. “FERPA,” The Family Educational Rights and Privacy Act of 1974, is a
federal law that affords students and the parents and legal guardians of minor
students certain rights, primarily access and confidentiality, with respect to the
students’ educational records. (20 U.S.C. 1232g)
5
i. “Parent” means a parent of a student and includes:
•
A natural parent
•
A guardian
•
An individual acting as a parent in the absence of a parent or guardian (e.g.,
surrogate parent, foster parent) (20 U.S.C. 1232g, §99.3)
j. “Personally identifiable information” includes, but is not limited to:
•
Student’s name
•
Name of the student’s parent or other family members
•
Address of the student or student’s family
•
Personal identifier, such as a Social Security number, student number,
biometric record, indirect identifiers (e.g., date and place of birth, mother’s
maiden name)
•
Other information that, alone or in combination, is linkable to a specific
student that would allow a person to identify the student
•
Information requested by a person who the educational agency or institution
reasonably believes knows the identity of the student to whom the education
record relates (20 U.S.C., 1232g, §99.3)
k. “Record” means any recorded information maintained in any way, including,
but not limited to:
•
Handwriting
•
Print
•
Film
•
Computer media
•
Video or audio tape
•
Microfilm and microfiche (20 U.S.C. 1232g, §99.3)
l. “State auditor” is a party under any branch of government with authority and
responsibility under state law for conducting audits. (§99.3)
D. Terminology
D-1. What additional terminology relates to the FERPA regulations?
a.
Who is considered a “school official?”
State and federal law do not define the term “school official.” However, there
is a definition of a school official in the language contained in the FERPA
model notice of rights of parents. School districts may wish to consider this
language as they review their student records policy. A school district has the
flexibility, however, to define the term “school official.”
The model notice defines “school official” as follows: “A school official is a
person employed by the district as an administrator, supervisor, instructor, or
support staff member (including health and medical staff and law enforcement
unit personnel); a person serving on the school board; a person or company
6
with whom the district has contracted to perform a special task (such as an
attorney, auditor, medical consultant or therapist); a parent or student serving
on an official committee such as disciplinary or grievance committee or
assisting another school official in performing his or her tasks.”
Rule 6A-1.0955(6), F.A.C., states: “Each school board shall adopt a policy for
educational records, which shall include: … Criteria for determining which
parties are ‘school officials’ and what the district considers a ‘legitimate
interest.’” (Rule 6A-1.0955(6), F.A.C.)
b.
Is there a definition of “legitimate educational interest”?
Under FERPA, each school district must define this term and determine who
has this interest. In general, legitimate educational interest refers to the right
of certain school officials to access student information and records for the
purpose of: (a) serving the student; (b) protecting the health, safety, and
learning of this student and others; (c) maintaining the operations of the
school district; (d) obtaining payment for educational programs and services;
and (e) other purposes as specified federal and state law.
2
E. FERPA Requirements
E-1. What must an educational agency or institution include in its annual
notification?
Institutions must annually notify parents of students in attendance and eligible
students of their rights under FERPA, including: (34 CFR §99)
•
The right to inspect and review records
•
The right to request amendment of records
•
The right to consent to disclosure, with certain exceptions
•
The right to file a complaint with the U.S. Department of Education (USDOE)
The notice is to also include the category of personally identifiable information
designated as directory information. (Rule 6A-1.0955(6)(j), F.A.C.)
The annual notification must also include the following (Rule 6A-1.0955(6)(a),
F.A.C.):
•
Procedure to inspect and review records
•
Procedure for requesting amendment of records
•
Statement that education records may be disclosed to school officials without
prior written consent, including:
o
Specification of criteria for identifying “school officials.”
o
Definition of “legitimate educational interest” (20 U.S.C. 1232g(e) and (f);
34 CFR 99.7).
2
Schwab, N. C., et al. (2004). p. 58.
7
o
FERPA does not specify the means of notification other than “by any
means reasonably likely to inform the parents.” Examples may be code of
conduct handbooks, student handbooks, school newspapers or catalogues,
local newspapers, and inclusion of information in student registration
packets. Additionally, FERPA requires effective notification of parents or
eligible students who are disabled or who have a primary or home
language other than English.
o
Military recruiters have access to student records and parents have the
right to request that records not be released without prior consent.
•
Statement that parents have the right to file a complaint with the Federal
Policy and Compliance Office (FPCO).
