Must a school or LEA record the non-consensual disclosure of personally identifiable information (PII) from education records to a community-based organization?

Yes.  Generally, when a school or LEA discloses without consent PII from education records to a community-based organization, with the exception of disclosures made under the “school official” exception, the disclosure must be recorded.  FERPA require schools to record all requests for access to, and all disclosures of, PII from the education records of each student, except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the parent or eligible student.  See 34 CFR § 99.32(d).  Schools and LEAs must maintain these records with the student’s education records for as long as the student’s records are maintained.  The recorded information must include the parties who have requested or received PII and their legitimate interests in requesting or obtaining the information. Parents and eligible students have a right to inspect and review the record of disclosures.  See 34 CFR § 99.32 for the full list of recordation requirements.