F. Family Rights
F-1. What rights exist for a parent or an eligible student to inspect and review
education records?
•
The district must comply with a request within a reasonable period of time,
but in no case more than 30 days after it has been made in accordance with
State Board of Education Rule 6A-1.0955(6)(b), F.A.C.
•
“Schools are required by FERPA to:
o
Provide a parent with an opportunity to inspect and review his or her
child’s education records within 45 days of the receipt of a request
o
Provide a parent with copies of education records or otherwise make the
records available to the parent if the parent, for instance, lives outside of
commuting distance of the school
o
Redact the names and other personally identifiable information about
other students that may be included in the child’s education records”
3
(See G-1; see §99.10)
F-2. What limitations exist on the right to inspect and review records?
If the education records of a student contain information on more than one
student, the parent or eligible student may inspect and review or be informed of
only their specific information. (§99.12(a))
F-3. Are districts required to provide parents with copies of psychological
protocols upon request?
FERPA and the Individuals with Disabilities Act (IDEA) give parents and eligible
students the right to inspect and review education records, including
psychological protocols if the test protocol contains personally identifiable
information. However, neither FERPA nor IDEA requires that copies of test
protocols be provided unless failure to do so would preclude the parent’s right of
access (e.g., the parent lives in another state). If circumstances prevent the parent
or eligible student from exercising the right to inspect and review education
records, the district may provide a copy of the records requested or make other
3
U.S. Department of Education. (2004, April 26).
FERPA general guidance for parents
. Retrieved July 23, 2008, from
http://www.ed.gov/policy/gen/guid/fpco/ferpa/parents.html.
8
arrangements for the parent to inspect and review the requested records (FERPA,
34 CFR, §99.10).
F-4. Do the rights of noncustodial parents differ from those of custodial parents?
No. FERPA affords full rights to either parent unless the school has been provided
with evidence that there is a court order, state statute, or legally binding document
that specifically revokes these rights (§99.4). This was endorsed by the 2001
Legislature through revisions to section 61.13(2)(b), F.S., which clarify that the
rights of access to records and information pertaining to a minor child, including
the right to in-person communication with medical, dental, and education
providers, apply to either parent in the absence of a court order specifically
revoking these rights.
F-5. Do stepparents have parental rights under FERPA?
The USDOE has issued an advisory letter concluding that FERPA allows a
stepparent to exercise all record access rights granted to a parent when the
stepparent is present in the home on a day-to-day basis, together with the child
and a natural parent, and the other parent is absent. In such cases, stepparents
have the same rights under FERPA as natural parents. Conversely, a stepparent
who is not present on a day-to-day basis in the home of the child has no FERPA
rights with respect to the child’s records.
F-6. What is the surrogate parent’s right of access to education records?
The surrogate parent has the same right to review educational records as parents
have. This includes all records regarding the student to which school
administrators and teachers have access. As for any parent, surrogate parents must
protect the confidentiality of educational records.
4
F-7. What rights exist for a parent of an eligible student who is still a dependent?
When a student becomes an eligible student, the rights accorded to, and consent
required of, parents transfer from the parents to the student (§99.4). Prior consent,
however, is not required for schools to disclose information from the education
record to the parents if the eligible student is a dependent for tax purposes under
the Internal Revenue Service rules.
5
F-8. Can a school disclose information in a health or safety emergency?
Yes. In an emergency, FERPA permits school officials to disclose, without
consent, education records, including personally identifiable information from
those records, to protect the health or safety of students or other individuals. At
4
Florida Department of Education. (2007, February 19).
Surrogate parents for exceptional students
(Technical
Assistance Paper K12: 2007-23.) Retrieved July 23, 2008, from http://info.fldoe.org/docushare/dsweb/Get/Document-
4273/k12-07-23memo.pdf.
5 U.S. Department of Education. (2007, June 7).
Disclosure of information from education records to parents of
postsecondary students
. Retrieved July 23, 2008, from http://www.ed.gov/policy/gen/guid/fpco/hottopics/ht-parents-
postsecstudents.html.
9
such times, records and information may be released to appropriate parties, such
as law enforcement officials, public health officials, and trained medical
personnel. This exception to FERPA’s general consent rule is limited to the
period of the emergency and generally does not allow for a blanket release of
personally identifiable information from a student’s education records. In
addition, the U.S. Department of Education interprets FERPA to permit
institutions to disclose information from education records to parents of a
postsecondary student if a health or safety emergency involves their son or
daughter. (See 34 CFR §99.31(a)(10) and §99.36.)
An educational agency or institution must record the following information when
it discloses personally identifiable information from education records under the
health or safety emergency exception in §99.31(a)(10) and §99.36:
•
The articulable and significant threat to the health or safety of a student or
other individuals that formed the basis for the disclosure
•
The parties to whom the agency or institution disclosed the information (see
34 CFR §99.32)
F-9. Can parents be informed about postsecondary students’ violation of alcohol
and controlled substance rules?
Yes. A provision in FERPA permits a college or university to let parents of
students under the age of 21 know when a student has violated any law or policy
concerning the use or possession of alcohol or a controlled substance.
6
F-10. Are there any special provisions regarding the right to inspect records that
apply to students with disabilities?
Yes. In accordance with IDEA, a parent of a student with a disability has the right
to a response from the participating agency to reasonable requests for
explanations and interpretations of the records and to have a representative of the
parent inspect and review the records. (34 CFR Part 99, §99.10(b),(c),(d))
F-11. What are the rights of parents or guardians concerning the records of their
children in state-funded school readiness or Voluntary Prekindergarten
Education Programs?
The individual records of a child enrolled in the Voluntary Prekindergarten
Education Program held by an early learning coalition, the Agency for Workforce
Innovation, or a Voluntary Prekindergarten Education Program provider are
confidential and exempt from section 119.07(1) and section 24(a), Article I of the
State Constitution (section 1002.72(1), F.S.). Sections 411.011 (2) and 1002.72
(2), F.S., provide, respectively, that a parent, guardian, or individual acting as a
parent in the absence of a parent or guardian has the right to inspect and review
the individual school readiness program record of his or her child and obtain a
copy of the record, and a parent has the right to inspect and review the individual
6
Florida Department of Education. (2007, February 19).
10
Voluntary Prekindergarten Education Program record of his or her child and to
obtain a copy of such record.
F-12. If a student attends a private school on a McKay Scholarship, does FERPA
apply to that private school?
McKay Scholarships are supported by state (not federal) funds. If a student
attends a private school on a McKay Scholarship, FERPA requirements do not
apply to that school by virtue of the acceptance of scholarship funds. Private
schools can determine their own policy regarding release of student records.
Many such issues are addressed through contracts that private schools have with
each parent. However, FERPA does apply if the private school receives funding
from the U.S. Department of Education. (34 CFR Part 99, Subpart A, §99.1)
F-13. If a student has not reached age 18 but is dual-enrolled at a postsecondary
institution (e.g., technical center, community college), would FERPA rights
transfer to the student?
Yes, if the student is dual-enrolled in a postsecondary course, no communication
or records requested directly from the postsecondary institution will be released to
a third party without consent of the student regardless of age. The exception is the
student who is a dependent (see F-6). (§99.3, definition of eligible student;
USDOE Policy Guidance, http://www.ed.gov/policy/gen/guid/fpco/hottopics/ht-
parents-postsecstudents.html)
F-14. If a student who has graduated from high school has not yet reached age 18
but is enrolled in a postsecondary institution, would FERPA rights transfer
to the student?
Yes, when a student (at any age) enters a postsecondary institution, FERPA rights
transfer to the student. (§99.3, definition of eligible student; USDOE Policy
Guidance, http://www.ed.gov/policy/gen/guid/fpco/hottopics/ht-parents-
postsecstudents.html)
G. Procedures
G-1. What is the time frame within which districts must comply with a request for
education records?
Florida rule prevails in that it is more stringent than FERPA (see F-1) to assist the
eligible student or the parent/guardian of a student with their request for records.
Rule 6A-1.0955(6)(b), F.A.C., states, “The district shall comply with a request
within a reasonable period of time, but in no case more than 30 days after it has
been made.”
G-2. May an educational agency or institution charge a fee for copies of education
records?
Yes, unless imposing a fee effectively prevents a parent from exercising his or her
right to inspect and review records. Rule 6A-1.0955(6)(d), F.A.C., requires that
school board policy for education records include a schedule of fees for copies of
11
the records that does not exceed the cost of reproduction or retrieval of the
records. (34 CFR Part 99, §99.11)
G-3. What are the procedures for amending education records?
The following steps should be taken to amend education records:
•
The parents should identify, in writing to the school, the portion of the record
believed to be inaccurate, misleading, or a violation of the privacy of the
rights of the student.
•
The school must decide within a reasonable period of time whether to amend
as requested.
•
If the school decides not to amend, it must inform the parents of their rights to
a hearing.
•
After the hearing is held, if the decision is to not amend the records, the
parents have a right to insert a statement of disagreement in the record. This
statement must be maintained with the contested part of the record and
disclosed whenever the corresponding part of the student record is released. If,
as a result of the hearing, the school decides that the information is inaccurate,
misleading, or a violation of the privacy rights of the student, it will amend the
record and inform the parent in writing of the amendment.
7
(34 CFR Part 99, Subpart C, §99.20)
G-4. Under what conditions is prior consent not required to disclose information
in education records?
The exceptions to required prior consent for disclosure include when records are
released:
•
To school officials who have been determined to have legitimate educational
interest. (As noted previously, school districts must define “school officials”
and “legitimate educational interest” in their annual notice to parents.)
•
To contractors, consultants, volunteers, and other outside parties (under direct
control of the agency) to whom an educational agency has outsourced
institutional services or functions that it would otherwise use employees to
perform (see definition of “school official”).
•
To schools or institutions of postsecondary education in which a student seeks
or intends to enroll.
•
To another institution even after a student has already enrolled or transferred
if the purpose is related to the student’s enrollment or transfer.
•
To federal, state, and local authorities involved in an audit or evaluation of
compliance with education program requirements.
•
To institutions in connection with financial aid, such as a college loan.
•
To organizations conducting studies for or on behalf of educational
institutions; however, a written agreement that specifies the purpose of the
study is required.
•
To parents of a dependent student as defined by the Internal Revenue Services
Code.
7
U.S. Department of Education. (2004, April 26).
12
•
To accrediting organizations.
•
To comply with a judicial order or subpoena.
•
To comply with an
ex parte
court order obtained by the Attorney General (or
designee) concerning offenses such as domestic terrorism.
•
In a health or safety emergency.
•
As directory information.
•
To state or local officials in connection with serving the student under the
juvenile justice system in accordance with an interagency agreement as
required by section 1002.22(3)(d)(13), F.S., or a cooperative agreement
mandated by section 1003.52, F.S.
•
If a school district initiates legal action against a parent, or if a parent initiates
legal action against a school district. In such circumstances, the school district
may disclose to the court, without court order or subpoena, the education
records of the student that are relevant for the school district to proceed with
legal action as the plaintiff or to defend itself.
•
To state auditors in connection with an audit of federal- or state-supported
educational programs.
•
If a student is required to register as a sex offender in the state
(postsecondary).
(Note: There are additional provisions that apply exclusively to postsecondary
institutions.) (34 CFR Part 99, Subpart D, §99.31)
G-5. Under what conditions is prior consent required to disclose information in
education records?
In situations other than those identified in G-4, a parent or eligible student shall
provide signed and dated written consent before a school may disclose records.
The consent must:
•
Specify the records that may be disclosed
•
State the purpose of disclosure
•
Identify the party or class of parties to whom disclosure may be made
(34 CFR Part 99, Subpart D, §99.30)
G-6. Is prior consent for disclosure required when the school board is conducting
an expulsion hearing?
If the school board has been identified as a “school official” in the annual notice
to parents, then they may have access to a student’s personally identifiable
information in order to conduct an expulsion hearing. However, public records of
the hearing may not contain any personally identifiable information on students
who are the focus of the expulsion hearing. For example, public records
pertaining to expulsion decisions or disciplinary actions should be reflected in the
minutes as “Case #XXX: Expelled for one year for possession of a weapon on
school grounds.”
13
G-7. What conditions apply to disclosure of information to the juvenile justice
system?
Nonconsensual disclosures made in connection with the juvenile justice system
that are permitted by Florida statute are now also permitted under FERPA. The
requirements for disclosure are:
•
The disclosure must be related to the juvenile justice system’s ability to
“effectively serve” the student whose records are released.
•
The disclosure must concern the juvenile justice system’s ability to serve the
student prior to adjudication. Also, the officials to whom the information is
disclosed must certify, in writing, that the records will not be redisclosed to
any other party except as provided by state law.
•
In Florida, section 1002.22(3)(d)(13), F.S., requires that such disclosures be in
accordance with an interagency agreement and/or section 1003.52(13), F.S.
(34 CFR Part 99, Subpart D, §99.38)
G-8. What record-keeping requirements exist concerning requests and
disclosures?
A school must maintain a record of each request for access to, and each disclosure
from, an education record as well as the names of state and local educational
authorities and federal officials and agencies that may make further disclosures of
personally identifiable information from the student’s education records without
consent. Also, the school’s log must:
•
Be maintained as long as the record is maintained
•
Include the parties who have requested or received information from the
records
•
Include the legitimate interest parties had in receiving information
The record-keeping requirement does not apply if the request was from, or the
disclosure was made to, the following (but it is best practice to keep written
records of requests):
•
The parent or eligible student
•
A properly designated school official with a legitimate educational intent
•
A party with written consent from the parent or eligible student
•
A party seeking directory information
•
A party with a law enforcement subpoena or court order that specifies that the
existence or contents of the subpoena or court order not be disclosed
(34 CFR Part 99, Subpart D, §99.32)
G-9. What limitations apply to the redisclosure of information?
When disclosing information from public school education records, the school
should inform the receiving party that the information may not be further
disclosed and may be used only for the purposes for which the disclosure was
made. Exceptions to this include:
15
G-12. What conditions apply to disclosure of information in health or safety
emergencies?
In the event of a health or safety emergency, FERPA allows disclosure of
information to appropriate parties in connection with an emergency if knowledge
of the information is necessary to protect the health or safety of the student or
others. An educational agency or institution may take into account the totality of
the circumstances pertaining to a threat to the safety or health of a student or other
individuals. (34 CFR Part 99, Subpart D, §99.36)
G-13. What conditions apply to disclosing directory information?
An institution may disclose directory information if it has given public notice to
parents of students regarding:
•
What the school has designated as directory information
•
A parent’s right to refuse to let the school designate any or all of the
information about the student as directory information
•
The time within which a parent must notify the school in writing that he or she
does not want any or all of the information designated as directory
information
(34 CFR Part 99, Subpart D, §99.37)
For the purpose of disclosing directory information, FERPA does not define
“public notice.” Public notice is left to the individual school to define. The means
of notice could include the student handbook or code of conduct, the school or
local newspaper, or information included in the student registration packet. The
school may choose to include notice regarding directory information with the
annual notification of the parents’ and student’s rights under FERPA.
An agency or institution must continue to honor any valid request to opt out of
directory information disclosures made while the individual was a student unless
the parent or eligible student rescinds the decision to opt out of directory
information disclosures.
Parents and students may not use their right to opt out of directory information
disclosures to prevent school officials from identifying the student by name or
disclosing the student’s electronic identifier or email address in a class in which
the student is enrolled.
An educational agency or institution is prohibited from using a Social Security
number to identify or help identify a student or the student’s records when
disclosing or confirming directory information unless the student has provided
written consent.
G-14. What are the enforcement procedures for FERPA?
The Family Policy Compliance Office is authorized by the U.S. Secretary of
Education to investigate, process, and review complaints and violations under
FERPA. Parents and eligible students may file complaints with the Family Policy
Compliance Office, U.S. Department of Education, 400 Maryland Avenue, SW,
16
Washington, DC, 20202-4605. Complaints must be filed in a timely manner,
which is considered within 180 calendar days of the date of the alleged violation
or of the date that the complainant knew or should have known of the alleged
violation.
8
Under section 1002.22(5), F.S., parents and students have the right to petition a
circuit court for an injunction to enforce their rights. If successful, they may
recover attorney fees and costs.
G-15. What conditions apply to state auditors’ access to education records?
Records may be disclosed to state auditors in connection with an audit of federal-
or state-supported educational programs. (34 CFR Part 99, Subpart D, §99.35)
G-16. What conditions apply to contractors’ and consultants’ access to education
records?
Education records may be disclosed (without consent) to contractors, consultants,
volunteers, and other outside parties to whom an educational agency has
outsourced institutional services or functions that it would otherwise use
employees to perform. The outside party must be under direct control of the
agency and subject to the same conditions governing the use and redisclosure of
education records. (§99.31(a)(1)(i)(B))
G-17. What obligations do educational agencies have with regard to teachers’ and
other school officials’ access to educational records?
Educational agencies are required to use reasonable methods to ensure that
teachers and other school officials obtain access to only those education records in
which they have legitimate educational interests. (§99.31(a)(1)(ii))
G-18. May records or information from records that have been de-identified be
released without consent?
Objective standards under which educational agencies may release, without
consent, education records or information from education records that have been
de-identified through the removal of all personally identifiable information will be
provided. “The Department encourages educational agencies and institutions to be
sensitive to publicly available data on students and to the cumulative effect of
disclosures of student data.” (§99.31(b))
G-19. What process must be used to properly identify a party to whom it discloses
personally identifiable information from education records?
FERPA states that an educational agency or institution must use reasonable
methods to identify and authenticate the identity of parents, students, school
officials, and any other parties to whom the agency or institution discloses
personally identifiable information from education records. (§99.31(c))
8
U.S. Department of Education. (2004, April 26).
17
G-20. Do military recruiters have access to student information?
Yes. Section 9528 of the No Child Left behind Act (NCLB) requires local
education agencies (LEAs) to provide military recruiters with the name, address,
and telephone listing of secondary students. School districts that are currently
releasing directory information to military recruiters should continue to do so.
Individual districts that are not supplying this information to military recruiters
must establish policies and begin this procedure. The established policies must
give parents the option to request that the information not be released without
prior written consent, and the LEA or private school shall comply with any
request. (Public Law (P.L.) 107-110, Subpart 2, Sec. 9528; Division of Public
Schools Memo #03-042)
G-21. Are peer-graded papers a violation of FERPA?
No. Peer-graded papers that have not been collected and recorded by a teacher are
not considered maintained by an educational agency or institution and, therefore,
are not educational records under FERPA. (§99.3; see also Owasso Public
Schools v. Falvo, 534 U.S. 426 (2007))
G-22. What does a model notice of rights look like?
A model notice must include the rights of parents as identified in the response to
F-1. A model notice of rights provided by the U.S. Department of Education is
available at:
http://www.ed.gov/policy/gen/guid/fpco/doc/ferpamodelnotice04.doc (English)
http://www.ed.gov/policy/gen/guid/fpco/doc/rnevarezcomments.doc (Spanish)
H. Health Insurance Portability and Accountability Act (HIPAA)
H-1. What is HIPAA?
HIPAA, the Health Insurance Portability and Accountability Act of 1996, is a
federal law enacted to: (1) encourage the development of a health information
system; (2) establish standards and requirements for electronic transmission of
certain health information; and (3) protect the privacy and security of individually
identifiable health information (i.e., “protected health information”).
H-2. How does HIPAA define “protected health information”?
“Protected health information” means information held or disclosed by the
covered entity in any form that: (1) identifies an individual; and (2) relates to the
individual’s health condition, the provision of health care to the individual, or
payment for provision of health care to the individual. Note: Exceptions to
definitions of FERPA—If the information falls within the FERPA definition of
18
“education record” (20 U.S.C. 1232g), it will not be considered protected health
information under HIPAA.
9
H-3. What are the requirements of HIPAA’s Privacy Rule?
HIPAA established new health privacy rights, enforced by the Office for Civil
Rights (OCR), and to ensure these rights, the Privacy Rule requires certain entities
who routinely handle protected information to: (1) limit uses and disclosures of
protected health information; (2) develop reasonable safeguards, policies, and
procedures to protect the privacy of health information; (3) train personnel in the
policies and procedures of document completion; (4) designate personnel to
handle privacy violation complaints and issues; (5) notify individuals about
privacy practices and their health privacy rights; and (6) keep track of certain
disclosures of protected health information not authorized by the individual or
related to treatment, payment, or health care operations.
10
H-4. How are health records of youth under the jurisdiction of the Department of
Juvenile Justice treated under HIPAA?
The Department of Juvenile Justice and all contracted service providers operating
under its authority are defined as “correctional institutions” under HIPAA. As
such, covered entities (e.g., health and mental health providers, hospitals, etc.)
may disclose protected health information to the Department, and those acting
under its authority, pursuant to 4 CFR section 164.512(k)(5), without consent or
authorization from the youth, his/her parent, or guardian.
11
H-5. How do HIPAA and FERPA apply to student health records?
When a student’s health information is in a public school record, then it is
considered part of the “educational” record. In this case, FERPA applies but
HIPAA does not apply.
“Education records in public schools are covered by FERPA and are specifically
exempted from the HIPAA Privacy Rule. Nonetheless, there are multiple practice
considerations for schools that relate to HIPAA. For example, if publicly funded
schools transmit personally identifiable student health information electronically
to Medicaid or an insurance company for health services, they must comply with
applicable requirements of the HIPAA Transaction Rule.”
12
“When a qualified minor gives informed authorization to allow information from
a HIPAA-covered entity to be released to the school district, the minor student
must understand that, under FERPA, parents will have the right to access that
information once it becomes part of the student’s education record. School Health
9
Florida Department of Education. (September 22, 2008).
Release of student records
[Memorandum].
10
Florida Department of Juvenile Justice. (2006, October).
Florida Department of Juvenile Justice health services
manual
(chapter 4 (XVI)(B), pp. 4–14). Retrieved July 23, 2008, from
http://www.djj.state.fl.us/manuals/approvedmanuals/health_services/index.html.
11
Florida Department of Juvenile Justice. (2006, October).
12
Schwab, N. C., et al. (2004). p. 18.
19
Professionals and other school officials should seek information about potential
conflicts regarding confidentiality…”
13
“The term ‘authorization’ in HIPAA is consistent with the meaning of ‘consent’
under FERPA. HIPAA does not require authorization for the exchange of
personally identifiable health information among health care providers for
treatment purposes, payment, or health care operations. In other words, a HIPAA-
covered provider may, without authorization, share medical/health information
with a school therapist, medical advisor, nurse, or health aide about a treatment
order for health care in school (e.g., physical therapy, tube feeding, administration
of oxygen or of medication).”
14
HIPAA permits such communication, but does not require it. When school
officials request student health information from HIPAA-covered entities for
educational reasons rather than for treatment reasons, however, these entities will
require HIPAA-compliant authorization signed by the parent.
15
H-6. How does HIPAA apply to students’ education records?
The HIPAA Privacy Rule excludes from its coverage those records that are
protected by FERPA at school districts and postsecondary institutions that provide
health or medical services to students. This is because Congress specifically
addressed how education records should be protected under FERPA. For this
reason, records that are protected by FERPA are not subject to the HIPAA
Privacy Rule and may be shared with parents under the circumstances described
above. (See http://www.ed.gov/policy/gen/guid/fpco/hottopics/ht-parents-
postsecstudents.html.)
I. Technical Assistance and Resources
I-1. Where can public school officials obtain advice and technical assistance
regarding FERPA?
Public schools and parents can contact:
The Florida Department of Education
Student Support Services Project
310 Blount Street, Suite 215
Tallahassee, FL 32301
Phone: (850) 922-3727
Fax: (850) 921-4752
For informal requests for technical assistance, please email
bhyle@tempest.coedu.usf.edu
Requests can also be sent to:
13
Schwab, N. C., et al. (2004). p. 19.
14
Schwab, N. C., et al. (2004). p. 18.
15
Schwab, N. C., et al. (2004). p. 19.
20
Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-5920
Phone: (202) 260-3887
Fax: (202) 260-9001
For formal requests for technical assistance, please email:
FERPA@ed.gov
For the Family Policy Compliance Office Web site, please contact:
http://www.ed.gov/policy/gen/guid/fpco/index.html
This document is available on the Florida Department of Education Web site at
http://www.fldoe.org/ese/pdf/ferpa.pdf
I-2. What are some of the available resources addressing FERPA and HIPAA?
Resources from:
The Family Policy Compliance Office, U.S. Department of Education:
Email: FERPA.Customer@ED.Gov
Web site: http://www.ed.gov/policy/gen/guid/fpco/index.html
Balancing Privacy and School Safety: A Guide to the Family Rights and Privacy
Act for Elementary and Secondary Schools
(Family Policy Compliance Office,
U.S. Department of Education, 400 Maryland Avenue, S.W., Washington, D.C.
20202-5920, (202) 260-3887)
Joint Guidance on the Application of the Family Educational Rights and Privacy
Act (FERPA) and the Health Insurance Portability and accountability Act of 1996
(HIPAA) to Student Health Records
(November, 2008)
Parents’ Guide to the Family Rights and Privacy Act: Rights Regarding
Children’s Education Records
(Family Policy Compliance Office, U.S.
Department of Education, 400 Maryland Avenue, S.W., Washington, D.C. 20202-
5920, (202) 260-3887)
This publication was adapted with permission from:
Family Educational Rights and Privacy Act (FERPA): NAPSA Notes
National Association of Pupil Services Administrators
6603 Duffield
Dallas, Texas 75248
